Mend Platform

No entries match these filters. Clear filters

1. Version 26.10.1 (01-November-2026) Nov 1, 2026 · issue 129

   Mend Platform adds an AI natural-language assistant and granular SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan-category control in the Scan Profile⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Reduce SAST noise on a codebase that does not use direct database access by excluding the Database Read category before the next scan.
   📍In the Mend Platform, go to the Scan Profile settings, open the low-probability scan categories selection tree, uncheck Database Read (and any other categories to exclude), then save — the change takes effect on the next scan and the counter updates to reflect the number of active categories.
   • Control low-probability SAST scan categories individually in the Scan Profile — include or exclude specific categories such as File Read or Database Read — replacing the previous binary toggle with a configurable selection tree that applies to the next scan and shows a count of selected categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Mend Platform adds Mend Intelligent Agent, an AI assistant that accepts natural-language queries to explore platform capabilities, navigate to relevant views, and produce executive-level risk summaries across all applications and projects; enabled by default for organizations with a signed AI consent addendum.

   2 details in Everything

2. changelog Oct 25, 2026 · issue 120

   Mend Platform 26.9.3 adds aggregated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and makes Custom Roles generally available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Generate a single deduplicated SBOM for an entire application scope to simplify ingestion into downstream tooling.
   📍In the Mend Platform UI, navigate to your Application, select Export SBOM, choose Aggregated scope, select CycloneDX or SPDX as the standard, and confirm the export.
   Prevent proprietary in-house components from triggering false-positive Empty License workflow violations across the organization.
   📍In the Mend Platform UI, navigate to Organization Settings, find the Include Proprietary Libraries in Workflows setting, and toggle it off to exclude proprietary components from license-condition automation.
   • Adds a new organizational setting, 'Include Proprietary Libraries in Workflows,' to exclude proprietary (in-house) components from automation workflows that check for Empty License conditions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces aggregated SBOM export for application and multi-project scopes, consolidating multiple project-level files into one deduplicated document; supports CycloneDX and SPDX standards. Projects in multi-project scope must belong to the same application; per-project generation remains the default.
   • Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown and Create Role wizard for custom role management.
   • Adds a new organizational setting, 'Include Proprietary Libraries in Workflows,' to exclude proprietary (in-house) components from automation workflows that check for Empty License conditions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces aggregated SBOM export for application and multi-project scopes, consolidating multiple project-level files into one deduplicated document; supports CycloneDX and SPDX standards. Projects in multi-project scope must belong to the same application; per-project generation remains the default.

   1 more in Everything

3. docs update Oct 20, 2026 · issue 114
   • Updated supported platform Bun package manager — general availability
4. docs update Oct 20, 2026 · issue 114
   └──▷ HOW TO FIND IT
   Generate a single deduplicated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. across an entire application scope to feed into downstream compliance tooling.
   📍In the Mend Platform UI, navigate to your Application, select Export SBOM, choose Aggregated scope, then select CycloneDX or SPDX as the output format and download the consolidated file.
   Prevent proprietary in-house components from triggering false-positive Empty License workflow violations across the organization.
   📍In the Mend Platform UI, go to Organization Settings, locate Include Proprietary Libraries in Workflows, and disable the toggle to exclude proprietary components from license-condition automation rules.
5. docs update Oct 20, 2026 · issue 114

   Mend SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. 26.9.3 adds aggregated CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export for application and multi-project scopes, and an Include Proprietary Libraries in Workflows organizational setting.

   • Introduces aggregated SBOM export for application and multi-project scopes, consolidating multiple project-level files into a single deduplicated document in CycloneDX or SPDX format; per-project generation remains the default.
   • Adds an Include Proprietary Libraries in Workflows organizational setting to exclude in-house components from Empty License automation workflow conditions, so only genuine third-party components with missing license data are flagged.

   2 details in Everything

   • New integration GitHub repository-level security advisories import source
   • New supported platform Bun package manager GA support (bun.lock / bun.lockb)
6. docs update Oct 20, 2026 · issue 114

   Mend SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. v26.9.3 extends the Gen 2 detection engine to Swift and PHP.

   • Updated supported platformIntroduces the Gen 2 detection engine for Swift and PHP, expanding the newer analysis engine beyond previously supported languages.

   1 detail in Everything

   • Updated detection XSS false-positive fix for HttpServletResponse and ServletResponse in Java
   • Updated detection SSRF and NoSQL Injection false-positive fixes for JavaScript and TypeScript
   • Updated detection Improved Swagger YAML entry point detection for API definitions
7. Version 26.9.3 (18-October-2026) Oct 18, 2026 · issue 114

   Mend Platform 26.9.3 adds GA Custom Roles and aggregated multi-project SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Generate a single deduplicated SBOM across all projects in an application scope to feed into downstream tooling or compliance pipelines.
   📍In the Mend Platform UI, navigate to your Application scope, select Export SBOM, choose Aggregated scope, select CycloneDX or SPDX format, and download the consolidated file.
   Prevent proprietary in-house libraries from triggering false-positive Empty License policy violations in automation workflows.
   📍In the Mend Platform UI, go to Organization Settings › Workflows, locate the Include Proprietary Libraries in Workflows setting, and disable it.
   • Adds aggregated SBOM export for application and multi-project scopes, consolidating and deduplicating components across projects into a single CycloneDX or SPDX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown view and Create Role wizard for intuitive role management.
   • Introduces an organizational setting, Include Proprietary Libraries in Workflows, to exclude in-house components from Empty License automation workflow evaluations by default.
   • Adds aggregated SBOM export for application and multi-project scopes, consolidating and deduplicating components across projects into a single CycloneDX or SPDX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces an organizational setting, Include Proprietary Libraries in Workflows, to exclude in-house components from Empty License automation workflow evaluations by default.

   1 more in Everything

8. announced Oct 15, 2026 · issue 113

   New docker.io/sbx/mend-guardrails-kit mixin routes AI agent traffic through Mend Guardrails inside Docker Sandboxes, adding content inspection without agent changes.

   • New detectionNew integrationAdds docker.io/sbx/mend-guardrails-kit mixin kit that routes OpenAI-compatible agent traffic through mend-guardrails-server inside a Codex Docker Sandbox using OPENAI_BASE_URL, enabling AI Guardrails policy enforcement without rebuilding the agent.
   • Adds --kit-arg mend-guardrails.interceptTui=true flag to extend Guardrails interception to Codex TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. model traffic (requires a host OpenAI Platform API key with Responses write permission).
   • Adds mend-guard-text command to explicitly evaluate MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and tool-result text content against Mend AI Guardrails policy inside the sandbox.
   • Adds mend-guardrails-selftest built-in self-test command to validate that Guardrails enforcement is working correctly inside the running sandbox.

   4 details in Everything

9. changelog Oct 10, 2026 · issue 100

   Mend Platform adds zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts, a centralized Activity Log with API export, account-level global workflows, IDE-based finding suppression via Agentic Integrations, and a unified SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. remediation experience.

   • Adds dedicated zero-day alerts for immediate awareness when your organization is vulnerable to emerging threats, toggleable per organization via My Profile → Email Notifications.
   • Adds a new Send Email action in Automation Workflows to notify of new findings independent of scans, with configurable delivery frequencies.
   • Enhances Automation Workflows email notifications to allow workflow creators to select specific users or groups as recipients for scan summary emails.
   • Introduces a suppression tool in Agentic Integrations enabling single and bulk suppression or unsuppression of findings across SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCA engines directly within IDE or AI agent workflows, with UI updates reflected within seconds.
   • Introduces unified vulnerability remediation across the Mend Platform, adding a Top Fix column in the Findings table and standardizing fix logic and recommendations in the Remediation tab.

