Mend SAST

No entries match these filters. Clear filters

1. Version 26.10.1 (02-November-2026) Nov 2, 2026 · issue 129

   Mend SAST adds per-category scan profile controls and custom Node.js routing support via routes.json⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Reduce noise for a codebase that has no database access by excluding the Database Read category from the next scan.
   📍In the platform UI, go to your Scan Profile › Low-Probability Scan Categories, expand the selection tree, uncheck Database Read, and save — the count indicator confirms how many categories remain active.
   • Support custom Node.js routing frameworks by parsing routes.json manifests to identify handler functions as entry points for taint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Control low-probability scan categories individually in the Scan Profile — replacing the previous binary toggle with a configurable selection tree that lets you include or exclude categories such as File Read or Database Read, with a count indicator for selected categories.
   • Support custom Node.js routing frameworks by parsing routes.json manifests to identify handler functions as entry points for taint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. changelog Oct 29, 2026 · issue 124

   Mend SAST adds AI-based project risk factors to help prioritize which applications and projects to fix first⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Mend SAST now shows a risk factors column in the Applications and Projects lists, filterable by group or individual risk factor, to help prioritize remediation across projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • An evidence page now lists the code signals behind each risk factor classification, grouped by risk factor and file, so teams can see why a project was classified a certain way.
   • A risk factors widget now appears on the project summary page for at-a-glance visibility into each project's risk profile.
   • Enable AI-based project risk factors from organization administration — the setting requires AI consent, is off by default, and when on shares code snippets and project details with Mend's AI model to produce classifications.

   4 details in Everything

3. changelog Oct 21, 2026 · issue 115

   Mend SAST: Extends the Gen 2 detection engine to Swift and PHP (now the default engine for new organizations).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4. docs update Oct 20, 2026 · issue 114
   • New supported platform Bun package manager general availability
5. docs update Oct 20, 2026 · issue 114

   Gen 2 detection engine now covers Swift and PHP in Mend SAST v26.9.3.

   • Updated supported platformIntroduces the Gen 2 detection engine for Swift and PHP, bringing next-generation analysis to both languages.

   1 detail in Everything

   • Updated detection False-positive XSS reduction for Java HttpServletResponse/ServletResponse
   • Updated detection False-positive SSRF and NoSQL Injection reduction for JavaScript and TypeScript
   • Updated detection Improved Swagger YAML entry point detection for API definitions
6. Version 26.9.3 (19-October-2026) Oct 19, 2026 · issue 114

   Gen 2 detection engine for Swift and PHP delivers improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage for more accurate, scalable scans.

   • Updated detection Gen 2 detection engine for Swift and PHP
7. changelog Oct 12, 2026 · issue 104

   Mend SAST 26.9.2 adds YAML/JSON config file support for automatic API endpoint detection and entry point taint mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports YAML and JSON configuration files for entry point detection, automatically identifying API endpoints and mapping them to implementation classes for contract-first applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Automatically marks all generated entry point parameters as tainted, eliminating the need for manual custom framework configuration for contract-first applications.
   • Improves Python engine detection accuracy across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. including CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-022 Path Traversal, CWE-078 OS Command Injection, CWE-079 XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., CWE-089 SQL Injection, CWE-094 Code Injection, CWE-209 Error Message Info Exposure, CWE-295 Improper Cert Validation, CWE-532 Sensitive Info in Log, CWE-601 Open Redirect, CWE-918 SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and CWE-943 NoSQL Injection.
   • Supports YAML and JSON configuration files for entry point detection, automatically identifying API endpoints and mapping them to implementation classes for contract-first applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

8. docs update Oct 6, 2026 · issue 096
   └──▷ HOW TO FIND IT
   Enable or silence zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. vulnerability alerts for a specific organization you belong to.
   📍In the platform, go to My Profile → Email Notifications and toggle zero-day alerts on or off for the desired organization.
9. docs update Oct 6, 2026 · issue 096

   Mend SAST: Improves Python engine detection accuracy across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. including Path Traversal, OS Command Injection, XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SQL Injection, and Code Injection.

10. docs update Oct 5, 2026 · issue 095

    Mend SAST gains workflow email controls with user/group recipient selection, a new Send Email action, and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a new Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables workflow creators to select specific users or groups as recipients for scan summary emails.
    • Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.
    • Adds a new Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

    1 more in Everything

11. docs update Oct 5, 2026 · issue 095
    • Updated supported platform Gradle manager rich version constraints support
    • Updated supported platform Azure platform auto-complete settings re-applied to existing PRs
12. Version 26.9.2 (05-October-2026) Oct 5, 2026 · issue 096

    Mend SAST gains automatic API endpoint detection from YAML/JSON config files, eliminating manual framework setup for contract-first apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for YAML and JSON configuration files as input to the entry point detection engine, enabling automatic identification of API endpoints and mapping to their implementation classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Automatically marks all generated entry point parameters as tainted for contract-first applications, removing the need for manual custom framework configuration.
    • Adds support for YAML and JSON configuration files as input to the entry point detection engine, enabling automatic identification of API endpoints and mapping to their implementation classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

13. docs update Sep 28, 2026 · issue 088

    Mend SAST: Adds Bun package manager support for JavaScript projects, enabling automatic detection and reporting of direct and transitive dependencies when package.json is present alongside bun.lock or bun.lockb files.

