https://cybertoolchain.io/tools/chainguard New releases and features in Chainguard, tracked by The Cyber Toolchain. en Wed, 04 Nov 2026 08:02:27 GMT https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Wed, 04 Nov 2026 08:02:27 GMT API surface changed: +5 endpoints, 12 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /argos/v1/partners/{partnerId}/mitigations/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /argos/v1/partners/{partnerId}/mitigations • New endpoint GET /argos/v1/partners/{partnerId}/mitigations/{id} • New endpoint POST /argos/v1/partners/{partnerId}/mitigations • New endpoint PUT /argos/v1/partners/{partnerId}/mitigations/{id} • GET /argos/v1/documents: param cgpId (query) added; param includeFindingCounts (query) added • GET /argos/v1/orgs/{parent}/vulns: param ecosystem (query) added; param hasChainguardFix (query) added; param packageName (query) added • GET /sts/exchange: param refreshTokenRotation (query) added • POST /sts/exchange: param refreshTokenRotation (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-11-02 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-11-02 Mon, 02 Nov 2026 00:00:00 GMT Chainguard adds a hardened GitLab Enterprise Edition Commercial Build and 63 new container images, including FIPS variants⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Thu, 29 Oct 2026 07:55:10 GMT Chainguard: Chainguard now offers Rancher 2.11 images, including rancher:2.11 and rancher-agent:2.11, among others.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Chainguard now offers a suite of Sentry images: `sentry`, `sentry-launchpad`, `sentry-relay`, `sentry-taskbroker`, `sentry-uptime-checker`, and `sentry-vroom`. • Chainguard now offers `apache-pulsar:4.0` as a hardened container image. • Chainguard now offers `gitleaks` as a hardened container image. • Chainguard now offers `vllm-omni` as a hardened container image. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-26 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-26 Mon, 26 Oct 2026 00:00:00 GMT Chainguard adds 47 new container images this week, including GitLab EE, Sentry suite, vllm-omni, and gitleaks — many with FIPS variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new images across tiers: at the commercial tier, 5 commercial GitLab EE images (`commercial-gitlab-geo-logcursor-ee`, `commercial-gitlab-sidekiq-ee`, `commercial-gitlab-toolbox-ee`, `commercial-gitlab-webservice-ee`, `commercial-gitlab-workhorse-ee`) with FIPS variants; at the application tier, 6 Sentry images (`sentry`, `sentry-launchpad`, `sentry-relay`, `sentry-taskbroker`, `sentry-uptime-checker`, `sentry-vroom`) with FIPS variants, plus `gitleaks`, `automq`, `gke-deploy`, `aws-elasticache-controller`, `aws-sns-controller`, `kubernetes-csi-driver-smb`, `mpi-operator`, `snuba`, `sloth`, and `symbolicator`, each with a FIPS variant, and `node-red`, `supabase-storage-api`, and `supabase-studio` without FIPS variants; and at the ai tier, `vllm-omni` with a FIPS variant.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Sun, 25 Oct 2026 08:00:25 GMT API surface changed: +6 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /argos/v1/partners/{partnerId}/capabilities⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /argos/v1/mitigation-methods • New endpoint GET /argos/v1/partners/{partnerId}/capabilities • New endpoint GET /iam/v2/authPolicies/{authPolicy.uid} • New endpoint PATCH /iam/v2/authPolicies/{authPolicy.uid} • New endpoint PUT /argos/v1/partners/{partnerId}/capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Thu, 22 Oct 2026 07:59:49 GMT API surface changed: +1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /iam/v1/scimGroups⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • POST /libraries/v1/entitlements/{id}: param cooldownDays (query) removed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Wed, 21 Oct 2026 07:52:12 GMT Chainguard: Adds Chainguard Harness (Beta), an AI-powered runtime vulnerability finder that surfaces only exploitable findings reproducible in a running application. • Promotes Chainguard Actions to general availability, now covering more than 1,000 hardened GitHub Actions replacements with transitive dependency hardening/pinning, a `Hardening.md` vulnerability report per action, self-serve requests with a one-business-day SLA, and automated migration via the Chainguard App. • Promotes the Chainguard Compliance Dashboard to general availability in the Chainguard Console, showing OpenSCAP results against the DISA GPOS SRG, FIPS 140-3 validation details, and downloadable XCCDF reports per architecture for FedRAMP audit packages. • Adds Guardener (Early Access), an AI-native adoption agent that continuously scans Dockerfiles, Helm charts, and Kubernetes manifests and opens automated YAML-configured pull requests to migrate images to hardened equivalents. Breaking changes: • After December 15, 2026, Chainguard will sign new artifacts with Sigstore v3 only; any tooling still running Cosign v2 or v3.1.0 and earlier will be unable to verify those artifacts. Upgrade to `cosign v3.1.1` or later before that date. • Custom verification tooling built against the Cosign v2 libraries must be reviewed and updated against the v3 library API, which changed in Cosign v3. • Registries used to mirror Chainguard artifacts must support the OCI 1.1 Referrers API; registries that do not support it may fail to copy v3 signatures alongside mirrored artifacts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-19 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-19 Mon, 19 Oct 2026 00:00:00 GMT Chainguard adds Custom Assembly Overlays, Libraries for .NET and Go, AI-powered Harness, hardened CI Checks, and agent Workspaces in beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `image_overlay` Terraform resource to manage Custom Assembly Overlays and bindings for per-tag image customizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds version templates (e.g., `py{{major}}.{{minor}}-cryptography`) in Custom Assembly Overlays so each tag resolves package names to its own version automatically. • Introduces Custom Assembly Overlays (Early Access) to apply packages, environment variables, annotations, certificates, and user accounts to specific image tags, variants, or entire organizations via `chainctl` or Terraform — without affecting unrelated versions. • Introduces Chainguard Libraries for .NET (Beta), replacing public NuGet feeds with a secure Chainguard endpoint that applies automated malware and greyware scanning plus customizable organization policies for C#, F#, and Visual Basic dependencies. • Introduces Chainguard Harness (Beta), an AI-powered engine that finds exploitable runtime vulnerabilities — including logic flaws, injection, and resource exhaustion — and returns engineer-reviewed fixes without requiring customer access to frontier models. • Introduces Chainguard Checks (Beta), replacing standard CI runners with hardened microVMs that secure credentials and enforce egress policies by default, usable before code