migration
Safeguard articles tagged "migration" — guides, analysis, and best practices for software supply chain and application security.
17 articles
tfsec to Trivy IaC: 2026 Migration Playbook
tfsec has been folded into Trivy for over a year and Aqua has stopped feature work on tfsec. We migrated three platforms in 2026 and documented what actually breaks.
CycloneDX 1.7 Migration Guide From 1.5
A practical migration path from CycloneDX 1.5 to 1.7 covering schema changes, machine learning BOM additions, formulation, and the tooling adjustments required.
Post-Quantum Cryptography Migration for Software Supply Chains
NIST finalized ML-KEM, ML-DSA, and SLH-DSA in 2024. Here's what it means for Sigstore, package registry signing, TLS, and the harvest-now-decrypt-later problem.
Cosign v3.0 Migration Guide for Production Teams
Sigstore Cosign v3.0 flips four behaviours to defaults: bundle format, trusted root, signing config, and statement-based attestations. Here's a clean upgrade plan.
The moment npm Package in 2025: Security Review and Safe Usage
The moment npm package is in maintenance mode, not abandoned. Here is what that means for security, when it is fine to keep, and what to migrate to when it is not.
react-scripts After Create React App: A Security Guide
With Create React App deprecated, react-scripts is now in maintenance mode. Here is what that means for the security of projects still depending on it.
xmldom Is Deprecated: Vulnerabilities and Migration Options
The npm xmldom package was replaced by @xmldom/xmldom years ago, yet the old name still sits in countless lockfiles with unfixed advisories. Here is how to find it and migrate.
Python 2 vs Python 3: Differences and Why 2.x Is a Security Liability
The real differences between Python 2 and Python 3 — print, strings, division, integers — and why running anything on 2.x after its end of life is now a security decision, not a compatibility one.
Jakarta and Java: A Security Guide to the Namespace Migration
Jakarta Java is the successor to Java EE, and the javax-to-jakarta namespace shift has real security implications for anyone still running the old libraries.
Data Pipeline Platform Migration Security
Moving from one orchestration platform to another surfaces hidden trust relationships. A security-first migration plan for Airflow, Dagster, and Prefect transitions.
Rust Edition Migration Security Notes
Field notes from migrating a production workspace from Rust 2018 to 2021, and what to watch for when 2024 lands in edition transitions.
Migrating SBOM Tooling Providers
A practical field guide to switching SBOM tooling vendors without losing historical data, breaking compliance reports, or annoying the auditors.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.