    └──▷ TRY IT
    Tail SAST scan output in real time during CI runs without separately tailing the log file.
    copy

    $ mend code --print-to-console

14. docs update Sep 28, 2026 · issue 088
    └──▷ TRY IT
    Tail SAST scan progress live in a CI pipeline console without waiting for the log file to flush.
    copy

    $ mend code --print-to-console

15. Version 26.9.1 (28-September-2026) Sep 28, 2026 · issue 088

    Mend SAST 26.9.1 adds --print-to-console flag to mend code and auto-excludes macOS metadata files from all SAST scan engines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Stream scan logs to the console during CI runs so pipeline output captures real-time SAST progress without having to tail a separate log file.
    copy

    $ mend code --print-to-console

    • Adds --print-to-console flag to mend code CLI scans, printing scan logs directly to stdout in real time in addition to the log file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, even when default exclusions are otherwise disabled.
    • Adds --print-to-console flag to mend code CLI scans, printing scan logs directly to stdout in real time in addition to the log file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

16. docs update Sep 8, 2026 · issue 068

    Mend SAST adds multi-base-branch scanning on Azure DevOps and Bitbucket Cloud, plus JS/TS detection accuracy improvements across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..

    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.
    • Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEs (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-117, CWE-295, CWE-601, CWE-918, CWE-943), including tuned handling of React controlled components to reduce false-positive DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. findings.
    • Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.

    1 more in Everything

17. docs update Sep 8, 2026 · issue 068

    Mend SAST 26.8.2 adds IDE/AI-agent suppression tooling and a unified vulnerability remediation experience with a Top Fix column.

    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SAST and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.
    • Introduces a unified vulnerability remediation experience with a Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.
    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SAST and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., with UI updates reflecting within seconds.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The updated fix logic may result in fewer remediation suggestions per vulnerability; existing workflows relying on the previous volume of remediation recommendations will see reduced suggestions.
18. Version 26.8.2 (07-September-2026) Sep 7, 2026 · issue 068

    Mend SAST 26.8.2 improves JavaScript/TypeScript detection accuracy across 11 CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. including XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and NoSQL injection.

19. docs update Sep 1, 2026 · issue 061

    Mend SAST now scans into dedicated per-branch projects on Azure DevOps and Bitbucket Cloud

20. docs update Sep 1, 2026 · issue 061

    Mend API 3.0 brings JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, cursor pagination, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs in JSON and YAML

    • New Mend API 3.0 REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. available, downloadable as 3.0.json or 3.0.yaml OpenAPI descriptions.
    • Authenticates via a per-organization JWT token (expires every 10 minutes) obtained using a user key from the Mend Platform profile page.
    • Supports cursor pagination and result-size limiting for scalable programmatic access.
    • Broader functionality now available via REST for workflow automation across the Mend Platform.

    4 details in Everything

21. docs update Aug 25, 2026 · issue 056

    Mend SAST 26.8.1 adds probability risk factor per data flow, new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detections for JS/TS and Rust, and opt-in AI rule customization.

    • Adds an opt-in option to share additional project data with Mend.io so AI can generate candidates for customizing and tailoring detection rules to your organization.

    1 detail in Everything

22. docs update Aug 24, 2026 · issue 055

    Mend SAST adds AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 formats via Platform UI and API.

    • New AI Bill of Materials (AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) report available via the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — across organization, application, and project scopes.
    • AI-BOM exports use industry-standard CycloneDX 1.7 and SPDX 3.0.1 formats, with metadata-only exports to ensure data privacy.
    • AI-BOM coverage applies only to scans performed after the feature release date (24-August-2026).

    3 details in Everything

23. docs update Aug 24, 2026 · issue 055

    Mend SAST 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar.

    • Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally; includes comprehensive API support for managing global workflows.
    • Updates the Administration page sidebar with a categorized, collapsible navigation structure; moves AI Usage settings from the General tab to a dedicated AI Usage tab under a new AI category; adds AI, Code, and Dependencies sub-headers within Engine Settings.

    2 details in Everything

24. docs update Aug 24, 2026 · issue 055

    Renovate 44.41 adds overrideDescription config option and scopes Go stdlib OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. remediation to the toolchain directive

    └──▷ USE IT
    Override the default PR description for a dependency update to provide team-specific context.
    renovate.json copy

    {
      "overrideDescription": "This PR was auto-generated by Renovate. Review before merging."
    }

    • Adds overrideDescription option to Renovate configuration, allowing users to customize dependency update PR descriptions.
    • Manager devcontainer: adds folder pattern to the list of managerFilePatterns, expanding Dev ContainerDev ContainerA Docker-based development environment defined in a JSON config file, standardized by Microsoft, that lets a project ship its exact toolchain so any contributor's editor or CI system gets an identical workspace. dependency detection.
    • Onboarding: shows What to Expect first in the summary view for a clearer onboarding experience.

    3 details in Everything

25. docs update Aug 24, 2026 · issue 055

    Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status and layer visibility in the UI.

    • Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and base image/layer detection.
    • Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

    2 details in Everything

26. Version 26.8.1 (24-August-2026) Aug 24, 2026 · issue 056

    Mend SAST 26.8.1 adds per-data-flow probability risk factors and expands CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detection for JS/TS and Rust.

    • Adds probability risk factor display next to each data flow in finding details within the Mend Platform, enabling more granular triage.
    • Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript.
    • Adds detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) for Rust.

