You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

For more information about using cooldown policies, see 

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit. The Create and Update endpoints run the same compilation check.

Cloudsmith 

 uses Rego, the declarative policy language from Open Policy Agent (OPA).

The 

: a list describing each problem, with a severity, code, message and, where known, the line it occurs on

: contains the full output from the Rego compiler and is empty when the policy is valid

A policy that compiles returns no findings:

If the policy doesn't compile, the response lists each problem. For example, if line 5 of the policy refers to 

Validate your policy logic with the Cloudsmith API

The Cloudsmith CLI can now update itself, so you can upgrade quickly and get back to work. The CLI also authenticates Terraform to your Cloudsmith registries without storing a token, reads your workspace settings from a new 

 option, and keeps single sign-on (SSO) sessions alive through temporary network failures.

, along with a daily check that tells you when a new version is available.

To update the CLI to the latest released version, run:

.

The CLI detects how it was installed and acts accordingly:

: The CLI downloads the latest release, verifies its SHA-256 checksum, and replaces itself in place.

: The CLI prints the upgrade command for that install method, for example, 

brew update && brew upgrade cloudsmith-cli

A standalone update asks for confirmation first. Pass 

 to skip the prompt. If the update fails partway, including when you press Ctrl+C, the CLI restores the version you had.

 On Windows, a standalone binary can't replace itself because the running executable is locked. Instead, the command prints the archive URL and SHA-256 checksum so you can download and replace it manually.

The CLI checks for a newer version at most once a day, in the background. When an update is available, it prints a short notice to stderr with the upgrade command for your install method and a link to the release notes. The check never fails your command and never delays it by more than a second.

The notice appears only in an interactive terminal. The CLI skips the check in CI (when the 

 environment variable is set), and hides the notice for machine-readable output (

Disable the daily background check using any of the following:

Disabling the background check doesn't affect 

, which always checks for a newer version when you run it.

v1.27.0 adds Terraform to the CLI's credential helpers, alongside Docker, Cargo, and pnpm.

cloudsmith credential-helper install terraform

 authenticates to your Cloudsmith registries, including custom domains, with the CLI's existing credentials. No token is stored in your Terraform configuration.

The helper uses the same profile and workspace you installed it with. For hosts other than Cloudsmith, Terraform falls back to its own credential sources.

cloudsmith credential-helper uninstall terraform

Authenticate Terraform with the Cloudsmith credential helper

 as an option for your Cloudsmith workspace, alongside 

. Authentication, OpenID Connect (OIDC), and custom domain discovery all read it. Set 

 reuses an existing SSO session when it can renew it, and SSO sessions no longer end unexpectedly after a temporary network failure (v1.27.0).

 reports when your access token expires, in both normal and JSON output (v1.27.0).

Security Assertion Markup Language (SAML) sign-in no longer fails when its default callback port is in use (v1.27.0).

SAML two-factor codes stay visible as you type them (v1.27.0).

 controls American National Standards Institute (ANSI) color output, and the CLI respects 

A failed OIDC token exchange prints the workspace, service, API host, Cloudsmith OIDC vendor detector, and decoded token claims to help diagnose the failure, without printing the raw token (v1.27.0).

The CLI no longer asks for a keyring password in CI or when no terminal is available (v1.28.0).

Tables no longer wrap when CLI output is piped to a file or another command (v1.28.0).

For a more detailed list of changes, see the 

CLI v1.27.0 and v1.28.0: Built-in updates and a Terraform credential helper

 field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it.


 is the source repository the package lives in; 

 lists the connected repositories it was served through.

CSV separates multiple values with semicolons.

If no connected repositories were involved, the field is an empty array in JSON and an empty value in CSV.

 field is disabled by default. If you already receive log exports and use connected repositories, 

 to have this field added to your exports.

Log exports are available on Ultra and Enterprise plans.

Trace downloads through connected repositories in client log exports

You can now provision Cloudsmith team membership from groups in your identity provider (IdP) on Ultra and Enterprise plans. Adding or removing a user from a mapped group in your IdP updates their Cloudsmith team membership automatically.

The System for Cross‑domain Identity Management (SCIM) specification is an open standard designed to manage user identity information. Cloudsmith is SCIM 2.0‑compliant. 

