# Chainguard Libraries for JavaScript and CVE remediation for Python libraries

URL: https://chainguard-docs-preview-git-okta-scim-update.chainguard.app/software-security/learning-labs/ll202510.md
Last Modified: September 28, 2026
Tags: Learning Labs, Chainguard Libraries

Learning Lab for October 2025 about Chainguard Libraries for JavaScript and CVE remediation for Python libraries


The October 2025 Learning Lab with Manfred Moser covers Chainguard Libraries for
JavaScript and CVE remediation with Chainguard Libraries for Python. It starts
with an overview about libraries and the JavaScript ecosystem and moves on to a
demo with npm and pnpm. In the second section Manfred explains the approach for
CVE remediation and shows an example project with remediation and scanning with
grype.

[Watch the video on YouTube](https://www.youtube.com/watch?v=6V7IHtYekwM)


## Sections

* [0:00](https://www.youtube.com/watch?v=6V7IHtYekwM) Introduction
* [1:55](https://www.youtube.com/watch?v=6V7IHtYekwM&t=115s) Agenda
* [2:54](https://www.youtube.com/watch?v=6V7IHtYekwM&t=174s) Secure container and the role of libraries
* [5:20](https://www.youtube.com/watch?v=6V7IHtYekwM&t=320s) Software supply chain for libraries and security
* [6:51](https://www.youtube.com/watch?v=6V7IHtYekwM&t=411s) Chainguard Libraries and the JavaScript ecosystem
* [14:33](https://www.youtube.com/watch?v=6V7IHtYekwM&t=873s) Malware in the npm ecosystem
* [18:39](https://www.youtube.com/watch?v=6V7IHtYekwM&t=1119s) Chainguard Libraries for JavaScript
* [25:57](https://www.youtube.com/watch?v=6V7IHtYekwM&t=1557s) Demoes with npm and pnpm
* [33:50](https://www.youtube.com/watch?v=6V7IHtYekwM&t=2030s) Troubleshooting results and additional demos
* [41:34](https://www.youtube.com/watch?v=6V7IHtYekwM&t=2494s) Chainguard Libraries for Python
* [43:39](https://www.youtube.com/watch?v=6V7IHtYekwM&t=2619s) CVE remediation process and examples
* [52:03](https://www.youtube.com/watch?v=6V7IHtYekwM&t=3123s) Demoes with uv and grype
* [56:25](https://www.youtube.com/watch?v=6V7IHtYekwM&t=3385s) Further resources
* [57:35](https://www.youtube.com/watch?v=6V7IHtYekwM&t=3455s) Next up
* [58:18](https://www.youtube.com/watch?v=6V7IHtYekwM&t=3498s) Questions
* [1:06:00](https://www.youtube.com/watch?v=6V7IHtYekwM&t=3960s) Wrapping up

## JavaScript demo

The demonstration of Chainguard Libraries for JavaScript walks through the
[minimal example for
pnpm](/chainguard/libraries/javascript/build-configuration/#pnpm-minimal) with
direct access to the registry and with access to a local repository manager, and
shows an equivalent project with npm as well.

## CVE remediation demo

The example project to showcase the CVE remediation for Python packages uses a
simple project setup for use with `uv`.

The pyproject.toml file contains all relevant configuration:

```toml
[project]
name = "uv-example"
version = "0.1.0"
description = "An example project with uv for Chainguard Libraries"
readme = "README.md"
requires-python = ">=3.13"
dependencies = [
    "flask==2.0.0",          # fix with 2.0.0+cgr.1
    "werkzeug==3.0.2",       # fix in 3.0.2+cgr.1
    "urllib3==1.26.7",       # fix in 1.26.7+cgr.1
    "setuptools==77.0.3"     # fix in 77.0.3+cgr.1
]

[[tool.uv.index]]
name = "nexus"
#url = "http://localhost:8081/repository/python-all/simple/"
url = "http://localhost:8081/repository/python-all-remediated/simple/"
```

Note the declared dependencies just using the plain semantic version. These
versions are resolved to the specific versions with the CVE fixes in place if
the remediated packages are available.

The script sets up a new virtual environment, builds the project with uv, and
then scans for vulnerabilities with grype:

```shell
rm -rf bin dist uv.lock
python3 -m venv .
source ./bin/activate
uv cache clean
rm -rf lib include
uv build
uv lock
grype .
```

## Resources

* [Slide deck](/downloads/learning-lab-javascript-cve-202510.pdf)
* [Chainguard Libraries product site](https://www.chainguard.dev/libraries)
* [Chainguard Libraries documentation](/chainguard/libraries/)
* [Chainguard Libraries for JavaScript documentation](/chainguard/libraries/javascript/)
* [Chainguard Libraries for Python documentation](/chainguard/libraries/python/)
* [CVE remediation for Chainguard Libraries](/chainguard/libraries/policies-and-security/cve-remediation/)
* [Vulnerability scanners and Chainguard Libraries](/chainguard/libraries/policies-and-security/scanners/)