Secure your software supply chain directly in VS Code with the latest version of Cloudsmith’s extension
We’ve released a major update to the Cloudsmith VS Code extension, transforming it from a repository browser into a proactive part of your software supply chain security. By integrating security remediation, automated Infrastructure as Code (IaC) generation, and dependency health tracking directly into the IDE, we’ve eliminated the friction between writing code and managing a secure software supply chain…
Cloudsmith CLI: New vulnerability command
Cloudsmith has introduced a new vulnerabilities command to the CLI, allowing users to retrieve package security scan results through a single command…
Stop dependency confusion by defining trusted sources
Upstream Trust prevents attackers from hijacking your internal package names in public repositories. By defining explicit trust boundaries, you ensure that once an artifact is identified as internal, it cannot be replaced by an untrusted externally-sourced version…
Take the complexity out of policy management with new templates
Policy as code is a powerful way to scale security and compliance across modern DevOps pipelines, but writing Rego from scratch is a high barrier to entry. We’ve introduced Policy Templates to provide functional starting points, allowing you to deploy validated security guardrails without coding from scratch…
Filter client logs by edge response (hit/miss)
Following our recent update to include cache data in Client Log Exports, we have now added the ability to filter by Edge Response directly within the Client Logs UI…
Manage your supply chain using natural language with MCP
The Cloudsmith CLI now supports the Model Context Protocol (MCP), allowing you to bridge your package management workflow with AI assistants like Claude, Cursor, and VS Code…
New upstream source: GitHub Releases
You can now proxy and cache binaries, scripts, and other assets directly from GitHub Releases into Cloudsmith…
Upstream publish date added for additional formats
You can now use the upstream publish date in Cloudsmith policies for Python, NuGet, Docker, Ruby, Go, Rust (Cargo), Conda, and Maven packages, expanding on the npm support added earlier this year. This enables you to define policies that automatically quarantine new packages for a specific time period (e.g., three days) after release…
API sandbox added to our documentation website
We've made a significant new upgrade to our documentation website, adding an API sandbox where you get hands-on with all of our API endpoints…
Manage generic upstreams via the Cloudsmith Terraform provider
We’ve added support for generic upstreams to the Cloudsmith Terraform provider. This update allows customers to automate the proxying and caching of any file-based asset - such as raw binaries or scripts - directly via Infrastructure as Code…