    3 details in Everything

27. Version 26.7.2 (10-August-2026) Aug 10, 2026 · release notes

    Mend SAST v26.7.2 adds Gen 2 Ruby engine, Scala GA, and clickable compliance finding counts

    └──▷ HOW TO FIND IT
    Quickly navigate from a compliance summary to specific violation details within the platform UI.
    📍Navigate to the Compliance Standards section in the Mend Platform and click the findings count for your target standard.
    Leverage the new Scala analysis capabilities in your project scanning workflow.
    📍Run a SAST scan on a codebase containing Scala sources; the engine will now be selected automatically for Scala files.
    • Introduces the Gen 2 Ruby detection engine with improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage for accurate, scalable scans.
    • Makes the Scala detection engine generally available, delivering increased coverage and accuracy for Scala code analysis.
    • Shows a clickable count of findings violating each compliance standard in the Mend Platform compliance standards section.

    3 details in Everything

28. Version 26.7.1 (27-July-2026) Jul 27, 2026 · release notes

    Mend SAST 26.7.1 adds Project Risk Factors evidence page, auto-inclusion of new CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. via config toggle, and new language/CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detections.

    └──▷ HOW TO FIND IT
    Verify project risk classification (e.g., Payments) by clicking the classification in the Project Risk Factors section to view underlying code signals.
    📍Navigate to Project Risk Factors › click classification (e.g., Payments)
    • Custom Code Configuration settings now include a toggle to automatically include newly supported CWE types in scan coverage
    • Project Risk Factors section gains an evidence page accessible by clicking risk factor classifications (e.g., Payments, Healthcare, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.) to view specific code signals
    • New detection for CWE-319 (Cleartext Transmission of Sensitive Information) in Go
    • New detection for CWE-642 (External Control of Critical State Data) in Java
    • New detection for CWE-284 (Improper Access Control / Unsafe Permission Check) in Java

    +1 more show less

    • New detection for CWE-614 (Sensitive Cookie Without Secure Attribute) in Python

    6 details in Everything

29. Version 26.6.1 (29-June-2026) Jun 29, 2026 · release notes

    Mend SAST v26.6.1 introduces AI-based triage for findings and enhanced detection accuracy for Python, JS, and Java.

    • Adds production-grade AI-based triage capability for SAST findings in the Developer Platform to automate false positive detection and provide exploitation paths
    • Increases detection accuracy for Python CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-78, CWE-79, CWE-117) and Java CWE-117
    • Enhances JavaScript analysis by adding local storage as a low-probability source for potential client-side vulnerabilities

    3 details in Everything

30. Version 26.5.2 (15-June-2026) Jun 15, 2026 · release notes

    Mend SAST v26.5.2 adds natural language data flow explanations to findings API and improves detections for XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. and credentials

    • SAST findings API now includes natural language descriptions for each step in a vulnerability's data flow trace.
    • Extended support for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. callbacks and anonymous classes in Java.
    • Improved detection of CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-79: Cross-site Scripting (XSS) in JavaScript/TypeScript.
    • Improved detection of hard-coded credentials for JavaScript/TypeScript, PL/SQL, and VB.Net.

    4 details in Everything

31. Version 26.5.1 (01-June-2026) Jun 1, 2026 · release notes

    Mend SAST v26.5.1 adds Scala support, enhanced secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., and suppression workflow controls via .whitesource config.

    • Adds new detection capabilities for hardcoded private keys (.pem, .key) and certificate files (.pfx, .p12)
    • Adds PowerShell scripts (.ps1) to the default set of file types scanned by secret scanning
    • Adds Information Requested state to suppression requests in the UI to allow reviewers to request additional context

    3 details in Everything

32. Version 26.4.3 (18-May-2026) May 18, 2026 · release notes

    Mend SAST adds JetBrains IDE plugin and GA Gen 2 Go engine

    └──▷ HOW TO FIND IT
    Fix a flagged vulnerability directly in IntelliJ
    📍In JetBrains IDE, open the Mend tool window, locate a finding, and click Apply Fix.
    • Gen 2 Go detection engine is generally available.

    1 detail in Everything

33. Version 26.4.2 (04-May-2026) May 4, 2026 · release notes

    Mend SAST 26.4.2 adds Python smbclient taint analysis, server-side only SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. for JS, and VS Code integration.

    • Adds taint analysis support for Python smbclient to enhance detection of path traversal vulnerabilities.
    • Changes SSRF reporting in JavaScript to report only when detected on the server side, improving finding accuracy.
    • Adds Secret scanningSecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. availability in Mend for Visual Studio Code.

    3 details in Everything

34. Version 26.4.1 (20-April-2026) Apr 20, 2026 · release notes

    Mend SAST 26.4.1 adds Gen 2 Go engine, Rust auto-remediation, incremental secrets scanning, and deep links to CSV exports.

    • Introduces the Gen 2 Go detection engine for improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage
    • Adds automated remediation suggestions for Code findings in Rust
    • Enables incremental scanning for secrets detection to analyze only changed files
    • Adds a Deep Link column to CSV exports with direct URLs to findings in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform UI

    4 details in Everything

35. 26.3.1 Mar 23, 2026 · release notes

    Mend SAST 26.3.1 adds org-wide suppression request view with CSV export and improves Go analysis performance.