   +8 more show less

   • Introduces Account-Level (Global) Workflows, allowing administrators to define workflows centrally and propagate them to selected organizations, with full API support for managing global workflows.
   • Adds a centralized Activity Log for administrators covering platform activities, configuration changes, and security and legal findings actions across all engines (Platform, Dependencies, Code, Containers, AI) with 18 months of retention, filterable by date, event, category, engine, user, application, or project.
   • Adds Activity Log export as an Excel report from the Reports area or directly from the Activity Log page, plus programmatic retrieval via API.
   • Adds account-scoped Activity Log coverage for custom roles, global workflows, account-level reports, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integrations, visible only to Account Admins.
   • Adds a Project Risk Factors widget with high-level Contextual Project Classification information to the Project Summary dashboard (SAST).
   • Adds the ability to suppress findings or mark them as In Review in the Infrastructure as Code (IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.) engine.
   • Enhances the SCA tool in Agentic Integrations to display vulnerabilities from transitive dependencies.
   • Updates the Administration page sidebar with a categorized, collapsible navigation structure, and moves AI Usage settings to a dedicated AI Usage tab within a new AI category.

   13 details in Everything

   • New integration Invicti Platform DAST integration
   • New integration Port.io platform integration for SCA findings
10. docs update Oct 10, 2026 · issue 100

    Mend Renovate now merges mergeable env options with RENOVATE_CONFIG and removes the Containerbase Sidecar image from the Docker build process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Removes the Containerbase Sidecar image from the Docker build process, simplifying the container build pipeline.
    • Adds a strong type for Containerbase's known tools in util/exec, improving type safety for tool invocations.

    2 more in Everything

11. docs update Oct 9, 2026 · issue 098

    Mend Renovate merges env host rules with RENOVATE_CONFIG and fixes env option merging behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Merges mergeable env options with RENOVATE_CONFIG so environment-sourced settings are combined rather than overriding config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Appends env host rules to RENOVATE_CONFIG ones, allowing both sources of host rules to coexist.
    • Replaces unvalidated JSON fetching in the datasource/gitlab-packages datasource with validated getJson, improving data integrity for GitLab package lookups.
    • Merges mergeable env options with RENOVATE_CONFIG so environment-sourced settings are combined rather than overriding config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

12. docs update Oct 8, 2026 · issue 097

    Renovate now reports which datasource served each lookup and re-runs install-tool on version downgrades in the exec subsystem.

    • Reports the datasource which served a lookup, giving practitioners visibility into which registry resolved each dependency.
    • Retired integrationRe-runs install-tool when switching back to an earlier tool version in the exec subsystem, fixing stale cached installs.

    2 details in Everything

    • Updated integration GitHub Actions manager: slsa-framework/actions/* extraction
    • Updated integration GitHub Actions manager: setup-deno via GitHub Releases
    • Updated integration GitHub Actions manager: gh-aw-actions/setup-cli with.version
    • Updated integration datasource/crate: host rule credentials for git index registries
    └──▷ BREAKING ON UPGRADE

    • !The java-maven tool has been removed from util/exec; any configuration relying on Renovate installing Maven via its built-in exec tooling will break.
13. docs update Oct 6, 2026 · issue 096
    └──▷ HOW TO FIND IT
    Opt out of zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts for a specific organization you belong to, without disabling all email notifications.
    📍In the Mend Platform, go to My Profile → Email Notifications and toggle off zero-day alerts for the target organization.
14. docs update Oct 6, 2026 · issue 096

    Mend Platform: Uses GitHub Releases as the source for setup-deno in manager/github-actions.

15. docs update Oct 6, 2026 · issue 096

    Mend AI now supports per-finding Suppress and Review triage, letting security teams act on individual findings within an entity independently.

    • Updated supported platform Mend AI Runtime Protection Guardrails — expanded language support
16. docs update Oct 6, 2026 · issue 096
    └──▷ HOW TO FIND IT
    Set up a Send Email workflow action to alert a security team group whenever a newly published CVE affects your projects, without waiting for the next scheduled scan.
    📍In the Mend Platform, go to Workflows › Create Workflow, add a trigger for New Finding, then add a Send Email action, select the target users or groups as recipients, and configure the delivery frequency.
17. docs update Oct 6, 2026 · issue 096

    Mend SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. adds --print-to-console flag for live CLI log output and expands YAML/JSON config file entry-point detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Stream SAST scan logs to the console in CI pipelines so you can see progress without waiting for the log file — useful for debugging long-running scans.
    copy

    $ mend code --print-to-console

    • Adds automatic /_MACOSX/..* metadata file exclusions to mend code CLI scans across all SAST engines, applied via centralized settings even when default exclusions are otherwise disabled.
    • Extends entry-point detection to support YAML and JSON configuration files, automatically identifying API endpoints, mapping them to implementation classes, and marking generated entry-point parameters as tainted for contract-first applications.
    • Improves Python engine detection accuracy across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes.: CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-022 Path Traversal, CWE-078 OS Command Injection, CWE-079 XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., CWE-089 SQL Injection, CWE-094 Code Injection, CWE-209 Error Message Info Exposure, CWE-295 Improper Cert Validation, CWE-532 Sensitive Info in Log, CWE-601 Open Redirect, CWE-918 SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and CWE-943 NoSQL Injection.

    3 more in Everything

18. docs update Oct 5, 2026 · issue 095

    Mend CLI 26.9.1 adds --print-to-console to mend code and auto-excludes /_MACOSX/..* files from SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scans.

    • Adds --print-to-console flag to mend code SAST scans to stream CLI logs directly to stdout during the scan, mirroring behaviour already available in mend dep.
    • Default exclusions in mend code scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines to prevent interference with the TreeSitter parser on Windows.

    2 details in Everything

    • New supported platform Bun package manager support for JavaScript projects
19. docs update Oct 5, 2026 · issue 095

    Mend AI extends Suppress and Review triage actions to individual finding level for more precise remediation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

20. docs update Oct 5, 2026 · issue 095

    Mend CLI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. gains --print-to-console flag and automatic /_MACOSX/..* exclusions in v26.9.1⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Tail SAST scan output live in CI logs without separately reading a log file — useful in pipelines where log file access is inconvenient.
    copy

    $ mend code --print-to-console

    • Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, preventing macOS system files from interfering with the TreeSitter parser on Windows.

    1 more in Everything

21. docs update Oct 5, 2026 · issue 095

    Mend Platform: Adds a new Send Email workflow action to notify recipients of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Receive immediate notification when a newly published CVE affects your organization, without waiting for the next scheduled scan.
    📍In the Workflows editor, add a Send Email action step, select target users or groups as recipients, configure the delivery frequency, and save the workflow.
22. docs update Oct 5, 2026 · issue 095

    Mend Renovate gains rich Gradle version-constraint support, Azure PR auto-complete re-application, and improved vulnerability fix raising.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports rich version constraints in the Groovy/Kotlin DSL for the gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Re-applies auto-complete settings to existing PRs on the azure platform.
    • Supports rich version constraints in the Groovy/Kotlin DSL for the gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

23. docs update Oct 5, 2026 · issue 095

    Mend Container raises image scan size limit from 2 GB to 4 GB, covering all registry integrations including ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

24. Version 26.9.2 (04-October-2026) Oct 4, 2026 · issue 095

    Mend Platform 26.9.2 adds a Send Email Automation Workflow action and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. vulnerability alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Set up a scan-independent email alert so your team is notified immediately when a newly published CVE affects your inventory, without waiting for the next scan.
    📍In the Mend Platform, go to Administration › Automation Workflows, create or edit a workflow, add a new action of type Send Email, select the target users or groups, configure the delivery frequency, and set the trigger to New Findings (e.g. newly published CVEs).
    • Extends Automation Workflow email controls to let workflow creators select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated zero-day alerts to provide immediate awareness when your organization is exposed to emerging threats.

