Using Dependabot and Renovate with Chainguard Libraries

Community guidance. Chainguard does not currently publish an official guide for Dependabot or Renovate with Chainguard Libraries (the published Renovate guide covers Chainguard Containers image tags, not Libraries packages). The steps below are a practical starting point, not officially supported configuration.

Point the bot at the Chainguard index for the relevant ecosystem and supply a pull token.

For npm, use _auth (base64 of IDENTITY_ID:TOKEN), not _authToken:

registry=https://libraries.cgr.dev/javascript/
//libraries.cgr.dev/javascript/:_auth=<base64 of identity-id:token>

Setting a username and _password instead of _auth does not work with npm. Yarn Berry uses npmAuthIdent with a raw (non-base64) identity:token.

When a bot PR fails on an integrity mismatch

Because Chainguard rebuilds packages from source, checksums can differ from the public registry, so a bot's update can fail on an integrity check. Fix it in place with chainctl libraries update-hashes, which updates the lockfile integrity hashes to Chainguard's checksums while preserving your locked dependency versions, without re-resolving your dependency graph (it appends Chainguard hashes by default; use --replace to override existing ones). Regenerating the lockfile against the Chainguard index is a heavier-handed backup option.