# Chainguard products changelog URL: https://chainguard-docs-preview-git-athena-mention.chainguard.app/chainguard/changelog.md Last Modified: October 5, 2026 Tags: Chainguard Containers, Changelog Weekly changelog of Chainguard product updates — product announcements, breaking changes, container images reaching end-of-life or leaving the catalog, and images newly added to it. This page logs Chainguard product updates week by week, newest first: product announcements, breaking changes, container images that reached end-of-life or are no longer available, and images newly added to the catalog. Each event is listed once, in the week it first appeared. Breaking changes and product announcements cover the entire Chainguard portfolio, while end-of-life, availability, and new-image entries relate specifically to Chainguard Containers. This page summarizes the changes most likely to affect your work rather than every change Chainguard ships. Routine updates, such as new tags for existing images, are not listed individually. For the current tags and versions of any container image, refer to its entry in the [Chainguard Directory](https://images.chainguard.dev/directory). ## Week of 2026-10-05 **Product Announcements** ### First Athena vulnerability disclosures _Launched September 28, 2026._ [Athena](https://www.chainguard.dev/athena), the industry coalition for coordinated defense of open source software, published its first 14 vulnerability disclosures. All 14 are silent vulnerabilities in Java projects: bugs that a later upstream release fixed but that never received a CVE, so vulnerability scanners couldn't flag the affected versions. The batch includes one critical, one high, eight medium, and four low-severity vulnerabilities. For each disclosure, Chainguard publishes: - Patch files for every affected version, in the public [Athena repository](https://github.com/chainguard-dev/athena) under each project's original license. - An advisory in the [Chainguard Libraries VEX feed](/chainguard/libraries/policies-and-security/cve-remediation/#vex), so [scanners that integrate with Chainguard Libraries](/chainguard/libraries/policies-and-security/scanners/) now report these vulnerabilities. - A remediated version of each affected artifact in Chainguard Repository, for Chainguard Libraries customers. To adopt a fix, replace the affected version in your lockfile with the remediated version and rebuild. The remediated version keeps the same package coordinates and adds a `-0.cgr.N` suffix, as described in [CVE remediation for Chainguard Libraries](/chainguard/libraries/policies-and-security/cve-remediation/). Ten new mitigation and detection partners also joined the coalition. For the full partner list and a walkthrough of four of the disclosed vulnerabilities, read the [announcement](https://www.chainguard.dev/unchained/athenas-disclosures-begin). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `nextcloud-server:32` | 2026-09-30 | 2027-03-30 | | `zabbix:7.4` | 2026-09-30 | 2027-03-30 | | `zabbix-agent2:7.4` | 2026-09-30 | 2027-03-30 | | `tekton-pipelines:1.4` | 2026-10-04 | 2027-04-04 | | `tekton-pipelines:1.5` | 2026-10-04 | 2027-04-04 | **New Images** Chainguard built 37 new container images this week, including both standard and FIPS variants.
