Stay up to date about new Lightwell Network features that you can use to keep your open source dependencies secure.

Predisclosure repository added to Lightwell Network

The Predisclosure repository is now available in the Lightwell Network. This repository builds on the existing Remediated repository by delivering fixes for novel vulnerabilities before public disclosure.

Key features and behaviors

• Packages in this repository are built on the latest remediated builds and are maintained with moderate and higher severity CVE fixes.
• As vulnerabilities are publicly disclosed and addressed upstream, corresponding fixes are promoted from the Predisclosure repository into the Remediated repository.

Important operational considerations

• Repository migration: Novel fixes are moved directly into the predisclosure repository. If you previously mirrored or pulled these specific artifacts into a local repository, such as JFrog Artifactory, they will no longer be available at their former Remediated path.
• Existing novel builds: Pre-existing novel fixes moved during this update do not retrospectively display the new -nxxxx suffix. Only newly created builds reflect the updated versioning format.

Lightwell Network API provides programmatic access to packages and security data

The Lightwell Network API provides a single, stable interface to integrate Lightwell data into your build pipelines, audit workflows, and automation tooling. With the Lightwell Network API, you can query the following types of information:

• Packages and repositories: List repositories by ecosystem and list packages within a repository with filtering by name, version, ecosystem, and release date. Retrieve metadata for each package, including available versions, release dates, repository placement, and current status.
• Common Vulnerabilities and Exposures (CVE) data: Query a CVE ID to see which Lightwell packages are affected, which have a fix available, and which fixes are in progress. Query a specific package to get all CVEs that apply to it along with their remediation status.

For more information about the Lightwell Network API, see the LightwellAPI documentation in the Related information section.