Mend AI

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 104
   • Updated detection Mend AI Runtime Protection | Guardrails multi-language support
2. docs update Oct 10, 2026 · issue 100

   Mend AI: Merges mergeable env options with RENOVATE_CONFIG, enabling environment-variable-based config to compose cleanly with the main config object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a strong type for Containerbase's known tools in util/exec, improving type safety for tool execution.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Containerbase Sidecar image is removed from the Docker build process (docker-build-process); setups relying on it will need to be updated.
3. docs update Oct 9, 2026 · issue 099

   Mend Renovate now merges env-sourced host rules and mergeable options with RENOVATE_CONFIG instead of overwriting it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Merges mergeable env options with RENOVATE_CONFIG rather than replacing it, via config change in #46844.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Appends env host rules to RENOVATE_CONFIG host rules rather than overwriting them, via config change in #46843.
   • Merges mergeable env options with RENOVATE_CONFIG rather than replacing it, via config change in #46844.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. docs update Oct 8, 2026 · issue 097

   Mend Renovate gains credential-aware Crate git-index lookups, datasource reporting, and SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. action extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Applies host rule credentials when resolving crate datasource git index registries, enabling authenticated private registry lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reports which datasource served a dependency lookup, surfacing provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. information during version resolution.
   • Extracts slsa-framework/actions/* action references in the github-actions manager for version tracking.
   • Adds gh-aw-actions/setup-cli with.version field support in the github-actions manager.
   • Switches setup-deno in the github-actions manager to use GitHub Releases as its datasource.

   +1 more show less

   • Removes the java-maven tool from util/exec, retiring built-in Maven tool management.
   • Applies host rule credentials when resolving crate datasource git index registries, enabling authenticated private registry lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reports which datasource served a dependency lookup, surfacing provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. information during version resolution.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The java-maven tool is removed from util/exec; any configuration relying on Renovate's built-in Maven tool management will break and must use an external Maven installation.
5. docs update Oct 6, 2026 · issue 096

   Mend AI: Adds a new Send Email workflow action that notifies of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.

6. docs update Oct 6, 2026 · issue 096

   Mend Renovate gains rich version constraint support for Gradle Groovy/Kotlin DSL and re-applies auto-complete settings to existing Azure PRs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Re-applies auto-complete settings to existing pull requests on the Azure DevOps platform (platform/azure).

   1 more in Everything

7. docs update Oct 5, 2026 · issue 095

   Mend AI 26.9.2 adds workflow email controls with per-user/group recipients, a new Send Email action, and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Get immediate notification when a newly published CVE affects your org, outside of any scheduled scan cycle.
   📍In the platform, go to Workflows › your workflow › Actions, add a Send Email action, configure the delivery frequency, and select the specific users or groups to notify.
   • Enhances workflow email notifications to allow creators to select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

   2 details in Everything

8. docs update Oct 5, 2026 · issue 095

   Mend Renovate adds rich version constraint support for Gradle Groovy/Kotlin DSL and broader vulnerability fix coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

9. docs update Oct 5, 2026 · issue 095

   Mend Container raises the image scan size limit from 2 GB to 4 GB, enabling scanning of larger container images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

10. (05-October-2026) Oct 5, 2026 · issue 096
    • Updated detection Mend AI Runtime Protection | Guardrails multi-language threat detection
11. docs update Sep 28, 2026 · issue 088

    Mend CLI mend code gains --print-to-console flag and auto-excludes /_MACOSX/..* metadata from all SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. engines⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Tail SAST scan output in CI pipelines without having to locate the log file — useful for real-time visibility in pipeline runners.
    copy

    $ mend code --print-to-console

    • Adds --print-to-console flag to mend code CLI SAST scans, streaming scan logs directly to stdout in addition to the log file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, preventing macOS system files from interfering with the TreeSitter parser on Windows.
    • Adds --print-to-console flag to mend code CLI SAST scans, streaming scan logs directly to stdout in addition to the log file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

12. docs update Sep 28, 2026 · issue 088

    Mend Renovate adds gomod versioning support and applies downgrade guard across all versioning schemes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds gomod versioning scheme, enabling Renovate to version-match Go module dependencies and query pseudo-versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Applies the downgrade guard to every versioning scheme, not just select ones, preventing accidental downgrades across all package managers.
    • Extends Poetry versioning to accept PEP 440 specifiers instead of relying on a lookup special case.
    • Adds gomod versioning scheme, enabling Renovate to version-match Go module dependencies and query pseudo-versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

13. (27-September-2026) Sep 27, 2026 · issue 088

    Mend AI extends Suppress and Review triage actions to the individual finding level for more precise control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

14. docs update Sep 25, 2026 · issue 085

    Mend AI: Adds matchIsBreaking package rule option to match dependencies based on whether an update is breaking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ BREAKING ON UPGRADE

    • !The addLabel, commitFiles, and getRepoForceRebase methods are dropped from the platform API as unreachable code.
15. docs update Sep 25, 2026 · issue 085

