Continuous risk detection replaces Trivy scanning, which is deprecated. Continuous risk detection checks every package against new vulnerability data as soon as it arrives, with no scheduled or manual rescans. It is powered by the Open Source Vulnerabilities database (OSV.dev) and has been generally available since August 2026.
We are switching Trivy scanning off in stages, starting on 2 November 2026 for workspaces that use it only for upload scans, manual rescans, or recurring scheduled scans. It will be off for all workspaces by 31 March 2027.
security_scan in policy as code: update your policies to use OSV.dev data by 31 March 2027. For examples of how to use OSV data in policies, see the policy templates in the web app.package.scanned webhook event: these are moving to OSV.dev. We will share migration details before anything changes.If you use any feature that needs migration, our Customer Success team will contact you to plan the migration and make sure it’s complete before Trivy is switched off for your workspace, no later than 31 March 2027. If you have questions before then, contact us.
Cloudsmith’s npm client support now serves npm's attestations and signing keys APIs, so provenance verification works through Cloudsmith just as it does when connecting directly to the upstream registry…
Two changes reduce the work involved in resolving npm packages: pnpm clients make fewer requests to Cloudsmith, and every npm repository makes fewer lookups to upstreams. No configuration changes are needed…
The Cloudsmith CLI now sends anonymous reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with 'cloudsmith' login and 'cloudsmith token' is deprecated and stops working on November 20, 2026…
Username and password login with cloudsmith login and cloudsmith token is deprecated and stops working on November 20, 2026. If you authenticate the CLI by running cloudsmith login or cloudsmith token with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date…
Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster…
Usage limits used to be set with sliders, which were imprecise and cumbersome. Based on customer feedback, you can now type an exact value instead. Workspace owners and managers can set them on the workspace Settings tab, under Usage limits…