 upstreams, with configuration built into the Libraries tab.

ActiveState provides curated open-source packages rebuilt from verified source code, scanned, signed, and maintained to address known vulnerabilities.

 upstream: select it, choose a library, name the upstream, and add your ActiveState credentials — Cloudsmith fills in the proxy URL.

ActiveState Curated Catalog upstreams are available for the following libraries:

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own.

v1.29.0 adds Buildkite to the CI/CD platforms that the CLI detects automatically. In a Buildkite job, the CLI asks the Buildkite agent for an OIDC token and exchanges it for a short-lived Cloudsmith token.

First, create an OIDC provider in your Cloudsmith workspace with these settings:

, set to the slug of your Buildkite organization. Buildkite signs tokens for all organizations with the same keys, so this claim keeps other organizations out. You can add other claims from the token, such as 

: the service account that the pipeline authenticates as.

Then set your workspace and service account in the pipeline:

Authentication Method: OIDC Auto-Discovery

v1.29.0 also adds automatic detection of OIDC credentials for Google Cloud. On Compute Engine, Google Kubernetes Engine (GKE), Cloud Run, Cloud Run functions, App Engine, and Cloud Build, the CLI gets an ID token for the service account of the workload. It then exchanges the ID token for a short-lived Cloudsmith token. The CLI finds the service account through Application Default Credentials (ADC), which is the same mechanism that the Google Cloud client libraries use.

Create an OIDC provider in your Cloudsmith workspace with 

 as the provider URL. Google signs ID tokens for all Google Cloud projects with the same keys, so add claims that match only your own service accounts:

 claim set to the numeric unique ID of the service account. To get the ID, run:

 claim with a wildcard at the start, such as 

. Keep your project ID in the value. A broader value, such as 

, also matches service accounts in other Google Cloud projects.

You can add other claims from the token to limit access further.

: the service account of a virtual machine (VM), a Cloud Run service, or a Cloud Build job.

gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL

. Use them to test the setup from your own machine.

For a step-by-step Cloud Build setup, see 

. For all supported credential types, see 

List packages from connected repositories

Connected repositories let one repository serve the packages of other repositories. v1.29.0 adds 

, so you can see these packages from the terminal:

 column that shows the repository each package belongs to. In JSON output (

 for packages that belong to the repository you listed. The flag works with 

 search queries and the pagination options.

, point to the repository you listed, not to the repository that the package belongs to.

Connected repositories are in early access. To try them, 

 output no longer includes the repository display name

) in the first column instead of the repository display name. The identifier is the value that other CLI commands accept.

The standalone binaries now ship with the Python 3.14 runtime. 

The Python package now requires Python 3.11 or later.

The new detectors use the existing OIDC controls, with the IDs 

 to skip the Google Cloud detector, or use 

 to change the order in which the CLI tries each platform.

For a more detailed list of changes, see the 

CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories

You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

For more information about using cooldown policies, see 

Cooldown policies now support Ruby

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit. The Create and Update endpoints run the same compilation check.

Cloudsmith 

 uses Rego, the declarative policy language from Open Policy Agent (OPA).

The 

: a list describing each problem, with a severity, code, message and, where known, the line it occurs on

: contains the full output from the Rego compiler and is empty when the policy is valid

A policy that compiles returns no findings:

If the policy doesn't compile, the response lists each problem. For example, if line 5 of the policy refers to 

Validate your policy logic with the Cloudsmith API

The Cloudsmith CLI can now update itself, so you can upgrade quickly and get back to work. The CLI also authenticates Terraform to your Cloudsmith registries without storing a token, reads your workspace settings from a new 

 option, and keeps single sign-on (SSO) sessions alive through temporary network failures.

, along with a daily check that tells you when a new version is available.

To update the CLI to the latest released version, run:

.

The CLI detects how it was installed and acts accordingly:

: The CLI downloads the latest release, verifies its SHA-256 checksum, and replaces itself in place.

: The CLI prints the upgrade command for that install method, for example, 

brew update && brew upgrade cloudsmith-cli

A standalone update asks for confirmation first. Pass 

 to skip the prompt. If the update fails partway, including when you press Ctrl+C, the CLI restores the version you had.

 On Windows, a standalone binary can't replace itself because the running executable is locked. Instead, the command prints the archive URL and SHA-256 checksum so you can download and replace it manually.

The CLI checks for a newer version at most once a day, in the background. When an update is available, it prints a short notice to stderr with the upgrade command for your install method and a link to the release notes. The check never fails your command and never delays it by more than a second.

The notice appears only in an interactive terminal. The CLI skips the check in CI (when the 

 environment variable is set), and hides the notice for machine-readable output (

Disable the daily background check using any of the following:

Disabling the background check doesn't affect 

, which always checks for a newer version when you run it.

v1.27.0 adds Terraform to the CLI's credential helpers, alongside Docker, Cargo, and pnpm.

cloudsmith credential-helper install terraform

 authenticates to your Cloudsmith registries, including custom domains, with the CLI's existing credentials. No token is stored in your Terraform configuration.

The helper uses the same profile and workspace you installed it with. For hosts other than Cloudsmith, Terraform falls back to its own credential sources.

cloudsmith credential-helper uninstall terraform

Authenticate Terraform with the Cloudsmith credential helper

 as an option for your Cloudsmith workspace, alongside 

. Authentication, OpenID Connect (OIDC), and custom domain discovery all read it. Set 

 reuses an existing SSO session when it can renew it, and SSO sessions no longer end unexpectedly after a temporary network failure (v1.27.0).

 reports when your access token expires, in both normal and JSON output (v1.27.0).

Security Assertion Markup Language (SAML) sign-in no longer fails when its default callback port is in use (v1.27.0).

SAML two-factor codes stay visible as you type them (v1.27.0).

 controls American National Standards Institute (ANSI) color output, and the CLI respects 

A failed OIDC token exchange prints the workspace, service, API host, Cloudsmith OIDC vendor detector, and decoded token claims to help diagnose the failure, without printing the raw token (v1.27.0).

The CLI no longer asks for a keyring password in CI or when no terminal is available (v1.28.0).

Tables no longer wrap when CLI output is piped to a file or another command (v1.28.0).

CLI v1.27.0 and v1.28.0: Built-in updates and a Terraform credential helper

 field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it.


 is the source repository the package lives in; 

 lists the connected repositories it was served through.

CSV separates multiple values with semicolons.

If no connected repositories were involved, the field is an empty array in JSON and an empty value in CSV.

 field is disabled by default. If you already receive log exports and use connected repositories, 

 to have this field added to your exports.

Log exports are available on Ultra and Enterprise plans.

Trace downloads through connected repositories in client log exports

You can now provision Cloudsmith team membership from groups in your identity provider (IdP) on Ultra and Enterprise plans. Adding or removing a user from a mapped group in your IdP updates their Cloudsmith team membership automatically.

The System for Cross‑domain Identity Management (SCIM) specification is an open standard designed to manage user identity information. Cloudsmith is SCIM 2.0‑compliant. 

IdP groups map to Cloudsmith teams with the same name. If a team with the same name doesn’t exist, Cloudsmith creates it automatically during the next IdP sync.

 role to users provisioned via SCIM groups. To assign a different 

To set up SCIM group provisioning for Cloudsmith, you must configure it in your IdP. For more details, see 

Proxy and cache packages from your ActiveState Curated Catalog

Other logs

CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories

Cooldown policies now support Ruby

Validate your policy logic with the Cloudsmith API

CLI v1.27.0 and v1.28.0: Built-in updates and a Terraform credential helper

Trace downloads through connected repositories in client log exports

SCIM group provisioning is now generally available