Two changes reduce the work involved in resolving npm packages: pnpm clients make fewer requests to Cloudsmith, and every npm repository makes fewer lookups to upstreams. No configuration changes are needed.

For each package downloaded, pnpm clients now make 40% fewer metadata requests and 92% fewer attestations requests. Installs finish faster and CI builds stay lighter, especially on fresh runners with no local cache.

More npm metadata served from Cloudsmith’s index

Cloudsmith indexes npm metadata as packages are requested, then serves it directly instead of calling the upstream each time, so resolution gets faster the more a repository is used. This means lower latency, faster installs, and less reliance on upstream availability.

The Cloudsmith CLI now sends reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. 

 is deprecated and stops working on November 20, 2026.

When a command fails with an unexpected error, the CLI sends a report to Cloudsmith through 

, an error-tracking service. Error reporting helps us find and fix CLI bugs, including ones nobody reports to support. New reports alert the Cloudsmith CLI team, who triage them as bugs. 

Usage errors, such as a missing argument, errors that the Cloudsmith API returns, and failed certificate checks are not reported. Reports aren't linked to you or your account, so for help with a specific problem, contact Cloudsmith support.

: the exception type, the error message, and the stack trace.

: the command name, without its arguments.

: the CLI version and install method, the operating system, the CPU architecture, and the Python version.

Before the CLI sends a report, it removes API keys, entitlement tokens, passwords, email addresses, IP addresses, file paths, your user and machine names, and host names that are not Cloudsmith hosts. The CLI never sends environment variables, local variables, or source code. The error message can include workspace, repository, and package names.

Error reporting is on by default, including in CI. A failed command waits at most 2 seconds for its report to send.

If you prefer not to send error reports, use any of the following:

In a CI pipeline, set the variable for the whole job:

 for networks that inspect encrypted traffic with a TLS-intercepting proxy. Python 3.13 and later apply strict X.509 certificate checks by default, and the standalone binaries ship with the Python 3.14 runtime. Many intercepting proxies issue certificates that fail these checks, for example with 

Basic Constraints of CA cert not marked critical

The new option turns off only the strict checks. The CLI still verifies the certificate chain and the host name, unlike 

, which turns verification off completely.

The setting applies to API calls, single sign-on (SSO), uploads, downloads, the Model Context Protocol (MCP) server, and 

When a certificate check fails, the CLI now stops at once instead of retrying, and the error includes a hint with the cause. For a failed strict check, the hint names 

. For a certificate from a certificate authority (CA) that the CLI does not trust, the hint names 

, which points the CLI at a CA bundle that contains your proxy's CA.

v1.30.0 also adds general names for the setting that turns certificate verification off, because it covers more than API calls: pass 

. Existing scripts and config files keep working: 

 now puts the Docker, Cargo, and pnpm helpers in 

 by default, instead of the directory that contains the 

 executable. When the CLI is installed with a package manager such as Homebrew, that directory belongs to the package manager, so an upgrade could remove the helpers.

, the Docker and Cargo install commands print the line to add to your shell profile. On Linux and macOS, add this line:

: the Terraform helper keeps using Terraform's plugin directory.

: they stay where they were installed. To remove one with 

Automatically discover Docker credentials

 and the credential helpers now get your workspace's domains, including custom domains, from the Cloudsmith API host that the CLI is configured to use, instead of a list built into the CLI. They now work with Cloudsmith deployments other than the default one.

: the JSON document keeps its version 1 shape. 

, because the API does not return them, and 

, which sends every HTTP request the CLI makes through one proxy. This includes API calls, uploads, downloads, the MCP server, 

 and the background update check, the credential helpers, OpenID Connect (OIDC) detection on Amazon Web Services (AWS) and Google Cloud, and error reports. 

cloudsmith credential-helper install terraform

, so the helper uses it when Terraform runs it.

A configured proxy now takes precedence over the 

 environment variables. Without one, the CLI uses 

Username and password login is deprecated

 are deprecated, and will stop working on November 20, 2026, when Cloudsmith disables username and password login. If you authenticate the CLI by running 

 with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date.