ImageTierAdded
crossplane-* — 8 images (with FIPS variants)
ImageTierAdded
crossplane-azure-computeapplication2026-09-28
crossplane-azure-containerserviceapplication2026-09-28
crossplane-azure-eventhubapplication2026-09-28
crossplane-azure-networkapplication2026-09-28
crossplane-azure-operationalinsightsapplication2026-09-28
crossplane-aws-s3vectorsapplication +fips2026-09-29
crossplane-azure-cognitiveservicesapplication2026-09-29
crossplane-function-extra-resourcesapplication +fips2026-09-30
openstack-* — 10 images
ImageTierAdded
openstack-ceph-config-helperapplication2026-10-01
openstack-cinder-oshelmapplication2026-10-01
openstack-client-oshelmapplication2026-10-01
openstack-glance-oshelmapplication2026-10-01
openstack-keystone-oshelmapplication2026-10-01
openstack-neutron-oshelmapplication2026-10-01
openstack-nova-oshelmapplication2026-10-01
openstack-octavia-oshelmapplication2026-10-01
openstack-placement-oshelmapplication2026-10-01
openstack-libvirt-oshelmapplication2026-10-02
longhorn-engine-fipsfips2026-09-28
nemo-rlai2026-09-28
pmm-serverapplication2026-09-28
ray-fipsfips2026-09-28
datadog-serverless-initapplication +fips2026-09-29
elasticsearch-iamguarded-fipsfips2026-09-29
commercial-kyverno-clicommercial2026-09-30
commercial-kyverno-readiness-checkercommercial2026-09-30
kserve-llmisvc-controllerai +fips2026-10-01
playwright-chromiumapplication2026-10-01
aws-lambda-providedapplication +fips2026-10-02
flociapplication2026-10-02
livekit-sipapplication +fips2026-10-02
## Week of 2026-09-28 **Product Announcements** ### FIPS 140-3 validation with post-quantum key exchange _Launched September 24, 2026._ NIST has validated the Chainguard FIPS Provider for OpenSSL v3.6 under FIPS 140-3 ([Certificate #5523](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5523)). The module includes: - Hybrid post-quantum key exchange for TLS, which pairs a classical key exchange with ML-KEM, as an approved FIPS service. - The standardized post-quantum algorithms ML-KEM, ML-DSA, and SLH-DSA, alongside classical FIPS algorithms such as AES, SHA-2, SHA-3, ECDSA, and RSA. - Fixes for known CVEs inside the validated module boundary. Chainguard FIPS container images can [opt in to the v3.6 module](/platform/fips/verify-fips/#opt-in-to-different-fips-provider-versions) starting October 1, 2026. SHA-1 is not an approved algorithm in v3.6, so check [how your workloads use non-approved algorithms](/platform/fips/non-approved-algorithms/) before you switch. For more on the validation and CNSA 2.0, read the [announcement](https://www.chainguard.dev/unchained/announcing-chainguards-industry-first-validated-fips-140-3-module-delivering-post-quantum-readiness). ### Chainguard Libraries for Go and .NET (invite-only beta) _Launched September 28, 2026._ Chainguard Libraries now covers the Go and .NET ecosystems through an invite-only beta. Organizations accepted into the beta can pull Go and .NET packages from Chainguard Libraries and evaluate them in their existing development workflows. **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `longhorn-ui:1.10` | 2026-09-25 | 2027-03-25 | **New Images** Chainguard built 19 new container images this week, including both standard and FIPS variants.
ImageTierAdded
chainguard-server-hypervisor-gcpbase2026-09-23
kuredapplication +fips2026-09-23
conftestapplication +fips2026-09-24
foundryapplication2026-09-24
keepalivedapplication +fips2026-09-24
mcp-grafana-fipsfips2026-09-24
nixapplication2026-09-24
rayapplication2026-09-24
vault-secrets-webhookapplication +fips2026-09-24
argocd-agentapplication2026-09-25
katesapplication +fips2026-09-25
kubernetes-pause-fipsfips2026-09-25
victoriatracesapplication +fips2026-09-25
## Week of 2026-09-21 **Product Announcements** ### Sovereign Artifacts beta for EU data residency _Launched September 15, 2026._ [Sovereign Artifacts](https://www.chainguard.dev/unchained/announcing-the-sovereign-artifacts-beta) is a data-sovereignty capability for Chainguard Containers and Chainguard Libraries. For enrolled customers, it stores artifact bytes in an EU region, serves them from there, and backfills existing artifacts automatically. Pulls from Europe run about 30 percent faster. During the beta, authentication and build pipelines continue to run on US infrastructure. **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `openjdk:26` | 2026-09-17 | 2027-03-17 | | `ceph:19` | 2026-09-19 | 2027-03-19 | **New Images** Chainguard built 18 new container images this week, including both standard and FIPS variants.