submission so pull requests pass on the first try. • Introduces Chainguard Workspaces (Beta), giving each AI coding agent an isolated, hardened microVM with no access to developer credentials, preventing prompt injection and credential exposure from agents running on developer machines. • Adds 45 new container images this week, including `crossplane-function-kcl`, `crossplane-gcp-bigquery`, `crossplane-gcp-cloudfunctions`, `crossplane-gcp-cloudrun`, `crossplane-gcp-cloudscheduler`, `crossplane-gcp-datastream`, `crossplane-gcp-secretmanager`, `crossplane-azuread`, `crossplane-provider-nop`, multiple `openstack-*` variants, `logstash-fips`, `mountpoint-s3-csi-driver-fips`, `opentelemetry-dotnet-instrumentation`, `commercial-nginx-ingress-plus-fips`, `openscap-fips`, `nemo-gym`, `nemo-skills`, and others — many with FIPS variants. Breaking changes: • After December 15, 2026, Chainguard will sign artifacts with Sigstore v3 format only; Cosign v2 or v3.1.0 and earlier cannot verify artifacts published after that date — upgrade to Cosign v3.1.1 or later before that deadline. • Custom verification tooling built against the Cosign v2 libraries will break because the Cosign library API changed in v3 — review and update against the v3 libraries. • Registries that do not support the OCI 1.1 Referrers API may fail to copy Sigstore v3 signatures when mirroring Chainguard artifacts after December 15, 2026 — confirm registry support before the cutover. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Thu, 15 Oct 2026 07:58:40 GMT API surface changed: 15 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /registry/v1/entitlements/{parent}/catalog-images: param includeDeleted (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /registry/v1/entitlements/{parent}/images: param includeDeleted (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-12 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-12 Mon, 12 Oct 2026 00:00:00 GMT Chainguard Actions and Compliance Dashboard hit GA; Guardener AI migration agent launches in Early Access with 17 new images added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Launches Chainguard Actions (GA) with 1,000+ continuously hardened, drop-in replacements for GitHub Actions, including pinning of transitive action dependencies and a `Hardening.md` report per action listing removed vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds self-serve action requests via Chainguard Actions with a one-business-day SLA and automated migration through the Chainguard App or migration skill. • Launches the Chainguard Compliance Dashboard (GA) in the Chainguard Console, providing a centralized view of container compliance, vulnerability posture, and audit-ready reporting with continuously logged image attestations and real-time CVE status. • Surfaces OpenSCAP scan results against the DISA General Purpose Operating System (GPOS) SRG and FIPS 140-3 validation details on every FIPS image in the Chainguard Console. • Adds per-architecture downloadable XCCDF reports on FIPS images in the Chainguard Console for inclusion as supporting evidence in FedRAMP and other audit packages. • Launches Guardener (Early Access), Chainguard's AI-native adoption agent, providing continuous repository scanning across Dockerfiles, Helm charts, and Kubernetes manifests with automated pull requests configured in YAML for image swaps. • Adds 17 new container images this week, including `aws-sqs-controller`, `zeek`, `istioctl`, `llm-d-router-coordinator`, `llm-d-router-disagg-sidecar`, `llm-d-router-endpoint-picker`, `openstack-keystone-oshelm-fips`, `verdaccio`, `whereabouts-fips`, `openstack-barbican-oshelm`, and `openstack-manila-oshelm`, most available in standard and FIPS variants. Breaking changes: • The `spark:3.5` container image has passed its grace period and is no longer available as of 2026-10-12. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Mon, 05 Oct 2026 07:56:51 GMT Breaking changes: • SHA-1 is not an approved algorithm in the OpenSSL v3.6 FIPS module — workloads using SHA-1 will break if you opt FIPS container images in to the v3.6 module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-05 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-10-05 Mon, 05 Oct 2026 00:00:00 GMT Athena coalition publishes first 14 silent Java CVE disclosures; Chainguard ships 37 new container images including crossplane-azure and openstack variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds advisories for 14 silent Java vulnerabilities (1 critical, 1 high, 8 medium, 4 low) to the Chainguard Libraries VEX feed, so scanners integrating with Chainguard Libraries now surface these previously uncategorized bugs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Provides remediated artifact versions in Chainguard Repository with a `-0.cgr.N` suffix for Chainguard Libraries customers, adoptable by updating a lockfile entry. • Adds 8 new `crossplane-azure-*` and `crossplane-aws-*` container images (including FIPS variants): `crossplane-azure-compute`, `crossplane-azure-containerservice`, `crossplane-azure-eventhub`, `crossplane-azure-network`, `crossplane-azure-operationalinsights`, `crossplane-aws-s3vectors`, `crossplane-azure-cognitiveservices`, and `crossplane-function-extra-resources`. • Adds 10 new `openstack-*` container images: `openstack-ceph-config-helper`, `openstack-cinder-oshelm`, `openstack-client-oshelm`, `openstack-glance-oshelm`, `openstack-keystone-oshelm`, `openstack-neutron-oshelm`, `openstack-nova-oshelm`, `openstack-octavia-oshelm`, `openstack-placement-oshelm`, and `openstack-libvirt-oshelm`. • Adds new images `longhorn-engine-fips`, `ray-fips`, `elasticsearch-iamguarded-fips` as FIPS-tier container images. • Adds `nemo-rl` (AI tier), `kserve-llmisvc-controller` (AI + FIPS), and `aws-lambda-provided` (application + FIPS) container images. • Adds `commercial-kyverno-cli` and `commercial-kyverno-readiness-checker` to the commercial image tier. • Adds `playwright-chromium`, `pmm-server`, `datadog-serverless-init`, `floci`, and `livekit-sip` container images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Sun, 04 Oct 2026 07:50:19 GMT Chainguard FIPS Provider for OpenSSL v3.6 achieves FIPS 140-3 validation with post-quantum ML-KEM, ML-DSA, and SLH-DSA; Go and .NET Libraries enter invite-only beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports hybrid post-quantum key exchange for TLS pairing classical key exchange with ML-KEM as an approved FIPS service under the newly FIPS 140-3-validated Chainguard FIPS Provider for OpenSSL v3.6 (Certificate #5523).