    Mend Renovate adds matchIsBreaking package rule option, JSONataJSONataA query and transformation language for JSON data, maintained as an open-source project. Cyber tools use it to extract, reshape, and map JSON payloads without writing custom parsing code. $matchRegexOrGlob, Nix zstd channel tarball support, and Mise conda backend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Use matchIsBreaking in a package rule to auto-merge only non-breaking updates while requiring manual review for breaking ones.
    renovate.json copy

    {
      "packageRules": [
        {
          "matchIsBreaking": false,
          "automerge": true
        },
        {
          "matchIsBreaking": true,
          "automerge": false,
          "labels": ["breaking-change"]
        }
      ]
    }

    • Adds matchIsBreaking package rule option to let users target or skip breaking updates in Renovate configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to JSONata expressions for regex-or-glob pattern matching in config queries.
    • Supports conda backend in the mise manager for Conda-based dependency updates.
    • Supports zstd channel tarballs in the nix manager.
    • Adds matchIsBreaking package rule option to let users target or skip breaking updates in Renovate configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to JSONata expressions for regex-or-glob pattern matching in config queries.

    2 more in Everything

16. docs update Sep 17, 2026 · issue 077

    Renovate adds minimumReleaseAgeBuffer, Dockerfile apk add extraction, Forgejo support, and an uppercase template helper⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds minimumReleaseAgeBuffer config option to control a buffer window around minimum release age checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extracts apk add packages from RUN instructions in Dockerfiles via manager/dockerfile.
    • Adds uppercase template helper via util/template for use in Renovate template expressions.
    • Supports Forgejo preset references (e.g. forgejo>) in manager/renovate-config.
    • Detects forgejo-tags datasource for git-tag sources in manager/terragrunt.

    +2 more show less

    • Treats Forgejo like Gitea for onboarding-branch rebase and config-hash detection in workers/onboarding.
    • Attempts direct merge before falling back to the merge queue on platform/github.
    • Adds minimumReleaseAgeBuffer config option to control a buffer window around minimum release age checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extracts apk add packages from RUN instructions in Dockerfiles via manager/dockerfile.
    • Adds uppercase template helper via util/template for use in Renovate template expressions.
    • Supports Forgejo preset references (e.g. forgejo>) in manager/renovate-config.
    • Detects forgejo-tags datasource for git-tag sources in manager/terragrunt.

    +1 more show less

    • Treats Forgejo like Gitea for onboarding-branch rebase and config-hash detection in workers/onboarding.

    1 more in Everything

17. docs update Sep 16, 2026 · issue 076

    Mend AI: Supports abatilo/actions-poetry poetry-version input for automated version tracking in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports actions-rust-lang/setup-rust-toolchain toolchain input for automated version tracking in GitHub Actions workflows.
    • Supports aquaproj/aqua-installer aqua_version input for automated version tracking in GitHub Actions workflows.
    • Supports astral-sh/ruff-action version input for automated version tracking in GitHub Actions workflows.
    • Supports azure/setup-kubectl version input for automated version tracking in GitHub Actions workflows.
    • Supports biomejs/setup-biome version input for automated version tracking in GitHub Actions workflows.

    +42 more show less

    • Supports bufbuild/buf-setup-action version input for automated version tracking in GitHub Actions workflows.
    • Supports cargo-bins/cargo-binstall version input for automated version tracking in GitHub Actions workflows.
    • Supports cloudflare/wrangler-action wranglerVersion input for automated version tracking in GitHub Actions workflows.
    • Supports cycjimmy/semantic-release-action semantic_version input for automated version tracking in GitHub Actions workflows.
    • Supports dagger/dagger-for-github version input for automated version tracking in GitHub Actions workflows.
    • Supports dart-lang/setup-dart sdk input for automated version tracking in GitHub Actions workflows.
    • Supports erlef/setup-beam version inputs for automated version tracking in GitHub Actions workflows.
    • Supports foundry-rs/foundry-toolchain version input for automated version tracking in GitHub Actions workflows.
    • Supports GitTools/actions/gitversion/setup versionSpec input for automated version tracking in GitHub Actions workflows.
    • Supports goreleaser/goreleaser-action version input for automated version tracking in GitHub Actions workflows.
    • Supports hashicorp/setup-packer version input for automated version tracking in GitHub Actions workflows.
    • Supports helm/chart-releaser-action version input for automated version tracking in GitHub Actions workflows.
    • Supports helm/kind-action version inputs for automated version tracking in GitHub Actions workflows.
    • Supports j178/prek-action prek-version input for automated version tracking in GitHub Actions workflows.
    • Supports jfrog/setup-jfrog-cli version input for automated version tracking in GitHub Actions workflows.
    • Supports julia-actions/setup-julia version input for automated version tracking in GitHub Actions workflows.
    • Supports mozilla-actions/sccache-action version input for automated version tracking in GitHub Actions workflows.
    • Supports opentofu/setup-opentofu tofu_version input for automated version tracking in GitHub Actions workflows.
    • Supports peaceiris/actions-hugo hugo-version input for automated version tracking in GitHub Actions workflows.
    • Supports pulumi/actions pulumi-version input for automated version tracking in GitHub Actions workflows.
    • Supports PyO3/maturin-action maturin-version input for automated version tracking in GitHub Actions workflows.
    • Supports raven-actions/actionlint version input for automated version tracking in GitHub Actions workflows.
    • Supports reviewdog/action-setup reviewdog_version input for automated version tracking in GitHub Actions workflows.
    • Supports snok/install-poetry version input for automated version tracking in GitHub Actions workflows.
    • Supports stCarolas/setup-maven maven-version input for automated version tracking in GitHub Actions workflows.
    • Supports subosito/flutter-action flutter-version input for automated version tracking in GitHub Actions workflows.
    • Supports supabase/setup-cli version input for automated version tracking in GitHub Actions workflows.
    • Supports baptiste0928/cargo-install crate and version inputs for automated version tracking in GitHub Actions workflows.
    • Supports conda-incubator/setup-miniconda version inputs for automated version tracking in GitHub Actions workflows.
    • Supports crystal-lang/install-crystal version inputs for automated version tracking in GitHub Actions workflows.
    • Supports cue-lang/setup-cue version input for automated version tracking in GitHub Actions workflows.
    • Supports graalvm/setup-graalvm version inputs for automated version tracking in GitHub Actions workflows.
    • Supports jwlawson/actions-setup-cmake cmake-version input for automated version tracking in GitHub Actions workflows.
    • Supports moonrepo/setup-rust channel input for automated version tracking in GitHub Actions workflows.
    • Supports moonrepo/setup-toolchain version inputs for automated version tracking in GitHub Actions workflows.
    • Supports superfly/flyctl-actions/setup-flyctl version input for automated version tracking in GitHub Actions workflows.
    • Supports swift-actions/setup-swift swift-version input for automated version tracking in GitHub Actions workflows.
    • Supports WillAbides/setup-go-faster go-version input for automated version tracking in GitHub Actions workflows.
    • Supports extractions/setup-just just-version input for automated version tracking in GitHub Actions workflows.
    • Supports gradle/actions/setup-gradle gradle-version input for automated version tracking in GitHub Actions workflows.
    • Supports hashicorp/setup-terraform terraform_version input for automated version tracking in GitHub Actions workflows.
    • Supports terraform-linters/setup-tflint tflint_version input for automated version tracking in GitHub Actions workflows.

