Chainguard products changelog

This page logs Chainguard product updates week by week, newest first: product announcements, breaking changes, container images that reached end-of-life or are no longer available, and images newly added to the catalog. Each event is listed once, in the week it first appeared.

Week of 2026-08-10

Chainguard Libraries available through AWS Security Hub Extended

Launched August 4, 2026.

AWS added a Supply Chain category to Security Hub Extended and named Chainguard one of its inaugural partners. You can now subscribe to Chainguard Libraries from the Security Hub console and pay through your existing AWS account. Libraries findings arrive normalized to the Open Cybersecurity Schema Framework (OCSF), so they appear alongside your AWS and other partner findings, and AWS Enterprise Support customers receive Level 1 support from AWS.

For more information about the catalog, refer to the Chainguard Libraries overview.

Malware avoidance in the Console (beta)

Launched August 4, 2026.

The Console now shows which malicious and suspicious packages Chainguard Libraries blocked before they reached your environment. A weekly chart tracks the malware and greyware stopped across the Python and JavaScript ecosystems, and a search tool reports why any given package was flagged unsafe. Find it under the Malware tab in the Libraries section of the Console sidebar; it is enabled by default for every organization entitled to Libraries.

For more information, refer to View malware information.

PKCE support for custom identity providers

Launched August 3, 2026.

Chainguard now supports Proof Key for Code Exchange (PKCE) on the OAuth token exchange with custom OIDC identity providers, in line with OAuth 2.1. Administrators can enable it with chainctl or the Chainguard API, either alongside an existing client secret or as a secret-free public client.

For more information, including setup steps, refer to Enable PKCE for OAuth Token Exchange.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 25 new container images this week, including both standard and FIPS variants.

Week of 2026-08-03

ingress-nginx-controller entrypoint, command, and default user changes

Effective July 15, 2026.

Chainguard aligned the entrypoint and command behavior of all supported ingress-nginx-controller images with the upstream image, correcting a startup configuration defect present since the image was first published in 2024. Non-iamguarded variants also changed their default runtime user from root (UID 0) to www-data (UID 101).

• Affected: all supported ingress-nginx-controller images, including FIPS and -iamguarded variants.
• Action: review any configuration that overrides command, args, entrypoint, or runAsUser, or that depends on admission policies or file ownership assumptions. Deployments using the upstream Helm chart defaults need no changes.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 18 new container images this week, including both standard and FIPS variants.

Week of 2026-07-28

SUSE NeuVector now natively supports Chainguard Containers

Launched July 24, 2026.

SUSE’s NeuVector vulnerability scanner now natively supports Chainguard Containers and ingests Chainguard’s OSV advisory feed, which includes recent data-quality improvements. Scans of Chainguard images suppress false positives and report more accurate results.

Group-based role mapping is now generally available

Launched July 22, 2026.

Administrators can map identity provider groups — Okta or Microsoft Entra ID, for example — directly to Chainguard roles, instead of assigning roles one user at a time. Anyone who authenticates with a mapped group in their token receives that role for the session.

For more information, including setup steps, refer to Grant Chainguard roles from identity provider groups.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 15 new container images this week, including both standard and FIPS variants.