v1.20.0
Breaking Changes📦 cloudsmithView on GitHub →
⚠ 1 breaking✨ 26 features🐛 10 fixes🔧 10 symbols
Summary
This release introduces significant new features including arbitrary metadata support, enhanced credential management with OIDC auto-discovery and a credential provider chain, and the ability to build and publish standalone CLI binaries. It also includes various bug fixes and dependency upgrades.
⚠️ Breaking Changes
- The metadata API client has been switched to use the /v2/metadata/ endpoint. If you are programmatically interacting with the metadata API, you may need to update your calls to reflect this change.
Migration Steps
- Update any programmatic calls to the metadata API to use the new `/v2/metadata/` endpoint.
✨ New Features
- Added a new `--request-api-key` flag for the `cloudsmith auth` command.
- Added a `logout` command to the CLI.
- Added `--verbose` output for the `cloudsmith whoami` command.
- Added `--tag` option to the download command.
- Added a command to return vulnerability results.
- Added `--filename` and `--download-all` options to the download command.
- Implemented Alpine upstreams.
- Added metadata API client and client tests.
- Added metadata commands (CRUD).
- Added metadata flag to the push command.
- Release of arbitrary metadata support.
- Added credential provider chain concept.
- Added OIDC credential auto-discovery.
- Added Claude-code support.
- Added Docker credential helper for Cloudsmith registries.
- Added GitHub Actions OIDC detector.
- Added Azure DevOps OIDC detector.
- Added generic OIDC detector.
- Added CircleCI OIDC detector.
- Added Bitbucket Pipelines OIDC detector.
- Added GitLab CI OIDC detector.
- Added OIDC detector enable/order controls.
- Migrated packaging to uv + pyproject.toml.
- Built standalone CLI binaries with PyInstaller + clean-room smoketest.
- Published standalone binaries via the release + Docker pipelines.
- Published standalone binaries via the Homebrew tap.
🐛 Bug Fixes
- Updated python-toon dependency name.
- Fixed v2 API Spec loading.
- Fixed download command in the SAML context.
- Fixed incorrect URLs in the CONTRIBUTING.md file.
- Fixed metadata enum update.
- Fixed Docker container to run as non-root user.
- Bumped mcp to 1.27.2 and upgraded vulnerable dependencies.
- Resolved code scanning alerts in JWT and checksum handling.
- Stricter acceptance of API hosts and proxies.
- Ensured `whoami` command exits with 1 when not authenticated.