    2 details in Everything

25. 26.9.2 Oct 4, 2026 · release notes

    Mend Platform 26.9.2 adds configurable email recipients in workflows, a new Send Email action for CVE alerts, and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerting

    • Enhances Automation Workflows to allow selecting specific users or groups as recipients for scan summary emails
    • Adds a new Send Email action in Automation Workflows to notify of new findings like published CVEs with configurable delivery frequencies
    • Introduces dedicated zero-day alerts to ensure immediate awareness when the organization is vulnerable to emerging threats

    3 details in Everything

26. docs update Sep 28, 2026 · issue 088

    Mend SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds Bun package manager support for JavaScript dependency scanning in CLI and repository integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

27. docs update Sep 25, 2026 · issue 085
    └──▷ BREAKING ON UPGRADE

    • !The addLabel, commitFiles, and getRepoForceRebase methods are dropped from the platform API (platform: drop unreachable addLabel, commitFiles and getRepoForceRebase from the API) — any integration calling these endpoints will break.
28. docs update Sep 25, 2026 · issue 085

    Mend Renovate adds matchIsBreaking package rule option, $matchRegexOrGlob JSONataJSONataA query and transformation language for JSON data, maintained as an open-source project. Cyber tools use it to extract, reshape, and map JSON payloads without writing custom parsing code. function, Nix zstd channel tarball support, and mise conda backend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Separate breaking updates into their own PRs so they get extra review before merge.
    renovate.json copy

    {
      "packageRules": [
        {
          "matchIsBreaking": true,
          "addLabels": ["breaking-change"],
          "automerge": false
        }
      ]
    }

    • Adds matchIsBreaking package rule option to config for filtering or acting on breaking dependency updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to jsonata for regex or glob matching in JSONata expressions.
    • Supports conda backend in manager/mise for Conda-managed dependencies.
    • Supports zstd channel tarballs in manager/nix.
    • Adds matchIsBreaking package rule option to config for filtering or acting on breaking dependency updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to jsonata for regex or glob matching in JSONata expressions.
    • Supports conda backend in manager/mise for Conda-managed dependencies.

    1 more in Everything

29. docs update Sep 24, 2026 · issue 084

    Mend Renovate adds GraalVM version datasource, supportsNpmrc flag, and postUpgradeTasks in branch commit fingerprint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds supportsNpmrc flag to control npm rc support in package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Includes postUpgradeTasks in the branch commit fingerprint via the cache subsystem, ensuring post-upgrade task changes are reflected in branch identity.
    • Adds a GraalVM version datasource so Renovate can track and update GraalVM versions.
    • Adds supportsNpmrc flag to control npm rc support in package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a GraalVM version datasource so Renovate can track and update GraalVM versions.

    1 more in Everything

30. docs update Sep 16, 2026 · issue 076

    Mend Platform: Caches the publication time of each version in datasource/go, avoiding repeated .info timestamp refetches.

31. docs update Sep 15, 2026 · issue 075

    Mend SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds the EU Vulnerability Database (EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories.) from ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. as a primary security data source with dedicated CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores and exploitability data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

32. docs update Sep 15, 2026 · issue 075

    Mend Renovate expands GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. manager with 50+ new action version inputs and adds mise selector lockfile support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds manager/github-actions support for baptiste0928/cargo-install crate and version inputs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds manager/github-actions support for conda-incubator/setup-miniconda version inputs
    • Adds manager/github-actions support for crystal-lang/install-crystal version inputs
    • Adds manager/github-actions support for cue-lang/setup-cue version
    • Adds manager/github-actions support for graalvm/setup-graalvm version inputs

    +41 more show less

    • Adds manager/github-actions support for jwlawson/actions-setup-cmake cmake-version
    • Adds manager/github-actions support for moonrepo/setup-rust channel
    • Adds manager/github-actions support for moonrepo/setup-toolchain version inputs
    • Adds manager/github-actions support for superfly/flyctl-actions/setup-flyctl version
    • Adds manager/github-actions support for swift-actions/setup-swift swift-version
    • Adds manager/github-actions support for WillAbides/setup-go-faster go-version
    • Adds manager/github-actions support for abatilo/actions-poetry poetry-version
    • Adds manager/github-actions support for actions-rust-lang/setup-rust-toolchain toolchain
    • Adds manager/github-actions support for aquaproj/aqua-installer aqua_version
    • Adds manager/github-actions support for astral-sh/ruff-action version
    • Adds manager/github-actions support for azure/setup-kubectl version
    • Adds manager/github-actions support for biomejs/setup-biome version
    • Adds manager/github-actions support for bufbuild/buf-setup-action version
    • Adds manager/github-actions support for cargo-bins/cargo-binstall version
    • Adds manager/github-actions support for cloudflare/wrangler-action wranglerVersion
    • Adds manager/github-actions support for cycjimmy/semantic-release-action semantic_version
    • Adds manager/github-actions support for dart-lang/setup-dart sdk
    • Adds manager/github-actions support for erlef/setup-beam version inputs
    • Adds manager/github-actions support for foundry-rs/foundry-toolchain version
    • Adds manager/github-actions support for GitTools/actions/gitversion/setup versionSpec
    • Adds manager/github-actions support for hashicorp/setup-packer version
    • Adds manager/github-actions support for helm/chart-releaser-action version
    • Adds manager/github-actions support for helm/kind-action version inputs
    • Adds manager/github-actions support for j178/prek-action prek-version
    • Adds manager/github-actions support for jfrog/setup-jfrog-cli version
    • Adds manager/github-actions support for julia-actions/setup-julia version
    • Adds manager/github-actions support for mozilla-actions/sccache-action version
    • Adds manager/github-actions support for opentofu/setup-opentofu tofu_version
    • Adds manager/github-actions support for peaceiris/actions-hugo hugo-version
    • Adds manager/github-actions support for PyO3/maturin-action maturin-version
    • Adds manager/github-actions support for raven-actions/actionlint version
    • Adds manager/github-actions support for reviewdog/action-setup reviewdog_version
    • Adds manager/github-actions support for snok/install-poetry version
    • Adds manager/github-actions support for stCarolas/setup-maven maven-version
    • Adds manager/github-actions support for subosito/flutter-action flutter-version
    • Adds manager/github-actions support for supabase/setup-cli version
    • Adds manager/github-actions support for extractions/setup-just just-version
    • Adds manager/github-actions support for gradle/actions/setup-gradle gradle-version
    • Adds manager/github-actions support for hashicorp/setup-terraform terraform_version
    • Adds manager/github-actions support for terraform-linters/setup-tflint tflint_version
    • Adds manager/github-actions support for aws-actions/amazon-ecs-render-task-definition image
    • Adds manager/github-actions support for baptiste0928/cargo-install crate and version inputs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    45 more in Everything

33. docs update Sep 8, 2026 · issue 068

    Mend SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. 26.8.2 adds a unified vulnerability remediation experience with a new Top Fix column in the Findings table.

34. docs update Sep 8, 2026 · issue 068

    Mend SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. adds multi-base-branch scanning for Azure DevOps and Bitbucket Cloud, plus JS/TS detection accuracy improvements across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..

    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.
    • Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEs (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-117, CWE-295, CWE-601, CWE-918, CWE-943), including tuning for React controlled components to reduce false positives where query parameters flowing into escaped JSX attributes were incorrectly flagged as DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session..
    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.

    1 more in Everything

35. docs update Sep 8, 2026 · issue 068

    Mend Platform: Adds a suppression tool for IDE and AI agent workflows, supporting single and bulk suppression or unsuppression across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.

    └──▷ BREAKING ON UPGRADE

    • !The unified fix logic may produce fewer remediation suggestions per vulnerability due to increased accuracy, reducing overall noise but potentially removing previously shown suggestions.
36. docs update Sep 8, 2026 · issue 068

    Mend Renovate adds AWS S3 Helm chart repo support, pixi optional channel options, and pnpm --no-frozen-lockfile for lock file updates.

