diff --git a/.bumpversion.cfg b/.bumpversion.cfg index 36f82350..596d6709 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 1.30.1 +current_version = 1.31.0 commit = True tag = True parse = (?P\d+)\.(?P\d+)\.(?P\d+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f15ddd44..900f404a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,28 +7,28 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ## [Unreleased] +## [1.31.0] - 2026-11-05 + ### Added -- Added `cloudsmith credential-helper install maven`, `install gradle`, and `install sbt`. They set up the Cloudsmith Maven tools, which get repository credentials from `cloudsmith credential-helper generic`. Each command installs the newest release from the public `cloudsmith/maven-tools` repository, for every build of the user. +- Added `cloudsmith credential-helper install maven`, `install gradle`, and `install sbt`. They set up the Cloudsmith Maven tools, which get repository credentials from `cloudsmith credential-helper generic`. Each command installs the newest release from the public `cloudsmith/maven-tools` repository, for every build of the user. (#520) - `maven` puts the extension in `~/.m2/repository` and adds it to `~/.m2/extensions.xml`, which Maven 3.10 and later read. When `mvn -v` reports an earlier Maven, the command shows a warning. With `--local`, the command adds the extension to `.mvn/extensions.xml` of the Maven project in the current directory instead. With `--mavenrc`, it adds a block to `~/.mavenrc` instead, which the `mvn` and `mvnw` scripts of all Maven versions read. `--mavenrc` does not work on Windows or when the path of the local Maven repository contains a space or a `:`. In these cases the command stops and tells you to use `--local` or Maven 3.10. - `gradle` writes an init script to `~/.gradle/init.d` (or `$GRADLE_USER_HOME/init.d`), which applies the plugin to every Gradle build. - `sbt` writes a global plugin to `~/.sbt/1.0/plugins`, which adds the plugin to every sbt 1 build. With `--local`, it writes `project/cloudsmith.sbt` of the sbt project in the current directory instead. - The commands add to existing files and keep their other content. `uninstall` removes only what `install` added. - -- Added `skills` to `cloudsmith upstream`. Use `cloudsmith upstream skills list`, `create`, `update`, and `delete` to manage AI Skills upstreams. An AI Skills upstream caches skills and plugins from a GitHub repository. -- Added `--changelog` to `cloudsmith push skills`. Use it to add release notes to an AI Skills package. The option is available only for the `skills` format. -- Added `--compress` to `cloudsmith push skills`. With this option, you can pass a skill folder instead of a `.zip` archive. The CLI compresses the contents of the folder into a `.zip` archive, then uploads it. If you pass a folder without `--compress`, the command fails with a usage error. The option is available only for the `skills` format. +- Added `skills` to `cloudsmith upstream`. Use `cloudsmith upstream skills list`, `create`, `update`, and `delete` to manage AI Skills upstreams. An AI Skills upstream caches skills and plugins from a GitHub repository. (#575) +- Added `--changelog` to `cloudsmith push skills`. Use it to add release notes to an AI Skills package. The option is available only for the `skills` format. (#564) +- Added `--compress` to `cloudsmith push skills`. With this option, you can pass a skill folder instead of a `.zip` archive. The CLI compresses the contents of the folder into a `.zip` archive, then uploads it. If you pass a folder without `--compress`, the command fails with a usage error. The option is available only for the `skills` format. (#564) ### Changed -- After a SAML login, `cloudsmith auth` saves the Workspace to `config.ini`. It writes to the `[profile:NAME]` section of the selected profile, or to `[default]` when you do not select a profile. The CLI writes to the file or directory that `--config-file` gives, or else to your user-level `config.ini`. If the `config.ini` does not exist, the CLI creates it. -- Using `#!/usr/bin/env sh` as shebang path for unix credential helpers. -- The minimum version of `cloudsmith-api` is now 2.0.42. +- The credential-helper launchers on Linux and macOS now start with `#!/usr/bin/env sh` instead of `#!/bin/sh`, so they also work on systems that have no `/bin/sh`. (#586) +- The minimum version of `cloudsmith-api` is now 2.0.42. (#575) - The update notice and `cloudsmith update` now link to the version's entry in the Cloudsmith changelog (`https://cloudsmith.com/changelog/cli-v--`) instead of its GitHub release page. ### Deprecated -- The old names of renamed options, environment variables, and `config.ini` keys are deprecated, and version 2.0.0 will remove them. Until then, they work as before, but the CLI prints a warning to stderr, once per run, that names the replacement. For example: ``Warning: `--org` is deprecated and will be removed in version 2.0.0. Use `--workspace` instead.