ImageTierAdded
cursor-agentapplication2026-09-14
chainguard-desktop-workstation-pcbase2026-09-15
commercial-avocadocommercial2026-09-15
rustfsapplication2026-09-15
cloudzero-agentapplication +fips2026-09-16
trivy-k8s-wrapperapplication +fips2026-09-16
access-log-exporterapplication +fips2026-09-18
datahub-gmsapplication +fips2026-09-18
kates-connectapplication +fips2026-09-18
kubeflow-trainer-controller-managerapplication +fips2026-09-18
traceeapplication +fips2026-09-18
## Week of 2026-09-14 **Breaking Changes** ### sonar-scanner-cli default user change _Effective October 12, 2026._ Chainguard's `sonar-scanner-cli` image changes its default user from `root` (UID 0) to `nonroot` (UID 65532), aligning it with the upstream image and the principle of least privilege. The default working directory `/usr/src` is owned by `65532:0` with mode `0775`, and the scanner's scratch directory moves from `/.scannerwork` to `/tmp/.scannerwork`. - **Affected:** organizations running `sonar-scanner-cli` as root by default — including derived images that install packages or write to system paths as root, pipelines that read `report-task.txt` from the old `.scannerwork` location, and scans that write output files into the mounted project directory. Deployments that already override the container user, or that mount a project and run the image as-is, are unaffected. - **Action:** derived images that need root for build steps should add `USER root` before those steps and switch back to `USER 65532` afterward. Pipelines reading `report-task.txt` from the workspace should read it from `/tmp/.scannerwork`, or set `-Dsonar.working.directory=/.scannerwork` and ensure the workspace is writable by the container user. To restore the previous behavior temporarily, run with `--user 0` (Docker), `USER root` (Dockerfile), or `runAsUser: 0` (Kubernetes), or pin to a digest built before the effective date. **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `kuma:2.12` | 2026-09-09 | 2027-03-09 | **New Images** Chainguard built 26 new container images this week, including both standard and FIPS variants.
ImageTierAdded
clamav-prometheus-exporterapplication +fips2026-09-07
crossplane-azure-marketplaceorderingapplication2026-09-07
kserve-sklearnserverai2026-09-07
commercial-spilo-fipsfips2026-09-08
graphql-hive-gatewayapplication2026-09-08
jupyterhub-k8s-singleuser-sampleapplication +fips2026-09-08
nuxeo-2025application2026-09-08
chainguard-server-hypervisor-awsbase2026-09-09
mongodb-kubernetesapplication +fips2026-09-09
opentelemetry-python-instrumentation-fipsfips2026-09-09
strimzi-kafka-fipsfips2026-09-09
crossplane-aws-emrcontainersapplication +fips2026-09-11
kroapplication +fips2026-09-11
pyrraapplication +fips2026-09-11
starboard-exporterapplication +fips2026-09-11
krakendapplication +fips2026-09-14
mongodb-searchapplication +fips2026-09-14
## Week of 2026-09-07 **Product Announcements** ### Chainguard Containers for Go 1.27 _Launched August 31, 2026._ Chainguard now ships Go 1.27 in three images: `go`, `go-fips`, and `go-openssl-fips`. The new `go-openssl-fips` image selects its FIPS-validated cryptographic module at deployment rather than at build time. Choosing a FIPS module for Go previously meant choosing a toolchain at compile time. Teams compiled against either the host's OpenSSL FIPS provider (`go-msft-fips`) or the Go Cryptographic Module (`go-geomys-fips`), so supporting both required two pipelines producing two artifacts. The new Go FIPS toolchain ships one artifact that picks the validated module after the build, at the point of deployment. A single build cross-compiles from one command, runs wherever you deploy, keeps your validated module and FedRAMP authorization intact, and is ready for CNSA 2.0 — all without recompilation. Go 1.26 and earlier behave as before and remain supported until end-of-life, so you can migrate on your own schedule. For more information, refer to [Getting started with the Go Chainguard Container](/chainguard/containers/getting-started/languages-and-runtimes/go/). ### Chainguard Libraries in JFrog _Launched September 2, 2026._ JFrog Catalog now recognizes Chainguard-built packages, so joint Chainguard and JFrog customers can pull Chainguard Libraries through JFrog without build errors. This is what underpins JFrog's Zero-Touch Remediation: when a scan finds a vulnerable artifact, teams can take the patched Chainguard package in place, without changing developer workflows or forcing a major version upgrade. - Java support shipped with this announcement; JavaScript and Python are scheduled to follow by the end of September 2026. - JFrog Xray scanning and Curation policies work as before. - Nothing changes for Chainguard Libraries customers who don't use JFrog. For more information, refer to [Chainguard Libraries overview](/chainguard/libraries/introduction/overview/). **New Images** Chainguard built 39 new container images this week, including both standard and FIPS variants.