    • Passes --no-frozen-lockfile to pnpm when performing lock file updates in the manager/npm manager.
    • Supports optional channel options in the manager/pixi manager.
    • Supports AWS S3 as a Helm charts repository in the datasource/helm datasource.
    • Supports AWS S3 as a Helm charts repository in the datasource/helm datasource.

    2 more in Everything

37. Version 26.8.2 (06-September-2026) Sep 6, 2026 · issue 068

    Mend 26.8.2 adds in-IDE suppression for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings and unifies vulnerability remediation with a new Top Fix column.

    • Adds a suppression tool in Agentic Integrations supporting single and bulk suppression or unsuppression actions across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds — reducing context-switching for developers working in their IDE or AI agent workflow.
    • Introduces a unified vulnerability remediation experience with a new Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.
    • Adds a suppression tool in Agentic Integrations supporting single and bulk suppression or unsuppression actions across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds — reducing context-switching for developers working in their IDE or AI agent workflow.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The unified vulnerability remediation fix logic may produce fewer remediation suggestions per vulnerability; existing workflows that relied on the previous volume of suggestions should be reviewed.
38. docs update Aug 31, 2026 · issue 060

    Mend SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. 26.8.1 adds per-data-flow probability risk, new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detections for JS/TS and Rust, and branch-level project scanning on Azure DevOps and Bitbucket Cloud.

    • Adds probability risk factor display next to each data flow in finding details, giving more granular triage information per finding.
    • Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript.
    • Adds detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) for Rust.
    • Supports scanning into dedicated branch-level projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling per-branch policy and monitoring.
    • Enables optional sharing of additional project data with Mend.io for AI-driven customization of detection rules tailored to your organization.

    5 details in Everything

39. docs update Aug 31, 2026 · issue 060

    Mend Renovate 44.50.0 adds protobufprotobufA language-neutral binary serialization format created by Google that encodes structured data more compactly and faster than JSON or XML, making it attractive for high-throughput inter-process or network communication. + gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. exporter for instrumentation and improves GitHub rate-limit handling.

    • Adds protobuf + gRPC exporter support to Renovate's instrumentation pipeline (closes #36073).
    • GitHub GraphQL responses with graphql_rate_limit errors are now treated as rate-limiting, enabling proper back-off behaviour.
    • Sets isExecutable on added and modified files in the copier manager.

    3 details in Everything

40. docs update Aug 31, 2026 · issue 060

    Mend Platform API 3.0 launches with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, cursor pagination, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs in JSON and YAML

    └──▷ TRY IT
    Download the OpenAPI 3.0 spec in YAML to generate a typed API client or import into Postman.
    copy

    $ curl -O https://docs.mend.io/platform-api-3-0/latest/3.0.yaml

    • Cursor pagination and result-size limiting now supported across API responses for scalable data retrieval.
    • OpenAPI description downloadable in 3.0.json and 3.0.yaml formats for integration with tooling and client generation.

    2 details in Everything

41. docs update Aug 24, 2026 · issue 055

    Mend AI adds an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 formats via platform UI and API.

    • New AI Bill of Materials (AI-BOM) report available through the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — at organization, application, and project scopes.
    • AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. exports use industry-standard CycloneDX 1.7 and SPDX 3.0.1 formats, with metadata-only exports to preserve data privacy.
    • AI-BOM data is populated only for scans performed after the feature release date (24-August-2026).

    3 details in Everything

42. docs update Aug 24, 2026 · issue 055
    • Updates the Administration page sidebar with a categorized, collapsible navigation structure, adding a dedicated AI Usage tab within a new AI category and sub-headers for AI, Code, and Dependencies under Engine Settings.
43. docs update Aug 24, 2026 · issue 055

    Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. remediation.

    • Adds overrideDescription option to Renovate config, allowing custom descriptions to be set on dependencies.
    • Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening which Dev ContainerDev ContainerA Docker-based development environment defined in a JSON config file, standardized by Microsoft, that lets a project ship its exact toolchain so any contributor's editor or CI system gets an identical workspace. files are detected.
    • Onboarding summary view now shows What to Expect section first, improving the onboarding flow for new repositories.
    • Onboarding UI clarifies that security PRs do not count against PR limits.

    4 details in Everything

44. docs update Aug 24, 2026 · issue 055

    Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status and branding in the UI.

    • Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and detection of Chainguard image layers and base images.
    • Surfaces Chainguard VEX status and branding directly within the risk factors columns across the Mend Container UI for Chainguard-based images and findings.

    2 details in Everything

45. Version 26.8.1 (23-August-2026) Aug 23, 2026 · issue 055

    Mend 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar with AI settings.

    └──▷ HOW TO FIND IT
    Adjust AI Usage settings after the tab reorganization in the Administration page.
    📍In the Administration page, open the sidebar, navigate to the AI category, and select the AI Usage tab to configure AI Usage settings.
    • Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
    • Adds comprehensive API support for managing global workflows.
    • Updates the Administration page sidebar with a categorized, collapsible navigation structure aligning with Application and Project pages.
    • Moves AI Usage settings from the General tab to a dedicated AI Usage tab under a new AI category in the Administration page.
    • Adds specific sub-headers for AI, Code, and Dependencies within the Engine Settings section of the Administration page.

    5 details in Everything

46. Version 26.7.2 (09-August-2026) Aug 9, 2026 · release notes

    Mend Platform 26.7.2 adds Invicti Platform DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4 support

    • Adds Invicti Platform as a supported DAST integration for ingesting assets, vulnerabilities, and scans via its latest API.
    • Enhances data mapping in the Invicti integration to include structured vulnerability classifications and CVSS v4 scoring.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The existing Invicti integration has been renamed to Invicti Enterprise within the UI.
47. Version 26.7.1 (26-July-2026) Jul 26, 2026 · release notes

    Mend Platform 26.7.1 adds centralized Activity Log with API access and enhanced SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. transitive dependency visibility

    • Adds a new Activity Log view for administrators to track user and system activity across all engines with 18 months of retention.
    • Adds API access to programmatically retrieve events from the new Activity Log.
    • Enhances SCA tool in Agentic Integrations to display vulnerabilities from transitive dependencies.

    3 details in Everything

48. Version 26.6.2 (12-July-2026) Jul 12, 2026 · release notes

    Mend Platform v26.6.2 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. finding suppression, Port.io integration, and project risk widgets

    └──▷ HOW TO FIND IT
    View Mend security findings directly within the Port.io platform to avoid context switching during development workflows.
    📍Within the Port.io platform, navigate to the integrated Mend app section to monitor application security findings and access issue details.
    Review high-level context about project risk classification directly from the Project Summary dashboard.
    📍Open the Mend Platform, go to a Project Summary dashboard, and locate the new Project Risk Factors widget displaying Contextual Project Classification information.
    • Adds Infrastructure as Code (IaC) engine capability to suppress or mark findings as In Review
    • Seamlessly integrates into the Port.io platform for monitoring application security findings without context switch
    • Adds Project Risk Factors widget with Contextual Project Classification information in the Project Summary dashboard

    3 details in Everything

49. Version 26.6.1 (28-June-2026) Jun 28, 2026 · release notes

    Mend 26.6.1 adds scan comparison, malicious package detection in containers, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. rules for AI assistants

    └──▷ USE IT
    Fetch updated rules for your AI coding assistant using the MCP server
    shell copy

    Prompt your agent: "Download the newest rules for Mend MCP"

