Improvements to package status indicator in the web app
We've improved how package statuses are displayed and managed across the Cloudsmith web app to help you quickly understand if a package or container is available, safe, and compliant.
The package detail page for a quarantined package with vulnerabilities
Key changes
We have removed the status flag that indicated a package matched a policy, as this information describes an automation outcome and not a fixed status.
We have consolidated all initial processing and scanning statuses that occur before package availability under a single Processing status.
Vulnerability and quarantine statuses have been removed from the Tags column; this information is now communicated directly through the main package status indicator.
We’ve added additional status details in the tooltip when a package has an error or is quarantined.
We've updated the color scheme and icons for consistency and clarity:
Gray spinner icon: Indicates the package is still processing and is unavailable.
Green checkmark icon: Indicates the package is available with no errors or vulnerabilities.
Yellow exclamation point icon: Indicates the package is available but has vulnerabilities.
Gray info icon: Indicates the package is available but there are important processing details to review.
Gray blocked icon: The package is unavailable as it is quarantined.
Red error text: Indicates the package errored during processing and is unavailable. (Red will also be used to indicate malware in future updates.)
Package status indicators in the compliance table
These updates apply uniformly across the platform, including package lists in workspaces and repositories, compliance pages, and individual package detail pages.
We’ve added a last_downloaded field to packages in Cloudsmith, extending search-based package retention rules to enable cleanup of unused packages. This feature allows you to create retention rules that automatically clean up packages in your repository based on usage, rather than just age or count, ensuring you retain only actively used packages…
You can now use the package publish date in Enterprise Policy Manager (EPM) for npm packages. This enables you to define policies that automatically quarantine new packages for a specific time period (e.g., two weeks) after release…
Cloudsmith’s Enterprise Policy Manager (EPM) now leverages Software Bill of Materials (SBOM) data to enable powerful, component-level policies for Docker and OCI container images…
You can now better assess a vulnerability's impact by exploring its key details directly within the vulnerabilities table for a package or container. We've introduced an expanded row layout that shows all available information for a specific finding, helping you make more informed decisions about your response.
Additionally, we’ve added CVSS score…
Monitoring the software licenses in use across your organization is critical, and could help you avoid costly re-work in the future. Cloudsmith's web app now gives you a breakdown of your packages by license, and lists packages with no apparent software license…