What's Changed

• feat(ENG-15090): creating default credential helper dir in user's home directory by @coillteoir in #482
• ci(no-ticket): merge the Homebrew tap bump pull request automatically by @cloudsmith-iduffy in #487
• feat(ENG-14146): Report errors to sentry by @tigh-latte in #459
• test(no-ticket): stop pointing upstream tests at cloudsmith.io by @BartoszBlizniak in #490
• build(deps): bump astral/uv from 0.12.22-alpine3.23 to 0.13.0-alpine3.23 in the docker-all group by @dependabot[bot] in #496
• build(deps): bump the actions-all group across 1 directory with 3 updates by @dependabot[bot] in #497
• build(deps): bump the uv-all group with 3 updates by @dependabot[bot] in #498
• fix(ENG-15090): find default-installed launchers in credential-helper list by @cloudsmith-iduffy in #491
• feat(no-ticket): get Workspace domains from the v2 API by @cloudsmith-iduffy in #476
• chore(ENG-14534): send a release event to downstream repositories by @cloudsmith-iduffy in #451
• fix(no-ticket): quote the standalone binary path in helper launchers by @cloudsmith-iduffy in #492
• feat(ENG-15089): deprecate cloudsmith login and handle the password login switch-off by @BartoszBlizniak in #489
• docs(no-ticket): list Sentry reporting and the helper directory as unreleased by @cloudsmith-iduffy in #500
• fix(no-ticket): bake the Workspace and API host into the Terraform helper by @cloudsmith-iduffy in #488
• fix(no-ticket): update vulnerability examples to use correct term on_violation_quarantine by @coillteoir in #501
• Add --without-ssl-verify-strict to disable VERIFY_X509_STRICT by @cloudsmith-iduffy with @Copilot in #499
• fix(cargo-provider): register the Cargo provider when config.toml has no [registry] table by @rudranil29 in #506
• fix(ENG-15211): explain TLS certificate failures and stop retrying them by @cloudsmith-iduffy in #504
• Upgrade certifi to 2026.10.19 by @cloudsmith-iduffy with @Copilot in #507
• bug(token): stop tokens create --save-config crashing when no token is returned by @rudranil29 in #508
• feat(no-ticket): add --proxy and apply it to all HTTP requests by @cloudsmith-iduffy in #505
• chore(no-ticket): bump uv in dev.Dockerfile to 0.13.4 by @cloudsmith-iduffy in #510
• ci(no-ticket): improve ci runtime by @BartoszBlizniak in #514
• build(deps): bump virtualenv from 21.7.13 to 21.14.9 in the uv-security group across 1 directory by @dependabot[bot] in #518
• release: cloudsmith-cli v1.30.0 by @BartoszBlizniak in #503

New Contributors

• @rudranil29 made their first contribution in #506

Full Changelog: v1.29.0...v1.30.0

What's Changed

• Revert: #461 - Re-merge OIDC features by @tigh-latte in #464
• fix(ENG-13941): removing name column from cloudsmith-repos-list by @coillteoir in #465
• feat: add --include-connected flag to ls packages by @cloudsmith-iduffy in #460
• build(no-ticket): update python runtime version by @coillteoir in #467
• build(no-ticket): drop support for python 3.10 by @coillteoir in #469
• build(deps): bump astral/uv from 0.12.19-alpine3.23 to 0.12.22-alpine3.23 in the docker-all group by @dependabot[bot] in #473
• build(deps): bump the uv-all group with 7 updates by @dependabot[bot] in #474
• chore(no-ticket): add security policy and OSS Scanner build files by @cloudsmith-iduffy in #475
• build(no-ticket): bump cloudsmith-api to 2.0.38 by @cloudsmith-iduffy in #477
• chore(no-ticket): confidently say service is up to date by @coillteoir in #483
• ci(no-ticket): run lint and tests on merge_group by @cloudsmith-iduffy in #484
• refactor(no-ticket): share one v2 API client by @cloudsmith-iduffy in #478
• build(no-ticket): build glibc binaries on AlmaLinux 8 again by @cloudsmith-iduffy in #486
• release: cloudsmith-cli v1.29.0 by @cloudsmith-iduffy in #485

Full Changelog: v1.28.0...v1.29.0

What's Changed

• fix(cli): correct linebreaks in command help. by @nikshankarnoble in #420
• feat(ENG-14143): update rich tables to respect TTY state by @coillteoir in #423
• feat(ENG-14601): adding dependabot config by @coillteoir in #424
• feat(ENG-14601): removing baseimage build args from image build by @coillteoir in #435
• build(deps): bump astral/uv from 0.12.7-alpine3.23 to 0.12.15-alpine3.23 in the docker-all group by @dependabot[bot] in #436
• build(deps): bump the actions-all group with 4 updates by @dependabot[bot] in #426
• build(deps): bump actions/checkout from 6.0.3 to 7.0.1 by @dependabot[bot] in #427
• build(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @dependabot[bot] in #428
• build(deps-dev): bump setuptools from 83.0.0 to 84.0.0 by @dependabot[bot] in #431
• build(deps): bump rich from 14.3.3 to 15.0.0 by @dependabot[bot] in #434
• build(deps-dev): bump twine from 6.2.0 to 7.0.0 by @dependabot[bot] in #432
• build(deps): bump the uv-all group across 1 directory with 17 updates by @dependabot[bot] in #430
• build(deps): bump anyio from 4.12.1 to 4.14.2 by @dependabot[bot] in #441
• build(deps): bump mcp from 1.28.1 to 2.2.0 by @dependabot[bot] in #433
• build(deps): bump astral-sh/setup-uv from 8.2.0 to 10.1.0 by @dependabot[bot] in #429
• fix(mcp): report the CLI version in the MCP server info by @cloudsmith-iduffy in #442
• fix: never prompt for a keyring password without a user by @cloudsmith-iduffy in #425
• Fix macOS standalone binary OpenSSL mismatch by @cloudsmith-iduffy with @Copilot in #443
• build(deps): bump the docker-all group with 2 updates by @dependabot[bot] in #444
• build(deps-dev): bump the uv-all group with 2 updates by @dependabot[bot] in #445
• build(deps): bump anyio from 4.14.2 to 4.15.1 by @dependabot[bot] in #446
• feat(ENG-14145): self-update command and background update check by @tigh-latte in #419
• build(deps): bump cryptography from 50.0.1 to 50.0.2 by @dependabot[bot] in #448
• build(deps): bump virtualenv from 21.5.0 to 21.7.12 by @dependabot[bot] in #449
• fix(ENG-14445): Fixed the package analytics endpoint generation by mcp, included v2 in it by @agupta-cruiser in #417
• build(deps): bump virtualenv from 21.7.12 to 21.7.13 by @dependabot[bot] in #450
• ci: auto-merge minor and patch Dependabot updates by @cloudsmith-iduffy in #452
• build(deps): bump astral/uv from 0.12.17-alpine3.23 to 0.12.19-alpine3.23 in the docker-all group by @dependabot[bot] in #453
• fix: Change merge command to use admin privileges by @cloudsmith-iduffy in #456
• build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions-all group across 1 directory by @dependabot[bot] in #454
• build(deps): bump the uv-all group across 1 directory with 4 updates by @dependabot[bot] in #455
• build(deps): bump pyjwt from 2.13.0 to 2.15.0 in the uv-security group across 1 directory by @dependabot[bot] in #457
• feat: add Buildkite OIDC credential detection by @cloudsmith-iduffy in #415
• feat: add Google Cloud OIDC detector by @cloudsmith-iduffy in #306
• Revert: d6da221 and ce2396 by @tigh-latte in #461
• release: cloudsmith-cli v1.28.0 by @tigh-latte in #462
• fix(no-ticket): trust certifi CA bundle for MCP HTTP calls by @tigh-latte in #463

New Contributors

• @nikshankarnoble made their first contribution in #420
• @agupta-cruiser made their first contribution in #417

Full Changelog: v1.27.0...v1.28.0

What's Changed

• fix(security): update dependencies by @BartoszBlizniak in #401
• fix: totp not hidden for 2fa by @tigh-latte in #403
• chore(no-ticket): fixing random lints by running "ruff check --unsafe-fixes --fix" by @coillteoir in #405
• feat(ENG-14323): add OIDC exchange diagnostics by @cloudsmith-iduffy in #412
• Fix SAML authentication when redirect port is occupied by @cloudsmith-iduffy in #413
• feat(ENG-13677): Terraform credential helper by @tigh-latte in #400
• feat: Harden automatic SSO renewal by @cloudsmith-iduffy in #407
• feat: Integrate SSO renewal with credential resolution by @cloudsmith-iduffy in #408
• feat: Reuse existing SSO auth sessions by @cloudsmith-iduffy in #410
• feat(ENG-14143): adding checks for colour and interactivity suppression by @coillteoir in #402
• feat(ENG-14143): adding colour suppression to the CLI via environment variables by @coillteoir in #404
• release: cloudsmith-cli v1.27.0 by @cloudsmith-iduffy in #416