Until then, both commands work as before and print a deprecation warning to stderr. For more details, see the 

 now saves your workspace and API host in 

, so the helper finds the right domains when Terraform runs it, while existing entries that use 

 now exits with code 1 when a file fails to download, so scripts and CI jobs can detect the failure.

 now reports API errors and exits with a non-zero code, and 

 no longer fails with JSON output or when you choose not to replace an existing token.

cloudsmith credential-helper install cargo

 now registers the credential provider on the first run when 

For a more detailed list of changes, see the 

CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation

To improve API key protection, Cloudsmith is moving to a model in which keys are not stored in a retrievable form, in line with security best practices. Because 

 work by exchanging your credentials for your stored API key, the CLI can no longer fetch an API key on your behalf.

Until November 20, the commands work as they do today and print a deprecation warning. After that date, they fail with a message explaining how to get an API key.

To migrate from username and password to API key authentication:

, and click the button on the right side of the table row to rotate your key.

 environment variable, or add it to your CLI config — see 

 in the Cloudsmith documentation for details.

Update any scripts or pipelines that call 

To authenticate with single sign-on (SSO) instead, run:

Username and password login on the Cloudsmith CLI stops working on November 20, 2026

Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster. Select 

 as your storage region when creating a new repository, or transfer an existing one via a repository’s settings.

Custom storage regions are available for Ultra and Enterprise plans. For details, see 

Mumbai is now a supported storage region

Setting usage limits on your Cloudsmith workspace (workspace 

.) used to mean dragging sliders. Customers told us this was cumbersome and imprecise. Today we’ve simplified usage limits - now you simply input the value of your desired limit. 

 each limit shows the artifact data and package delivery your plan already includes, so it’s clear what you’re adding on top.

 when you save, validation messages appear next to the input they apply to, so you can see which value needs changing.

Set exact usage limits with numerical inputs

 upstreams, with configuration built into the Libraries tab.

ActiveState provides curated open-source packages rebuilt from verified source code, scanned, signed, and maintained to address known vulnerabilities.

 upstream: select it, choose a library, name the upstream, and add your ActiveState credentials — Cloudsmith fills in the proxy URL.

ActiveState Curated Catalog upstreams are available for the following libraries:

Proxy and cache packages from your ActiveState Curated Catalog

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own.

v1.29.0 adds Buildkite to the CI/CD platforms that the CLI detects automatically. In a Buildkite job, the CLI asks the Buildkite agent for an OIDC token and exchanges it for a short-lived Cloudsmith token.

First, create an OIDC provider in your Cloudsmith workspace with these settings:

, set to the slug of your Buildkite organization. Buildkite signs tokens for all organizations with the same keys, so this claim keeps other organizations out. You can add other claims from the token, such as 

: the service account that the pipeline authenticates as.

Then set your workspace and service account in the pipeline:

Authentication Method: OIDC Auto-Discovery

v1.29.0 also adds automatic detection of OIDC credentials for Google Cloud. On Compute Engine, Google Kubernetes Engine (GKE), Cloud Run, Cloud Run functions, App Engine, and Cloud Build, the CLI gets an ID token for the service account of the workload. It then exchanges the ID token for a short-lived Cloudsmith token. The CLI finds the service account through Application Default Credentials (ADC), which is the same mechanism that the Google Cloud client libraries use.

Create an OIDC provider in your Cloudsmith workspace with 

 as the provider URL. Google signs ID tokens for all Google Cloud projects with the same keys, so add claims that match only your own service accounts:

 claim set to the numeric unique ID of the service account. To get the ID, run:

 claim with a wildcard at the start, such as 

. Keep your project ID in the value. A broader value, such as 

, also matches service accounts in other Google Cloud projects.

You can add other claims from the token to limit access further.

: the service account of a virtual machine (VM), a Cloud Run service, or a Cloud Build job.

gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL

. Use them to test the setup from your own machine.

For a step-by-step Cloud Build setup, see 

. For all supported credential types, see 

List packages from connected repositories

Connected repositories let one repository serve the packages of other repositories. v1.29.0 adds 

, so you can see these packages from the terminal:

 column that shows the repository each package belongs to. In JSON output (

 for packages that belong to the repository you listed. The flag works with 

 search queries and the pagination options.

, point to the repository you listed, not to the repository that the package belongs to.

Connected repositories are in early access. To try them, 

 output no longer includes the repository display name

) in the first column instead of the repository display name. The identifier is the value that other CLI commands accept.

The standalone binaries now ship with the Python 3.14 runtime. 

The Python package now requires Python 3.11 or later.

The new detectors use the existing OIDC controls, with the IDs 

 to skip the Google Cloud detector, or use 

 to change the order in which the CLI tries each platform.

npm installs are now faster, with fewer requests and lookups

Fewer requests for pnpm clients