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Includes standardized post-quantum algorithms ML-KEM, ML-DSA, and SLH-DSA alongside classical FIPS algorithms AES, SHA-2, SHA-3, ECDSA, and RSA in the validated module. • Chainguard FIPS container images can opt in to the v3.6 module starting October 1, 2026; note that SHA-1 is not an approved algorithm in v3.6. • Extends Chainguard Libraries to Go and .NET ecosystems through an invite-only beta, letting accepted organizations pull Go and .NET packages and evaluate them in existing development workflows. • Adds 19 new container images this week, including both standard and FIPS variants, among them `mcp-grafana-fips`, `kubernetes-pause-fips`, `chainguard-server-hypervisor-gcp`, `argocd-agent`, `victoriatraces`, `vault-secrets-webhook`, `ray`, `foundry`, `conftest`, `kured`, `keepalived`, `nix`, and `kates`. • Adds guides for managing tag-based Custom Assembly with the Chainguard Terraform provider and with `chainctl`, covering overlays and binding them to specific tags of a Custom Assembly repository. Breaking changes: • SHA-1 is not an approved algorithm in the v3.6 FIPS module; workloads using SHA-1 will break if they opt in to the OpenSSL v3.6 module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Sat, 03 Oct 2026 13:03:56 GMT API surface changed: +1 endpoint, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /vulnerabilities/v1/advisory_events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /sts/exchange: param delegated (query) added; param task (query) added • POST /sts/exchange: param delegated (query) added; param task (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Tue, 29 Sep 2026 14:33:07 GMT API surface changed: +1 endpoint, 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /vulnerabilities/v1/advisory_events/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /vulnerabilities/v1/advisories: param createdBeforeTime (query) added; param createdSinceTime (query) added; param eventCreatedBeforeTime (query) added; param eventCreatedSinceTime (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-28 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-28 Mon, 28 Sep 2026 00:00:00 GMT Chainguard gains FIPS 140-3 validation with post-quantum algorithms, Libraries beta for Go and .NET, and 19 new container images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds FIPS 140-3 validated Chainguard FIPS Provider for OpenSSL v3.6 (Certificate #5523), including hybrid post-quantum TLS key exchange via ML-KEM paired with classical algorithms, plus standalone ML-KEM, ML-DSA, and SLH-DSA support alongside AES, SHA-2, SHA-3, ECDSA, and RSA; opt-in available for Chainguard FIPS container images starting October 1, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Launches Chainguard Libraries for Go and .NET ecosystems in an invite-only beta, letting accepted organizations pull Go and .NET packages from Chainguard Libraries into existing development workflows. • Adds 19 new container images this week, including `chainguard-server-hypervisor-gcp`, `kured` (+fips), `conftest` (+fips), `foundry`, `keepalived` (+fips), `mcp-grafana-fips`, `nix`, `ray`, `vault-secrets-webhook` (+fips), `argocd-agent`, `kates` (+fips), `kubernetes-pause-fips`, and `victoriatraces` (+fips). Breaking changes: • SHA-1 is not an approved algorithm in the OpenSSL v3.6 FIPS module — workloads relying on SHA-1 will break if they opt in to the v3.6 module on or after October 1, 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Sat, 26 Sep 2026 07:48:54 GMT Chainguard adds EU Sovereign Artifacts beta, Guardener now covers GitHub Actions, and 26+ new container images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Guardener automated migration tool now covers GitHub Actions in addition to container images, inventorying Actions across an organization's repositories, mapping them to hardened Chainguard equivalents, and opening pull requests pinned to a specific SHA rather than a mutable tag. • Guardener runs in two modes: an upfront pass that surfaces existing Actions usage and opens migration pull requests, and ongoing standardization that watches workflow files and suggests Chainguard equivalents as new upstream Actions appear. • Adds tutorial for pulling packages from Chainguard package repositories through Sonatype Nexus as pull-through caches for apk packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Fri, 25 Sep 2026 07:52:00 GMT Chainguard adds EU data-residency beta for Containers and Libraries, plus 26+ new container images including FIPS variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Launches Sovereign Artifacts beta for enrolled customers, storing Chainguard Containers and Libraries artifact bytes in an EU region with automatic backfill of existing artifacts and ~30% faster pulls from Europe.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `openjdk:26` container image (released 2026-09-17, EOL 2027-03-17). • Adds `ceph:19` container image (released 2026-09-19, EOL 2027-03-19). • Adds `kuma:2.12` container image (released 2026-09-09, EOL 2027-03-09). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Thu, 24 Sep 2026 07:52:43 GMT Chainguard: Publishes tutorial for pulling packages from Chainguard package repositories through Sonatype Nexus raw repositories as pull-through caches for `apk` packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Wed, 23 Sep 2026 07:44:07 GMT Chainguard launches Sovereign Artifacts beta for EU data residency, storing container and library artifacts in-region for ~30% faster pulls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `openjdk:26` and `ceph:19` container images. • Adds 26 new container images this week, including `clamav-prometheus-exporter`, `crossplane-azure-marketplaceordering`, `kserve-sklearnserver`, `commercial-spilo-fips`, `graphql-hive-gateway`, `jupyterhub-k8s-singleuser-sample`, `nuxeo-2025`, `chainguard-server-hypervisor-aws`, `mongodb-kubernetes`, `opentelemetry-python-instrumentation-fips`, `strimzi-kafka-fips`, `crossplane-aws-emrcontainers`, `kro`, `pyrra`, `starboard-exporter`, `krakend`, `mongodb-search`, and FIPS variants. • Adds `cursor-agent`, `chainguard-desktop-workstation-pc`, `commercial-avocado`, `rustfs`, `cloudzero-agent`, `trivy-k8s-wrapper`, `access-log-exporter`, `datahub-gms`, `kates-connect`, `kubeflow-trainer-controller-manager`, and `tracee` container images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Tue, 22 Sep 2026 13:00:06 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Mon, 21 Sep 2026 14:37:42 GMT API surface changed: 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /registry/v1/eoltags: param excludeVcsSnapshots (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /registry/v1/repotagssummary/{repoId}: param excludeVcsSnapshots (query) added • GET /registry/v1/tags: param excludeVcsSnapshots (query) added • GET /registry/v2/tags: param includeVcsSnapshots (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-21 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-21 Mon, 21 Sep 2026 00:00:00 GMT Chainguard adds EU Sovereign Artifacts beta for data residency and ships 18 new container images including FIPS variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Launches Sovereign Artifacts beta, storing and serving Chainguard Containers and Chainguard Libraries artifact bytes in an EU region for enrolled customers, with automatic backfill of existing artifacts and approximately 30% faster pulls from Europe.