We have updated our timeline to sunset the classic web »

we introduced Cloudsmith’s new web app user interface

 and shared our plans to retire the legacy interface on 

. We knew there were a few key features we wanted to bring to the new UI before deprecating the old one, and customer feedback since launch has reinforced those priorities. As such, we have updated our timeline:

While we previously announced a January 2026 retirement, 

the classic app will now remain available through the second half of 2026.

To support this transition, we are working to bring the following features to the new interface before the end of the year:

Thank you for your support as we complete this transition. If you have any questions or concerns, please 

The Cloudsmith status page is now available at 

As part of this change, we’ve adopted a new incident management platform to improve how we manage incidents and communicate updates. The new platform gives us better tools to share clear, timely information when incidents happen and when they are resolved.

 now redirects you to the new location. We recommend updating any bookmarks or links you may have.

If you have subscribed to updates, you will need to resubscribe to the new status page:

No action is needed, we’ve migrated your subscription.

If you haven’t subscribed, now is a great time to 

. You’ll get real-time notifications about outages, maintenance, and service health.

Cloudsmith Status Page has moved

You can now upload and distribute arbitrary files via Cloudsmith Maven repositories, whether pulled from upstream sources or directly uploaded.

Previously we supported artifacts that were using well known file names (Maven coordinates). As Maven doesn't enforce any standard when uploading a filename, we were not proxying and caching non-standard files from upstream repositories, nor supporting the direct upload of those non-standard files. Now, if you depend on non-standard Maven file names (such as custom dependencies or miscellaneous files) you can cache these from upstream repositories, as well as upload directly to Cloudsmith.

Cloudsmith has expanded support for the Maven format to include arbitrary (non-standard) files. These are files that don’t follow the typical Maven artifact structure but are still versioned and distributed using Maven-compatible tooling.

.zip, .tar.gz, .exe, .dmg and other binary assets

Configuration files, templates, and scripts

Any other file that doesn’t require strict Maven packaging

Upstream repositories: Files outside the conventional structure are now proxy, cached and served from upstream repositories.

Direct uploads: You can now attach arbitrary files during a package upload. Our support includes -

Uploading using Maven, Gradle, and SBT native tooling

Uploading using the Cloudsmith API and CLI

 if you have questions or feedback on these new capabilities.

Cloudsmith’s Maven repositories now support arbitrary files for more flexible workflows

We now verify the authenticity of sign-ins from new or unrecognized devices. Because this is a new change, you may be asked to verify a device even if it has accessed Cloudsmith before. By confirming both your login credentials and the device, we help prevent unauthorized access with minimal disruption to your workflow.

When you log in from a new or unrecognized device, you’ll receive an email with a secure link.

Clicking that link approves the device for your Cloudsmith account.

Once verified, the device remains authorized for 12 months.

Each Cloudsmith account on the same device must be verified separately.

You can revoke sessions anytime by visiting 

No immediate action is required right now.

This requirement starts at your next login.

Current sessions remain valid until they end or you sign out.

If you haven't already, consider enabling multi-factor authentication for an added layer of security. Questions? Please 

Security update: Device verification for sign-ins

Cloudsmith’s Enterprise Policy Management (EPM) now supports the Exploit Prediction Scoring System (EPSS), a data-driven metric designed to estimate the probability of a software vulnerability being exploited in the wild.

Using Enterprise Policy Management, you can now use a package’s EPSS score to inform your package workflows, including those around package quarantine and promotion.

: Use EPSS scores to prioritize vulnerabilities most likely to be exploited, to strengthen your organization’s security posture and automate your response to vulnerabilities.

: Leverage EPSS-based policies for more granular, data-informed decisions around vulnerability management.

 Remain protected in real time as Cloudsmith automatically re-checks and re-applies your policies when EPSS scores change.

 if you have any questions or feedback on this feature.

Improved security with EPSS in Enterprise Policy Management

Cloudsmith has extended our Swift support to include the native signing of Swift packages. This update brings seamless, secure, and high-performance signing capabilities directly to iOS developers, eliminating the need for third-party workarounds or custom implementations.

Swift packages are signed using an ECDSA private key and X.509 Certificate combination. With native Swift signing enabled, your repositories will automatically sign Swift packages when they are uploaded or synchronized.

Once the relevant security settings for the Swift CLI are configured, you can consume fully verifiable and signed Swift packages directly from Cloudsmith.

Native Swift package signing mitigates against package content tampering and provides an effective means of integrity verification using native tooling. Check out 

Introducing native Swift signing

Cloudsmith now supports natively signing all NuGet packages using an X.509 certificate. This feature enables consumers to verify a package’s repository signatures in native tooling using the NuGet or .NET CLI, ensuring integrity and authenticity.

When NuGet native signing is enabled for a Cloudsmith repository:

A unique X.509 certificate is issued for that repository.

A repository signature is generated when a NuGet package is uploaded or resynced, and the signing certificate is included in the NuGet repository signature index.

Consumers can verify a package’s repository signature locally using native tooling such as the NuGet or .NET CLI, confirming that the package originated from Cloudsmith.

For repositories with NuGet native signing and NuGet upstreams configured:

Cloudsmith indexes the upstream repository’s RepositorySignature endpoint from the NuGet service index.

Upstream signatures are also passed through for verification.

Signed packages enable integrity verification, mitigating risks of content tampering. The package’s repository signatures serve as proof of origin, providing consumers a reliable way to authenticate packages before use.

To get started with native signing for NuGet, please see 

Sunsetting our legacy web app

Other logs

Cloudsmith Status Page has moved

Cloudsmith’s Maven repositories now support arbitrary files for more flexible workflows

Security update: Device verification for sign-ins

Improved security with EPSS in Enterprise Policy Management

Introducing native Swift signing

Verify the integrity of NuGet packages with native signing