    └──▷ HOW TO FIND IT
    Audit all pending suppressions across the org and export them for compliance records.
    📍In the console, go to Findings --> Suppression Requests, apply filters as needed, then click Export to CSV.
    • Adds Findings --> Suppression Requests view for Organization admins to filter by application, project, status, or reason
    • Enables exporting suppression requests to CSV via the new Suppression Requests view for compliance audits

    2 details in Everything

36. Version 26.2.2 (09-March-2026) Mar 9, 2026 · release notes

    Mend SAST v26.2.2 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-457/828 C/C++ detection and GitHub suppression audit trail

    • Adds support for CWE-457 (Use of Uninitialized Variable) and CWE-824 (Access of Uninitialized Pointer) to C/C++ analysis in low probability mode.
    • Suppressions synchronized with GitHub now add a comment to the linked issue containing the suppression reason, extra comments, and the user who performed the suppression.
    • Suppression request tables now display a Reviewed By column showing who approved or rejected each request.

    3 details in Everything

37. 26.1.2 Feb 9, 2026 · release notes

    Mend SAST 26.1.2 adds resolved findings export and improved detection accuracy.

    • Adds CSV, XML, and JSON export for SAST reports containing resolved (historical) findings via API and Platform UI
    • Increases accuracy of CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-79: Cross-site Scripting detection for JavaScript
    • Improves Rust detection accuracy with multiple minor enhancements
    • Enhances secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to detect hardcoded database connection strings in configuration files without code changes

    4 details in Everything

38. Version 26.1.2 (09-February-2026) Feb 9, 2026 · release notes

    Adds historical SAST report export in CSV/JSON/XML via API and UI; improves CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-79, Rust, and secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. detection.

    • Added sast.report.historical capability to generate reports including resolved findings for a selected time frame, exported as CSV, XML, or JSON via API and Platform UI
    • Improved accuracy of CWE-79 (Cross-site Scripting) detection specifically for JavaScript files
    • Multiple minor improvements to increase the accuracy of Rust language detection in the SAST engine
    • Enhanced secret scanning to better detect hardcoded database connection strings in code changes
    • Triggered secret scanning on configuration file changes even when no actual code is present in the repository

    5 details in Everything

39. 26.1.1 Jan 26, 2026 · release notes

    Mend SAST 26.1.1 adds GitHub suppression approval workflows, C/C++ auto-remediation, Rust GA, .pbxproj secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., and multi-threading.

    └──▷ HOW TO FIND IT
    Enable Rust scanning for a new project now that it is GA.
    📍n/a (feature enabled via platform settings, not a CLI flag)
    Scan Xcode projects for exposed secrets in .pbxproj configuration files.
    📍n/a (native support, no new flag required)
    • Supports suppression approval workflows for GitHub repositories
    • Adds automated remediation suggestions for Code findings in C and C++ (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, CWE-601)
    • Rust detection is now generally available with expanded CWE coverage
    • Added support for .pbxproj files in secret scanning
    • SAST detection for Android, Objective-C and Cold Fusion now supports multi-threading to reduce scan time

    5 details in Everything

40. Version 26.1.1 (26-January-2026) Jan 26, 2026 · release notes

    Mend SAST adds GitHub suppression workflows, C/C++ auto-remediation, GA Rust detection, and .pbxproj secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

    • Adds support for suppression approval workflows in GitHub repositories to let developers request suppressions while managers retain control
    • Adds automated remediation suggestions for Code findings in C and C++ covering CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, and CWE-601
    • Makes Mend SAST Rust detection generally available with expanded CWE coverage
    • Adds support for .pbxproj files in secret scanning to detect sensitive information in Xcode configuration files

    4 details in Everything

41. Version 25.12.2 (12-January-2026) Jan 12, 2026 · release notes

    Mend SAST adds suppression approval workflows for Azure DevOps and new Express entry points.

    • Supports suppression approval workflows for Azure DevOps repositories
    • Adds additional entry points for Express framework

    2 details in Everything

42. Version 25.12.1 (05-January-2026) Jan 5, 2026 · release notes

    Mend SAST 25.12.1 adds Bitbucket suppression approval workflows and improves Rust double-unwrapping analysis

    • Supports suppression approval workflows for Bitbucket repositories, allowing developers to request suppressions and security managers to approve or reject them.

    1 detail in Everything

43. 25.11.2 Dec 15, 2025 · release notes

    Mend SAST 25.11.2 adds PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0/MISRA compliance support, C++ gen 2 for new orgs, and enhanced analysis accuracy.

    └──▷ HOW TO FIND IT
    Check compliance status against new standards in reports.
    📍View PCI DSS 4.0 and MISRA columns in the code findings table within Mend SAST UI.
    Filter suppression requests by reason to speed up review workflows.
    📍In the Suppression Requests view, use the filter dropdown to select false positive or acceptable risk.
    • Adds PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS 4.0 and MISRA as supported compliance standards in code findings table and reports
    • Enables C++ gen 2 engine by default for newly created organizations
    • Adds filtering, sorting, and grouping of findings by project in the applications view
    • Improves accuracy of Java, JavaScript/TypeScript and Python analysis for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-78, CWE-79 and CWE-89
    • Enhances support for Rust macros to ensure proper parsing of tainted data

    +1 more show less

    • Adds ability to filter suppression requests by predefined reasons (false positive or acceptable risk) in the review UI

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Scans are now automatically stopped if the CLI cannot retrieve required engine configuration, which will interrupt scans on unreliable networks where this previously may have hung or produced inconsistent results.
44. Version 25.11.2 (15-December-2025) Dec 15, 2025 · release notes

    Mend SAST adds PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0/MISRA compliance filters, C++ gen2 default for new orgs, and findings view enhancements.

