Plugin: Lightwell Dependency Checker

[bobbyjohnstx]

Summary

Check Java and Python dependencies against Red Hat Lightwell's remediated and validated repositories. Surfaces supply chain patch availability at development time — no other coding tool has this.

Plugin Details

• Red Hat product: Red Hat Lightwell Network (GA July 8, 2026)
• Plugin hooks: tool
• Complexity: Medium
• Priority: 7 (Medium value, differentiator)

Tools

Tool	Description
lightwell_check_deps	Parse pom.xml/build.gradle/requirements.txt/Pipfile.lock, check each dependency against Lightwell repos
lightwell_check_package	Check single package against Lightwell (patch availability, .rhlw suffix version, CVE details)
lightwell_osv	Query Lightwell's OSV vulnerability data for a package
lightwell_provenance	Verify SLSA Level 3 build provenance for a Lightwell artifact
lightwell_config_check	Analyze build config (settings.xml, build.gradle, pip.conf) for Lightwell repo configuration

Ecosystem coverage (as of Aug 2026)

• Java (Maven/Gradle) — GA
• Python (pip/Pipenv/Poetry) — GA
• npm, Go, Rust, .NET — NOT covered (npm and Go on roadmap)

How it queries Lightwell

• Java: packages.redhat.com/lightwell/java/remediated and /validated
• Python: packages.redhat.com/lightwell/network/python/remediated and /validated
• OSV data: packages.redhat.com/lightwell/osv/java/remediated

Novel value

Snyk and Dependabot find vulnerabilities; Lightwell actually patches them without version upgrades. This plugin surfaces that capability at development time — vulnerability gap drops from 45-90 days to the next dependency resolve.

---

From: Red Hat Product Integration Plugin Ideas