    • Adds a new scan comparison feature (available via UI or public API) to visualize added, removed, or modified findings across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Containers, and AI engines
    • Extends malicious package detection capabilities to container images, enabling end-to-end protection and workflows for embedded malicious packages
    • Enables the MCP server to fetch optimized rules for supported AI coding assistants (Cursor, Claude Code, VS Code Copilot, Windsurf) via the prompt 'Download the newest rules for Mend MCP'
    • Adds support for INFO-severity findings in the Infrastructure as Code (IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.) engine
    • Makes Contextual Project Classification generally available, allowing AI to automatically label projects based on sensitive data handling

    5 details in Everything

50. Version 26.5.2 (14-June-2026) Jun 14, 2026 · release notes

    Org-level Dependencies Risk report via UI; new scalable reporting pipeline for Dependencies Findings Report

    └──▷ HOW TO FIND IT
    View aggregated dependency risk across your entire organization via the web console.
    📍In the Mend Platform UI, navigate to Reports › Dependencies Risk (Org-level).
    • Adds Dependencies Risk organization-level report available in the Mend Platform UI

    1 detail in Everything

51. Version 26.5.1 (31-May-2026) May 31, 2026 · release notes

    Mend Platform v26.5.1 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server exposure for security findings and new Admin group assignment setting

    └──▷ HOW TO FIND IT
    Query top security issues in a repo via an AI agent using the MCP server.
    📍ask "What are the top 5 security issues in this repo?" to your preferred MCP-compatible AI tool
    Manage application access by configuring automatic Admin group assignment.
    📍Navigate to Administration › Application Settings and enable Assign new apps to Admin group in the Mend Platform console
    • Adds MCP server exposing SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. security findings with remediation suggestions to AI-powered tools via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
    • Adds a new Administration setting to control whether newly created applications are automatically assigned to the Admin group.

    2 details in Everything

52. Version 26.4.3 (17-May-2026) May 17, 2026 · release notes

    Mend Platform v26.4.3 adds custom roles with granular permissions and UI clarity for copyright origins.

    • Introduces custom roles with granular permissions to define least-privilege access via groups at organization and application levels
    • Adds an Assigned by field to copyright entries in the OS library side panel to distinguish system-detected from user-overridden copyrights
    • Replaces the floating filter row in Admin > Applications with platform-standard filter buttons for consistent filtering

    3 details in Everything

53. Version 26.4.2 (03-May-2026) May 3, 2026 · release notes

    Mend for VS Code extends to Open-VSX/AI IDEs; bulk actions toolbar adds to admin UI.

    • Mend for Visual Studio Code extension becomes available on the Open-VSX registry, enabling installation in AI-native IDEs like Cursor and Windsurf
    • Updated administration screens include a floating bulk actions toolbar

    2 details in Everything

54. Version 26.4.1 (19-April-2026) Apr 19, 2026 · release notes

    Adds Users & Groups report generation via UI/API, CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently.-based SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import fallback, Application Admin source file remapping, and UI revamps for Findings and Reports.

    • Adds the Users & Groups report to allow admins to generate comprehensive reports of users, roles, and group memberships via the UI or API, supporting multiple formats.
    • Adds support for recognizing CPE identifiers during SBOM imports in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. formats when PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. is missing, using CPEs to identify components for broader compatibility.
    • Enables Application Admins to remap source files within their assigned applications via updated UI and API with restricted application-level scope.
    • Revamps the organizational Findings table UI with streamlined columns, improved filtering/sorting, enhanced search, clearer terminology, and modern UX patterns.
    • Enhances the Report Page UI with refreshed scan engine icons, optimized column layouts, ellipsis overflow for text cells, unified status chip designs, and hidden Generated By cell by default.

    5 details in Everything

55. Version 26.3.2 (12-April-2026) Apr 12, 2026 · release notes

    Zero-Day response workflows with dedicated catalog and configurable enforcement; enhanced Jira integration with clickable CVEs.

    └──▷ HOW TO FIND IT
    Navigate the dedicated Zero-Day catalog to track enforcement actions on critical vulnerabilities.
    📍In the Mend AppSec Platform, go to the new Zero-Day section from the main navigation to view alerts and violation tracking
    • Adds Zero-Day response workflows offering immediate risk visibility, audit-level transparency, user-controlled enforcement for critical vulnerabilities, prominent alerts, a dedicated Zero-Day catalog, configurable workflows, and permanent violation tracking
    • Enhances Jira security tickets to provide direct links to Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform areas, display project-level violation details and counts per vulnerability, and make CVE identifiers clickable

    2 details in Everything

56. Version 26.3.1 (22-March-2026) Mar 22, 2026 · release notes

    Mend Forge adds AI project classification, X-OrgId MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. header, bulk license selection, and dashboard filters

    └──▷ USE IT
    Configure your agentic MCP client to direct requests to a specific organization when you belong to multiple ones.
    text copy

    Add 'X-OrgId: <org-id>' to the MCP server configuration headers.

    Speed up workflow creation by selecting all licenses visible on the current page instead of clicking them one by one.
    📍In the Legal automation workflow editor, select Select all results when configuring the Licenses event condition.
    • Adds contextual project classification in Mend Forge that uses AI to automatically analyze a codebase, identify apps handling sensitive data (payments, healthcare, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.), and assign corresponding labels to the project.
    • Enables an optional X-OrgId header in the MCP server configuration used for agentic integrations, allowing multi-org users to specify which organization the MCP tools operate against.
    • Adds a Select all results option in Legal automation workflows when using the Licenses event condition, enabling quick selection of all visible licenses (up to 50 per page) during workflow creation.

    3 details in Everything

57. 26.2.2 Mar 8, 2026 · release notes

    Mend Platform v26.2.2 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. column, Auditor role, AI scan filter, and dependencyContexts API field.

    • Adds dependencyContexts field to the Get Project Security Findings API endpoint
    • Adds a new pre-defined Auditor role for read-only access
    • Adds support for filtering scans, reports, findings, and violations by AI scan engine
    • Adds EPSS Score column to the Dependencies → Findings table

    4 details in Everything

58. Version 26.2.2 (08-March-2026) Mar 8, 2026 · release notes

    Mend Platform v26.2.2 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. column, Auditor role, AI engine filtering, and dependencyContexts API field

    • Added a new dependencyContexts field to the Get Project Security Findings API.
    • Added support for filtering scans, reports, findings, and violations by the AI scan engine.
    • Added a new pre-defined Auditor role that grants read-only access.
    • Added a new EPSS Score column to the Dependencies → Findings table.

    4 details in Everything

59. Version 26.2.1 (22-February-2026) Feb 22, 2026 · release notes

    Source File Matching in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds Source Files page and column; rows-per-page selector to tables

    • Adds a dedicated Source Files page for automatic and manual grouping of source files into logical libraries to improve vulnerability detection and compliance reporting.
    • Adds a new Source File column in existing SCA tables that maps findings to the specific source files within matched libraries.
    • Adds a rows-per-page selector in paginated tables, allowing users to switch between 50 (default) and 100 rows per page.

    3 details in Everything

60. 26.2.1 Feb 22, 2026 · release notes

    Mend Platform 26.2.1 adds Source File grouping for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and a rows-per-page selector to tables

    • Source Files page enables automatic and manual grouping of source files into logical libraries

    1 detail in Everything

61. 26.1.2 Feb 8, 2026 · release notes

    Mend Platform v26.1.2 adds responsive top nav redesign, improved sidebar, consistent SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. file paths, and clearer SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import feedback.

    • Redesigned the top navigation to be fully responsive with a more dropdown for overflow buttons
    • Consolidated profile and admin options into a single menu in the updated top navigation
    • Updated sidebar across the platform with modern design, improved selected tab visibility, and consistent collapse/expand behavior
    • Displayed file locations consistently for dependencies in the UI (SCA)
    • Showed clear error feedback when importing a valid SBOM fails

    5 details in Everything

62. Version 26.1.1 (25-January-2026) Jan 25, 2026 · release notes

    Mend Platform 26.1.1 adds centralized Scans View and enhances LVP remediation strategy.