    • PCI DSS 4.0 and MISRA standards are now visible in the code findings table and code reports for compliance filtering
    • Newly created organizations automatically have the C++ gen 2 engine enabled by default
    • Suppression request review now supports filtering by predefined reasons: false positive or acceptable risk
    • The applications view adds the ability to filter, sort, and group findings by project

    4 details in Everything

45. Version 25.11.1 (01-December-2025) Dec 1, 2025 · release notes

    Mend SAST v25.11.1 adds batched findings for Agentic detection and expands low-probability taint sources for Rust/C++.

    • Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation.
    • Added low probability taint sources for file, database, console, and environment variable reads in Rust.
    • Reclassified CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++.
    • Added reading from local files as a low probability taint source.
    • Organizations are now sorted alphabetically in the Mend CLI’s organization selection step.

    5 details in Everything

46. 25.11.1 Dec 1, 2025 · release notes

    Mend SAST 25.11.1 adds batched Agentic SAST findings, expanded low-prob taint sources for Rust and C/C++, and sorted org selection in CLI

    • Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation
    • Added low probability taint sources for file, database, console, and environment variable reads in Rust, improving analysis accuracy
    • Reading from local files has been added as a low probability taint source
    • Reclassified CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++, enhancing scan accuracy when scanning with the default configuration
    • Further improved detection accuracy for C/C++ gen 2 , most notably for the following CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes.: CWE-121: Buffer Overflow CWE-369: Divide by Zero CWE-606: Loop Denial of Service CWE-611: XML External Entity (XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery.) Injection CWE-789: Uncontrolled Memory Allocation

    +1 more show less

    • Organizations are now sorted alphabetically in the Mend CLI’s organization selection step, making it easier and faster to navigate large lists

    6 details in Everything

47. 25.10.3 Nov 17, 2025 · release notes

    Mend SAST 25.10.3 adds IDE extension, Wiz integration, and improved Rust detection

    • Mend.io code extension provides security findings and remediation suggestions directly in the IDE
    • SAST findings can now be uploaded into Wiz to correlate static vulnerabilities with runtime context
    • Detection accuracy for Rust projects improved, specifically addressing CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-614, CWE-943, and CWE-1004
    • SAST secret scanning now includes .xcconfig files by default for hardcoded API key detection
    • Gradle wrapper distribution files automatically excluded from scans to reduce false positives

    5 details in Everything

48. Version 25.10.3 (17-November-2025) Nov 17, 2025 · release notes

    Mend SAST v25.10.3 adds Mend io Code IDE extension, Wiz integration, and .xcconfig secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

    • Mend io Code extension provides real-time security findings and remediation suggestions directly in the IDE before code is committed
    • SAST findings can now be uploaded to Wiz for correlation with runtime cloud context
    • Secret scanning now includes .xcconfig files by default, detecting hardcoded API keys and sensitive data
    • Detection accuracy improved for Rust projects covering CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-614, CWE-943, and CWE-1004
    • C/C++ (Gen 2) macro expansion handling updated to ensure accurate method names and data flow traces

    +1 more show less

    • Gradle wrapper distribution files are now automatically excluded from scans by default

    6 details in Everything

49. Version 25.10.2 (03-November-2025) Nov 3, 2025 · release notes

    Mend SAST v25.10.2 adds PySpark support and new CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. for Rust and C/C++ engines

    • Adds PySpark framework detection to the Python scan engine

    1 detail in Everything

50. 25.10.2 Nov 3, 2025 · release notes

    Mend SAST v25.10.2 adds new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. coverage for Rust and C/C++, and PySpark support for Python detection.

    • Adds CWE-79, CWE-327, CWE-328, CWE-614, CWE-798, CWE-942, CWE-943, and CWE-1004 to the Rust detection engine
    • Adds CWE-606 to the Gen 2 C/C++ detection engine
    • Adds support for the PySpark framework to the Python detection engine

    3 details in Everything

51. 25.10.1 Oct 20, 2025 · release notes

    Mend SAST 25.10.1 adds Gen 2 C/C++ engine, finding suppression approval workflow, and HTTP handler entry points for JS/TS

    • Gen 2 C/C++ detection engine with improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage
    • New approval process for security finding suppressions in code repositories
    • Reading HTTP Handler Methods from an array as entry points for JavaScript/TypeScript

    3 details in Everything

52. Version 25.10.1 (20-October-2025) Oct 20, 2025 · release notes

    Gen 2 C/C++ engine, finding suppression approval process, JS/TS HTTP entry points, and PR-based repo onboarding in Mend SAST 25.10.1

    • Introduces the Gen 2 C/C++ detection engine for improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage
    • Adds a new approval workflow for security finding suppressions where developers propose and security managers approve or reject changes
    • Enables repository onboarding via the first pull request when no prior scans exist, causing initial findings to fail the check rather than becoming backlog
    • Supports reading HTTP Handler Methods from an array as entry points in JavaScript/TypeScript
    • Updates SCMs .whitesource or .mend onboarding configuration templates to explicitly list available options

    5 details in Everything

53. 25.9.1 Sep 29, 2025 · release notes

    Mend SAST 25.9.1 adds Rust support and allows custom encryption keys via API

    • Adds Rust as a supported language for static analysis
    • Adds an API endpoint to provide a custom encryption key for code snippets instead of the default service-managed key

    2 details in Everything

54. Version 25.9.1 (29-September-2025) Sep 29, 2025 · release notes

    Mend SAST adds Rust support and a new API endpoint for custom encryption keys.