ImageTierAdded
kubeflow-pipelines-* — 10 images
ImageTierAdded
kubeflow-pipelines-api-server-fipsfips2026-08-31
kubeflow-pipelines-cache-deployer-fipsfips2026-08-31
kubeflow-pipelines-cache-server-fipsfips2026-08-31
kubeflow-pipelines-driver-fipsfips2026-08-31
kubeflow-pipelines-frontend-fipsfips2026-08-31
kubeflow-pipelines-metadata-envoy-fipsfips2026-08-31
kubeflow-pipelines-metadata-writer-fipsfips2026-08-31
kubeflow-pipelines-persistenceagent-fipsfips2026-08-31
kubeflow-pipelines-scheduledworkflow-fipsfips2026-08-31
kubeflow-pipelines-viewer-crd-controller-fipsfips2026-08-31
dbmateapplication +fips2026-08-31
go-openssl-fipsfips2026-09-01
hadolintapplication +fips2026-09-01
jrubybase2026-09-01
kserve-huggingfaceserverai +fips2026-09-01
gubernatorapplication +fips2026-09-02
kates-testerapplication +fips2026-09-02
fortiotelapplication +fips2026-09-03
packerapplication +fips2026-09-03
security-profiles-operatorapplication2026-09-03
aws-lambda-dotnetapplication +fips2026-09-04
mongodb-kubernetes-readinessprobeapplication +fips2026-09-04
opentelemetry-go-instrumentationapplication +fips2026-09-04
prom-label-proxyapplication +fips2026-09-04
kserve-sklearnserver-fipsfips2026-09-07
presidio-anonymizerapplication +fips2026-09-07
redpanda-console-fipsfips2026-09-07
## Week of 2026-08-31 **Product Announcements** ### chainctl fixes for standard Windows accounts _Launched August 26, 2026._ Several `chainctl` workflows now work for standard, non-administrator Windows users: - Configuring Docker credentials no longer requires symlinks or Developer Mode. - Self-update replaces the running executable correctly and checks release attestations before installing. - Library verification checks signatures in-process and cleans up its temporary directories reliably. - Authentication failures report an error instead of a misleading 0.00% coverage result. These are targeted fixes. Chainguard's official Windows support tier is unchanged. ### Custom container policies (open beta) _Launched August 25, 2026._ Organizations enabled for the beta can now write their own container pull policies instead of relying only on Chainguard's system policies. Custom policies are [Rego](https://www.openpolicyagent.org/docs/policy-language) expressions submitted as YAML manifests and managed with `chainctl`, so you can keep them in git and validate them in CI. - Policies can declare parameters, with values set per binding. - `chainctl policies custom validate` reports the exact line and column of an error before the policy is stored. - Evaluation runs in a sandbox with no network or filesystem access. - A custom policy in `ENFORCE` mode blocks pulls, but cannot loosen a system policy. For more information, refer to [Writing custom policies](/chainguard/chainguard-repository/container-policies/#writing-custom-policies). ### Build pinning for Chainguard Libraries _Launched August 24, 2026._ Build pinning is now enabled for all organizations using Chainguard Libraries with upstream fallback, across JavaScript, Python, and Java. The first time your organization pulls a package version, Chainguard records which copy you received — the upstream mirror or the Chainguard rebuild — and keeps resolving that version to the same copy until you choose to move forward. This keeps your lockfiles and checksums valid as Chainguard's library coverage grows. Organizations that do not use upstream fallback see no change. To review what your organization holds, or to opt out, refer to [`chainctl libraries cache`](/platform/chainctl/chainctl-docs/chainctl_libraries_cache/). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that are no longer available The following container images reached the end of their grace period and are no longer available: | Image | End-of-life | Grace period ended | | --- | --- | --- | | `kube-conformance:1.32` | 2026-02-28 | 2026-08-28 | | `kubernetes:1.32` | 2026-02-28 | 2026-08-28 | | `nextcloud-server:31` | 2026-02-28 | 2026-08-28 | | `rke2-runtime:1.32` | 2026-02-28 | 2026-08-28 | | `teleport:17` | 2026-02-28 | 2026-08-28 | ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `istio:1.29` | 2026-08-31 | 2027-02-28 | | `istio-cni:1.29` | 2026-08-31 | 2027-02-28 | | `istio-envoy:1.29` | 2026-08-31 | 2027-02-28 | | `istio-operator:1.29` | 2026-08-31 | 2027-02-28 | | `istio-pilot-agent:1.29` | 2026-08-31 | 2027-02-28 | | `istio-pilot-discovery:1.29` | 2026-08-31 | 2027-02-28 | | `teleport:18` | 2026-08-31 | 2027-02-28 | | `ztunnel:1.29` | 2026-08-31 | 2027-02-28 | **New Images** Chainguard built 21 new container images this week, including both standard and FIPS variants.
ImageTierAdded
dynatrace-operatorapplication +fips2026-08-24
netshootapplication +fips2026-08-24
strimzi-drain-cleanerapplication +fips2026-08-24
kube-logging-operator-fluentd-drain-watchapplication +fips2026-08-25
mlrun-api-fipsfips2026-08-25
mlrun-fipsfips2026-08-25
redpanda-consoleapplication2026-08-26
apache-polarisapplication +fips2026-08-28
kserve-pmmlserverai +fips2026-08-28
kserve-xgbserverai +fips2026-08-28
nomadapplication +fips2026-08-28
victorialogs-vlagentapplication +fips2026-08-28
## Week of 2026-08-24 **Product Announcements** ### SCIM user provisioning (Early Access) _Launched August 20, 2026._ Chainguard now supports SCIM user provisioning for Okta and Microsoft Entra ID in Early Access. Assigning a user to the provisioning application creates and updates their Chainguard provisioning record through the SCIM `/Users` resource; deactivating or unassigning them blocks the next login or token refresh once the current token expires, within about an hour. Roles stay under Chainguard's control through default roles, manual bindings, and group-based role mapping. SCIM group provisioning is not available, so leave your identity provider's SCIM group push turned off. For more information, refer to [SCIM user provisioning](/platform/administration/custom-idps/scim-provisioning/). ### Chainguard API v2 is generally available _Launched August 19, 2026._ Chainguard API v2 is now generally available at `/v2/`, replacing the `v2beta1` designation with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts. It standardizes cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details, and ships an OpenAPI specification and v2 Go SDK clients. Existing `v2beta1` integrations keep their request and response shapes and need only update the path prefix. API v1 remains supported during the transition. For more information, refer to [Migrating from API v1 to API v2](/platform/api/api-v2-migration/). ### Self-serve Helm chart provisioning _Launched August 18, 2026._ Catalog customers can now provision Chainguard Helm charts from the Chainguard Console instead of filing a request ticket. When you select a chart, the Console identifies the required images your organization is missing, adds them in a single request, and starts provisioning the chart asynchronously; the chart appears in your registry once synchronization completes, without EOL tags. Dependency resolution does not detect renamed images. For more information, refer to [Self-serve Helm charts](/get-started/self-serve/helm-charts/). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that are no longer available The following container images reached the end of their grace period and are no longer available: | Image | End-of-life | Grace period ended | | --- | --- | --- | | `flux:2.5` | 2026-02-24 | 2026-08-24 | ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `grafana:12.3` | 2026-08-19 | 2027-02-19 | | `py3-numpy:2.1` | 2026-08-19 | 2027-02-19 | **New Images** Chainguard built 27 new container images this week, including both standard and FIPS variants.