`` The old names no longer show in `--help`. +- The old names of renamed options, environment variables, and `config.ini` keys are deprecated, and version 2.0.0 will remove them. Until then, they work as before, but the CLI prints a warning to stderr, once per run, that names the replacement. For example: ``Warning: `--org` is deprecated and will be removed in version 2.0.0. Use `--workspace` instead.`` `--help` no longer lists the old names, except `cloudsmith auth --help`, which marks `--token`, `--force`, and `--json` as deprecated. (#574) | Setting | Deprecated name | Replacement | | -- | -- | -- | @@ -52,47 +52,60 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. - `cloudsmith auth --token`, `--force`, and `--json`, and the `cloudsmith login` and `cloudsmith token` commands, now use the same warning format. The warning prefix is now `Warning:` instead of `DEPRECATION WARNING:`. `cloudsmith login` still stops working on November 20, 2026. - When you give an old and a new option on the same command line, such as `--org a --workspace b`, the new option now wins. Previously, the last option won. -- A `[profile:NAME]` section in `config.ini` now keeps the `[default]` values of `telemetry`, `check_for_update`, `ssl_verify`, `api_ssl_verify`, and `ssl_verify_strict` when it does not set them. Previously, a profile that left out one of these keys reset it to `true`, so `--profile`/`-P` turned telemetry and the update check back on, and turned certificate verification back on. A key that no section sets is still `true`. -- `cloudsmith credential-helper install pnpm` now ends `.npmrc` with a newline. Previously, a line that a shell appended to the file, such as `echo '//host/:_authToken=...' >> ~/.npmrc`, joined the last `tokenHelper` line. This made the `tokenHelper` path incorrect, and npm did not read the appended token. The install now also shows each `tokenHelper` line that it sets and the file that it writes to. To add the newline to an existing `.npmrc`, run the install again. If a line is already joined, split it into two lines before you run the install. If you do not, the install removes the appended token. -- OIDC authentication now works when the CLI cannot create its config directory, for example in a CI container with a read-only home directory. Previously, the CLI did not exchange the OIDC token and ran the command without credentials. Now the CLI exchanges the token. If the CLI cannot write the token to the disk cache, it continues without the cache. A malformed entry in the disk cache no longer stops the token exchange. -- `cloudsmith vulnerabilities` no longer stops with `IndexError` when a package has no vulnerability scan results. The command now shows the error "The package has no vulnerability scan results." and exits with the status of a 404 error. With `-F json`, it prints this error in the usual JSON error format. -- `cloudsmith vulnerabilities` no longer stops with `TypeError` or `AttributeError` when the API returns scan data without a list of scans, a list of results, or a severity. The command counts a result with no severity as `Unknown`. -- With `-F json`, list commands now give the correct `meta.pagination.page_results_len`. Earlier versions gave a value that was one less than the number of results on the page. -- List commands no longer fail with `ValueError` when the server sends a pagination header that is not an integer, such as `many`. The JSON output then has no `meta.pagination` data. -- `cloudsmith credential-helper uninstall docker` no longer creates the Docker `config.json` when the file does not exist. The command also no longer reports that it removed `credHelpers` entries when there is no file. This also applies to `--dry-run`. -- Fixed `cloudsmith mcp configure`, `cloudsmith download` and `cloudsmith update` when their output goes to a pipe or a file on Windows. Windows then uses a legacy encoding, such as cp1252, and these commands failed with `UnicodeEncodeError` after they did their work. The CLI now prints only ASCII text in the messages of these commands and in the dry-run message of `cloudsmith credential-helper`. -- Fixed `cloudsmith mcp configure` on Windows when a client configuration file contains non-ASCII text. The command read the UTF-8 file with the legacy Windows encoding. It then wrote incorrect characters back to the file, or it failed with `UnicodeDecodeError`. The CLI now reads the file as UTF-8. -- When the API returns an error body that is a JSON list, string, number, or `null`, the CLI now shows the HTTP status and the API message. Before this fix, the CLI stopped with `AttributeError: 'list' object has no attribute 'get'`, and `-F json` wrote nothing to stdout. -- `--api-headers "Authorization=username:password"` accepts a password that contains a colon. Before, all commands stopped with a `ValueError`. -- `--api-headers "Authorization=username"` without a password shows a usage error for `--api-headers`. Before, the CLI showed a traceback. -- `--api-headers` with a blocked header, such as `user-agent=x`, or with a value that has no `=`, shows a usage error. Before, the CLI showed a traceback. -- `cloudsmith list dependencies --help` now shows the help for the dependencies list. Before, it showed the help for the entitlements list. -- `cloudsmith credential-helper install terraform` now escapes the `terraformrc` args. Previously, a Windows path such as `C:\Users\jo\config.ini` in `--config-file` or `--credentials-file` made Terraform reject the full CLI config file. A `"` in an arg also made Terraform reject the file. A `${` in an arg could change the value that Terraform read. A `}` in an arg made the next install write an incorrect file. To fix a file that an earlier version wrote, run the install command again. -- `cloudsmith logout` no longer damages `credentials.ini` when a line follows an empty `api_key`. Previously, the CLI removed the next line that is not blank, for example on the second `logout`. When that line was a section header, such as `[profile:NAME]`, and that section also had a key, each later command failed with `DuplicateOptionError`. `cloudsmith logout` now also clears an `api_key` that uses `:` instead of `=`. The same fix applies when `cloudsmith login`, `cloudsmith tokens create --save-config`, `cloudsmith tokens refresh --save-config`, or `cloudsmith auth --request-api-key --save-config` write the API key. -- When `credentials.ini` has no `api_key` in the `[default]` section, `cloudsmith login` and the `--save-config` options now add the API key to that section. If the section does not exist, the CLI creates it. Previously, the CLI showed `UPDATED` but did not save the key. -- `cloudsmith credential-helper list` now shows the pnpm hosts in `.npmrc` when the pnpm launcher is missing. Previously, the command showed no hosts, and pnpm still tried to run the missing launcher for those hosts. +### Fixed + +- `cloudsmith list dependencies --help` now shows the help for the dependencies list. Before, it showed the help for the entitlements list. (#546) +- `cloudsmith credential-helper install terraform` now escapes the `terraformrc` args. Previously, a Windows path such as `C:\Users\jo\config.ini` in `--config-file` or `--credentials-file` made Terraform reject the full CLI config file. A `"` in an arg also made Terraform reject the file. A `${` in an arg could change the value that Terraform read. A `}` in an arg made the next install write an incorrect file. To fix a file that an earlier version wrote, run the install command again. (#543) +- `cloudsmith logout` no longer damages `credentials.ini` when a line follows an empty `api_key`. Previously, the CLI removed the next line that is not blank, for example on the second `logout`. When that line was a section header, such as `[profile:NAME]`, and that section also had a key, each later command failed with `DuplicateOptionError`. `cloudsmith logout` now also clears an `api_key` that uses `:` instead of `=`. The same fix applies when `cloudsmith login`, `cloudsmith tokens create --save-config`, `cloudsmith tokens refresh --save-config`, or `cloudsmith auth --request-api-key --save-config` write the API key. (#533) +- When `credentials.ini` has no `api_key` in the `[default]` section, `cloudsmith login` and the `--save-config` options now add the API key to that section. If the section does not exist, the CLI creates it. Previously, the CLI showed `UPDATED` but did not save the key. (#533) +- `cloudsmith credential-helper list` now shows the pnpm hosts in `.npmrc` when the pnpm launcher is missing. Previously, the command showed no hosts, and pnpm still tried to run the missing launcher for those hosts. (#554) - `list` also shows the pnpm hosts that you installed with `--bin-dir`. `cloudsmith credential-helper uninstall pnpm` now removes these `.npmrc` entries, as the Docker and Cargo uninstall commands do. -- `cloudsmith credential-helper list` now shows a helper as not configured when its config file is not valid, and it still lists the other helpers. This applies to a Docker `config.json` with a `credHelpers` value that is not an object, and to a Docker or Terraform config file that is not UTF-8. It also applies to a pnpm `.npmrc` that the CLI cannot read or decode. Previously, the command stopped with an error such as `AttributeError`. -- **Breaking:** `cloudsmith login`, `cloudsmith logout`, and `--save-config` on `cloudsmith auth` and `cloudsmith tokens` now set `credentials.ini` to mode `0600`. Only your user can read or change the file and its API key. Previously, the CLI created the file with mode `0660`, so all members of your group could read and change the API key. When the CLI writes an existing `credentials.ini` that you own, it also sets the mode to `0600`. The CLI does not change the mode when it only reads the file. Other users in your group can no longer read a `credentials.ini` that the CLI writes. On Windows, the CLI does not change the access to the file. -- `cloudsmith copy`, `move`, and `resync` with `--skip-errors` now ignore an API error, the same as `cloudsmith push`. The CLI prints the error one time, then `Skipping error and moving on.`, and exits with code 0. Previously, the CLI also printed the error a second time as an unexpected error (`Error: ApiException: ...`), sent an error report, and exited with code 1. -- The `--skip-errors` help text no longer says "when copying packages" for `move`, `resync`, and `push`. -- An empty optional trailing part in an `OWNER/REPO` argument now means that you did not give the part. For example, `cloudsmith repos get myorg/` lists the repositories in `myorg`. Before, it requested a repository with an empty name and printed a row of `None` values. `cloudsmith metrics entitlements myorg/` now works the same as `myorg`, and a `push` target such as `myorg/myrepo/ubuntu/` works the same as `myorg/myrepo/ubuntu`. An empty `OWNER` before a `REPO`, such as `/myrepo`, now gives a usage error. -- `cloudsmith credential-helper --help` now shows a correct summary for the `pnpm` helper. Before, it showed a part of the input description. The `pnpm` help also shows the correct output format, and its examples no longer join on one line. The `cargo` help examples no longer join on one line. -- `cloudsmith credential-helper install pnpm`, `uninstall pnpm`, and `list` now read and write `.npmrc` as UTF-8, as npm and pnpm do. On Windows, a home directory with characters such as Cyrillic or CJK letters caused a `UnicodeEncodeError`, and UTF-8 text in `.npmrc` was read incorrectly. The CLI keeps bytes that are not UTF-8 unchanged, and it reads a `.npmrc` that starts with a UTF-8 byte order mark. -- `cloudsmith mcp start`, `list_tools`, and `list_groups` now show the standard API error when the CLI cannot load the API schema. An API key that is not valid is one cause. The error includes the API detail and a hint, and `-F json` prints the standard JSON error. Previously, the commands printed an `HTTPStatusError` and sent an error report. `cloudsmith mcp start` writes the error to stderr, so the MCP client does not get it on stdout. -- When the API or a proxy answers the SAML IdP request with an HTML page or a JSON value that is not an object, `cloudsmith auth` now shows "Failed to authenticate via SAML!" with the reason. Before this fix, the CLI stopped with a `JSONDecodeError` or an `AttributeError`. The 2FA code exchange and the SAML token refresh now also reject a response that is not a JSON object. The 2FA code exchange also rejects a response without an access token. -- List commands that return no results now print `Results: 0 `, not `Results: 1-0 (0) of 0 (page: 1/1, ...)`. When the API response has no pagination headers, list commands print only the result count, not `of None`. -- An API request no longer waits without a limit when the API host accepts the connection but does not reply. A request now fails when it cannot connect in 30 seconds, or when it gets no data for 90 seconds. The API CDN waits 60 seconds for the API, so the CLI does not stop a slow request before the CDN does. If a request fails, the CLI retries it up to 6 times by default (`--error-retry-max`). A POST request has only the 30-second connection timeout, because a retry after a read timeout can create a second entry. File uploads and downloads do not change. -- Every command, including `--help`, no longer stops with `TypeError` or `AttributeError` about `ColorMode` when the installed `click` is older than 8.2. The CLI needs `click` 8.2 or later, but the install of another package can replace it with an older `click`. -- `cloudsmith credential-helper install cargo` no longer replaces a `credential-provider` that you set on a Cloudsmith registry in `config.toml`. The install keeps your provider and shows a warning that names the registry. Previously, the install replaced your provider, and `uninstall cargo` then removed it. -- `cloudsmith credential-helper uninstall pnpm` now removes the `pnpm-credential-cloudsmith` launcher