55. Version 25.8.2 (08-September-2025) Sep 8, 2025 · release notes

    Mend SAST 25.8.2 adds Windsurf AI code scanning and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based deep links for findings.

    • Adds the capability to scan AI-generated code within Windsurf
    • uuid-based deep links replace older finding identifiers in Mend CLI report outputs

    2 details in Everything

56. 25.8.1 Aug 25, 2025 · release notes

    Mend SAST 25.8.1 adds Terraform and requirements.txt support for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with new local log file output

    • Secret scanning now supports Terraform files
    • Secret scanning now supports requirements.txt files
    • The local log file for secret scans now includes a list of all scanned files

    3 details in Everything

57. Version 25.8.1 (25-August-2025) Aug 25, 2025 · release notes

    Mend SAST 25.8.1 adds Terraform and requirements.txt to secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with new log details

    • Secret scanning now supports Terraform files as well as requirements.txt files.
    • The local log file for secret scans now includes a list of all scanned files.

    2 details in Everything

58. Version 25.7.2 (11-August-2025) Aug 11, 2025 · release notes

    Mend SAST 25.7.2 adds <input> taint source for Angular/React and fixes JS/TS analysis timeouts.

    • Improves JavaScript/TypeScript analysis performance with substantially reduced duration

    1 detail in Everything

59. 25.7.1 Jul 28, 2025 · release notes

    Mend SAST 25.7.1 adds exact line numbers to code remediation suggestions and improves JS entry point detection.

    └──▷ HOW TO FIND IT
    View exact line numbers for remediation suggestions alongside the diff in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.
    📍In the Mend AppSec Platform, review a finding to see code snippets with explicit line numbers.
    • Code Remediation Suggestions now display exact line numbers in addition to the existing code diff view.
    • React event-handlers defined in separate files are now picked up as entry points when analyzing JavaScript code.

    2 details in Everything

60. Version 25.7.1 (28-July-2025) Jul 28, 2025 · release notes

    Mend SAST 25.7.1 adds exact line numbers to code remediation and improves JavaScript entry point detection

    • Adds exact line numbers to the code diff view for Code Remediation Suggestions
    • Improves analysis of React event handlers defined in separate files, picking them up as entry points in JavaScript

    2 details in Everything

61. Version 25.6.2 (14-July-2025) Jul 14, 2025 · release notes

    Mend SAST adds compliance violations as workflow conditions and detailed CLI progress indicator.

    • Adds compliance standard violations as direct conditions in the workflow engine
    • Adds historical findings handling to prevent reappearing of suppressed issues older than 90 days
    • Adds a detailed progress indicator for code analysis in the Mend SAST CLI
    • Adds Violations, Endpoint Access, and Exploitable data columns to findings reports

    4 details in Everything

62. 25.6.1 Jun 30, 2025 · release notes

    Mend SAST 25.6.1 adds automated GitLab repo integration for base branch and MR scanning.

    • Adds Mend for GitLab repository integration allowing developers to set automated SAST scans for base branches and merge requests
    • Excludes files named test.* or tests.* from analysis by default

    2 details in Everything

63. Version 25.6.1 (30-June-2025) Jun 30, 2025 · release notes

    Mend SAST v25.6.1 adds GitLab repo integration for automated base/PR scans and excludes test.* files by default.

    • Adds support for GitLab Repository Integration to enable automated SAST scanning of base branches and merge requests within the GitLab environment.
    • Excludes files named test.* or tests.* from analysis by default.

    2 details in Everything

64. 25.5.2 Jun 23, 2025 · release notes

    Mend SAST 25.5.2-HF1 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. correlation for Exploitable findings and AI code scanning via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.

    • Correlates SAST findings with Invicti DAST results, marking confirmed vulnerabilities with the Exploitable risk factor

    1 detail in Everything

65. Version 25.5.2-HF1 (23-June-2025) Jun 23, 2025 · release notes

    Mend SAST v25.5.2-HF1 adds Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. correlation for exploitable findings and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server scanning with Cursor IDE support.

    • Correlates SAST findings with dynamic analysis results from the Invicti integration, marking confirmed vulnerabilities with an Exploitable risk factor to prioritize remediation
    • Enables scanning of AI-generated code via the MCP server, with optimized integration for the Cursor IDE to maintain secure coding practices within existing workflows

    2 details in Everything

66. Version 25.5.2 (16-June-2025) Jun 16, 2025 · release notes

    Mend SAST 25.5.2 adds Code Risk Factors to workflow conditions, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 templates, and CLI-based secrets detection.

    • Code Risk Factors column and workflow condition support allows prioritizing findings by endpoint access or high-probability risk
    • New workflow templates for OWASP Top 10 2021, SANS/CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. Top 25, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. standards
    • C# parser runtime environment updated to .NET 8.0
    • Added detection for CWE-208, CWE-256, and CWE-352 in Java
    • Enhanced detection accuracy for CWE-79 (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session./DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based XSS) in JavaScript/TypeScript and CWE-89 (SQL Injection) in Java

    +1 more show less

    • Scan source code and configuration files for exposed credentials with new CLI flag --secrets-detection

    6 details in Everything

67. 25.4.3 May 19, 2025 · release notes

    Mend SAST v25.4.3 adds Endpoint Access risk factor for API findings and AI-driven rule customization.

