InfoQ - Application Security - News

Buildpacks Move the Container Hardening Control Point Away from the Dockerfile

Mark Silvester — Mon, 10 Aug 2026 07:00:00 GMT

Cloud Native Buildpacks, which graduated within the CNCF in July 2026, move base image choice out of per-service Dockerfiles into a single builder owned by platform engineering, enabling fleet-wide patching. BellSoft's hardened Paketo builder is the latest sign that vendors now treat the builder, not the Dockerfile, as the container security control point.

By Mark Silvester

npm Staged Publishing Available, Adding a Human Approval Step before Packages Go Live

Daniel Curtis — Fri, 07 Aug 2026 06:12:00 GMT

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags.

By Daniel Curtis

HashiCorp Ships Public Beta of Vault Kubernetes Key Management

Mark Silvester — Mon, 03 Aug 2026 10:00:00 GMT

HashiCorp has released a public beta of Vault Kubernetes key management, a KMS v2-compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise, moving the key encryption keys that protect etcd data out of the cluster and into a separately governed trust domain.

By Mark Silvester