Chainguard endpoints now handle breaking changes

Chainguard is introducing a dedicated endpoint that provides visibility for Athena members into security fixes that include breaking changes.

Remediating vulnerabilities at scale often forces a costly compromise between production stability and security coverage. When a patch alters underlying APIs or interfaces, deploying it automatically risks service disruptions. Historically, holding those breaking fixes back protected production, but it also created unresolved scanner noise, operational triage overhead, and critical exposure blind spots.

By separating backward-compatible patches from breaking remediations into two isolated endpoints, we remove this friction. Teams can now keep standard patching fully automated and disruption-free, while taking a deliberate, risk-informed approach to breaking updates whenever the threat warrants it.

Two endpoints for implementing fixes at scale 

Athena has introduced a second endpoint that includes breaking changes, cgb. Members can now select between two feeds based on their operational requirements:

• The standard cgp endpoint remains unchanged and provides backward-compatible fixes. This feed will not include breaking changes.

• The new cgb endpoint includes fixes with breaking changes and mirrors patches from the cgp endpoint, allowing teams to opt-in to breaking changes when they are ready.

The cgb endpoint is isolated from existing configurations, meaning teams will only consume breaking patches if they explicitly update their package manager settings. Both Open Source Vulnerabilities (OSV) and Vulnerability Exploitability Exchange (VEX) data feeds will recognize .cgb package releases as fixed versions, ensuring vulnerability scanners accurately reflect remediation status.

What we’re building next

Athena will soon roll out dedicated package changelogs and implementation documentation to enable faster patching and easier decision-making. These logs will outline specific API modifications for newly released packages and will eventually be backfilled for existing patches.

Meeting members where they are requires balancing operational stability against zero-day risk. By offering granular control over breaking changes, Athena enables organizations to deploy critical fixes quickly while maintaining production reliability.

Chainguard will extend this model to our broader customer base by introducing a similar distribution option for the public .cgr line of CVE patches. This update will allow organizations utilizing standard Chainguard feeds to opt into critical fixes that carry breaking changes on their own timeline, rather than being restricted strictly to backward-compatible releases. 

Alongside this endpoint expansion, we are actively developing changelogs for public remediations as well, providing engineering teams with clear visibility into code-level adjustments, deprecated interfaces, and behavioral modifications across all public security fixes.

Get in touch with our team to learn more about Athena and how you can protect yourself from AI attacks.