when the `.npmrc` file does not exist. Previously, it printed `.npmrc file doesn't exist, nothing to do` and did not remove the launcher. The command does not create the `.npmrc` file. -- `cloudsmith credential-helper install` and `uninstall` no longer replace a Docker `config.json` or a Cargo `config.toml` that does not parse. Previously, the CLI read such a file as empty and wrote over it, so your settings were lost. Now the command stops with an error that names the file, and it does not write to the file. Correct or remove the file. Then run the command again. -- `cloudsmith credential-helper install` and `uninstall` no longer rewrite a config file when they make no change to its data. Previously, the CLI always rewrote a file in a different formatting, such as the tab-indented `config.json` that Docker writes. The command also made a `.bak` copy and reported changes that it did not make. -- When the API host name or the proxy host name does not exist, for example because of a typo in `--api-host`, commands now fail immediately. Previously, they retried for approximately 62 seconds without output. The CLI still retries a DNS failure that the operating system reports as temporary. -- When the CLI waits before it retries a failed connection or a 5xx response, it now writes `Request failed: retrying in N second(s) ...` to stderr. Previously, it waited without output. -- `cloudsmith mcp start` now stops without an error when the MCP client closes the connection while the server writes a reply. Previously, the command stopped with `BrokenPipeError` and exit status 1. -- The CLI now exits with status 1 when you interrupt it with Ctrl+C after the reader of its stderr has closed the pipe. Before, the CLI sent an error report and exited with status 120. -- `cloudsmith check rates` no longer stops with `TypeError` when the API does not give a value for an interval, limit, remaining count, reset time or throttled status. The command now shows `None` for that value. +- A `[profile:NAME]` section in `config.ini` now keeps the `[default]` values of `telemetry`, `check_for_update`, `ssl_verify`, `api_ssl_verify`, and `ssl_verify_strict` when it does not set them. Previously, a profile that left out one of these keys reset it to `true`, so `--profile`/`-P` turned telemetry and the update check back on, and turned certificate verification back on. A key that no section sets is still `true`. +- `cloudsmith credential-helper list` now shows a helper as not configured when its config file is not valid, and it still lists the other helpers. This applies to a Docker `config.json` with a `credHelpers` value that is not an object, and to a Docker or Terraform config file that is not UTF-8. It also applies to a pnpm `.npmrc` that the CLI cannot read or decode. Previously, the command stopped with an error such as `AttributeError`. (#549) +- **Breaking:** `cloudsmith login`, `cloudsmith logout`, and `--save-config` on `cloudsmith auth` and `cloudsmith tokens` now set `credentials.ini` to mode `0600`. Only your user can read or change the file and its API key. Previously, the CLI created the file with mode `0660`, so all members of your group could read and change the API key. When the CLI writes an existing `credentials.ini` that you own, it also sets the mode to `0600`. The CLI does not change the mode when it only reads the file. Other users in your group can no longer read a `credentials.ini` that the CLI writes. On Windows, the CLI does not change the access to the file. (#553) +- `cloudsmith copy`, `move`, and `resync` with `--skip-errors` now ignore an API error, the same as `cloudsmith push`. The CLI prints the error one time, then `Skipping error and moving on.`, and exits with code 0. Previously, the CLI also printed the error a second time as an unexpected error (`Error: ApiException: ...`), sent an error report, and exited with code 1. (#552) +- The `--skip-errors` help text no longer says "when copying packages" for `move`, `resync`, and `push`. (#552) +- An empty optional trailing part in an `OWNER/REPO` argument now means that you did not give the part. For example, `cloudsmith repos get myorg/` lists the repositories in `myorg`. Before, it requested a repository with an empty name and printed a row of `None` values. `cloudsmith metrics entitlements myorg/` now works the same as `myorg`, and a `push` target such as `myorg/myrepo/ubuntu/` works the same as `myorg/myrepo/ubuntu`. An empty `OWNER` before a `REPO`, such as `/myrepo`, now gives a usage error. (#550) +- `cloudsmith credential-helper --help` now shows a correct summary for the `pnpm` helper. Before, it showed a part of the input description. The `pnpm` help also shows the correct output format, and its examples no longer