    • Adds new Endpoint Access risk factor to findings accessible through API endpoints to improve prioritization
    • Adds option to share additional project data with Mend.io for AI processing and custom rule candidate generation

    2 details in Everything

68. Version 25.4.3 (19-May-2025) May 19, 2025 · release notes

    Mend SAST adds API endpoint context to findings and AI-driven rule customization

    • Adds Endpoint Access as a new Risk Factor for findings accessible via API endpoints
    • Adds ability to share additional project data with Mend.io for AI-assisted detection rule customization

    2 details in Everything

69. 25.4.2 May 5, 2025 · release notes

    Mend SAST v25.4.2 adds configurable scan timeouts exceeding 30 minutes via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.

    └──▷ USE IT
    Extend scan duration for large repositories by setting a custom timeout via the command line.
    shell copy

    mend-sast scan --timeout 3600 <path>

    • SAST scanning now supports timeout values exceeding 30 minutes, configurable via both the CLI and SCM integrations.

    1 detail in Everything

70. Version 25.4.2 (05-May-2025) May 5, 2025 · release notes

    Mend SAST 25.4.2 adds configurable scan timeouts (>30 min) and improves Angular/C# detection.

    • Adds support for SAST scanning timeouts exceeding 30 minutes, configurable via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations

    1 detail in Everything

71. 25.4.1 Apr 21, 2025 · release notes

    Mend SAST 25.4.1 adds support for scanning Python files with BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. encoding and optimizes incremental dump storage.

    • Supports scanning Python files that use BOM (Byte Order Mark) encoding.

    1 detail in Everything

72. Version 25.4.1 (21-April-2025) Apr 21, 2025 · release notes

    Mend SAST v25.4.1 supports scanning Python files with BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. encoding.

73. Version 25.3.2 (07-April-2025) Apr 7, 2025 · release notes

    Mend SAST v25.3.2 adds second-order detection with Probability risk factor, mend code import CLI for SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., and branch suppression sync.

    • Adds support for automated remediation suggestions for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-78, CWE-90, CWE-502, CWE-643, and CWE-918 in Java, JavaScript/TypeScript, C#, and Python.
    • Introduces Probability as a new Risk Factor to distinguish second-order findings (data from env vars, config files) from standard web-input findings.
    • Adds mend code import CLI command to import SARIF results from third-party SAST scanners into the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.
    • Syncs suppressions and finding adaptations across all base branches in Azure DevOps, Bitbucket Cloud, Classic GitHub, and Developer Platform integrations.

    4 details in Everything

74. 25.3.2 Apr 7, 2025 · release notes

    Mend SAST 25.3.2 adds CLI import for third-party SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. results and expands second-order detection capabilities.

    • Adds mend code import CLI command to import third-party SAST results in SARIF format
    • Introduces Probability risk factor for second-order findings in Code scan configuration
    • Carries suppressions from one base branch to all other base branches of the same repository

    3 details in Everything

75. Version 25.3.1 (24-March-2025) Mar 24, 2025 · release notes

    New .ws configuration key enables suppressing GitHub/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. findings from code repos

    • Adds suppression capability in classic GitHub.com and GitHub Enterprise integrations, allowing developers to suppress findings directly in the repository without logging into Mend.
    • Adds new configuration option in the .ws file to disable the developer suppression feature for restricted autonomy.
    • Improves accuracy of CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) detections for JavaScript and Python.
    • Expands CWE-22 (Path Traversal) detection in Python to include Zip Slip Attacks.
    • Adds support for registration-based entry points for C#.

    5 details in Everything

76. 25.3.1 Mar 24, 2025 · release notes

    Mend SAST 25.3.1 adds in-repo finding suppression for GitHub integrations with .ws config control

    • Adds suppress_in_repo configuration option to .ws files to enable developers to suppress findings directly in GitHub without logging into Mend
    • Improved detection accuracy for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) in JavaScript and Python engines
    • Extended CWE-22 (Path Traversal) detection in Python to cover Zip Slip Attacks
    • Added support for registration-based entry points in C# analysis

    4 details in Everything

77. 25.2.2 Mar 10, 2025 · release notes

    Automated remediation suggestions for Code findings are now available for Bitbucket Cloud on the Developer Platform

    └──▷ HOW TO FIND IT
    Review and accept code fix suggestions directly within Bitbucket Cloud pull requests or issues.
    📍Steps: Go to your Bitbucket Cloud repository, open a Pull Request containing code findings from Mend SAST. Look for the Remediation Suggestions panel in the Developer Platform integration tab. Click Accept on the suggested fix to auto-apply the patch.
78. Version 25.2.2 (10-March-2025) Mar 10, 2025 · release notes

    Mend SAST adds automated remediation suggestions for Code findings to Bitbucket Cloud on the Developer Platform.

79. 25.1.2 Feb 10, 2025 · release notes

    Mend SAST 25.1.2 adds automated remediation suggestions for Azure DevOps and enhanced TypeScript tsconfig.json import resolution.

    • Enables automated remediation suggestions for Code findings in the Mend Developer Platform for Azure DevOps integration
    • Adds support for resolving additional imports mapped within tsconfig.json during TypeScript scans

    2 details in Everything

80. 25.1.1 Jan 27, 2025 · release notes

    Mend SAST 25.1.1 adds Jinja2/Flask Python template scanning and automated remediation for five Python CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..