    • Adds Scans View for organization-wide visibility into scan activities, monitoring, filtering, and analysis.
    • Enhances Least Vulnerable Package (LVP) remediation strategy to recommend both major and minor version upgrade paths in the library side-panel.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the legacy Library Page from the SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. module; users must now use dedicated side-panels for library-related data.
63. 26.1.1 Jan 25, 2026 · release notes

    Mend Platform 26.1.1 adds centralized Scans View and LVP version path enhancements

    • Adds a centralized Scans View providing organization-wide visibility into all scan activities for administrators and security teams.
    • Removes the legacy Library Page from the SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. module, moving library data to dedicated side-panels with streamlining navigation.
    • Enhances Least Vulnerable Package (LVP) remediation strategy to recommend both major and minor version upgrade paths in the Remediation tab.

    3 details in Everything

64. 25.12.1 Dec 28, 2025 · release notes

    Mend Platform 25.12.1 adds AI-powered natural language search and enhanced SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration controls

    • Adds a natural language search bar powered by AI to filter applications and projects with intuitive prompts.
    • Enhances SAML integration with new configuration options, improved user provisioning controls, and a modernized UI for a more flexible and secure authentication experience.
    • Enables disabling local logins within the SAML configuration.

    3 details in Everything

65. Version 25.12.1 (28-December-2025) Dec 28, 2025 · release notes

    Mend Platform 25.12.1 adds AI natural language search for apps/projects and enhanced SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. config options.

    • Adds AI-powered natural language search bar to filter applications and projects with intuitive prompts.
    • Enhances SAML integration with new configuration options including disabling local logins, toggling just-in-time user creation, uploading/editing metadata in multiple formats, expiration notifications, and two-way SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enforcement.

    2 details in Everything

66. Version 25.11.2 (14-December-2025) Dec 14, 2025 · release notes

    Mend Platform 25.11.2 adds ServiceNow integration, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. API 3.0 import, account-level reporting, and Jira workflow support

    • Adds bi-directional sync of Dependencies and Code findings to ServiceNow Vulnerability Response
    • Adds SBOM import via API 3.0 with a dedicated logs API for traceability
    • Adds a new Reports tab in the Accounts view for account-level Inventory and Security Alerts reports
    • Adds Jira Issue creation for Legal and Compliance workflows in OS Inventory and Automation Workflows

    4 details in Everything

67. 25.11.2 Dec 14, 2025 · release notes

    New ServiceNow integration, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import API v3.0, account-level reports, and Jira legal workflows in Mend Platform 25.11.2.

    • Adds bi-directional sync of Dependencies and Code findings to ServiceNow Vulnerability Response module
    • Added support for SBOM import through API 3.0 with a dedicated logs API
    • Added Reports tab in Accounts view for generating Inventory and Security Alert reports
    • Legal and Compliance workflows now support Jira Issue creation from OS Inventory table

    4 details in Everything

68. Version 25.11.1 (30-November-2025) Nov 30, 2025 · release notes

    Mend Platform v25.11.1 adds streamlined filter buttons on Apps/Projects views and consolidates Profile/Admin options.

    • Adds streamlined filter buttons to the Applications and Projects views to improve filtering UX
    • Consolidates Profile and admin options into a single consolidated menu

    2 details in Everything

69. 25.11.1 Nov 30, 2025 · release notes

    Mend Platform 25.11.1 adds streamlined filter buttons and consolidated profile menu in UI

    • Adds streamlined filter buttons for a cohesive user experience on Applications and Projects views
    • Groups non-fitting buttons under a more dropdown
    • Consolidates Profile and admin options into a single menu

    3 details in Everything

70. (25-November-2025) Nov 25, 2025 · release notes

    Adds Shai-Hulud zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. detection via dedicated workflow event condition

71. Version 25.10.3 (16-November-2025) Nov 16, 2025 · release notes

    Mend Platform 25.10.3 adds Risk Reduction Dashboard, Legal Analyst role, and makes Automation Workflows default for all CLI scans

    • Adds the Legal Analyst role (mapping to Legacy SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. License and Copyright Assigners) to assign license and copyright management permissions directly through the UI.
    • Adds a Risk Reduction Dashboard focused on security findings, including a risk funnel and application/project tables with actionable insights.
    • Enables Automation Workflows by default in every CLI dependencies scan, removing the previous requirement for the --update parameter.

    3 details in Everything

72. 25.10.3 Nov 16, 2025 · release notes

    Mend Platform 25.10.3 adds Risk Reduction Dashboard, Legal Analyst role, and CLI automation workflow scope.

    • Adds a Risk Reduction Dashboard with a risk funnel and application/project tables to highlight security findings and potential risk reduction opportunities
    • Adds the Legal Analyst role (replacing License and Copyright Assigners in Legacy SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.) to enable direct UI assignment of license and copyright management permissions
    • Extends Automation Workflows to apply in every CLI dependencies scan, regardless of whether the --update parameter is specified

    3 details in Everything

73. (27-October-2025) Oct 27, 2025 · release notes

    Automation Workflows are now triggered for every scan by default.

74. Version 25.10.1 (20-October-2025) Oct 20, 2025 · release notes

    Mend Platform v25.10.1 adds Agentic IDE integrations, scan tag triggers, persona filtering, and auto SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user creation

    • Adds Mend Agentic Integration for Amazon Q, Claude Code, Cursor IDE, VS Code Copilot, and Windsurf IDE to detect and fix vulnerabilities in real-time
    • Adds a new Scan Metadata operational triggering event allowing workflows to use Scan Tag (Key) or Scan Tag (Key:Value) with Matches/Doesn't Match operators
    • Introduces Persona-Based Violation Filtering for Security and Legal teams to view violations separately by persona
    • Enables suppressing violating findings directly from the main table and side-panel at Origin, Library, and Finding levels
    • Adds an Automatic User Creation toggle in SAML settings to auto-create new users on first SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login

    5 details in Everything

75. 25.10.1 Oct 20, 2025 · release notes

    Mend Platform 25.10.1 adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. agentic IDE support, scan metadata workflow tags, persona violation filtering, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. auto-creation toggle.

    • Adds Mend Agentic Integration for Amazon Q, Claude Code, Cursor IDE, VS Code, Copilot, and Windsurf IDE to detect and fix vulnerable libraries or code in real-time
    • Adds Scan Metadata operational triggering event with Scan Tag (Key) and Scan Tag (Key:Value) conditions using Matches/Doesn't Match operators for workflow scope and policy alignment
    • Introduces Persona-Based Violation Filtering to allow Security and Legal teams to view violations separately by persona with toggle or combined views
    • Enables suppression of violating findings directly from the main table and side-panel at Origin level (Root Library for SCA, Package for Containers), Library level, and Finding level
    • Adds an Automatic User Creation toggle in SAML settings to automatically create users on first SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login

    5 details in Everything

76. Version 25.8.2 (07-September-2025) Sep 7, 2025 · release notes

    Mend Platform 25.8.2 adds custom SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. values for workflow violations and IP allowlisting

    • Adds Administration > General tab for configuring IP allowlists (exact IPs or CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges) to block unauthorized API and UI access
    • Adds ability to define custom SLA values for violations in automation workflows, ranging from 1 - 1000 days

    2 details in Everything

77. 25.8.2 Sep 7, 2025 · release notes

    Mend Platform 25.8.2 adds custom SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. values for automation workflows and IP allowlisting via Admin settings.

    • Adds configurable SLA values (1-1000 days) for violations in automation workflows
    • Adds IP allowlisting via the Administration > General tab to block unauthorized access

    2 details in Everything

78. Version 25.8.1 (24-August-2025) Aug 24, 2025 · release notes

    Mend Platform v25.8.1 adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties.-only enforcement, Jira label mapping config, and CSV findings export.