join on one line. The `cargo` help examples no longer join on one line. (#547) +- `cloudsmith credential-helper install pnpm`, `uninstall pnpm`, and `list` now read and write `.npmrc` as UTF-8, as npm and pnpm do. On Windows, a home directory with characters such as Cyrillic or CJK letters caused a `UnicodeEncodeError`, and UTF-8 text in `.npmrc` was read incorrectly. The CLI keeps bytes that are not UTF-8 unchanged, and it reads a `.npmrc` that starts with a UTF-8 byte order mark. (#555) +- `cloudsmith mcp start`, `list_tools`, and `list_groups` now show the standard API error when the CLI cannot load the API schema. An API key that is not valid is one cause. The error includes the API detail and a hint, and `-F json` prints the standard JSON error. Previously, the commands printed an `HTTPStatusError` and sent an error report. `cloudsmith mcp start` writes the error to stderr, so the MCP client does not get it on stdout. (#561) +- When the API or a proxy answers the SAML IdP request with an HTML page or a JSON value that is not an object, `cloudsmith auth` now shows "Failed to authenticate via SAML!" with the reason. Before this fix, the CLI stopped with a `JSONDecodeError` or an `AttributeError`. The 2FA code exchange and the SAML token refresh now also reject a response that is not a JSON object. The 2FA code exchange also rejects a response without an access token. (#559) +- List commands that return no results now print `Results: 0 `, not `Results: 1-0 (0) of 0 (page: 1/1, ...)`. When the API response has no pagination headers, list commands print only the result count, not `of None`. (#545) +- An API request no longer waits without a limit when the API host accepts the connection but does not reply. A request now fails when it cannot connect in 30 seconds, or when it gets no data for 90 seconds. The API CDN waits 60 seconds for the API, so the CLI does not stop a slow request before the CDN does. If a request fails, the CLI retries it up to 6 times by default (`--error-retry-max`). A POST request has only the 30-second connection timeout, because a retry after a read timeout can create a second entry. File uploads and downloads do not change. (#538) +- Every command, including `--help`, no longer stops with `TypeError` or `AttributeError` about `ColorMode` when the installed `click` is older than 8.2. The CLI needs `click` 8.2 or later, but the install of another package can replace it with an older `click`. (#582) +- `cloudsmith credential-helper install cargo` no longer replaces a `credential-provider` that you set on a Cloudsmith registry in `config.toml`. The install keeps your provider and shows a warning that names the registry. Previously, the install replaced your provider, and `uninstall cargo` then removed it. (#532) +- `cloudsmith credential-helper uninstall pnpm` now removes the `pnpm-credential-cloudsmith` launcher when the `.npmrc` file does not exist. Previously, it printed `.npmrc file doesn't exist, nothing to do` and did not remove the launcher. The command does not create the `.npmrc` file. (#539) +- `cloudsmith credential-helper install` and `uninstall` no longer replace a Docker `config.json` or a Cargo `config.toml` that does not parse. Previously, the CLI read such a file as empty and wrote over it, so your settings were lost. Now the command stops with an error that names the file, and it does not write to the file. Correct or remove the file. Then run the command again. (#540) +- `cloudsmith credential-helper install` and `uninstall` no longer rewrite a config file when they make no change to its data. Previously, the CLI always rewrote a file in a different formatting, such as the tab-indented `config.json` that Docker writes. The command also made a `.bak` copy and reported changes that it did not make. (#540) +- When the API host name or the proxy host name does not exist, for example because of a typo in `--api-host`, commands now fail immediately. Previously, they retried for approximately 62 seconds without output. The CLI still retries a DNS failure that the operating system reports as temporary. (#542) +- When the CLI waits before it retries a failed connection or a 5xx response, it now writes `Request failed: retrying in N second(s) ...