Full Changelog: v1.26.0...v1.27.0

What's Changed

• fix: write retry messages to stderr by @cloudsmith-iduffy in #387
• perf: import command modules lazily by @cloudsmith-iduffy in #374
• perf: keep the SDK and requests out of startup by @cloudsmith-iduffy in #375
• perf: skip the SDK import on custom-domain cache hits by @cloudsmith-iduffy in #376
• perf: defer the rich, urllib3 and semver imports by @cloudsmith-iduffy in #377
• chore: optimize CI test coverage by @cloudsmith-iduffy in #388
• chore: enforce type-checking-only imports with ruff by @cloudsmith-iduffy in #379
• chore: ban module-level imports of startup-heavy modules by @cloudsmith-iduffy in #380
• chore: enable the perflint and comprehension ruff rules by @cloudsmith-iduffy in #381
• feat(ENG-13678): adding cargo credential helper to cli by @coillteoir in #371
• chore(no-ticket): refine ty config to not display all diagnostics by @coillteoir in #392
• copy: add slug_perm to output by @ThomasAdam in #36
• fix(no-ticket): Prefix pnpm credential with Bearer by @tigh-latte in #396
• feat(eng-14008): add cloudsmith repos privileges command group by @BartoszBlizniak in #393
• fix: stop recurring macOS keychain prompts and self-heal dead SSO sessions by @cloudsmith-iduffy in #383
• feat(ENG-14007): add cloudsmith repos gpg command group by @BartoszBlizniak in #391
• build(deps-dev): bump setuptools from 82.0.1 to 83.0.0 in the uv group across 1 directory by @dependabot[bot] in #354
• feat(cli): add Workspace option aliases by @cloudsmith-iduffy in #398
• release: cloudsmith-cli v1.26.0 by @cloudsmith-iduffy in #397

New Contributors

• @ThomasAdam made their first contribution in #36
• @dependabot[bot] made their first contribution in #354

Full Changelog: v1.25.0...v1.26.0

What's Changed

• feat(ENG-13667): add secrets_scanning.yml to prevent betterleaks being flagged by @coillteoir in #366
• fix(eng-13978): JSON output for package sync failure with status reason by @BartoszBlizniak in #368
• feat(ENG-13679): NPM Credential Helper by @tigh-latte in #367
• feat(no-ticket): adding ty type checking in warning mode by @coillteoir in #370
• feat(ENG-14032): adding container image build to CI by @coillteoir in #369
• fix: show pagination info in ents list output by @lvthillo in #385
• feat: add CLOUDSMITH_KEYRING_FILE_PATH and CLOUDSMITH_KEYRING_DIR for keyring file placement by @cloudsmith-iduffy in #382
• feat(no-ticket): normalize the API host by @cloudsmith-iduffy in #372
• perf: defer the mcp import to the mcp commands by @cloudsmith-iduffy in #373
• feat(ENG-12409): implement support for the Nix format & upstreams by @apoclyps in #365
• fix: improve 2fa flow on saml auth by @cloudsmith-iduffy in #384
• release: cloudsmith-cli v1.25.0 by @BartoszBlizniak in #386

New Contributors

• @tigh-latte made their first contribution in #367
• @lvthillo made their first contribution in #385

Full Changelog: v1.24.0...v1.25.0

What's Changed

• fix(ENG-13962): degrade gracefully when auth can't open a browser (#194) by @BartoszBlizniak in #350
• fix(no-ticket): stop 401 hint from asserting a permissions problem by @BartoszBlizniak in #352
• chore(ENG-13952): add dev-release workflow for standalone binaries by @cloudsmith-iduffy in #357
• fix: add CLOUDSMITH_KEYRING_* env var aliases to avoid global impact by @cloudsmith-iduffy in #356
• feat(ENG-13667): adding betterleaks checks to pre-commit hooks and CI by @coillteoir in #362
• fix(no-ticket): resolve AWS STS region and wire up --debug logging by @cloudsmith-iduffy in #363
• feat(ENG-56): derive Debian source package members from the .dsc on push deb by @BartoszBlizniak in #351
• release: cloudsmith-cli v1.24.0 by @cloudsmith-iduffy in #364

Full Changelog: v1.23.0...v1.24.0

What's Changed

• fix: embedded additional keyrings for headless use cases by @cloudsmith-iduffy in #353
• release: cloudsmith-cli v1.23.0 by @cloudsmith-iduffy in #355

Full Changelog: v1.22.0...v1.23.0

What's Changed

• fix: stop Homebrew rewriting bundled dylib IDs on macOS by @cloudsmith-iduffy in #335
• release: cloudsmith-cli v1.21.0 by @BartoszBlizniak in #343
• refactor(no-ticket): pass resolved credentials through credential-helper plumbing by @cloudsmith-iduffy in #336
• feat(ENG-13681): add cloudsmith domains list with custom-domain discovery by @cloudsmith-iduffy in #337
• chore(ENG-13226): migrating from black/pylint to ruff by @coillteoir in #345
• build(no-ticket): upgrade cryptography to 50.0.0 by @cloudsmith-iduffy in #346
• build(no-ticket): upgrade mcp to 1.28.1 by @cloudsmith-iduffy in #347
• release: cloudsmith-cli v1.22.0 by @cloudsmith-iduffy in #349

New Contributors

• @coillteoir made their first contribution in #345

Full Changelog: v1.20.2...v1.22.0

What's Changed

• fix: stop Homebrew rewriting bundled dylib IDs on macOS by @cloudsmith-iduffy in #335

Full Changelog: v1.20.2...v1.21.0