    47 more in Everything

18. (16-September-2026) Sep 16, 2026 · issue 077

    Mend AI Guardrails SDK download now requires a Mend Activation Key at install time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ BREAKING ON UPGRADE

    • !Existing Guardrails SDK installations with unpinned versions that attempt to re-install dependencies will now require a Mend Activation Key during the install step.
19. docs update Sep 15, 2026 · issue 075

    Mend Renovate's GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. manager gains version-input support for 50+ new actions across tools like Terraform, kubectl, Flutter, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds version-input support for hashicorp/setup-terraform's terraform_version in the manager/github-actions manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds version-input support for terraform-linters/setup-tflint's tflint_version in the manager/github-actions manager.
    • Adds version-input support for extractions/setup-just's just-version in the manager/github-actions manager.
    • Adds version-input support for gradle/actions/setup-gradle's gradle-version in the manager/github-actions manager.
    • Adds version-input support for azure/setup-kubectl's version in the manager/github-actions manager.

    +45 more show less

    • Adds version-input support for aquaproj/aqua-installer's aqua_version in the manager/github-actions manager.
    • Adds version-input support for subosito/flutter-action's flutter-version in the manager/github-actions manager.
    • Adds version-input support for peaceiris/actions-hugo's hugo-version in the manager/github-actions manager.
    • Adds version-input support for snok/install-poetry's version in the manager/github-actions manager.
    • Adds version-input support for jfrog/setup-jfrog-cli's version in the manager/github-actions manager.
    • Adds version-input support for helm/chart-releaser-action's version in the manager/github-actions manager.
    • Adds version-input support for helm/kind-action's version inputs in the manager/github-actions manager.
    • Adds version-input support for erlef/setup-beam's version inputs in the manager/github-actions manager.
    • Adds version-input support for GitTools/actions/gitversion/setup's versionSpec in the manager/github-actions manager.
    • Adds version-input support for opentofu/setup-opentofu tofu_version in the manager/github-actions manager.
    • Adds version-input support for dart-lang/setup-dart sdk in the manager/github-actions manager.
    • Adds version-input support for graalvm/setup-graalvm version inputs in the manager/github-actions manager.
    • Adds version-input support for moonrepo/setup-rust channel in the manager/github-actions manager.
    • Adds version-input support for moonrepo/setup-toolchain version inputs in the manager/github-actions manager.
    • Adds version-input support for swift-actions/setup-swift swift-version in the manager/github-actions manager.
    • Adds version-input support for WillAbides/setup-go-faster go-version in the manager/github-actions manager.
    • Adds version-input support for conda-incubator/setup-miniconda version inputs in the manager/github-actions manager.
    • Adds version-input support for crystal-lang/install-crystal version inputs in the manager/github-actions manager.
    • Adds version-input support for cue-lang/setup-cue version in the manager/github-actions manager.
    • Adds version-input support for jwlawson/actions-setup-cmake cmake-version in the manager/github-actions manager.
    • Adds version-input support for superfly/flyctl-actions/setup-flyctl version in the manager/github-actions manager.
    • Adds version-input support for baptiste0928/cargo-install crate and version in the manager/github-actions manager.
    • Adds version-input support for abatilo/actions-poetry poetry-version in the manager/github-actions manager.
    • Adds version-input support for actions-rust-lang/setup-rust-toolchain toolchain in the manager/github-actions manager.
    • Adds version-input support for astral-sh/ruff-action version in the manager/github-actions manager.
    • Adds version-input support for biomejs/setup-biome version in the manager/github-actions manager.
    • Adds version-input support for bufbuild/buf-setup-action version in the manager/github-actions manager.
    • Adds version-input support for cargo-bins/cargo-binstall version in the manager/github-actions manager.
    • Adds version-input support for cloudflare/wrangler-action wranglerVersion in the manager/github-actions manager.
    • Adds version-input support for cycjimmy/semantic-release-action semantic_version in the manager/github-actions manager.
    • Adds version-input support for dagger/dagger-for-github version in the manager/github-actions manager.
    • Adds version-input support for foundry-rs/foundry-toolchain version in the manager/github-actions manager.
    • Adds version-input support for goreleaser/goreleaser-action version in the manager/github-actions manager.
    • Adds version-input support for hashicorp/setup-packer version in the manager/github-actions manager.