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new `cursor-agent` (application tier) container image. • Adds new `chainguard-desktop-workstation-pc` (base tier) container image. • Adds new `commercial-avocado` (commercial tier) container image. • Adds new `rustfs` (application tier) container image. • Adds new `cloudzero-agent` (application + FIPS tier) container image. • Adds new `trivy-k8s-wrapper` (application + FIPS tier) container image. • Adds new `access-log-exporter` (application + FIPS tier) container image. • Adds new `datahub-gms` (application + FIPS tier) container image. • Adds new `kates-connect` (application + FIPS tier) container image. • Adds new `kubeflow-trainer-controller-manager` (application + FIPS tier) container image. • Adds new `tracee` (application + FIPS tier) container image. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Mon, 14 Sep 2026 14:40:26 GMT Chainguard: New endpoint GET /argos/v1/vex/dump Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-14 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-14 Mon, 14 Sep 2026 00:00:00 GMT Chainguard adds 26 new container images this week, including FIPS variants for MongoDB, Kafka, OpenTelemetry, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `clamav-prometheus-exporter` (application + FIPS) container image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `crossplane-azure-marketplaceordering` (application) container image. • Adds `kserve-sklearnserver` (ai) container image. • Adds `commercial-spilo-fips` (FIPS) container image. • Adds `graphql-hive-gateway` (application) container image. • Adds `jupyterhub-k8s-singleuser-sample` (application + FIPS) container image. • Adds `nuxeo-2025` (application) container image. • Adds `chainguard-server-hypervisor-aws` (base) container image. • Adds `mongodb-kubernetes` (application + FIPS) container image. • Adds `opentelemetry-python-instrumentation-fips` (FIPS) container image. • Adds `strimzi-kafka-fips` (FIPS) container image. • Adds `crossplane-aws-emrcontainers` (application + FIPS) container image. • Adds `kro` (application + FIPS) container image. • Adds `pyrra` (application + FIPS) container image. • Adds `starboard-exporter` (application + FIPS) container image. • Adds `krakend` (application + FIPS) container image. • Adds `mongodb-search` (application + FIPS) container image. Breaking changes: • Effective 2026-10-12: the `sonar-scanner-cli` image default user changes from root (UID 0) to nonroot (UID 65532); the scanner scratch directory moves from `<project>/.scannerwork` to `/tmp/.scannerwork`, breaking pipelines that read `report-task.txt` from the old location and derived images that write to system paths as root. To restore previous behavior, run with `--user 0` (Docker), `USER root` (Dockerfile), or `runAsUser: 0` (Kubernetes), or set `-Dsonar.working.directory=<project>/.scannerwork` and ensure the workspace is writable by the container user. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Sun, 13 Sep 2026 14:49:12 GMT API surface changed: +3 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /argos/v1/vex/documents/{ecosystem}/{package}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig:download • GET /policies/v1/decisions: param artifactId (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Sun, 13 Sep 2026 07:42:46 GMT Chainguard adds Go 1.27 images including a new `go-openssl-fips` container and JFrog Catalog integration for Chainguard Libraries⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `go-openssl-fips` container image that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single artifact to satisfy both OpenSSL FIPS and Go Cryptographic Module requirements without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Ships Go 1.27 across three Chainguard container images: `go`, `go-fips`, and `go-openssl-fips`. • Integrates Chainguard Libraries with JFrog Catalog, allowing joint customers to pull Chainguard-built packages through JFrog and enabling JFrog Zero-Touch Remediation to substitute patched Chainguard packages without changing developer workflows; Java support ships now, with JavaScript and Python to follow by end of September 2026. • Adds 39 new container images including 10 `kubeflow-pipelines-*` FIPS variants (`kubeflow-pipelines-api-server-fips`, `kubeflow-pipelines-cache-deployer-fips`, `kubeflow-pipelines-cache-server-fips`, `kubeflow-pipelines-driver-fips`, `kubeflow-pipelines-frontend-fips`, `kubeflow-pipelines-metadata-envoy-fips`, `kubeflow-pipelines-metadata-writer-fips`, `kubeflow-pipelines-persistenceagent-fips`, `kubeflow-pipelines-scheduledworkflow-fips`, `kubeflow-pipelines-viewer-crd-controller-fips`) plus `dbmate`, `hadolint`, `jruby`, `gubernator`, `fortiotel`, `packer`, `security-profiles-operator`, `opentelemetry-go-instrumentation`, `redpanda-console-fips`, and others. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Sat, 12 Sep 2026 13:30:19 GMT Chainguard: New endpoint GET /argos/v1/vex/documents/{ecosystem}/{package}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Sat, 12 Sep 2026 07:43:23 GMT Chainguard: Adds `go-openssl-fips` container image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single build artifact to run across environments without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Ships 39 new container images this week, including 10 `kubeflow-pipelines-*` FIPS variants and new images for `dbmate`, `hadolint`, `jruby`, `kserve-huggingfaceserver`, `gubernator`, `packer`, `security-profiles-operator`, `aws-lambda-dotnet`, `opentelemetry-go-instrumentation`, `presidio-anonymizer`, `redpanda-console-fips`, and others. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Fri, 11 Sep 2026 14:47:43 GMT Chainguard: New endpoint GET /argos/v1/vex/documents/{ecosystem}/{package}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /argos/v1/vex/dump Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Fri, 11 Sep 2026 07:38:55 GMT Chainguard Libraries now work in JFrog Catalog with Xray and Curation policy support. Java is available now; JavaScript and Python support is planned for September 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Thu, 10 Sep 2026 14:48:02 GMT API surface changed: +1 endpoint, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig:download⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /policies/v1/decisions: param artifactId (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Thu, 10 Sep 2026 07:41:00 GMT Chainguard adds Go 1.27 images with runtime FIPS module selection and Chainguard Libraries support in JFrog Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `go-openssl-fips` container image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment rather than at build time, enabling a single artifact to run with either the OpenSSL FIPS provider or the Go Cryptographic Module without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Go 1.27 support across the `go`, `go-fips`, and `go-openssl-fips` Chainguard container images. • Integrates Chainguard Libraries with JFrog Catalog so joint customers can pull Chainguard-built packages through JFrog Artifact Repository without build errors, enabling JFrog Zero-Touch Remediation with patched Chainguard packages; Java support is live, JavaScript and Python to follow by end of September 2026. • Adds 39 new container images including 10 FIPS variants of `kubeflow-pipelines-*` components, plus `dbmate`, `hadolint`, `jruby`, `kserve-huggingfaceserver`, `gubernator`, `fortiotel`, `packer`, `security-profiles-operator`, `aws-lambda-dotnet`, `opentelemetry-go-instrumentation`, `presidio-anonymizer`, `redpanda-console-fips`, and others. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Wed, 09 Sep 2026 14:52:34 GMT Chainguard: Adds Go 1.27 support across three Chainguard container images: `go`, `go-fips`, and `go-openssl-fips`. • Integrates Chainguard Libraries with JFrog Catalog, allowing joint customers to pull Chainguard-built packages through JFrog and enabling JFrog Zero-Touch Remediation with Chainguard packages; Java support ships now, with JavaScript and Python scheduled by end of September 2026. • Adds 39 new container images including `kubeflow-pipelines-api-server-fips`, `kubeflow-pipelines-cache-deployer-fips`, `kubeflow-pipelines-cache-server-fips`, `kubeflow-pipelines-driver-fips`, `kubeflow-pipelines-frontend-fips`, `kubeflow-pipelines-metadata-envoy-fips`, `kubeflow-pipelines-metadata-writer-fips`, `kubeflow-pipelines-persistenceagent-fips`, `kubeflow-pipelines-scheduledworkflow-fips`, `kubeflow-pipelines-viewer-crd-controller-fips`, `dbmate`, `hadolint`, `jruby`, `kserve-huggingfaceserver`, `gubernator`, `fortiotel`, `packer`, `security-profiles-operator`, `aws-lambda-dotnet`, `opentelemetry-go-instrumentation`, `prom-label-proxy`, `kserve-sklearnserver-fips`, `presidio-anonymizer`, and `redpanda-console-fips`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Mon, 07 Sep 2026 13:49:33 GMT API surface changed: +2 endpoints, 4 modified • New endpoint GET /iam/v1/scimUsers • New endpoint POST /vulnerabilities/v2/vulnCountReports:list • GET /iam/v2/roles/{uid}: response schema changed • GET /libraries/v1/artifacts: response schema changed • PATCH /iam/v2/roles/{uid}: request body changed; response schema changed • POST /iam/v2/roles/{uid}: request body changed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-07 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-09-07 Mon, 07 Sep 2026 00:00:00 GMT Chainguard ships Go 1.27 with runtime FIPS module selection, JFrog Catalog integration for Libraries, and 39 new container images including kubeflow-pipelines FIPS variants. • Adds `go-openssl-fips` image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single artifact to satisfy both OpenSSL FIPS provider and Go Cryptographic Module requirements without recompilation — with CNSA 2.0 readiness. • Adds `go` and `go-fips` images updated to Go 1.27, alongside the new `go-openssl-fips` image, with Go 1.26 and earlier continuing to be supported until end-of-life. • Adds JFrog Catalog recognition for Chainguard-built packages, allowing joint Chainguard and JFrog customers to pull Chainguard Libraries through JFrog — enabling JFrog Zero-Touch Remediation to swap in patched Chainguard packages without developer workflow changes or major version upgrades. • Adds Java support for Chainguard Libraries in JFrog Catalog at launch, with JavaScript and Python support scheduled by end of September 2026. • Adds 10 new `kubeflow-pipelines-*` FIPS container images including `kubeflow-pipelines-api-server-fips`, `kubeflow-pipelines-cache-deployer-fips`, `kubeflow-pipelines-cache-server-fips`, `kubeflow-pipelines-driver-fips`, `kubeflow-pipelines-frontend-fips`, `kubeflow-pipelines-metadata-envoy-fips`, `kubeflow-pipelines-metadata-writer-fips`, `kubeflow-pipelines-persistenceagent-fips`, `kubeflow-pipelines-scheduledworkflow-fips`, and `kubeflow-pipelines-viewer-crd-controller-fips`. • Adds new container images including `security-profiles-operator`, `jruby`, `kserve-huggingfaceserver`, `kserve-sklearnserver-fips`, `presidio-anonymizer`, `redpanda-console-fips`, `opentelemetry-go-instrumentation`, `packer`, `aws-lambda-dotnet`, and others — totalling 39 new images this week. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Fri, 04 Sep 2026 07:50:05 GMT API surface changed: +2 endpoints, 15 modified • New endpoint GET /libraries/v1/malware/blocklist/statistics • New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig • GET /iam/v2/roles/{uid}: response schema changed • GET /registry/v1/entitlements/{parent}/catalog-images: response schema changed • GET /registry/v1/entitlements/{parent}/images: response schema changed • GET /registry/v1/entitlements/{parent} response schema changed • GET /registry/v1/repos/{repoId}/digests/{digest}/chart: response schema changed • PATCH /iam/v2/roles/{uid}: request body changed; response schema changed • POST /argos/v1/documents/{id}: response schema changed • POST /iam/v2/roles/{uid}: request body changed; response schema changed • POST /policies/v1/policies/validate: request body changed • POST /policies/v1/policies/{id}: request body changed; response schema changed • POST /registry/v1/entitlements/{parent}:addImages: response schema changed • POST /registry/v1/entitlements/{parent}:removeImages: response schema changed • POST /registry/v1/entitlements/{parent}:swapImages: response schema changed • POST /registry/v1/repos/{parentId}:addChart: request body changed; response schema changed • PUT /policies/v1/policies/{id}: request body changed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Wed, 02 Sep 2026 10:38:09 GMT Chainguard adds custom container pull policies in open beta, plus build pinning for Libraries across JS, Python, and Java. • Introduces custom container pull policies (open beta): organizations can now write their own Rego-based container pull policies, submitted as YAML manifests and managed with `chainctl`, supporting parameterized declarations with per-binding values, and an `ENFORCE` mode that blocks pulls without loosening system policies. • Enables build pinning for all organizations using Chainguard Libraries with upstream fallback across JavaScript, Python, and Java — recording which copy (upstream mirror or Chainguard rebuild) was first pulled and resolving that version consistently until explicitly changed. • Adds 21 new container images this week, including `dynatrace-operator`, `netshoot`, `strimzi-drain-cleaner`, `nomad`, `redpanda-console`, `apache-polaris`, `kserve-pmmlserver`, `kserve-xgbserver`, `victorialogs-vlagent`, and FIPS variants `mlrun-api-fips` and `mlrun-fips`. • Extends active support window for Istio 1.29 images (`istio`, `istio-cni`, `istio-envoy`, `istio-operator`, `istio-pilot-agent`, `istio-pilot-discovery`, `ztunnel`) and `teleport:18` through 2027-02-28. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-31 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-31 Mon, 31 Aug 2026 00:00:00 GMT Chainguard adds custom Rego container pull policies, build pinning for Libraries, and new Windows-compatible chainctl workflows. • Adds `chainctl policies custom validate` subcommand that reports the exact line and column of a policy error before storing it, enabling CI validation of Rego policy manifests. • Introduces custom container pull policies (open beta): organizations can now write Rego expressions submitted as YAML manifests, managed via `chainctl`, supporting parameters with per-binding values and ENFORCE mode that blocks pulls. • Adds `chainctl libraries cache` command to review which package-version copies (upstream mirror or Chainguard rebuild) your organization holds, or to opt out of build pinning. • Enables build pinning for all organizations using Chainguard Libraries with upstream fallback across JavaScript, Python, and Java — recording the first-resolved copy of each package version to keep lockfiles and checksums stable. • Extends `chainctl` self-update on Windows to replace the running executable correctly and verify release attestations before installing, without requiring administrator privileges. • Adds 21 new container images including `dynatrace-operator`, `netshoot`, `strimzi-drain-cleaner`, `redpanda-console`, `apache-polaris`, `nomad`, `kserve-pmmlserver`, `kserve-xgbserver`, `victorialogs-vlagent`, `mlrun-api-fips`, `mlrun-fips`, and `kube-logging-operator-fluentd-drain-watch`, with both standard and FIPS variants where noted. Breaking changes: • The container images `kube-conformance:1.32`, `kubernetes:1.32`, `nextcloud-server:31`, `rke2-runtime:1.32`, and `teleport:17` have passed their grace periods and are no longer available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Fri, 28 Aug 2026 19:47:00 GMT API surface changed: +2 endpoints, 11 modified • New endpoint GET /registry/v1/chart-image-bindings • New endpoint GET /registry/v2/catalogImages • GET /argos/v1/documents: param updatedSince (query) added • GET /argos/v1/orgs/{parent}/vulns: param updatedSince (query) added • GET /iam/v2/roles/{uid}: response schema changed • GET /libraries/v1/artifacts: param sourceTypes (query) added • GET /libraries/v1/artifacts/{id}/versions: param sourceTypes (query) added • GET /policies/v1/overrides: response schema changed • GET /registry/v1/repos/{repoId}/chart-image-bindings: response schema changed • GET /vulnerabilities/v2/advisories/{uid}: response schema changed • PATCH /iam/v2/roles/{uid}: request body changed; response schema changed • POST /iam/v2/roles/{uid}: request body changed; response schema changed • POST /policies/v1/overrides/{id}: request body changed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/ https://edu.chainguard.dev/chainguard/changelog/ Wed, 26 Aug 2026 09:09:25 GMT • Chainguard API v2 is now generally available at `/v2/`, replacing the `v2beta1` path prefix, with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts; ships an OpenAPI specification and v2 Go SDK clients. • API v2 standardizes cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details. • Supports SCIM user provisioning (Early Access) via the `/Users` resource for Okta and Microsoft Entra ID; assigning a user creates/updates their Chainguard provisioning record, and deactivating or unassigning them blocks the next login or token refresh within approximately one hour. • Catalog customers can now provision Chainguard Helm charts directly from the Chainguard Console without filing a support ticket; the Console resolves required missing images, adds them in a single request, and provisions the chart asynchronously without EOL tags. • Adds 27 new container images this week, including FIPS variants for Airbyte components (`airbyte-bootloader`, `airbyte-cron`, `airbyte-worker`, `airbyte-workload-api-server`, `airbyte-workload-launcher`), `percona-server-mongodb-fips`, `commercial-nginx-plus-fips`, `apache-activemq-artemis-fips`, and `kubernetes-csi-external-health-monitor-fips`, among others. Breaking changes: • Existing `v2beta1` integrations must update their path prefix from `/v2beta1/` to `/v2/`; request and response shapes are preserved. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-24 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-24 Mon, 24 Aug 2026 00:00:00 GMT Chainguard adds SCIM user provisioning (Early Access), promotes API v2 to GA, and launches self-serve Helm chart provisioning. • Adds SCIM user provisioning (Early Access) for Okta and Microsoft Entra ID via the `/Users` SCIM resource — creating/updating provisioning records on assignment and blocking login within ~1 hour of deactivation or token expiry. • Promotes Chainguard API v2 to general availability at `/v2/`, with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts; existing `v2beta1` integrations need only update the path prefix. • Adds cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details to the stable API v2, plus an OpenAPI specification and v2 Go SDK clients. • Enables self-serve Helm chart provisioning from the Chainguard Console for Catalog customers — resolving required images, adding them in a single request, and provisioning asynchronously without EOL tags. • Adds 27 new container images this week including `airbyte-bootloader`, `airbyte-cron`, `airbyte-worker`, `airbyte-workload-api-server`, `airbyte-workload-launcher` (all with FIPS variants), `percona-server-mongodb-fips`, `application-gateway-kubernetes-ingress`, `falcosidekick-ui`, `kubernetes-csi-external-health-monitor-fips`, `mlrun`, `mlrun-api`, `spiffe-csi-driver`, `apache-activemq-artemis-fips`, `aws-iam-controller`, `commercial-nginx-plus-fips`, `kserve-lgbserver`, and `ranger`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Thu, 20 Aug 2026 14:31:50 GMT API surface changed: +79 endpoints, −78 endpoints, 14 modified • New endpoint DELETE /events/v2/subscriptions/{uid} • New endpoint DELETE /iam/v2/accountAssociations/{uid} • New endpoint DELETE /iam/v2/externalGroupRoleMappings/{uid} • New endpoint DELETE /iam/v2/groupInvites/{uid} • New endpoint DELETE /iam/v2/groups/{uid} • New endpoint DELETE /iam/v2/identities/{uid} • New endpoint DELETE /iam/v2/identityProviders/{uid} • New endpoint DELETE /iam/v2/roleBindings/{uid} • New endpoint DELETE /iam/v2/roles/{uid} • New endpoint DELETE /registry/v2/repos/{uid} • New endpoint DELETE /registry/v2/tags/{uid} • New endpoint GET /advisory/v2/documents • New endpoint GET /advisory/v2/images/resolvedVulns • New endpoint GET /advisory/v2/metadata • New endpoint GET /events/v2/subscriptions • New endpoint GET /events/v2/subscriptions/{uid} • New endpoint GET /iam/v2/accountAssociations • New endpoint GET /iam/v2/accountAssociations/{uid} • New endpoint GET /iam/v2/externalGroupRoleMappings • New endpoint GET /iam/v2/externalGroupRoleMappings/{uid} • New endpoint GET /iam/v2/groupInvites • New endpoint GET /iam/v2/groupInvites/{uid} • New endpoint GET /iam/v2/groups • New endpoint GET /iam/v2/groups/{uid} • New endpoint GET /iam/v2/groups:checkEligibility • New endpoint GET /iam/v2/groups:lookupGroup • New endpoint GET /iam/v2/identities • New endpoint GET /iam/v2/identities/{uid} • New endpoint GET /iam/v2/identities:lookupIdentity • New endpoint GET /iam/v2/identityProviders • New endpoint GET /iam/v2/identityProviders/{uid} • New endpoint GET /iam/v2/roleBindings • New endpoint GET /iam/v2/roleBindings/{uid} • New endpoint GET /iam/v2/roles • New endpoint GET /iam/v2/roles/{uid} • New endpoint GET /iam/v2/terms/{group} • New endpoint GET /libraries/v2/artifacts • New endpoint GET /libraries/v2/artifacts/count • New endpoint GET /libraries/v2/artifacts/{artifactId}/versions • New endpoint GET /ping/v2/ping • New endpoint GET /registry/v1/repotagssummary/{repoId} • New endpoint GET /registry/v2/repos • New endpoint GET /registry/v2/repos/{repoReadme.uid}/readme • New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/architectures • New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/size • New endpoint GET /registry/v2/repos/{uid} • New endpoint GET /registry/v2/tags • New endpoint GET /registry/v2/tags/{uid} • New endpoint GET /vulnerabilities/v2/advisories • New endpoint GET /vulnerabilities/v2/advisories/{uid} • New endpoint PATCH /iam/v2/accountAssociations/{uid} • New endpoint PATCH /iam/v2/groups/{uid} • New endpoint PATCH /iam/v2/identities/{uid} • New endpoint PATCH /iam/v2/identities:updateIdentityMetadata • New endpoint PATCH /iam/v2/identityProviders/{uid} • New endpoint PATCH /iam/v2/roleBindings/{uid} • New endpoint PATCH /iam/v2/roles/{uid} • New endpoint PATCH /registry/v2/repos/{repoReadme.uid}/readme • New endpoint PATCH /registry/v2/repos/{uid} • New endpoint POST /events/v2/subscriptions/{uid} • New endpoint POST /iam/v2/accountAssociations/{uid} • New endpoint POST /iam/v2/accountAssociations/{uid}:checkAccountAssociation • New endpoint POST /iam/v2/externalGroupRoleMappings/{uid} • New endpoint POST /iam/v2/externalGroupRoleMappings:batchDelete • New endpoint POST /iam/v2/groupInvites/{uid} • New endpoint POST /iam/v2/groups/{groupUid}:requestGroupAccess • New endpoint POST /iam/v2/groups/{uid} • New endpoint POST /iam/v2/identities/{uid} • New endpoint POST /iam/v2/identityProviders/{identityProviderUid}:generateScimToken • New endpoint POST /iam/v2/identityProviders/{identityProviderUid}:regenerateScimToken • New endpoint POST /iam/v2/identityProviders/{identityProviderUid}:revokeScimToken • New endpoint POST /iam/v2/identityProviders/{identityProviderUid}:setScimEnabled • New endpoint POST /iam/v2/identityProviders/{uid} • New endpoint POST /iam/v2/roleBindings/{uid} • New endpoint POST /iam/v2/roleBindings:batchCreate • New endpoint POST /iam/v2/roles/{uid} • New endpoint POST /iam/v2/terms/{group} • New endpoint POST /registry/v2/repos/{uid} • New endpoint POST /registry/v2/tags/{uid} • GET /iam/v1/identityProviders: response schema changed • GET /libraries/v1/artifacts/count: response schema changed • GET /libraries/v1/aws-marketplace-subscriptions/{id}: response schema changed • GET /libraries/v1/malware/blocklist: param deduplicateResults (query) added • GET /libraries/v1/resolutioncache/{parentId}/entries: response schema changed • GET /libraries/v1/resolutioncache/{parentId}/status: response schema changed • PATCH /libraries/v1/aws-marketplace-subscriptions/{id}: request body changed; response schema changed • POST /iam/v1/identityProviders/{id}: request body changed; response schema changed • POST /libraries/v1/aws-marketplace-subscriptions/{id}: request body changed; response schema changed • POST /libraries/v1/aws-marketplace-subscriptions/{id} response schema changed • POST /libraries/v1/entitlements/{id}: request body changed • POST /libraries/v1/resolutioncache/{parentId} response schema changed • POST /libraries/v1/resolutioncache/{parentId} response schema changed • PUT /iam/v1/identityProviders/{id}: request body changed; response schema changed Breaking changes: • Removed endpoint DELETE /events/v2beta1/subscriptions/{uid} • Removed endpoint DELETE /iam/v2beta1/accountAssociations/{uid} • Removed endpoint DELETE /iam/v2beta1/externalGroupRoleMappings/{uid} • Removed endpoint DELETE /iam/v2beta1/groupInvites/{uid} • Removed endpoint DELETE /iam/v2beta1/groups/{uid} • Removed endpoint DELETE /iam/v2beta1/identities/{uid} • Removed endpoint DELETE /iam/v2beta1/identityProviders/{uid} • Removed endpoint DELETE /iam/v2beta1/roleBindings/{uid} • Removed endpoint DELETE /iam/v2beta1/roles/{uid} • Removed endpoint DELETE /registry/v2beta1/repos/{uid} • Removed endpoint DELETE /registry/v2beta1/tags/{uid} • Removed endpoint GET /advisory/v2beta1/documents • Removed endpoint GET /advisory/v2beta1/images/resolvedVulns • Removed endpoint GET /advisory/v2beta1/metadata • Removed endpoint GET /events/v2beta1/subscriptions • Removed endpoint GET /events/v2beta1/subscriptions/{uid} • Removed endpoint GET /iam/v2beta1/accountAssociations • Removed endpoint GET /iam/v2beta1/accountAssociations/{uid} • Removed endpoint GET /iam/v2beta1/externalGroupRoleMappings • Removed endpoint GET /iam/v2beta1/externalGroupRoleMappings/{uid} • Removed endpoint GET /iam/v2beta1/groupInvites • Removed endpoint GET /iam/v2beta1/groupInvites/{uid} • Removed endpoint GET /iam/v2beta1/groups • Removed endpoint GET /iam/v2beta1/groups/{uid} • Removed endpoint GET /iam/v2beta1/groups:checkEligibility • Removed endpoint GET /iam/v2beta1/groups:lookupGroup • Removed endpoint GET /iam/v2beta1/identities • Removed endpoint GET /iam/v2beta1/identities/{uid} • Removed endpoint GET /iam/v2beta1/identities:lookupIdentity • Removed endpoint GET /iam/v2beta1/identityProviders • Removed endpoint GET /iam/v2beta1/identityProviders/{uid} • Removed endpoint GET /iam/v2beta1/roleBindings • Removed endpoint GET /iam/v2beta1/roleBindings/{uid} • Removed endpoint GET /iam/v2beta1/roles • Removed endpoint GET /iam/v2beta1/roles/{uid} • Removed endpoint GET /iam/v2beta1/terms/{group} • Removed endpoint GET /libraries/v2beta1/artifacts • Removed endpoint GET /libraries/v2beta1/artifacts/count • Removed endpoint GET /libraries/v2beta1/artifacts/{artifactId}/versions • Removed endpoint GET /ping/v2beta1/ping • Removed endpoint GET /registry/v2beta1/repos • Removed endpoint GET /registry/v2beta1/repos/{repoReadme.uid}/readme • Removed endpoint GET /registry/v2beta1/repos/{repoUid}/digests/{digest}/architectures • Removed endpoint GET /registry/v2beta1/repos/{repoUid}/digests/{digest}/size • Removed endpoint GET /registry/v2beta1/repos/{uid} • Removed endpoint GET /registry/v2beta1/tags • Removed endpoint GET /registry/v2beta1/tags/{uid} • Removed endpoint GET /vulnerabilities/v2beta1/advisories • Removed endpoint GET /vulnerabilities/v2beta1/advisories/{uid} • Removed endpoint PATCH /iam/v2beta1/accountAssociations/{uid} • Removed endpoint PATCH /iam/v2beta1/groups/{uid} • Removed endpoint PATCH /iam/v2beta1/identities/{uid} • Removed endpoint PATCH /iam/v2beta1/identities:updateIdentityMetadata • Removed endpoint PATCH /iam/v2beta1/identityProviders/{uid} • Removed endpoint PATCH /iam/v2beta1/roleBindings/{uid} • Removed endpoint PATCH /iam/v2beta1/roles/{uid} • Removed endpoint PATCH /registry/v2beta1/repos/{repoReadme.uid}/readme • Removed endpoint PATCH /registry/v2beta1/repos/{uid} • Removed endpoint POST /events/v2beta1/subscriptions/{uid} • Removed endpoint POST /iam/v2beta1/accountAssociations/{uid} • Removed endpoint POST /iam/v2beta1/accountAssociations/{uid}:checkAccountAssociation • Removed endpoint POST /iam/v2beta1/externalGroupRoleMappings/{uid} • Removed endpoint POST /iam/v2beta1/externalGroupRoleMappings:batchDelete • Removed endpoint POST /iam/v2beta1/groupInvites/{uid} • Removed endpoint POST /iam/v2beta1/groups/{groupUid}:requestGroupAccess • Removed endpoint POST /iam/v2beta1/groups/{uid} • Removed endpoint POST /iam/v2beta1/identities/{uid} • Removed endpoint POST /iam/v2beta1/identityProviders/{identityProviderUid}:generateScimToken • Removed endpoint POST /iam/v2beta1/identityProviders/{identityProviderUid}:regenerateScimToken • Removed endpoint POST /iam/v2beta1/identityProviders/{identityProviderUid}:revokeScimToken • Removed endpoint POST /iam/v2beta1/identityProviders/{identityProviderUid}:setScimEnabled • Removed endpoint POST /iam/v2beta1/identityProviders/{uid} • Removed endpoint POST /iam/v2beta1/roleBindings/{uid} • Removed endpoint POST /iam/v2beta1/roleBindings:batchCreate • Removed endpoint POST /iam/v2beta1/roles/{uid} • Removed endpoint POST /iam/v2beta1/terms/{group} • Removed endpoint POST /registry/v2beta1/repos/{uid} • Removed endpoint POST /registry/v2beta1/tags/{uid} Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/api.json https://edu.chainguard.dev/api.json Mon, 17 Aug 2026 10:18:29 GMT Chainguard now publishes an API — 260 endpoints across 59 areas: Registry, Registryentitlements, Identityprovidersservice, … • Registry (33 endpoints) — create, read, update, delete • Registryentitlements (11 endpoints) — Registry Entitlements API • Identityprovidersservice (9 endpoints) — create, read, update, delete • Groupsservice (8 endpoints) — create, read, update, delete • Identityproviders (8 endpoints) — create, read, update, delete • Advisories (7 endpoints) — create, read, update, delete • Groups (7 endpoints) — create, read, update, delete • Identitiesservice (7 endpoints) — create, read, update, delete • 51 more areas: Reposservice, Accountassociationsservice, Policies, Rolebindingsservice, Awsmarketplacesubscriptions, Actionsauthorization, Externalgrouprolemappings, Externalgrouprolemappingsservice, Groupaccountassociations, Iamidentities, Rolebindings, Rolesservice, Argosdocuments, Argososv, Auth, Bindings, Groupinvitesservice, Librariesresolutioncache, Librarypolicies, Librarypolicybindings, Roles, Subscriptionsservice, Tagsservice, Vulnerabilities, Artifacts, Artifactsservice, Groupinvites, Librariesentitlements, Overrides, Securityadvisory, Securityadvisoryservice, Securitytokenservice, Skillsentitlements, Subscriptions, Apk, Advisoriesservice, Apko, Argosvulns, Charts, Imagesservice, Npmpackages, Pingservice, Terms, Termsservice, Actions, Decisions, Eventidentities, Imagematcher, Librarypolicyblockevents, Malware, Packagesentitlements Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-17 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-17 Mon, 17 Aug 2026 00:00:00 GMT Chainguard adds npm 403 error codes for blocked packages, GitHub Actions migration via Guardener, and build pinning for Libraries cache. • Chainguard Libraries now returns a `403` HTTP status with a named reason code (e.g., `MALWARE_DETECTED`) when npm requests a blocked package or version, replacing the previously unexplained `404`. • Chainguard Guardener GitHub App (beta) extends automated migration to GitHub Actions: inventories Actions across org repositories, maps them to hardened Chainguard equivalents, and opens pull requests pinned to a specific SHA rather than a mutable tag. • Guardener runs in two modes: an upfront pass that surfaces existing Actions usage and opens migration PRs, and an ongoing standardization mode that watches workflow files and suggests equivalents as new upstream Actions appear. • New `chainctl libraries cache` build-pinning feature records which copy (upstream mirror or Chainguard rebuild) an org first received for a package version and keeps resolving that version to the same copy, preventing `EINTEGRITY` checksum mismatches in npm. • Adds `chainctl libraries cache opt-out` and `chainctl libraries cache opt-in` commands, both accepting `--ecosystem`, to control per-organization, per-ecosystem pinning behavior. • Adds `chainctl libraries cache list` to show which copy (upstream or Chainguard rebuild) each held version was sourced from. • Adds 17 new container images including `azurite`, `k0s-cni-node`, `peerdb-ui`, `scc`, `zitadel-login`, `aws-lambda-nodejs`, `localstack`, `kserve-router-fips`, `jdk-openssl-fips`, `jre-openssl-fips`, `kube-router`, and `commercial-nginx-ingress-plus`, with FIPS variants available for several. Breaking changes: • As of August 24, 2026, Chainguard Libraries build pinning is enabled by default for organizations using Chainguard Libraries with upstream fallback (JavaScript, Python, and Java ecosystems): the first copy of a package version an org downloads is locked in, and subsequent resolutions will no longer silently switch between the upstream mirror and a Chainguard rebuild. To preserve the previous behavior (no pinning), run `chainctl libraries cache opt-out`. Organizations without upstream fallback are unaffected. • The `prometheus:3.9` container image is no longer available as of 2026-08-17 (grace period ended). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-10 https://edu.chainguard.dev/chainguard/changelog/#week-of-2026-08-10 Mon, 10 Aug 2026 00:00:00 GMT Chainguard adds AWS Security Hub Extended integration, console malware visibility, PKCE for custom IdPs, and 23 new container images. • Adds Chainguard Libraries distribution through AWS Security Hub Extended, with findings normalized to the Open Cybersecurity Schema Framework (OCSF) and AWS Enterprise Support (Level 1) for eligible customers; subscribe and pay via existing AWS account from the Security Hub console. • New `Malware` tab in the Libraries section of the Console (beta) shows malicious and suspicious packages blocked before reaching your environment, with a weekly chart covering Python and JavaScript ecosystems and a per-package search explaining why a package was flagged; enabled by default for all Libraries-entitled organizations. • Adds Proof Key for Code Exchange (PKCE) support for the OAuth token exchange with custom OIDC identity providers (aligned with OAuth 2.1), configurable via `chainctl` or the Chainguard API, usable alongside an existing client secret or as a secret-free public client. • Adds 23 new container images including `prometheus-stackdriver-exporter` (+FIPS), `crossplane-azure-keyvault`, `crossplane-azure-kusto`, `influxdb-fips`, `moodle-iamguarded`, `pypiserver-fips`, `kubevirt-cdi-cloner` (+FIPS), `yopass`, `acm-controller` (+FIPS), `gremlin-server`, `rollouts-plugin-trafficrouter-gatewayapi` (+FIPS), `claude`, `codex`, `cruise-control` (+FIPS), `dotstatsuite-supercore`, `opencode`, and `zalando-pgbouncer` (+FIPS). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainguard