Cloudsmith Release Notes

Cloudsmith now supports ActiveState Curated Catalog upstreams, with configuration built into the Libraries tab…

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own…

You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit…

The Cloudsmith CLI can now update itself, so you can upgrade quickly and get back to work. The CLI also authenticates Terraform to your Cloudsmith registries without storing a token, reads your workspace settings from a new --workspace option, and keeps single sign-on (SSO) sessions alive through temporary network failures…

A connected_repositories field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it…

You can now provision Cloudsmith team membership from groups in your identity provider (IdP) on Ultra and Enterprise plans. Adding or removing a user from a mapped group in your IdP updates their Cloudsmith team membership automatically…

The Cloudsmith CLI has had six releases since our last update here. The headlines: you can now push Nix packages, let Cargo and pnpm authenticate automatically with credential helpers, and manage a repository's GNU Privacy Guard (GPG) key and access privileges without leaving your terminal. Along the way, the CLI got faster to start, kinder to macOS users, and better behaved on machines with no OS keyring…

Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads…

Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app…

Package logs are now available in the Cloudsmith web app, giving you a per-package audit trail: what changed, who changed it, and when…

Workspace owners can grant each privilege separately, without giving members the Manager or Owner role…

When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub…

See how published packages are being consumed - downloads, entitlement token use, and client logs - without leaving the Broadcasts app…

Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels…