Client log exports now include metadata requests, not just downloads
Client log exports now contain the format-specific metadata requests your toolchain makes, so you can see the full request chain behind a download…
Nov 10 2026
Hugging Face downloads now work on huggingface_hub 1.22 and later
Cloudsmith now serves Hugging Face's Tree API, so hf download and snapshot_download work through Cloudsmith on huggingface_hub 1.22 and later.
Hugging Face clients download a model in two steps: they list the files in the repository, then fetch each one. From version 1.22, the client gets that list only from the Tree API. Cloudsmith serves the endpoint for both models and datasets.
If a model hasn't been cached in your repository, or hasn't been indexed yet, Cloudsmith fetches its file list from the Hugging Face upstream in real time. The download goes ahead as normal, and the model is indexed for later requests.
Note: On huggingface_hub 1.20 and later, set HF_HUB_DISABLE_XET=1 until Cloudsmith supports Hugging Face’s Xet storage.
Other logs
01/06
Exempt specific packages from your cooldown policies
Exemptions defined in cooldown policies let specific packages skip the cooldown period and become available immediately, so a new release that fixes a vulnerability doesn’t have to wait. Exempt packages are still evaluated against your other active policies, and any action those policies define still applies…
Nov 5 2026
Prioritize vulnerabilities by likelihood of exploitation with EPSS scores
Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity…
Nov 5 2026
Deprecating Trivy vulnerability scanning
Continuous risk detection replaces Trivy scanning, which is deprecated. Continuous risk detection checks every package against new vulnerability data as soon as it arrives, with no scheduled or manual rescans. It is powered by the Open Source Vulnerabilities database (OSV.dev) and has been generally available since August 2026…
Oct 29 2026
Verify npm provenance through your Cloudsmith registry
Cloudsmith’s npm client support now serves npm's attestations and signing keys APIs, so provenance verification works through Cloudsmith just as it does when connecting directly to the upstream registry…
Oct 26 2026
npm installs are now faster, with fewer requests and lookups
Two changes reduce the work involved in resolving npm packages: pnpm clients make fewer requests to Cloudsmith, and every npm repository makes fewer lookups to upstreams. No configuration changes are needed…
Oct 26 2026
Keep up to date with our monthly product bulletin