IdP groups map to Cloudsmith teams with the same name. If a team with the same name doesn’t exist, Cloudsmith creates it automatically during the next IdP sync.

 role to users provisioned via SCIM groups. To assign a different 

To set up SCIM group provisioning for Cloudsmith, you must configure it in your IdP. For more details, see 

SCIM group provisioning is now generally available

The Cloudsmith CLI has had six releases since our last update here. The headlines: you can now push Nix packages, let Cargo and pnpm authenticate automatically with credential helpers, and manage a repository's GNU Privacy Guard (GPG) key and access privileges without leaving your terminal. Along the way, the CLI got faster to start, kinder to macOS users, and better behaved on machines with no OS keyring.

Push Nix packages and mirror Nix channels

v1.25.0 adds Nix as a first-class format. Push packages with 

, the same way you already do for other formats.

Cargo and pnpm now authenticate automatically

 introduced Docker credential discovery. The list of supported package managers keeps growing: the CLI can now handle authentication for Cargo (v1.26.0) and pnpm (v1.25.0) too.

One install command each, and the tool authenticates to your Cloudsmith registries with your existing CLI credentials. No 

. The Cargo provider only ever answers for Cloudsmith registries, so crates.io and any other provider you use are left untouched. Both helpers support custom domains, dry runs, listing, and uninstalling. For more information, see the 

If your tool of choice has no dedicated helper yet, v1.21.0 added a generic one. 

 resolves a credential through the full chain (API key, 

, system keyring, OpenID Connect (OIDC)) and prints it as a small JSON document any script can consume:

Administer repositories from the terminal

v1.26.0 brings two new command groups for repository administration.

 manages the GPG key your repository signs its package indexes with. View the active key, upload your own, or have Cloudsmith regenerate it. The CLI only ever reads key material from a file, stdin, or a hidden prompt, and a dry-run mode tells you exactly which key you are about to replace before anything happens.

 does the same for explicit repository access. List who can see a repository, grant or revoke access for teams, users and service accounts, or replace the whole privilege set from a JSON file for repeatable, reviewable access control.

Push a Debian source package with just the .dsc

 of a Debian source package and works out the 

All Debian source formats are supported, and explicit flags still win if you want control.

Single sign-on (SSO) tokens on headless and CI machines

SSO and OIDC sessions work in more places:

The standalone binary now bundles encrypted file-based keyring backends (v1.23.0), so a headless Linux container with no OS keyring can still persist tokens.

 (v1.24.0) select and unlock a backend non-interactively, and 

 (v1.25.0) control where the tokens live.

 (v1.24.0) prints the SSO URL instead of launching a browser, for remote shells where that would go nowhere.

macOS keychain prompts stop reappearing after every token refresh

If you use the CLI on macOS with SSO, you have probably seen the "Cloudsmith wants to use your credential information" prompt more times than you would like, and clicking "Always Allow" never seemed to stick. v1.26.0 fixes the root cause: the CLI now updates keychain items in place instead of deleting and recreating them, so your permission grants survive every token refresh. Each profile also keeps its own session now, and a session the server has rejected cleans itself up and asks you to log in again instead of nagging you every half hour.

v1.25.0 and v1.26.0 moved the CLI's heavy dependencies out of the startup path; they now load only when a command needs them. You will notice it most in scripts and CI, where the CLI is often invoked many times in a row.

 (v1.22.0) shows every host Cloudsmith can authenticate for you, including your organization's custom domains.

Exit codes are reliable again everywhere, including 

Security assertion markup language (SAML) authentication handles two-factor authentication more gracefully, directing you from the browser back to the terminal and retrying rejected codes (v1.25.0).

CLI v1.21.0 to v1.26.0: Nix support, Cargo and pnpm credential helpers, and repository administration from your terminal

Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads.

Format-specific metadata is currently available in client logs in the web app. Log exports will include this data from November 2026.

You can now see the full chain that led to a package download, including exactly which version a build pulled. For example, for the following npm install, the initial request results in two additional hops, all recorded and available in client logs:

Cooldown policies now support Ruby

Getting started

Other logs

Validate your policy logic with the Cloudsmith API

CLI v1.27.0 and v1.28.0: Built-in updates and a Terraform credential helper

Trace downloads through connected repositories in client log exports

SCIM group provisioning is now generally available

CLI v1.21.0 to v1.26.0: Nix support, Cargo and pnpm credential helpers, and repository administration from your terminal

Client logs now show the full request chain behind a package download