Quick Facts
- Chainguard Repository, launched in March 2026 with JavaScript support, now covers Java, Python, and containers, with Chainguard Libraries for Java reaching general availability on June 18, 2026.
- Nearly 455,000 malicious packages flooded npm, PyPI, and Maven Central in 2025, and 89% of container images in production carry known vulnerabilities.
- Chainguard containers show 97.6% fewer CVEs than open-source equivalents and save developers four hours per month on vulnerability management.
Chainguard has expanded its Repository platform to Java, Python, and containers, adding policy enforcement controls and CVE remediation to a product it launched three months ago with JavaScript support only. The company made Chainguard Libraries for Java generally available on June 18, 2026, with dozens of CVEs remediated at launch.
The expansion comes as software supply chain threats grow faster than most security teams can respond. The mean time-to-exploit for newly disclosed vulnerabilities has hit negative seven days, meaning active attacks often begin before a patch exists.
“The time to exploit has gone negative,” said Dan Lorenc, CEO and co-founder of Chainguard. “Exploits now land before a flaw is ever disclosed.”
What the Platform Does
Chainguard Repository gives developers a single, policy-enforced source for pulling open source packages, containers, OS packages, virtual machine images, CI/CD workflows, and agent skills. All artifacts are either rebuilt from verifiable source in a SLSA Level 2-compliant build environment or sourced from upstream public registries with configurable controls.
Four new policy enforcement features ship with the expanded platform. CVE blocking prevents artifacts with known critical vulnerabilities from being pulled. License enforcement restricts packages to approved licenses. End-of-life prevention rejects unmaintained software. Long-term support enforcement requires actively maintained artifacts across all in-use software.
Real-time dashboards show policy enforcement status and vulnerability coverage across every artifact an organization consumes.
How Remediation Works
For Java, teams replace a vulnerable library by updating a single reference in their pom.xml file. Chainguard’s remediated version ships with a backported fix under a new version identifier using a -0.cgr.N suffix. Wiz, AWS Inspector, Grype, and Trivy all recognize these remediated libraries.
For Python, remediated packages use a +cgr.N local version suffix. Package managers treat this as a higher-precedence local version of the base release, allowing remediated versions to be selected automatically during dependency resolution.
Abridge, a healthcare AI company, is already using the Python library. “Chainguard’s new Python library with CVE remediations has quickly become a key part of our security model,” said a spokesperson for the company. “They are helping us streamline how we secure our software supply chain without increasing overhead on our developers.”
The AI Complication
Lorenc pointed to AI coding tools as a factor accelerating the problem. AI agents pull dependencies at machine speed, and their training data is typically a year or more out of date. That means agents default to older, often insecure library versions by default.
“AI is dramatically increasing the speed of software development for defenders and attackers alike,” Lorenc said. “AI coding tools and autonomous agents are generating more code, pulling in more dependencies, and interacting with open source at a scale humans have never seen before.”
Spring received 482 new security reports in April 2026 alone. Spring Boot 2.7, which reached end of life in November 2023, carries 143 CVEs across 79 projects with no upstream patches available.
Company Scale
Chainguard’s platform now covers more than 2,500 container projects and millions of language library versions. The company, founded by former Google engineers who built Sigstore, reported $40 million in annual recurring revenue in 2025 and has delivered more than 500 million unique container build manifests.
The company’s roadmap calls for further expansion to OS packages, virtual machine images, CI/CD workflows, and agent skills under the same policy enforcement model.
Read more: Exclusive: Chainguard extends Repository scanning and policies to Java, Python and containers