Is chainguard.dev/melange safe to use?

chainguard.dev/melange has 1 known vulnerabilities on the latest version (v0.50.4). DepScope rates its health at 65/100 (moderate risk).

What is the latest version of chainguard.dev/melange?

The latest version of chainguard.dev/melange is v0.50.4, released 2026-04-28.

Yes. chainguard.dev/melange has 1 known vulnerabilities. See depscope.dev/pkg/go/chainguard.dev/melange for details.

No, chainguard.dev/melange is actively maintained. Latest release: v0.50.4 (2026-04-28).

DepScope has no curated alternatives for chainguard.dev/melange at this time.

chainguard.dev/melange is licensed under Apache-2.0.

govv0.50.4

License Apache-2.0permissive231 versions0 deps

/ 100

Health

safe to use

chainguard.dev/[email protected] is safe to use (health: 65/100)

Health breakdown0 – 100

25/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

0/15

community

Vulnerabilities

1 low

Advisories (1)

Severity	ID	Summary	Fixed in
unknown	CVE-2026-29049	`melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange	—

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/go/chainguard.dev/melange

Last updated · 2026-04-28T20:51:56Z