    • Adds a configuration option in the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration settings to enforce SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only login by disabling username/password authentication
    • Enhances the Jira integration by mapping Mend attributes to Jira fields for adding labels with Mend attributes or free text
    • Introduces the ability to export findings to CSV

    3 details in Everything

79. 25.8.1 Aug 24, 2025 · release notes

    Mend Platform 25.8.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only enforcement, Jira label mapping, and CSV export capabilities.

    • Adds sso_only configuration option to enforce single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and disable username/password authentication in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration settings
    • Enhances Jira integration by mapping Mend attributes to Jira fields for adding labels with Mend attributes or free text
    • Introduces the ability to export findings to CSV

    3 details in Everything

80. Version 25.7.2 (10-August-2025) Aug 10, 2025 · release notes

    Mend Platform 25.7.2 adds Reference column to scans, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata URLs, and opt-in email notifications.

    • Adds a Reference column to Mend scan results that displays the scanned branch (for Dependencies/Code) or image tag (for Containers), enabling filtering by these values
    • Updates SAML integration to accept a list of predefined metadata URL formats for identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration
    • Changes email notification default to opt-in for listed platform users, who can now opt out via My Profile

    3 details in Everything

81. 25.7.2 Aug 10, 2025 · release notes

    Mend Platform 25.7.2 adds Reference column to scans, changes email notification defaults to opt-in, and updates SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata URL support.

    • Adds a Reference column in Mend scans showing the scanned branch (Dependencies/Code) or image tag (Containers), enabling filtering by these values
    • Changes email notifications for listed platform users from opt-out to default opt-in, with an opt-out path via My Profile
    • Updates the SAML integration to accept a list of predefined metadata URL formats

    3 details in Everything

82. 25.6.2.2 Jul 23, 2025 · release notes

    Introduces Notification User account type to configure email notifications for distribution lists.

    • Adds Notification User as a new user type available in Mend Platform to handle email notification distribution.

    1 detail in Everything

83. Version 25.6.2.1 (15-July-2025) Jul 15, 2025 · release notes

    New granular control for Scan Summary email notifications via My Profile and bulk org settings

    • Adds ability to disable Scan Summary Email notifications in the new Email Notifications configuration page under My Profile
    • Enables enabling or disabling Scan Summary Email notifications per organization or in bulk across all organizations

    2 details in Everything

84. 25.6.2 Jul 13, 2025 · release notes

    Mend Platform v25.6.2 adds support for Jira Data Center versions 10.0.0 through 10.7.2.

85. Version 25.5.1 (08-June-2025) Jun 8, 2025 · release notes

    Version 25.5.1 introduces application-level workflow management and visibility into organization-level workflows within the Violations view.

    • Application admins can now create workflows tailored to specific applications
    • Existing application workflows can be edited to adapt to evolving requirements
    • Organization-admin set workflows are now visible to application admins
    • Violations from both application-level and organization-level workflows appear in the Violations view

    4 details in Everything

86. 25.5.1 Jun 8, 2025 · release notes

    Application Admins can now create and edit application-level workflows alongside organization-level ones.

    • Adds the ability for Application Admins to create new workflows tailored to specific applications
    • Enables editing of existing application-level workflows to adapt to evolving requirements
    • Displays violations triggered by both application-level and organization-level workflows in the Violations view

    3 details in Everything

87. Version 25.4.3 (18-May-2025) May 18, 2025 · release notes

    Aggregated scan alert emails and CVE remediation details in the finding side-panel.

    • Adds aggregated email notifications per scan and project to consolidate multiple alerts
    • Adds a Remediation section to the Finding side-panel showing fix recommendations for CVEs

    2 details in Everything

88. 25.4.3 May 18, 2025 · release notes

    Mend Platform 25.4.3 adds aggregated scan emails and a Remediation section in the Finding side-panel.

    • Consolidates multiple alerts into a single, aggregated email per scan and project
    • Adds a Remediation section to the Finding side-panel displaying the latest fix recommendation for CVEs

    2 details in Everything

89. Version 25.4.2 (04-May-2025) May 4, 2025 · release notes

    Mend Platform v25.4.2 adds multi-org Jira support, Microsoft Defender for Cloud integration, and dashboard UX improvements.

    • new features and updates includes a Jira Cloud plugin update for multi-organization support
    • Jira project mapping is available in the new multi-org view within the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform
    • Integration for Mend.io into Microsoft Defender for Cloud is now available

    3 details in Everything

90. 25.4.2 May 4, 2025 · release notes

    Adds multi-organization Jira plugin support, Microsoft Defender for Cloud integration, and UI clarity improvements in Mend Platform 25.4.2

    • Introduces multi-organization support for the Jira Cloud plugin to connect issues from multiple Mend organizations within a single Jira instance.
    • Adds an integration for Mend.io into Microsoft Defender for Cloud to display Mend results.

    2 details in Everything

91. Version 25.3.1 (24-March-2025) Mar 24, 2025 · release notes

    Mend Platform v25.3.1 introduces a Value Dashboard for CISOs and enhances Application Admin capabilities.

    • Adds the Value Dashboard to showcase security posture contributions with remediation trends, time-to-fix metrics, and UI export capabilities
    • Enhances the Application Admin role on the Administration Page with expanded access to edit application names, create/delete projects, assign labels, and link Code Scan Configs

    2 details in Everything

92. 25.3.1 Mar 24, 2025 · release notes

    Mend Platform 25.3.1 adds Value Dashboard with export and Application Admin tabs access

    • Adds the Value Dashboard to help security leaders showcase contribution to improved security posture, providing actionable insights into remediation trends and time-to-fix metrics.
    • Enables exporting data directly from the Dashboard UI for better reporting.
    • Grants users with the Application Admin role access to the Applications and Projects tabs on the Administration Page.

    3 details in Everything

93. Version 25.2.2 (09-March-2025) Mar 9, 2025 · release notes

    Mend Platform v25.2.2 adds sourceUrl to scans and --tags CLI parameter for unified tagging across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and Containers.

    • Adds a sourceUrl tag to projects and scans metadata, applied via Mend CLI and repository integrations (Developer Platform + Classic).
    • Introduces the --tags parameter in the Mend CLI to add custom single or multi-tags across all scan engines (SCA, SAST, Containers) for enhanced scan metadata management.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --label-proj and --label-app parameters are soon-to-be-deprecated, superseded by --tags.
94. 25.2.2 Mar 9, 2025 · release notes

    Mend Platform 25.2.2 adds --tags CLI parameter and sourceUrl metadata to projects.

    • Introduces the --tags CLI parameter across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and Containers engines for custom scan metadata management.
    • Adds a sourceUrl field containing the scanned repository URL to projects and scans in the platform.

    2 details in Everything

95. 03-March-2025 Mar 3, 2025 · release notes

    Mend Platform introduces Mend AI for AI inventory visibility and Mend AI Premium for behavioral risk detection.

    • Introducing Mend AI to detect AI components (models, frameworks, inference providers) and identify Shadow AI.
    • Adding Mend AI Premium for AI Component Risk Insights including licensing and vulnerability risks.
    • Adding AI Behavioral Risks (Red-teaming) capability with prebuilt customizable tests for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., context leakage, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
    • Enabling Proactive Policies and Governance for AI components through policy engine automation workflows.

    4 details in Everything

96. Version 25.1.2 (09-February-2025) Feb 9, 2025 · release notes

    Adds report filtering by up to 10 labels to scope data to specific teams.

