---
title: ✨ September 2026 product updates
---

New per-package audit logs, plus Nix push and automatic Cargo and pnpm auth in the Cloudsmith CLI. ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­    ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­  

| View in browser ArtiFacts is your monthly round up of new Cloudsmith product releases, industry news, and helpful resources. NEW Track every change to your packages with package logs Package logs give each package its own audit trail in the web app, so you can see what changed, who changed it, and when, without piecing together separate audit logs or support tickets. Every copy, delete, move, resync, tag change, quarantine, restore, and policy violation is recorded with a timestamp, actor, IP address, and version metadata, and you can filter by action, actor, or target to isolate a single event. Learn more PRODUCT UPDATES    What's new in Cloudsmith 🔎 Client logs now show the full request chain behind a package download Platform engineering teams troubleshooting a developer's broken build often need to see every request the package manager made, not just the final download. Client logs now capture format-specific metadata across every package format Cloudsmith supports, so each metadata fetch, redirect, and file transfer is recorded and searchable in the web app. Log exports will include this data from November 2026.   📂 Export a package's vulnerability findings as JSON Vulnerability and malicious package findings for any package now export as a JSON file directly from the Overview tab in the web app – ready to feed into your ticketing system, scanner, or auditors without a scripted API call.        💪 Nix support, Cargo and pnpm credential helpers, and more in the latest CLI releases The Cloudsmith command-line interface (CLI) can now push Nix packages and handle Cargo and pnpm authentication through credential helpers, so there's no cargo login and no tokens in .npmrc. It also lets you manage repository GNU Privacy Guard (GPG) keys and access privileges. This release fixes a repeated sign-in prompt on macOS with single sign-on (SSO) and speeds up startup in scripts and continuous integration (CI) jobs. 🆕 System for Cross‑domain Identity Management (SCIM) group provisioning is now generally available Map groups in your identity provider to Cloudsmith team, and membership will stay in sync automatically as people join or leave those groups in your IdP – no manual add and remove, no stale access when someone changes team or leaves the organization.  ALSO SHIPPED   Additional releases worth a scroll 👀 Read-only privileges for billing, usage, and OpenID Connect (OIDC) grant each separately so finance, ops, and security see what they need without an admin role.   🤫 Secret scanning notifications link to each detection when a Cloudsmith API key leaks on GitHub, you’ll receive an email that includes every location the key was found in GitHub.   🥶 Cooldown policies now support Cargo so that Cargo packages can be held in cooldown until each new version reaches a minimum age.   🔗 A new connected\_repositories field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it.  INDUSTRY ROUND UP    Resources we think you'll love 📊 Report \| Dependency attacks 2026: The confidence gap New Cloudsmith research on how organizations are (and aren't) keeping pace with the wave of dependency-focused supply chain attacks over the last year. Download the report →   🧠 Blog \| Simplify repository structure with connected repositories If your team has grown into a tangle of repositories per line of business, per project, or per format, connected repositories give you one repo to pull from without duplicating packages or losing governance. This walkthrough covers how to model the structure and the operational win it unlocks. Read more →   🧠 Blog \| Policy management, continuous risk detection, and the audit trail If you're using more than one of Cloudsmith's security features and want to see how they interlock, this walkthrough shows how policy management, continuous risk detection, and the audit trail fit together as one control layer. Read more → Cloudsmith, 7 Donegall Square West, Belfast, Northern Ireland BT1 6JH Unsubscribe Manage preferences |
| --- |