Chainguard products changelog

This page logs Chainguard product updates week by week, newest first: product announcements, breaking changes, container images that reached end-of-life or are no longer available, and images newly added to the catalog. Each event is listed once, in the week it first appeared.

Week of 2026-08-17

Clearer npm errors for blocked packages

Launched August 13, 2026.

When Chainguard Libraries withholds an npm package or version — because of detected malware or greyware, a pending malware scan, or a policy block such as a cooldown — npm now returns a 403 naming the specific reason, for example MALWARE_DETECTED, instead of the unexplained 404 it returned before. The other supported package managers (pnpm, yarn, uv, poetry, Maven, and Gradle) still report a blocked version as a generic not-found error, and a 409 when an entire package is blocked for malware.

For more information, refer to Error messages.

Guardener GitHub App (beta)

Launched August 12, 2026.

Chainguard Guardener, the automated migration tool, now covers GitHub Actions as well as container images. The GitHub App inventories the Actions in use across your organization’s repositories, maps them to hardened Chainguard equivalents, and opens pull requests to swap them in, pinned to a specific SHA rather than a mutable tag. It runs in two modes: an upfront pass that surfaces existing Actions usage and opens migration pull requests, and ongoing standardization that watches workflow files and suggests Chainguard equivalents as new upstream Actions appear.

For more information, refer to Getting started with Chainguard Guardener.

Chainguard Libraries build pinning

Effective August 24, 2026.

Chainguard Repository can serve two copies of the same package version: the upstream copy mirrored from the public registry, and Chainguard’s copy rebuilt from source. The two have different checksums, and each request resolves independently, so when Chainguard publishes a rebuild of a version your organization already pulled, the next resolution moves you to the rebuild and its checksum no longer matches your lockfile — surfacing client-side as errors such as EINTEGRITY in npm. As of August 24, 2026, build pinning records which copy your organization received the first time it downloads a package version and keeps resolving that version to the same copy until you choose to move forward. Malware and policy blocks apply independently: a version that is later blocked stops being served rather than being replaced with a different copy.

• Affected: organizations using Chainguard Libraries with upstream fallback, across JavaScript, Python, and Java. Organizations without upstream fallback see no change.
• Action: none required. To keep the current behavior, run chainctl libraries cache opt-out. Both opt-out and chainctl libraries cache opt-in accept --ecosystem, and pinning state is tracked per organization and ecosystem. To see which copy each held version came from, run chainctl libraries cache list.

For more information, refer to chainctl libraries cache.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 17 new container images this week, including both standard and FIPS variants.

Week of 2026-08-10

Chainguard Libraries available through AWS Security Hub Extended

Launched August 4, 2026.

AWS added a Supply Chain category to Security Hub Extended and named Chainguard one of its inaugural partners. You can now subscribe to Chainguard Libraries from the Security Hub console and pay through your existing AWS account. Libraries findings arrive normalized to the Open Cybersecurity Schema Framework (OCSF), so they appear alongside your AWS and other partner findings, and AWS Enterprise Support customers receive Level 1 support from AWS.

For more information about the catalog, refer to the Chainguard Libraries overview.

Malware avoidance in the Console (beta)

Launched August 4, 2026.

The Console now shows which malicious and suspicious packages Chainguard Libraries blocked before they reached your environment. A weekly chart tracks the malware and greyware stopped across the Python and JavaScript ecosystems, and a search tool reports why any given package was flagged unsafe. Find it under the Malware tab in the Libraries section of the Console sidebar; it is enabled by default for every organization entitled to Libraries.

For more information, refer to View malware information.

PKCE support for custom identity providers

Launched August 3, 2026.

Chainguard now supports Proof Key for Code Exchange (PKCE) on the OAuth token exchange with custom OIDC identity providers, in line with OAuth 2.1. Administrators can enable it with chainctl or the Chainguard API, either alongside an existing client secret or as a secret-free public client.

For more information, including setup steps, refer to Enable PKCE for OAuth Token Exchange.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 23 new container images this week, including both standard and FIPS variants.

Week of 2026-08-03

ingress-nginx-controller entrypoint, command, and default user changes

Effective July 15, 2026.

Chainguard aligned the entrypoint and command behavior of all supported ingress-nginx-controller images with the upstream image, correcting a startup configuration defect present since the image was first published in 2024. Non-iamguarded variants also changed their default runtime user from root (UID 0) to www-data (UID 101).

• Affected: all supported ingress-nginx-controller images, including FIPS and -iamguarded variants.
• Action: review any configuration that overrides command, args, entrypoint, or runAsUser, or that depends on admission policies or file ownership assumptions. Deployments using the upstream Helm chart defaults need no changes.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 18 new container images this week, including both standard and FIPS variants.

Week of 2026-07-28

SUSE NeuVector now natively supports Chainguard Containers

Launched July 24, 2026.

SUSE’s NeuVector vulnerability scanner now natively supports Chainguard Containers and ingests Chainguard’s OSV advisory feed, which includes recent data-quality improvements. Scans of Chainguard images suppress false positives and report more accurate results.

Group-based role mapping is now generally available

Launched July 22, 2026.

Administrators can map identity provider groups — Okta or Microsoft Entra ID, for example — directly to Chainguard roles, instead of assigning roles one user at a time. Anyone who authenticates with a mapped group in their token receives that role for the session.

For more information, including setup steps, refer to Grant Chainguard roles from identity provider groups.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 15 new container images this week, including both standard and FIPS variants.