97. 25.1.2 Feb 9, 2025 · release notes

    Adds filtering reports by Labels to scope data and improve ownership (up to 10 labels)

    • Supports filtering reports by Labels for scoping data to specific teams

    1 detail in Everything

98. Version 25.1.1 (26-January-2025) Jan 26, 2025 · release notes

    Version 25.1.1 adds Jira Data Center sync, primary platform redirect, and Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration

    • Adds Jira Data Center support for syncing issue data (status, link, reporter, creation date)
    • Adds Mend Platform as a selectable primary platform to auto-redirect login from Legacy SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.
    • Adds new Invicti DAST integration for viewing and managing dynamic security findings

    3 details in Everything

99. 25.1.1 Jan 26, 2025 · release notes

    Jira Data Center sync expanded, primary platform redirect added, Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration introduced

    • Syncs issue data (status, link, reporter, creation date) from Mend Platform to the Jira Data Center UI
    • Adds ability to set Mend Platform as the primary platform for automatic redirect from the Legacy SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. application
    • Introduces integration with Invicti to view and manage dynamic security findings in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform

    3 details in Everything

100. 24.12.1 Jan 6, 2025 · release notes

     Mend Platform 24.12.1 adds Violation SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments./Priority attributes, pipeline failure exit code 9, and bulk Code report generation.

     • Introduces Violation SLA and Violation Priority attributes to optimize policy violation management.
     • Enables Workflow admins to fail the pipeline when a violation is detected; CLI scans now return exit code 9 for Dependencies, Containers, and Code scans.
     • Adds bulk action functionality for generating Code reports at the Project level across all report types.

     3 details in Everything

101. Version 24.11.2 (15-December-2024) Dec 15, 2024 · release notes

     Mend Platform 24.11.2 adds Spotify Backstage integration and new remediation strategy config.

     • Adds Spotify Backstage integration to monitor SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings and access issue tracking tickets without context switch
     • Introduces a new configuration option for remediation strategies, allowing users to choose between Least Vulnerable Package (LVP) or First Fix across the Mend Platform, Jira integration and Platform API (3.0)

     2 details in Everything

102. 24.11.2 Dec 15, 2024 · release notes

     Mend Platform 24.11.2 adds Spotify Backstage integration and remediation strategy configuration options.

     • Integrates Mend into Spotify Backstage for developers to monitor SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings and access issue tracking tickets without context switching
     • Adds a new configuration option for remediation strategies, allowing users to choose between Least Vulnerable Package (LVP) or First Fix
     • Reflects the selected remediation strategy across the Mend Platform, Jira integration, and Platform API 3.0

     3 details in Everything

103. Version 24.10.3 (17-November-2024) Nov 17, 2024 · release notes

     Mend Platform 24.10.3 adds Jira Data Center integration and Violations API

     • Adds Jira Data Center integration for issue creation and tracking
     • Adds API to access violation data for security and compliance monitoring
     • Introduces Risk Factors feature grouping Reachability, Exploitability and Maliciousness statuses with a filterable column

     3 details in Everything

104. 24.10.3 Nov 17, 2024 · release notes

     Mend Platform 24.10.3 adds Jira Data Center integration, Violations API, and Risk Factors filtering in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.

     • Adds api endpoint for querying violation data to monitor, analyze and act on security and compliance violations
     • Adds new Risk Factors column in Mend SCA with filterable Reachability, Exploitability, and Maliciousness statuses
     • Adds integration with Jira Data Center for issue creation and tracking

     3 details in Everything

105. Version 24.9.2 (13-October-2024) Oct 13, 2024 · release notes

     Mend Platform 24.9.2 adds seamless SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with any IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and Mend Code/Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration.

     • Added seamless sign-in with any Identity Provider (IDP) to automatically log into Mend.io.
     • Integrated Mend Code results into Invicti for a holistic view of SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and DAST code findings.

     2 details in Everything

106. 24.9.2 Oct 13, 2024 · release notes

     Mend Platform 24.9.2 adds IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sign-in toggle and Invicti integration

     • Adds a Settings toggle to enable seamless sign-in with any Identity Provider (IDP).
     • Enables Mend Code results integration with Invicti for holistic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings.

     2 details in Everything

107. 24.7.2 Aug 11, 2024 · release notes

     Mend Platform 24.7.2 adds ML BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. report generation, workflow templates, custom repo tags, improved license search and CLI violation tables.

     • Adds a Create Report button to the ML BOM tab of the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. page in the UI to generate reports containing only ML BOM libraries
     • Added workflow templates to allow users to create new workflows based on Mend.io recommendations and best-practices
     • Added the option to define customized tags (metadata) in repositories for extraction and presentation in the Mend Platform UI (Closed Beta)
     • Improved license selection in Dependencies/Container workflows by allowing search and multi-select without clearing the search term
     • New CLI outputs for Workflow Violations include two tables for detected violations and triggering workflows, showing Finding, Origin, Violations, and Workflows details

     5 details in Everything

108. Version 24.7.1 (28-July-2024) Jul 28, 2024 · release notes

     Mend Platform 24.7.1 expands workflow condition permutations and adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Score trigger.

     • Adds EPSS Score as a standalone condition in the Containers Trigger Event
     • Allows combining project in with project regex or application in with application regex simultaneously in workflow Scope conditions
     • Updates Container Image SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report to use a drop-down menu for selecting the SBOM standard

     3 details in Everything

109. 24.7.1 Jul 28, 2024 · release notes

     Mend Platform 24.7.1 enhances workflow scope conditions with new permutations and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. support.

     • Adds ability to use project in alongside project regex or application in with application regex simultaneously in Workflow scope conditions
     • Adds EPSS Score as a standalone condition in the Containers Trigger Event
     • Updates Containers CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score targeting to version 3.0 while Dependencies target default configuration

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed the Vulnerability Score Type from the conditions dropdown in the Containers Workflows on the Workflow creation page
110. Version 24.5.1 (19-May-2024) May 19, 2024 · release notes

     Mend Platform 24.5.1 adds license selection and label-based scope conditions to automation workflows

     • Adds a predefined list of licenses selectable in the Licenses section of automation workflows
     • Adds label-based scope conditions to automation workflows, defaulting to organization-level

     2 details in Everything

111. 24.5.1 May 19, 2024 · release notes

     Adds conditions and license-based scoping to Mend Platform automation workflows.

     • Adds predefined list of licenses to select from in the Licenses section of automation workflows
     • Adds label-based scope conditions to automation workflows to define trigger scope (default: organization-level)

     2 details in Everything

112. Version 24.3.2 (8-April-2024) Apr 8, 2024 · release notes

     Mend Platform v24.3.2 adds consolidated scan engine displays, Automation Engine with Jira/sync actions, APIv3, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. UX improvements, and dashboard trendlines.

     • Consolidated display of Code, Dependencies, and Containers data on Applications/Projects pages
     • Automation Engine for enforcing workflow policies across the SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after.
     • Jira ticket creation configurable independently per scan engine within Automation Engine
     • Enhanced SAML integration under Administration → SAML Integration
     • APIv3 encompassing Code (SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment.), Dependencies (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.), Containers (Images), and Mend Platform application access

     +3 more show less

     • New Automation Engine workflow actions: Email Notification, Assign Label, Create Violation, Jira Issue
     • Vulnerabilities, Remediation and Suppressions Trendline on the Dashboard
     • Side-by-side bidirectional user navigation between Core SCA and Mend Platform

     8 details in Everything

113. 24.3.2 Apr 8, 2024 · release notes

     Mend Platform 24.3.2 adds Automation Engine with Jira/Email actions, APIv3 access, and consolidated scan engine display in UI.

     • Applications and Projects pages now support filtering by scan engine (Code, Dependencies, Containers) to consolidate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and Container data.
     • Administration → SAML Integration enhanced for improved user experience
     • Automation Engine workflows can now execute Email Notification, Assign Label, Create Violation, and Jira Issue actions; Jira workflow is customizable per scan engine.

     3 details in Everything