ImageTierAdded
airbyte-* — 5 images (with FIPS variants)
ImageTierAdded
airbyte-bootloaderapplication +fips2026-08-21
airbyte-cronapplication +fips2026-08-21
airbyte-workerapplication +fips2026-08-21
airbyte-workload-api-serverapplication +fips2026-08-21
airbyte-workload-launcherapplication +fips2026-08-21
percona-server-mongodb-fipsfips2026-08-17
application-gateway-kubernetes-ingressapplication +fips2026-08-18
falcosidekick-uiapplication +fips2026-08-18
kubernetes-csi-external-health-monitor-fipsfips2026-08-18
mlrunapplication2026-08-18
mlrun-apiapplication2026-08-18
spiffe-csi-driverapplication +fips2026-08-18
apache-activemq-artemis-fipsfips2026-08-19
aws-iam-controllerapplication +fips2026-08-21
commercial-nginx-plus-fipscommercial2026-08-21
kserve-lgbserverai +fips2026-08-21
rangerapplication2026-08-21
## Week of 2026-08-17 **Product Announcements** ### Clearer npm errors for blocked packages _Launched August 13, 2026._ When Chainguard Libraries withholds an npm package or version — because of detected malware or greyware, a pending malware scan, or a policy block such as a cooldown — npm now returns a `403` naming the specific reason, for example `MALWARE_DETECTED`, instead of the unexplained `404` it returned before. The other supported package managers (pnpm, yarn, uv, poetry, Maven, and Gradle) still report a blocked version as a generic not-found error, and a `409` when an entire package is blocked for malware. For more information, refer to [Error messages](/chainguard/libraries/troubleshooting/errors/#package-manager-behavior). ### Guardener GitHub App (beta) _Launched August 12, 2026._ Guardener, the automated migration tool, now covers GitHub Actions as well as container images. The GitHub App inventories the Actions in use across your organization's repositories, maps them to hardened Chainguard equivalents, and opens pull requests to swap them in, pinned to a specific SHA rather than a mutable tag. It runs in two modes: an upfront pass that surfaces existing Actions usage and opens migration pull requests, and ongoing standardization that watches workflow files and suggests Chainguard equivalents as new upstream Actions appear. For more information, refer to [Getting started with Guardener](/chainguard/guardener/github/getting-started/). **Breaking Changes** ### Chainguard Libraries build pinning _Effective August 24, 2026._ Chainguard Repository can serve two copies of the same package version: the upstream copy mirrored from the public registry, and Chainguard's copy rebuilt from source. The two have different checksums, and each request resolves independently, so when Chainguard publishes a rebuild of a version your organization already pulled, the next resolution moves you to the rebuild and its checksum no longer matches your lockfile — surfacing client-side as errors such as `EINTEGRITY` in npm. As of August 24, 2026, build pinning records which copy your organization received the first time it downloads a package version and keeps resolving that version to the same copy until you choose to move forward. Malware and policy blocks apply independently: a version that is later blocked stops being served rather than being replaced with a different copy. - **Affected:** organizations using Chainguard Libraries with upstream fallback, across JavaScript, Python, and Java. Organizations without upstream fallback see no change. - **Action:** none required. To keep the current behavior, run `chainctl libraries cache opt-out`. Both `opt-out` and `chainctl libraries cache opt-in` accept `--ecosystem`, and pinning state is tracked per organization and ecosystem. To see which copy each held version came from, run `chainctl libraries cache list`. For more information, refer to [`chainctl libraries cache`](/platform/chainctl/chainctl-docs/chainctl_libraries_cache/). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that are no longer available The following container images reached the end of their grace period and are no longer available: | Image | End-of-life | Grace period ended | | --- | --- | --- | | `prometheus:3.9` | 2026-02-17 | 2026-08-17 | ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `mattermost:10.11` | 2026-08-15 | 2027-02-15 | **New Images** Chainguard built 17 new container images this week, including both standard and FIPS variants.