` to stderr. Previously, it waited without output. (#542) +- `cloudsmith mcp start` now stops without an error when the MCP client closes the connection while the server writes a reply. Previously, the command stopped with `BrokenPipeError` and exit status 1. (#583) +- The CLI now exits with status 1 when you interrupt it with Ctrl+C after the reader of its stderr has closed the pipe. Before, the CLI sent an error report and exited with status 120. (#567) +- `cloudsmith check rates` no longer stops with `TypeError` when the API does not give a value for an interval, limit, remaining count, reset time or throttled status. The command now shows `None` for that value. (#581) + +## [1.30.1] - 2026-10-28 + +### Changed + +- After a SAML login, `cloudsmith auth` saves the Workspace to `config.ini`. It writes to the `[profile:NAME]` section of the selected profile, or to `[default]` when you do not select a profile. The CLI writes to the file or directory that `--config-file` gives, or else to your user-level `config.ini`. If the `config.ini` does not exist, the CLI creates it. (#517) +- The standalone binaries and the Docker image now use Python 3.14.10. Earlier Python 3.14 releases still trust the compromised eMudhra CA keys (CVE-2026-115557). (#565) +- The minimum version of `certifi` is now 2026.10.23. (#565) + +### Fixed + +- `cloudsmith credential-helper install pnpm` now ends `.npmrc` with a newline. Previously, a line that a shell appended to the file, such as `echo '//host/:_authToken=...' >> ~/.npmrc`, joined the last `tokenHelper` line. This made the `tokenHelper` path incorrect, and npm did not read the appended token. The install now also shows each `tokenHelper` line that it sets and the file that it writes to. To add the newline to an existing `.npmrc`, run the install again. If a line is already joined, split it into two lines before you run the install. If you do not, the install removes the appended token. (#528) +- OIDC authentication now works when the CLI cannot create its config directory, for example in a CI container with a read-only home directory. Previously, the CLI did not exchange the OIDC token and ran the command without credentials. Now the CLI exchanges the token. If the CLI cannot write the token to the disk cache, it continues without the cache. A malformed entry in the disk cache no longer stops the token exchange. (#531) +- `cloudsmith vulnerabilities` no longer stops with `IndexError` when a package has no vulnerability scan results. The command now shows the error "The package has no vulnerability scan results." and exits with the status of a 404 error. With `-F json`, it prints this error in the usual JSON error format. (#529) +- `cloudsmith vulnerabilities` no longer stops with `TypeError` or `AttributeError` when the API returns scan data without a list of scans, a list of results, or a severity. The command counts a result with no severity as `Unknown`. (#529) +- With `-F json`, list commands now give the correct `meta.pagination.page_results_len`. Earlier versions gave a value that was one less than the number of results on the page. (#524) +- List commands no longer fail with `ValueError` when the server sends a pagination header that is not an integer, such as `many`. The JSON output then has no `meta.pagination` data. (#524) +- `cloudsmith credential-helper uninstall docker` no longer creates the Docker `config.json` when the file does not exist. The command also no longer reports that it removed `credHelpers` entries when there is no file. This also applies to `--dry-run`. (#522) +- Fixed `cloudsmith mcp configure`, `cloudsmith download` and `cloudsmith update` when their output goes to a pipe or a file on Windows. Windows then uses a legacy encoding, such as cp1252, and these commands failed with `UnicodeEncodeError` after they did their work. The CLI now prints only ASCII text in the messages of these commands and in the dry-run message of `cloudsmith credential-helper`. (#525) +- Fixed `cloudsmith mcp configure` on Windows when a client configuration file contains non-ASCII text. The command read the UTF-8 file with the legacy Windows encoding. It then wrote incorrect characters back to the file, or it failed with `UnicodeDecodeError`. The CLI now reads the file as UTF-8. (#525) +- When the API returns an error body that is a JSON list, string, number, or `null`, the CLI now shows the HTTP status and the API message. Before this fix, the CLI stopped with `AttributeError: 'list' object has no attribute 'get'`, and `-F json` wrote nothing to stdout. (#526) +- `--api-headers "Authorization=username:password"` accepts a password that contains a colon. Before, all commands stopped with a `ValueError`. (#527) +- `--api-headers "Authorization=username"` without a password shows a usage error for `--api-headers`. Before, the CLI showed a traceback. (#527) +- `--api-headers` with a blocked header, such as `user-agent=x`, or with a value that has no `=`, shows a usage error. Before, the CLI showed a traceback. (#527) ## [1.30.0] - 2026-10-22 diff --git a/cloudsmith_cli/data/VERSION b/cloudsmith_cli/data/VERSION index 7f3c3aff..34aae156 100644 --- a/cloudsmith_cli/data/VERSION +++ b/cloudsmith_cli/data/VERSION @@ -1 +1 @@ -1.30.1 +1.31.0