Mend Container

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 104

   Mend Container raises the image scan size limit from 2 GB to 4 GB, unlocking scanning of larger container images across all registry integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2. docs update Oct 10, 2026 · issue 100

   Renovate now merges mergeable env options with RENOVATE_CONFIG and removes the Containerbase Sidecar image from the build process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Merges mergeable env options with RENOVATE_CONFIG via new config behaviour (config: merge mergeable env options with RENOVATE_CONFIG)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Removes the Containerbase Sidecar image from the Docker build process (docker-build-process: remove Containerbase Sidecar image)
   • Merges mergeable env options with RENOVATE_CONFIG via new config behaviour (config: merge mergeable env options with RENOVATE_CONFIG)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. docs update Oct 6, 2026 · issue 096
   └──▷ HOW TO FIND IT
   Receive immediate notification when a zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. vulnerability affects your organization, without waiting for a scheduled scan.
   📍In the platform, go to My Profile → Email Notifications and confirm zero-day alerts are enabled for each organization you are a member of.
   Set up an out-of-band alert so your team is notified of newly published CVEs on a defined schedule, independent of scan runs.
   📍In the Workflows editor, add a new action of type Send Email, configure the recipient users or groups, and set the desired delivery frequency for new-findings notifications.
4. docs update Oct 5, 2026 · issue 095

   Mend Container gains configurable Send Email workflow action and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts for emerging threats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a new Send Email workflow action that notifies users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables workflow creators to select specific users or groups as recipients for scan summary emails.
   • Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.
   • Adds a new Send Email workflow action that notifies users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

   1 more in Everything

5. Version 26.9.2 (04-October-2026) Oct 4, 2026 · issue 095

   Mend Container raises the image scan size limit from 2 GB to 4 GB, with clear errors for images that exceed it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Raises the container image scan size limit from 2 GB to 4 GB across all registry integrations, including ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., enabling successful pulling, extraction, and scanning of larger images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Surfaces a clear error message when a scanned image exceeds the new 4 GB limit, instead of failing silently.
   • Raises the container image scan size limit from 2 GB to 4 GB across all registry integrations, including ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., enabling successful pulling, extraction, and scanning of larger images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. 26.9.2 Oct 4, 2026 · release notes

   Mend Container 26.9.2 doubles image scan size limit to 4GB for larger registries

7. docs update Sep 14, 2026 · issue 074

   Mend Platform adds in-IDE/AI-agent suppression and a unified vulnerability remediation experience with a Top Fix column.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a suppression tool for IDE and AI agent workflows, supporting single and bulk suppression or unsuppression actions across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces a unified vulnerability remediation experience with a Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.
   • Adds a suppression tool for IDE and AI agent workflows, supporting single and bulk suppression or unsuppression actions across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

8. docs update Aug 24, 2026 · issue 055

   Mend Container adds an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 formats via platform UI and API.

9. docs update Aug 24, 2026 · issue 055

   Mend Platform 26.8.1 adds account-level global workflows with API support and a restructured Administration sidebar.

   • Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
   • Adds comprehensive API support for managing global workflows.
   • Updates the Administration page sidebar with a categorized, collapsible navigation structure, including a new dedicated AI Usage tab under an AI category and sub-headers for AI, Code, and Dependencies within Engine Settings.

   3 details in Everything

10. docs update Aug 24, 2026 · issue 055

    Renovate 44.41 adds overrideDescription config option; 44.38 scopes Go stdlib OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. remediation to toolchain and expands devcontainer patterns

    • Adds overrideDescription option to Renovate config, allowing custom description overrides per dependency update.
    • Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening detection of dev container configuration files.
    • Onboarding summary view now surfaces What to Expect section first, improving first-run clarity for new repositories.
    • Onboarding documentation clarifies that security PRs do not count against PR limits.

    4 details in Everything

11. Version 26.8.1 (23-August-2026) Aug 23, 2026 · issue 055

    Mend Container 26.8.1 adds Chainguard support with VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status, layer detection, and branding in risk factor columns.

    • Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data and VEX information.
    • Detects Chainguard image layers and base images within scanned containers.
    • Displays Chainguard VEX status and branding directly in the risk factors columns across the UI for clearer posture insights on Chainguard-based images and findings.

    3 details in Everything

12. 26.8.1 Aug 23, 2026 · release notes

    Mend Container 26.8.1 adds hardened image detection for Chainguard images, including VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status visibility in UI risk factors columns.

    └──▷ HOW TO FIND IT
    Check if a Chainguard-based container image has known vulnerabilities or specific VEX status directly in the Mend Container dashboard.
    📍Navigate to the Risk Factors columns in the UI for your scanned Chainguard images.
    • Adds hardened image detection for Chainguard-specific vulnerability data and VEX information in Mend Container.
    • Enables viewing of Chainguard VEX status and branding directly within the risk factors columns across the UI.

    2 details in Everything

13. Version 26.7.2 (09-August-2026) Aug 9, 2026 · release notes

    Mend Container 26.7.2 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import (CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.) for air-gapped or third-party image risk assessment.

    • SBOM import via Platform UI and platform API allows ingesting CycloneDX and SPDX files to create new projects without live image scans

    1 detail in Everything

14. Version 26.6.2 (12-July-2026) Jul 12, 2026 · release notes

    Mend Container adds Echo integration for hardened image management with VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. data support

    • Introduces an Echo integration for managing hardened images in the Mend Platform.
    • Enables automated security scanning and centralized management of container image vulnerabilities including VEX data.
    • Adds dedicated risk factor chips to the UI for vulnerability visualization.

    3 details in Everything

15. Version 26.6.1 (28-June-2026) Jun 28, 2026 · release notes

    Mend Container 26.6.1 extends malicious package detection to container images with consistent UI.

    • Extends malicious package detection capabilities to container images, providing end-to-end protection and workflows identical to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. for embedded malicious packages.
    • Updates the Containers Findings Search tab UI to align with the Dependencies findings search design for a consistent user interface.

    2 details in Everything

16. Version 26.3.1 (22-March-2026) Mar 22, 2026 · release notes

    Adds Docker VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. risk factor, DHI badge/filtering, and suppression comment column to CSV exports.

    └──▷ HOW TO FIND IT
    Filter the Containers view to see only packages that qualify as Docker Hardened Images.
    📍In the Containers view, use the new filtering options for DHI packages.
    Export suppressed findings and verify the rationale for suppression in a spreadsheet.
    📍Export findings to CSV; check the new Suppression Comment column for each suppressed item.
    • Docker VEX data now provides a new risk factor in the Containers view to highlight vulnerabilities not applicable to Docker packages, with improved visibility and filtering
    • Added support for Docker Hardened Images (DHI) including a clear badge and filtering options for DHI packages
    • CSV export of suppressed container findings now includes a Suppression Comment column

    3 details in Everything

17. Version 26.1.2 (08-February-2026) Feb 8, 2026 · release notes

    Version 26.1.2 adds a toggle to include Kubernetes system namespaces in scans

    └──▷ HOW TO FIND IT
    Include system namespaces in a Kubernetes scan via the UI toggle
    📍In the Mend AppSec Platform UI, go to your Kubernetes integration configuration and enable the toggle to include system namespaces.
    Update credentials for an existing Registry or Kubernetes integration
    📍In the Mend AppSec Platform UI, open the integration settings and use the Update Credentials option.
    • Added support for updating credentials for existing Registry and Kubernetes integrations
    • Optimized the scanner to clean up image files during the scan process, significantly reducing storage usage and improving resource efficiency

    2 details in Everything

18. Version 25.12.1 (28-December-2025) Dec 28, 2025 · release notes

    Mend Container 25.12.1 adds Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) integration.

19. Version 25.11.2 (14-December-2025) Dec 14, 2025 · release notes

    Mend Container registry integration now supports Google Artifact Registry (GAR).

20. Version 25.10.3 (16-November-2025) Nov 16, 2025 · release notes

    Mend Container 25.10.3 improves scan performance and fixes role-based API suppression permissions

    • General CLI container scan performance improvements.
    • Users with the Security Analyst role can now suppress container findings via API v3 without admin permissions.