    • Adds version-input support for j178/prek-action prek-version in the manager/github-actions manager.
    • Adds version-input support for julia-actions/setup-julia version in the manager/github-actions manager.
    • Adds version-input support for mozilla-actions/sccache-action version in the manager/github-actions manager.
    • Adds version-input support for pulumi/actions pulumi-version in the manager/github-actions manager.
    • Adds version-input support for PyO3/maturin-action maturin-version in the manager/github-actions manager.
    • Adds version-input support for raven-actions/actionlint version in the manager/github-actions manager.
    • Adds version-input support for reviewdog/action-setup reviewdog_version in the manager/github-actions manager.
    • Adds version-input support for stCarolas/setup-maven maven-version in the manager/github-actions manager.
    • Adds version-input support for supabase/setup-cli version in the manager/github-actions manager.
    • Adds version-input support for aws-actions/amazon-ecs-render-task-definition's image in the manager/github-actions manager.
    • Adds selector lockfile update support to the manager/mise manager.
    • Adds version-input support for hashicorp/setup-terraform's terraform_version in the manager/github-actions manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds selector lockfile update support to the manager/mise manager.

    48 more in Everything

20. docs update Sep 8, 2026 · issue 068

    Mend SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. adds multi-base-branch scanning on Azure DevOps and Bitbucket Cloud with per-branch policy support.

    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling per-branch monitoring and policy enforcement.
    • Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes., including Path Traversal (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22), OS Command Injection (CWE-78), XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. (CWE-79), SQL Injection (CWE-89), LDAP InjectionLDAP InjectionAn attack technique where unsanitized user input is embedded into LDAP queries, manipulating directory lookups to bypass authentication or extract data. Tools use it to test directory services for input-validation flaws. (CWE-90), Code Injection (CWE-94), Log Injection (CWE-117), Improper Certificate Validation (CWE-295), Open Redirect (CWE-601), SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. (CWE-918), and NoSQL/query-language injection (CWE-943).
    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling per-branch monitoring and policy enforcement.

    1 more in Everything

21. docs update Sep 8, 2026 · issue 068

    Mend AI 26.8.2 adds IDE/AI-agent suppression tooling and a unified vulnerability remediation experience with a Top Fix column.

    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppress/unsuppress actions across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.
    • Introduces a unified vulnerability remediation experience with standardized fix logic, a new Top Fix column in the Findings table, and an updated Remediation tab to reduce noise and improve fix consistency.
    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppress/unsuppress actions across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The unified remediation update may result in fewer remediation suggestions per vulnerability due to increased accuracy of fix logic.
22. docs update Sep 8, 2026 · issue 068

    Mend Renovate adds AWS S3 Helm chart repo support, pixi optional channel options, and pnpm no-frozen-lockfile handling

    • Supports AWS S3 as a Helm charts repository source via datasource/helm.
    • Adds support for optional channel options in the manager/pixi manager.
    • Passes --no-frozen-lockfile to pnpm when performing lock file updates in manager/npm.
    • Supports AWS S3 as a Helm charts repository source via datasource/helm.

    2 more in Everything

23. docs update Aug 31, 2026 · issue 060

    Mend Renovate adds protobuf + gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. exporter support and GitHub GraphQL rate-limit handling across v44.49–44.52.

    • Adds protobuf + gRPC exporter support to instrumentation (closes #36073).
    • Sets isExecutable on added and modified files in the manager/copier manager.
    • Returns a RepositoryResult during the onboarding phase (closes #22198).

    3 details in Everything

24. docs update Aug 31, 2026 · issue 060

    Mend API 3.0 launches with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, cursor pagination, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs in JSON and YAML

    • Adds Mend API 3.0, a REST-compliant API with broader programmatic access for any user with Mend credentials, authenticated via a user key from the Mend Platform profile page.
    • Introduces per-organization JWT token authentication with 10-minute expiration for improved security.
    • Supports cursor pagination and result-size limiting for scalable data retrieval.
    • Publishes OpenAPI description files downloadable as 3.0.json and 3.0.yaml for client generation and tooling integration.

    4 details in Everything

25. docs update Aug 24, 2026 · issue 055
    • Introduces the AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — available via the Mend Platform reporting interface and API.
    • Supports industry-standard CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3.0.1 export formats for AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. reports, enabling interoperability with existing SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. toolchains.
    • Scopes AI-BOM reports at organization, application, and project levels with metadata-only exports to preserve data privacy.
26. docs update Aug 24, 2026 · issue 055

    Mend AI 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar.

    • Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
    • Adds comprehensive API support for managing global workflows.
    • Updates the Administration page sidebar with a categorized, collapsible navigation structure, adding a dedicated AI Usage tab under a new AI category and sub-headers for AI, Code, and Dependencies within Engine Settings.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AI Usage settings have been moved from the General tab to a dedicated AI Usage tab under the new AI category in the Administration sidebar — any documentation or runbooks pointing to the General tab for AI Usage settings will need to be updated.
27. docs update Aug 24, 2026 · issue 055

    Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. remediation.

    └──▷ USE IT
    Override the auto-generated description on a Renovate dependency update PR using the new overrideDescription config option.
    renovate.json copy

    {
      "overrideDescription": "Managed dependency update — reviewed by platform team"
    }

    • Adds overrideDescription option to Renovate config, allowing custom descriptions to be set on dependency updates.
    • Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening which files it detects.
    • Onboarding summary view now shows What to Expect first, improving the initial setup experience.
    • Onboarding clarifies that security PRs do not count against PR limits.
    • Gradle manager now includes a link to Dependency Verification documentation.

    5 details in Everything

28. docs update Aug 24, 2026 · issue 055

    Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status and branding in the UI.

    • Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and base image/layer detection.
    • Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

    2 details in Everything

29. (24-August-2026) Aug 24, 2026 · issue 055

    Mend AI adds an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 formats via UI and API.

    • New AI Bill of Materials (AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) report available through the Mend Platform reporting interface and API, generating a metadata-only inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — at organization, application, and project scopes.
    • AI-BOM exports support industry-standard CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3.0.1 formats, enabling downstream tooling and compliance workflows that consume either standard.

    2 details in Everything

30. (09-August-2026) Aug 9, 2026 · release notes

    Mend AI adds framework-based AI agent discovery and entity suppression capabilities in open beta.

    • Adds framework-based agent discovery to detect AI agents, connected tools, and Model Context Protocols (MCPs) within projects
    • Enables entity-level suppression and review of Models, System Prompts, Agent Configs, and Agents with triage status tracking

    2 details in Everything

31. (29-June-2026) Jun 29, 2026 · release notes

    Mend AI adds lifecycle status detection for AWS Bedrock, watsonx, Azure AI Foundry models; CLI red-teaming automation

    └──▷ USE IT
    Automate red-teaming in CI/CD by defining and running tests via the new CLI interface without manual UI interaction.
    shell copy

    mend-ai redteaming define --target <model_target> --prompt_lang traditional-chinese
    mend-ai redteaming run --config <config_file>
    mend-ai redteaming results --run_id <run_id>

    Configure automation workflows to filter and manage models approaching End-of-Life based on their detected lifecycle state.
    📍In the Mend Platform UI, go to Automation › Workflow Conditions and add a filter for Model Lifecycle State or EOL Timeline.
    • Adds new automation workflow conditions that filter models based on their lifecycle state or specific End-of-Life timelines.
    • Adds CLI capability to define, run, configure targets for, trigger, and retrieve results of AI Red Teaming tests for CI/CD integration.
    • Extends Red Teaming support to Traditional Chinese prompts.

    3 details in Everything

32. (18-May-2026) May 18, 2026 · release notes

    Mend AI 18-May-2026 adds Guardrails Docker deployment, Langflow integration, and implicit prompt detection.

    └──▷ TRY IT
    Deploy the standalone Guardrails server via Docker to secure any environment.
    copy

    $ docker run -p 8080:8080 mend/guardrails-server

    • Guardrails can now be deployed as a standalone API server with Docker, extending protection beyond in-app SDK integrations to any environment or language.
    • The Guardrails SDK adds Langflow integration for agentic workflow security.
    • Enhanced Harmful Content detection for implicit prompts is now available in the Guardrails SDK.
    • Mend AI’s AI Agents Configuration Risk feature leaves open beta and becomes generally available.

    4 details in Everything

33. (11-May-2026) May 11, 2026 · release notes

    Mend AI adds red-teaming probes, compliance mapping, and a standalone mend ai scan CLI command

    • Adds new adversarial testing capabilities including age-restricted goods, dangerous content, cross-session leaks, unverifiable claims tests, hexadecimal/Morse/emoji encoding strategies, and multi-turn escalation.
    • Introduces automatic mapping of red-team results to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against., NIST, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language., EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., and DoD AI Ethics frameworks with configurable compliance thresholds.
    • Adds the mend ai scan command to enable AI scanning separately from SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. via the Mend CLI.

    3 details in Everything

34. (04-May-2026) May 4, 2026 · release notes

    Mend AI (04-May-2026): Runtime Protection open beta, streaming red teaming, custom parsers, and multi-language support

    └──▷ HOW TO FIND IT
    Use custom parsers to test proprietary apps that standard tools don't support.
    📍In Red Teaming, navigate to the Custom Parsers section and upload your parser logic for supported proprietary applications.
    Configure the HTTP connector to distinguish between successful responses and errors based on status codes.
    📍In the Application Red Teaming settings, open the HTTP connector configuration and enable Application status code filtering to define valid vs. error response codes.
    • Mend AI Runtime Protection enters Open Beta as an in-app guardrails solution for real-time protection against prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., jailbreak attempts, sensitive data exposure, and harmful content.
    • Red Teaming gains AI model/application streaming support and predefined templates tailored for specific hosting vendors.
    • Users can now add custom parsers to support proprietary applications in Red Teaming.
    • Red Teaming adds multi-language support enabling application simulations in different languages.
    • Application status code filtering is now available in the HTTP connector, allowing definition of valid versus error responses.

    5 details in Everything

35. (08-March-2026) Mar 8, 2026 · release notes

    Mend AI adds filtering by AI scan engine for scans and reports

    • Adds detection for all SKILL.md files regardless of their location.

    1 detail in Everything

36. (09-February-2026) Feb 9, 2026 · release notes

    Mend AI adds model metadata workflows, AI findings violations management with SLAs, and System Prompt violation tracking.

    • Enables sophisticated workflow automation based on AI model metadata (risk factors, licensing, inference providers, authorship) for granular governance rules
    • Provides comprehensive violations management for AI security findings with governance workflows, SLAs, and status tracking
    • Adds support for violations in System Prompts including a dedicated column in the risk table, side panel tab, and new workflow conditions

    3 details in Everything

37. (04-February-2026) Feb 4, 2026 · release notes

    Mend AI adds Open Beta support for AI Agents configuration, including discovery and risk assessment capabilities.

38. 25.12.1 Jan 5, 2026 · release notes

    Mend AI 25.12.1 adds open beta System Prompt Risk detection and side panel.

    • Adds System Prompt Risk detection to invent system prompts in conversational AI interfaces (open beta)
    • Adds System Prompt Risk table with quick export/sharing and deep-link side panel for prompt context
    • Integrates System Prompt Risks into existing AI Security Risk Factors across Projects and Applications with a filterable Conversational Interface chip
    • Enriches the AI Security Dashboard with system prompt risk data
    • Exposes system prompt risk data via API

    5 details in Everything

39. Version 25.12.1 (05-January-2026) Jan 5, 2026 · release notes

    Mend AI 25.12.1 introduces open beta System Prompt Risk detection, new table view, and API exposure.

40. Version 25.11.1 (01-December-2025) Dec 1, 2025 · release notes

    Mend AI adds OAuth to Red-Teaming REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and Traditional Chinese as default language option

    • oauth Target integration for the Red-Teaming REST API enables OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs.-based authentication.
    • Default language setting traditional-chinese available in Red-Teaming Target Configuration.

    2 details in Everything

41. 25.11.1 Dec 1, 2025 · release notes

    Mend AI 25.11.1 adds OAuth to Red-Teaming API target and Traditional Chinese language support.

    • Adds OAuth support for the Red-Teaming REST API Target integration
    • Adds Traditional Chinese as a configurable default language in the Target Configuration for red-teaming

    2 details in Everything

42. Version 25.10.3 (16-November-2025) Nov 16, 2025 · release notes

    Mend AI v25.10.3 enhances the unified AI configuration experience by enabling custom regex pattern extension for detection and allowing users to view the organization’s Global Default baseline configuration.

    • custom regex patterns can now be added to extend Mend AI's default detection capabilities for more precise scanning.
    • The organization’s Global Default configuration is now visible, serving as the baseline when creating new configurations.

    2 details in Everything

43. 25.10.3 Nov 16, 2025 · release notes

    Mend AI 25.10.3 adds custom regex detection and global default config view.

    • Adds the ability to extend AI detection with custom regex patterns for more precise scanning
    • Enables viewing the organization’s Global Default configuration used as the baseline for new configurations

    2 details in Everything

44. Version 25.10.1 (19-October-2025) Oct 19, 2025 · release notes

    Adds APIs for triggering red-teaming and listing AI findings to accelerate security remediation.

    • Adds /api/v3.0/projects/{projectUuid}/ai/redteam/trigger endpoint to initiate AI security red-teaming
    • Adds GET /api/v3.0/projects/{projectUuid}/ai/model/findings/security endpoint for listing project-specific AI findings
    • Adds GET /api/v3.0/applications/{applicationUuid}/ai/model/findings/security endpoint for listing application-level AI findings

    3 details in Everything

45. 25.9.1.2 Oct 5, 2025 · release notes

    Mend AI 25.9.1.2 updates Behavioral Risks scores on the Overview page.

    └──▷ HOW TO FIND IT
    Review updated risk visualization for red-teaming campaigns.
    📍In the Mend AI UI, navigate to the Overview page and view Behavioral Risks (Red-Teaming) scores
46. Version 25.9.1.1 (30-September-2025) Sep 30, 2025 · release notes

    Adds two new API endpoints for listing AI security findings by project or application

    • Introduces GET /api/v3.0/projects/{projectUuid}/ai/model/findings/security endpoint to retrieve AI model security findings for a specific project.
    • Introduces GET /api/v3.0/applications/{applicationUuid}/ai/model/findings/security endpoint to retrieve AI model security findings for a specific application.
    • Adds additional fields to the models endpoint in the Findings - Project API, aligning data with the AI Models page UI.

    3 details in Everything

47. 25.9.1.1 Sep 30, 2025 · release notes

    Mend AI 25.9.1.1 adds GET endpoints for listing AI security findings and expands model fields.

    └──▷ TRY IT
    Retrieve AI security findings for a specific project via API integration.
    copy

    $ curl -H 'Authorization: Bearer <token>' https://app.mend.io/api/v3.0/projects/<projectUuid>/ai/model/findings/security

    Retrieve AI security findings for a specific application via API integration.
    copy

    $ curl -H 'Authorization: Bearer <token>' https://app.mend.io/api/v3.0/applications/<applicationUuid>/ai/model/findings/security

    • Adds GET /api/v3.0/projects/{projectUuid}/ai/model/findings/security endpoint to list AI security findings at the project level
    • Adds GET /api/v3.0/applications/{applicationUuid}/ai/model/findings/security endpoint to list AI security findings at the application level
    • Expands the models endpoint in the Findings - Project API with additional fields aligning with the AI Models page

    3 details in Everything

48. Version 25.9.1 (29-September-2025) Sep 29, 2025 · release notes

    Mend AI v25.9.1 adds organizational reporting for AI inventory/filtering and behavioral risk target configuration with predefined responses.

    • Adds comprehensive organizational reporting to generate standardized AI inventory and findings reports filtered by AI system labels
    • Adds the option to configure Behavioral Risk targets with predefined responses expected by the target in specific scenarios

    2 details in Everything

49. 25.9.1 Sep 29, 2025 · release notes

    Mend AI 25.9.1 adds organizational reporting filtered by labels and configurable Behavioral Risk targets with predefined response matching.

    • Generates standardized AI inventory and findings reports filtered by AI system labels for compliance and audit.
    • Configures Behavioral Risk targets to mark tests as passed when the system’s response matches a predefined expected response.

    2 details in Everything

50. Version 25.8.2 (07-September-2025) Sep 7, 2025 · release notes

    New centralized dashboard for AI security risk management with severity distribution widgets.

    • Introducing a centralized dashboard for security managers to visualize and manage AI security risks.
    • Academic security findings are now integrated into the AI Models table, offering users immediate visibility of model-specific vulnerabilities.
    • Added an AI Security Findings column to Projects and Applications tables showing severity distribution (Critical/High/Medium/Low).
    • Introducing a Severity Distribution widget that summarizes AI security findings by severity.

    4 details in Everything

51. 25.8.2 Sep 7, 2025 · release notes

    Mend AI 25.8.2 adds centralized security dashboard with severity distribution widget and model vulnerability visibility

    └──▷ HOW TO FIND IT
    Monitor overall AI security posture across projects via the new dashboard.
    📍In the console, navigate to the Centralized Dashboard to view risk assessments and metrics
    View academic vulnerabilities for a specific AI model.
    📍Go to the AI Models table and check for integrated academic security findings
    Triage high-severity issues from the severity widget.
    📍Click a severity in the Severity Distribution widget to open the pre-filtered Projects view
    • Adds a centralized dashboard for security managers to visualize and manage AI security risks in a single view
    • Integrates academic security findings into the AI Models table for immediate visibility of model-specific vulnerabilities
    • Adds an AI Security Findings column to Projects and Applications tables showing severity distribution (Critical/High/Medium/Low) with one-click drill-down
    • Adds a Severity Distribution widget that summarizes AI security findings by severity and pre-filters the Projects view when clicked
    • Adds a side panel in the AI Technologies table that shows the full list of related AI libraries and details without truncation

    5 details in Everything

52. Version 25.7.1 (27-July-2025) Jul 27, 2025 · release notes

    Mend AI v25.7.1 adds Azure AI Foundry model detection, AI license indices, and OpenAI Compatible API behavioral risk integration

    • Adds detection of Azure AI Foundry models
    • Adds support for AI-specific license indices (Mistral Research, Mistral Non-Production, and Llama4) with display in the AI Models table

    2 details in Everything

53. 25.7.1 Jul 27, 2025 · release notes

    Mend AI 25.7.1 adds detection for Azure AI Foundry models and an OpenAI Compatible Behavioral Risk integration.

    └──▷ HOW TO FIND IT
    Configure the tool to assess risk against an external AI service using the new open standard integration.
    📍steps: Navigate to Integrations › Behavioral Risk and select OpenAI Compatible API to connect your endpoint
    View newly supported license types for AI models in the dashboard.
    📍steps: Go to the AI Models table and look for columns displaying Mistral Research, Mistral Non-Production, or Llama4 licenses
    • Adds support for detecting Azure AI Foundry models in the platform
    • Introduces AI-specific license indices including Mistral Research, Mistral Non-Production, and Llama4 licenses displayed in the AI Models table

    2 details in Everything

54. Version 25.6.2 (13-July-2025) Jul 13, 2025 · release notes

    This release upgrades the cyber tooling's AI model visibility by introducing a new detection engine and exposing project artifact data via API.

55. 25.6.2 Jul 13, 2025 · release notes

    Mend AI 25.6.2 adds AI-Powered Model Extraction, new API endpoints for project AI data.

    • Activates AI-Powered Code Snippet Analysis in Administration > AI Configuration to enable upgraded detection engine that identifies 10x more models than the previous pattern-based approach
    • Exposes GET /Findings - Project API endpoints for retrieving project AI technologies and project AI models
    • Expands AI model detection to support additional artifact types and sizes

    3 details in Everything

56. 25.6.1 Jun 29, 2025 · release notes

    Mend AI 25.6.1 adds detection for ~1K Amazon Bedrock models with license/terms visibility and renames AI Components view.

    • Adds detection for all ~1K models in Amazon Bedrock, revealing their license and terms-of-service
    • Renames the AI Components view to AI Technologies

    2 details in Everything

57. Version 25.5.2 (16-June-2025) Jun 16, 2025 · release notes

    Mend AI adds Confidence statuses for detected AI models and four new Behavioral Risk target types.

    • Adds Verified and Not Verified confidence statuses to indicate whether a detected AI model is present in the Mend AI index.
    • Adds Public with RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining., Public without RAG, Private with RAG, and Private without RAG as selectable target types in Mend AI Behavioral Risk (Red-Teaming) configuration.
    • Automatically assigns a default risk priority based on the selected Behavioral Risk target type.

    3 details in Everything

58. 25.5.2 Jun 16, 2025 · release notes

    Adds Confidence statuses for AI models and target type selection in Mend AI Behavioral Risk.

    └──▷ HOW TO FIND IT
    Review AI model detection results to see if they are in the Mend index.
    📍Check the Confidence column in the Detected Models table for Verified or Not Verified status
    Configure a behavioral risk probe targeting public data with retrieval augmented generationretrieval augmented generationRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining..
    📍In the probe configuration, select Public with RAG from the Target Type dropdown and set the desired risk priority
    • Introduces Verified and Not Verified confidence statuses for detected AI models to indicate presence in the Mend AI index
    • Adds four selectable target types for Mend AI Behavioral Risk probes: Public with RAG, Public without RAG, Private with RAG, and Private without RAG
    • Automatically assigns a default risk priority based on the selected target type, with manual override available per probe

    3 details in Everything

59. 25.5.1 Jun 9, 2025 · release notes

    Mend AI v25.5.1 adds configurable AI scanning toggles, CLI support for new settings, and license detection for top 100 open-source models.

    • Adds updated toggles for easier customization of AI scanning capabilities
    • Introduces intuitive labels and selective management options for AI features
    • Streamlines CLI support for new configuration settings controlling AI behavior
    • Enables detection of licenses for the top 100 open-source AI models with associated risk levels

    4 details in Everything

60. Version 25.5.1 (09-June-2025) Jun 9, 2025 · release notes

    Mend AI 25.5.1 adds configurable AI scanning toggles and CLI support for license detection of top 100 open-source models

    • Enables detection of licenses for the top 100 open-source AI models, including license risk level details

    1 detail in Everything

61. Version 25.4.3 (19-May-2025) May 19, 2025 · release notes

    Mend AI v25.4.3 adds code scanning for GitHub Enterprise repos and watsonx.ai model detection.

62. 25.4.3 May 19, 2025 · release notes

    Mend AI 25.4.3 adds AI code scanning for GitHub Enterprise and watsonx.ai model detection.

    • Adds Mend AI code scanning support in the Mend for GitHub Enterprise repository integration
    • Adds automatic detection and display of watsonx.ai models in the AI Components and AI Models tables

    2 details in Everything

63. Version 25.4.1 (20-April-2025) Apr 20, 2025 · release notes

    Mend AI v25.4.1 simplifies AI system-label naming and enhances DeepSeek governance.

    • Enhances AI governance by identifying DeepSeek models across self-hosted instances and inference providers (DeepSeek, AWS Bedrock, Google Vertex AI)

    1 detail in Everything

64. Version 25.3.1 (23-March-2025) Mar 23, 2025 · release notes

    Mend AI 25.3.1 enhances the AI Models table with two new columns to display verified vulnerability status (Risk Factors) and license compliance issues (License Risk) for improved visibility.

65. 03-March-2025 Mar 3, 2025 · release notes

    Mend AI 03-March-2025 introduces new AI inventory detection, Mend AI Premium for risk insights and red-teaming, and governance workflows.

    • Detects AI components including models, frameworks, and inference providers to provide visibility into the AI inventory
    • Identifies Shadow AI previously unknown or unauthorized AI components
    • Mend AI Premium adds AI Component Risk Insights for licensing, security vulnerabilities, and malicious packages
    • Mend AI Premium introduces AI Behavioral Risks red-teaming with prebuilt customizable tests for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., context leakage, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels.
    • Enables governance of AI components via policy engine and automation workflows

    5 details in Everything