TLDR Tech / InfoSec
Project Lightwell
IBM and Red Hat launched Project Lightwell with a $5 billion commitment to secure open source supply chains. The system backports vulnerability fixes to exact dependency versions already in production using 20,000 engineers and AI to patch packages across Maven/Java, with PyPI, npm, and Go planned. It works through dependency manifests like pom.xml without accessing source code, delivering signed patches with SLAs to repositories you control.
Read the full story