    2 details in Everything

21. Version 25.8.2 (07-September-2025) Sep 7, 2025 · release notes

    Adds support for Microsoft AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. container scanning in the Mend AI Native AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.

    • Adds Microsoft Azure Kubernetes Service (AKS) integration for container scanning.

    1 detail in Everything

22. 25.8.2 Sep 7, 2025 · release notes

    Mend Container 25.8.2 adds AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. integration support in the Mend AI Native AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.

    └──▷ HOW TO FIND IT
    Scan containers running in an Azure Kubernetes Service cluster using the Mend AI Native AppSec Platform.
    📍Use the new AKS integration in the Mend UI to select your cluster and start scanning.
    • Microsoft AKS container scanning is now supported in the Mend AI Native AppSec Platform
    • A new Kubernetes Integration is available for Microsoft Azure Kubernetes Service (AKS)

    2 details in Everything

23. Version 25.7.2 (10-August-2025) Aug 10, 2025 · release notes

    Mend Container 25.7.2 adds Layer Group and Library Type conditions to Automation Workflow triggers for container analysis.

    • Adds Layer Group condition for the Container Analysis triggering event in Automation Workflows, supporting values for Base Layers and Application Layers
    • Adds Library Type condition for the Container Analysis triggering event in Automation Workflows, supporting values for the detected library’s programming language or package manager (e.g., Debian, Maven)

    2 details in Everything

24. Version 25.6.2 (13-July-2025) Jul 13, 2025 · release notes

    Mend Container v25.6.2 adds configurable scan schedules for Kubernetes integrations via a new UI Configuration step.

    • Adds a Configuration step to the Kubernetes integration flow where users can define an automatic scan schedule.

    1 detail in Everything

25. 25.6.2 Jul 13, 2025 · release notes

    Mend Container 25.6.2 adds automated scan scheduling and last-scan time display for Kubernetes integrations

    └──▷ HOW TO FIND IT
    Configure automated periodic scans for a Kubernetes environment via the new schedule field.
    📍In the console, go to Integrations › Kubernetes, create or edit an integration, and set the schedule in the Configuration step.
    • Displays the last scan time for Kubernetes integrations in the My Integrations table

    1 detail in Everything

26. 25.5.1 Jun 8, 2025 · release notes

    Mend Container 25.5.1 adds VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. reports, registry include/exclude filters, K8s clusterName tagging, and API v3 findings management.

    └──▷ TRY IT
    Review and suppress a specific container finding via the API.
    copy

    $ curl -X POST "https://<platform-url>/api/v3/findings/<finding_id>/suppress" -H "Authorization: Bearer <token>"

    Configure registry integration to only scan specific tags using the new filter settings in the platform UI.
    📍In the console, go to Integrations › Container Registry, edit an existing integration, and use the include/exclude fields for repositories and tags.
    • Adds vulnerability data to CycloneDX and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports for container images
    • Enables editing scheduler settings of existing integrations
    • Adds include/exclude filters to customize which repositories and tags are pulled and scanned in registry integrations
    • Adds a Hide OS packages quick-filter to Security and Compliance views
    • API v3 enables reports for Container findings (SBOM, Due Diligence, Attribution) and allows reviewing/suppressing findings

    5 details in Everything

27. Version 25.3.1 (23-March-2025) Mar 23, 2025 · release notes

    Mend Container 25.3.1 adds local filesystem scanning via CLI and automatic async CVE data updates.

    • Introduces automatic and asynchronous CVE and package data updates for container images

    1 detail in Everything

28. Version 25.2.2 (09-March-2025) Mar 9, 2025 · release notes

    Mend Container v25.2.2 adds toggleable Legal view for license details and exposes layer SHA in container findings.

