Upcoming changes to wolfi-dev/os

[gaughen]

We’re rolling out changes starting next Wednesday, January 14, 2026 to dramatically improve Chainguard’s engineering velocity, change management efficiency, and, ultimately, package and image quality.

To support those efforts, we’ve consolidated several previously separate codebases (including Wolfi-related work) into a single Chainguard internal monorepo. This allows us to coordinate changes and test them together end-to-end.

What’s not changing:

• We will continue to maintain a fully open source mirror of wolfi-dev/os on GitHub.
• We will continue to welcome community contributions and package requests there.

What is changing:

• Contributions to wolfi-dev/os will be brought into our internal monorepo so we can run the full set of tests and validation before merging and releasing.

We realize this adds a hurdle to contributing, and may feel like a shift. We want to be transparent about why we’re doing it: higher quality, fewer regressions, and faster, safer delivery of improvements.

If you’d like to contribute, please follow the Contribution Guidelines as we’ll keep that current. We’ll do our best to shepherd changes through the process. If you are a Chainguard customer, please reach out to your Customer Success team for additional support.

Additionally, in preparation for this change, we will close existing issues and PRs filed in wolfi-dev/os on Monday, January 12, 2026 to reset and allow us to better manage external contributions going forward. If you feel your issue was closed in error, you can re-open or start fresh, following the Contribution Guidelines.

Keep being awesome,
Pat

[shyim]

Is it fine to use Wolfi without beeing an active paying customer? I building anyway my package on my own using melange and have a bunch of patches trying to upstream for almost 2 years. I tried to evangelist Wolfi for PHP, but with this careless of OSS, just be honest with your OSS strategy and put everything behind paid subscription. (I tried to push my minimal non breaking change through linkedin dms, twitter, talking with engineers on containerdays).

[gaughen]

Hi @shyim,

Apologies for my delay in response, and also the way your proposed patches have been handled. We should have done a better job in terms of setting expectations for how community contributions will be handled moving forward.

At the moment, Wolfi is going through changes to ensure our customers are fully supported. Whenever we accept a patch from the community, we take full responsibility for testing and maintaining that functionality, which is why we have been more conservative over time. If a proposed patch does not align with Chainguard’s priorities or customer use cases, it is unlikely to be merged for that reason, and this means most community patches will not be accepted into Wolfi.

The change communicated in this announcement is directly intended to reduce the maintenance burden on our engineers and — to be clear — it does come at a cost to community involvement.

That being said, our tooling and the core of Wolfi is, and will continue to be, open source. You are free to use our repositories as you like, fork them and turn them into new projects in accordance with the open source license terms. The same goes for our apko and melange tooling — those aren’t going away.

Thank you for reaching out; we will update our contribution guidelines in line with this message.

All the best,
Pat

[Mike-at-Paramify]

So do you intend to keep mirroring changes to this repo? Looks like no updates here in at least 10 days... ☹️

[xnox]

We are, design and implementation has hit issues. However the plan is to maintain read-only mirror similar to how chainguard-images/images repository looks like.

For us CVE SLA takes ultimate priority, hence we are prioritising catching up with updates after moving multiple git repositories into one.

Note, all packages include full expanded melange.yaml recipes in the .apk control section in the mean time.

[aditya-shrivastav1]

Hi, I have noticed that recently chainguard images also have started to accumulate vulnerabilities and the images are also not getting updated to newer versions regularly as it did a while ago. As discussed above chainguard is going through some internal changes, so any timelines regarding when it will be back on track?

[xnox]

@aditya-shrivastav1 all package updates and images should be building as normal.

If you are a customer - please use support portal to open an inquiry.

If you use free tier images - please let us know here, which images and/or vulnerabilities you are after; and which scanner was used to detect them

[aditya-shrivastav1]

Hi @xnox,

I’m noticing a version difference between the public Wolfi package repository and what appears in the SBOM for some Chainguard images.

For example, the public Wolfi repo currently shows helm-3 3.19.2-r2, while the Chainguard argocd image SBOM lists helm-3 3.20.0-r1, which appears to address several recent CVEs.

Could you clarify whether:

• The public Wolfi repository is expected to lag behind internal builds?
• There is an expected cadence for mirroring updated package versions to the public repo?
• The public repository should be considered the authoritative source of currently supported package versions?

Just trying to understand how the mirroring process works after the recent monorepo changes.

Thanks!