The State of Trusted Open Source Report

This report analyzes open source consumption patterns, vulnerability trends, and remediation data across container image projects from Q4 2025 through Q1 2026.

• •Python remains the most widely deployed image (72.1% of customers), and PostgreSQL grew 73% quarter-over-quarter, driven by AI workloads like vector search and RAG.
• •Language ecosystems account for over 50% of the top 25 production images, with Python, Node, Java, Go, and .NET defining the dominant runtime layer.
• •Chainguard Base became the 5th most-deployed image, serving as a customizable secure foundation for CI/CD pipelines and developer tooling.
• •CVE instances rose 145% to 377 unique vulnerabilities and 33,931 fix instances, while median remediation time held flat at 2.0 days with 97.9% of high-severity CVEs fixed within one week.