    • Adds a toggleable Legal view within the Packages tab to display package visibility and license violation tracking seamlessly
    • Exposes the sha field (layer hash) in the container findings layer view for cross-referencing with live images

    2 details in Everything

29. 25.2.2 Mar 9, 2025 · release notes

    Mend Container v25.2.2 adds layer SHA in findings and toggles for Legal view to enhance license tracking

    └──▷ HOW TO FIND IT
    Cross-reference container finding results with live images using the exposed layer hash.
    📍In the UI, go to Container Findings and locate the new Layer SHA field in the layer view.
    View license details directly from the Packages tab by switching to Legal view.
    📍In the UI, go to Packages tab and toggle the Legal view option.
    • Exposes the layer SHA into the layer view of container findings
    • Adds toggle for the Legal view from the Packages tab

    2 details in Everything

30. Version 25.2.1 (23-February-2025) Feb 23, 2025 · release notes

    Mend Container 25.2.1 adds license side panel and --skip-security-checks CLI flag for leaner scans

    • --skip-security-checks CLI parameter excludes secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and Reachability analysis in container scans.
    • New License side panel in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform shows compliance data and sources for detected licenses.

    2 details in Everything

31. 25.2.1 Feb 23, 2025 · release notes

    Adds --skip-security-checks CLI parameter and license side panel for container images in Mend Container 25.2.1

    • Adds --skip-security-checks CLI parameter to disable secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and Reachability analysis for leaner, faster scans
    • Adds a license side panel in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform UI to display compliance data and sources for detected licenses in container images

    2 details in Everything

32. Version 25.1.1 (26-January-2025) Jan 26, 2025 · release notes

    Mend Container 25.1.1 adds global CVE/package search in Findings and scan tags for traceability.

    • Enables global CVE and package search across organization containers to accelerate blast-radius analysis of high-profile vulnerabilities.
    • Supports adding scan tags to container image scans for improved traceability.

    2 details in Everything

33. 25.1.1 Jan 26, 2025 · release notes

    Adds global CVE/package search in Mend Platform UI and scan tags for Container images

    • Adds global CVE and package search for Container Findings on the Mend Platform, enabling organization-wide vulnerability and package lookups with risk context for blast-radius analysis
    • Supports scan tags for Container image scans to improve scan management and traceability

    2 details in Everything

34. Version 24.11.2 (15-December-2024) Dec 15, 2024 · release notes

    Mend Container adds base image identification in scans and issue filtering for base-sourced vulnerabilities

    • Identifies base images automatically during container image scans to focus remediation efforts on fixable issues.
    • Adds the ability to filter issues originating from base images within the scan results.

    2 details in Everything

35. 24.11.2 Dec 15, 2024 · release notes

    Mend Container 24.11.2 adds base image identification and filtering for scan results.

    └──▷ HOW TO FIND IT
    Filter out vulnerabilities in base images to focus on fixable application code.
    📍Use the UI to filter scan results by base image source
    • Adds the ability to identify base images in container image scans
    • Enables filtering issues originating from base images

    2 details in Everything

36. Version 24.11.1 (01-December-2024) Dec 1, 2024 · release notes

    Mend Container allows container scan data to be retained during project reassignment.

    • Reassigning a project with container scans to another application now moves all container-related findings and package data to the new application

    1 detail in Everything

37. Version 24.10.3 (17-November-2024) Nov 17, 2024 · release notes

    Mend Container 24.10.3 adds JFrog Artifactory Cloud token auth and new distro coverage.

    • Adds access_token authentication support for the JFrog Artifactory (Cloud) registry integration
    • Adds openSUSE Tumbleweed, SLE Micro 5.0-5.4, and Azure Linux 3.0 distribution support

    2 details in Everything

38. 24.10.3 Nov 17, 2024 · release notes

    Mend Container v24.10.3 adds JFrog Artifactory Access Token auth and support for Azure Linux 3.0 plus openSUSE/SLE Micro distributions.

    • Adds Access Token authentication support for the JFrog Artifactory (Cloud) registry integration
    • Adds detection support for Azure Linux 3.0
    • Adds detection support for SLE Micro 5.0-5.4
    • Adds detection support for openSUSE Tumbleweed

    4 details in Everything

39. Version 24.10.1 (20-October-2024) Oct 20, 2024 · release notes

    Mend Container 24.10.1 adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 support to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports and PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. auth for Docker Hub.