ImageTierAdded
azuriteapplication2026-08-10
k0s-cni-nodeapplication +fips2026-08-10
peerdb-uiapplication +fips2026-08-10
sccapplication +fips2026-08-10
zitadel-loginapplication2026-08-11
aws-lambda-nodejsapplication +fips2026-08-12
localstackapplication2026-08-12
kserve-router-fipsfips2026-08-13
jdk-openssl-fipsfips2026-08-14
jre-openssl-fipsfips2026-08-14
kube-routerapplication +fips2026-08-14
commercial-nginx-ingress-pluscommercial2026-08-17
## Week of 2026-08-10 **Product Announcements** ### Chainguard Libraries available through AWS Security Hub Extended _Launched August 4, 2026._ AWS added a Supply Chain category to Security Hub Extended and named Chainguard one of its inaugural partners. You can now subscribe to Chainguard Libraries from the Security Hub console and pay through your existing AWS account. Libraries findings arrive normalized to the Open Cybersecurity Schema Framework (OCSF), so they appear alongside your AWS and other partner findings, and AWS Enterprise Support customers receive Level 1 support from AWS. For more information about the catalog, refer to the [Chainguard Libraries overview](/chainguard/libraries/introduction/overview/). ### Malware avoidance in the Console (beta) _Launched August 4, 2026._ The Console now shows which malicious and suspicious packages Chainguard Libraries blocked before they reached your environment. A weekly chart tracks the malware and greyware stopped across the Python and JavaScript ecosystems, and a search tool reports why any given package was flagged unsafe. Find it under the **Malware** tab in the Libraries section of the Console sidebar; it is enabled by default for every organization entitled to Libraries. For more information, refer to [View malware information](/chainguard/libraries/introduction/browse/#view-malware-information). ### PKCE support for custom identity providers _Launched August 3, 2026._ Chainguard now supports Proof Key for Code Exchange (PKCE) on the OAuth token exchange with custom OIDC identity providers, in line with OAuth 2.1. Administrators can enable it with `chainctl` or the Chainguard API, either alongside an existing client secret or as a secret-free public client. For more information, including setup steps, refer to [Enable PKCE for OAuth Token Exchange](/platform/administration/custom-idps/enabling-pkce/). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `net-kourier:1.21` | 2026-08-04 | 2027-02-04 | | `tekton-pipelines:1.3` | 2026-08-04 | 2027-02-04 | | `ruby3.2-rails:7.2` | 2026-08-09 | 2027-02-09 | | `ruby3.3-rails:7.2` | 2026-08-09 | 2027-02-09 | | `ruby3.4-rails:7.2` | 2026-08-09 | 2027-02-09 | | `ruby4.0-rails:7.2` | 2026-08-09 | 2027-02-09 | **New Images** Chainguard built 23 new container images this week, including both standard and FIPS variants.
ImageTierAdded
prometheus-stackdriver-exporterapplication +fips2026-08-03
crossplane-azure-keyvaultapplication2026-08-04
crossplane-azure-kustoapplication2026-08-04
influxdb-fipsfips2026-08-04
moodle-iamguardedapplication2026-08-04
pypiserver-fipsfips2026-08-04
kubevirt-cdi-clonerapplication +fips2026-08-05
yopassapplication2026-08-05
acm-controllerapplication +fips2026-08-06
gremlin-serverapplication2026-08-06
rollouts-plugin-trafficrouter-gatewayapiapplication +fips2026-08-06
claudeapplication2026-08-07
codexapplication2026-08-07
cruise-controlapplication +fips2026-08-07
dotstatsuite-supercoreapplication2026-08-07
opencodeapplication2026-08-08
zalando-pgbouncerapplication +fips2026-08-10
## Week of 2026-08-03 **Breaking Changes** ### ingress-nginx-controller entrypoint, command, and default user changes _Effective July 15, 2026._ Chainguard aligned the entrypoint and command behavior of all supported `ingress-nginx-controller` images with the upstream image, correcting a startup configuration defect present since the image was first published in 2024. Non-`iamguarded` variants also changed their default runtime user from `root` (UID 0) to `www-data` (UID 101). - **Affected:** all supported `ingress-nginx-controller` images, including FIPS and `-iamguarded` variants. - **Action:** review any configuration that overrides `command`, `args`, `entrypoint`, or `runAsUser`, or that depends on admission policies or file ownership assumptions. Deployments using the upstream Helm chart defaults need no changes. **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that are no longer available The following container images reached the end of their grace period and are no longer available: | Image | End-of-life | Grace period ended | | --- | --- | --- | | `cilium:1.16` | 2026-02-03 | 2026-08-03 | | `neo4j:2025.12` | 2026-02-03 | 2026-08-03 | ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `eks-distro:1.33` | 2026-07-29 | 2027-07-29 | | `mongo:8.2` | 2026-07-31 | 2027-01-31 | | `prometheus:3.5` | 2026-07-31 | 2027-01-31 | | `cockroach:26.1` | 2026-08-02 | 2027-02-02 | | `cockroach-openssl:26.1` | 2026-08-02 | 2027-02-02 | **New Images** Chainguard built 18 new container images this week, including both standard and FIPS variants.
ImageTierAdded
atlasapplication +fips2026-07-29
azure-metrics-exporterapplication +fips2026-07-29
crossplane-azure-solutionsapplication2026-07-29
crossplane-azure-streamanalyticsapplication2026-07-29
crossplane-azure-webapplication2026-07-29
dns-controller-managerapplication +fips2026-07-29
instrumentisto-harakaapplication +fips2026-07-29
openstack-kolla-toolboxapplication +fips2026-07-29
sftpgoapplication2026-07-29
flink-kubernetes-operator-fipsfips2026-07-30
traccarapplication +fips2026-07-30
metacontroller-fipsfips2026-07-31
## Week of 2026-07-28 **Product Announcements** ### SUSE NeuVector now natively supports Chainguard Containers _Launched July 24, 2026._ SUSE's NeuVector vulnerability scanner now natively supports Chainguard Containers and ingests Chainguard's OSV advisory feed, which includes recent data-quality improvements. Scans of Chainguard images suppress false positives and report more accurate results. ### Group-based role mapping is now generally available _Launched July 22, 2026._ Administrators can map identity provider groups — Okta or Microsoft Entra ID, for example — directly to Chainguard roles, instead of assigning roles one user at a time. Anyone who authenticates with a mapped group in their token receives that role for the session. For more information, including setup steps, refer to [Grant Chainguard roles from identity provider groups](/platform/administration/custom-idps/grant-roles-from-groups/). **EOL** Chainguard offers [a grace period](/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/) for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade. ### Images that are no longer available The following container images reached the end of their grace period and are no longer available: | Image | End-of-life | Grace period ended | | --- | --- | --- | | `knative-eventing:1.19` | 2026-01-28 | 2026-07-28 | | `knative-serving:1.19` | 2026-01-28 | 2026-07-28 | | `net-kourier:1.19` | 2026-01-28 | 2026-07-28 | ### Images that have reached end-of-life The following container images reached end-of-life and entered their grace period: | Image | End-of-life | Grace period ends | | --- | --- | --- | | `dnsdist:1.9` | 2026-07-21 | 2027-01-21 | | `longhorn-backing-image-manager:1.8` | 2026-07-22 | 2027-01-22 | | `longhorn-instance-manager:1.8` | 2026-07-22 | 2027-01-22 | | `envoy:1.35` | 2026-07-23 | 2027-01-23 | **New Images** Chainguard built 15 new container images this week, including both standard and FIPS variants.
ImageTierAdded
coderapplication +fips2026-07-22
flink-kubernetes-operatorapplication2026-07-22
pgheroapplication +fips2026-07-22
kargoapplication2026-07-23
nuclio-controllerapplication +fips2026-07-23
phpmyadminapplication +fips2026-07-23
apache-exporter-iamguardedapplication2026-07-24
glabapplication +fips2026-07-27
metabaseapplication2026-07-27
crossplane-azure-relayapplication2026-07-28