Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
OpenSSL 3.4 lost upstream support on 22 October 2026 and 3.6 ends on 1 November. Where they still ship, how to check each runtime, and what to move to.
Next.js 15 left Maintenance LTS on 21 October 2026. The last 15.x fixes, how to find every 15.x app in your estate, and a tested path to Next.js 16.
aiohttp 3.14.4 fixed eight advisories rated low or medium by the project, scored up to 8.2 in CVE records. What they cover, upgrade changes, a checker.
PostgreSQL 14's final release is due on 12 November 2026. This year it needed fixes for 36 CVEs, 22 rated 8.0 or higher. The community and Amazon RDS dates that apply, two security defaults a 14-to-18 upgrade doesn't change for you, and a script that finds every pinned PostgreSQL version in a repository.
RustSec marked zvariant, zvariant_derive and zbus_names unmaintained after zbus 6.0 merged them, and cargo-deny fails on that by default. How far it reaches (523 of 637 zbus dependents still on zbus 5), what each tool does, the three situations you can be in, the zbus 6 migration essentials, and a Cargo.lock checker.
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
What CSAF 2.0 requires, a minimal security advisory that passes the official schema, how customers discover your advisories through provider-metadata.json, and two small scripts to check your own work.
A dependency scan that reports nothing has one of two meanings. Either the scanner checked your packages and the vulnerability data found nothing wrong, or the data didn't yet know about something that is wrong. Both produce the same green build.
A CVE record in the JSON 5 format can say precisely which versions are affected, but it can also say it in free text, say nothing, or contradict itself. How to read one correctly, with five real records from this week and data from 1,197 new records.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