    • Adds SPDX 2.3 and CycloneDX 1.5 formats to the Container Image SBOM report output
    • Adds Personal Access Token (PAT) authentication option for Docker Hub registry integration

    2 details in Everything

40. 24.10.1 Oct 20, 2024 · release notes

    Adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 support to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports and PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. auth for Docker Hub

    • Adds SPDX 2.3 and CycloneDX 1.5 SBOM standards to the Container Image SBOM report.
    • Adds PAT token authentication to the Docker Hub registry integration.

    2 details in Everything

41. Version 24.8.1-1 (27-August-2024) Aug 27, 2024 · release notes

    Mend Container 24.8.1-1 adds stdlib Go detection and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. deps.json analysis.

    • Adds detection of vulnerabilities in the Golang stdlib package
    • Enhances NuGet detection to analyze packages defined in deps.json

    2 details in Everything

42. Version 24.7.2 (11-August-2024) Aug 11, 2024 · release notes

    Mend Container 24.7.2 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning in CLI, C# reachability, and UI-based finding suppression.

    • Introducing Infrastructure-as-Code (IaC) scanning, available in the Mend CLI, that focuses on configuration file analysis to detect misconfigurations and provides resolution information
    • Added C# support for static container reachability, allowing you to find unused packages in .NET-based images and reduce security noise.
    • Added SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 to the list of available SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. standards in the Container Image SBOM export via the Mend CLI
    • Added the ability to suppress container image scan findings from the Mend Platform UI.

    4 details in Everything

43. 24.7.2 Aug 11, 2024 · release notes

    Mend Container 24.7.2 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning in CLI, C# static reachability, UI suppression, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. format updates.

    └──▷ USE IT
    Scan a directory for IaC misconfigurations directly from the command line.
    shell copy

    mend-cli iac-scan /path/to/infrastructure/configs

    Export a Container Image SBOM in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 format for compliance.
    shell copy

    mend-cli sbom-export --format cyclonedx-1.5 --output sbom.json

    • Added C# support for static container reachability, allowing you to find unused packages in .NET-based images and reduce security noise.
    • Introducing .NET (C#) support for container image scans with vulnerability detection for .dll files. (Closed Beta)
    • Adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. and CycloneDX 1.5 to the list of available SBOM standards in the Container Image SBOM export via the Mend CLI.
    • Added the ability to suppress container image scan findings from the Mend Platform UI.

    4 details in Everything

44. 24.7.1 Jul 28, 2024 · release notes

    Mend Container 24.7.1 adds configurable scheduling for integrations and updates JSON/SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. scan outputs.

    └──▷ USE IT
    View the updated JSON output structure which now includes layer number and vendor CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. type.
    shell copy

    cat scan_results.json | jq '.[].layer_number, .[].cvss_vendor_type'

    Confirm that the SARIF output no longer contains license information, suitable for security-only pipelines.
    shell copy

    grep -i 'licenses' sarif_results.sarif || echo 'No licenses found'

    • Adds configurable schedule settings for Registry Integration to enable automated image scanning flows
    • Adds static scheduling configuration for the Sysdig Integration to support automated scan workflows
    • Adds layer_number and cvss_vendor_type fields to Container scan JSON output
    • Removes licenses field from Container scan SARIF output

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The licenses field is no longer present in the SARIF output for Container scans
45. 24.5.3 Jun 16, 2024 · release notes

    Mend Container 24.5.3 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. formats for container scans via CLI and UI.

46. Version 24.3.2 (05-May-2024) May 5, 2024 · release notes

    Adds Static Container Reachability Analysis for Python to Mend Container

47. 24.3.2 May 5, 2024 · release notes

    Mend Container 24.3.2 adds Static Container Reachability Analysis for Python.

48. 14-March-2024 Mar 14, 2024 · release notes

    Mend Container introduces static Container Reachability to reduce vulnerability noise by identifying reachable packages before runtime.

    • Introduces static Container Reachability analysis in the CLI scanner for Container Images to prioritize vulnerabilities by actual reachability.

    1 detail in Everything