    • Adds Jinja2 and Flask Templates support in the Python detection engine to scan templating frameworks for frontend vulnerabilities like cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session..

    1 detail in Everything

81. Version 25.1.1 (27-January-2025) Jan 27, 2025 · release notes

    Mend SAST v25.1.1 adds Jinja2/Flask template scanning and expanded Python remediation for specific CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..

    • Adds detection of frontend vulnerabilities in Jinja2 and Flask templates for Python code
    • Extends Automated Remediation suggestions to CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, and CWE-601 findings in Python

    2 details in Everything

82. 24.12.1 Jan 6, 2025 · release notes

    Mend SAST 24.12.1 adds bulk Code report generation at project level and label filtering for findings.

    └──▷ HOW TO FIND IT
    Generate and download all Code reports for a project in one operation via the UI.
    📍Navigate to the Project view, select the desired project, and use the new bulk action menu to Generate Code Reports.
    Filter Application-level findings to show only those tagged with a specific label.
    📍In the Findings table, open the filter panel and select Labels, then choose your target label from the list.
    • Adds bulk action functionality for generating Code reports on Project level across all report types
    • Allows filtering Code Findings by Labels in the Application-level Findings table
    • Extends the JavaScript detection engine to support the Azure Functions framework for entry point detection

    3 details in Everything

83. Version 24.12.1 (06-January-2025) Jan 6, 2025 · release notes

    Adds bulk Code report generation and Label filtering for Application-level findings in Mend SAST v24.12.1

    • Adds Project-level bulk action to generate Code reports across all report types
    • Enables filtering JavaScript Code Findings by Labels at the Application level via the Findings table
    • Extends the JavaScript detection engine to support the Azure Functions framework for entry point detection

    3 details in Everything

84. Version 24.11.2 (16-December-2024) Dec 16, 2024 · release notes

    Mend SAST 24.11.2 adds CWE Number column to Code findings and renames existing columns.

    • Adds the CWE Number column to the Code findings table for direct CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifier visibility
    • Renames the Date column to Detected in the Code findings table
    • Renames the Type column to CWE Name in the Code findings table

    3 details in Everything

85. 24.11.1 Dec 2, 2024 · release notes

    Mend SAST 24.11.1 adds Code Findings API export and refined CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-20 detection for mail relay and memcache injection

    • Adds support for generating Code reports via the Platform API (API v3)
    • Splits CWE-20: Improper Input Validation into two new vulnerability types: CWE-20: Mail Relay and CWE-20: Memcache Injection Vulnerability
    • Adds detection of Stored Cross-site Scripting when tainted data is stored in React state
    • Updates the layout of the Code Findings table and the Code Finding Details panel to improve usability

    4 details in Everything

86. Version 24.11.1 (02-December-2024) Dec 2, 2024 · release notes

    Mend SAST v24.11.1 adds Platform API (v3) report generation, React XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection, and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-20 split.

    • Code reports can now be generated through the Platform API (API v3)
    • Mend.io now supports detection of Stored Cross-site Scripting if the tainted data is stored in React state
    • For the Python gen 2 detection engine, CWE-20: Improper Input Validation is split up into two new vulnerability types: CWE-20: Mail Relay and CWE-20: Memcache Injection Vulnerability. This change allows for a more fine-grained analysis

    3 details in Everything

87. Version 24.10.3 (18-November-2024) Nov 18, 2024 · release notes

    Mend SAST adds configurable scan depths (fast, balanced, deep) and pre-scan project configs.

    • Adds a new control in Code Scan Configuration to select fast, balanced, or deep scans for gen 2 detection engines
    • Enables storing Project-specific Code Scan Configurations before the first scan

    2 details in Everything

88. 24.10.3 Nov 18, 2024 · release notes

    Mend SAST 24.10.3 adds fast/balanced/deep scan profiles and pre-scan project configuration storage.

    └──▷ HOW TO FIND IT
    Pre-configure a project's scan behavior in the UI before running any scans on it.
    📍In the console, navigate to Project Settings › Code Scan Configuration and set your preferred profile (fast/balanced/deep) under the gen 2 engines section.
    • Code Scan Configuration control now supports fast, balanced, or deep scan profiles for gen 2 detection engines, optimizing performance or coverage respectively
    • Project-specific Code Scan Configurations can be stored before the first scan of a project

    2 details in Everything

89. 24.9.2 Oct 14, 2024 · release notes

    Mend SAST 24.9.2 adds Invicti integration and ASP.NET multi-core processing

    • Adds the ability to integrate Mend Code results into Invicti for a holistic view of SAST and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings.
    • Enables multi-core processing for ASP.NET code analysis, improving performance.
    • Adjusts accuracy for Java CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-79 (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.), CWE-497 (Sensitive System Information), CWE-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) and C# CWE-78 (Command Injection), CWE-89 (SQL Injection), CWE-918 (SSRF).

    3 details in Everything

90. Version 24.9.2 (14-October-2024) Oct 14, 2024 · release notes

    Mend SAST 24.9.2 adds Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration and ASP.NET multi-core processing

    • Adds integration of Mend Code results into Invicti for holistic SAST and DAST views
    • Enables multi-core processing for ASP.NET code analysis to improve performance

    2 details in Everything

91. Version 24.9.1 (23-September-2024) Sep 23, 2024 · release notes

    Mend SAST v24.9.1 adds configurable Python detection engine generation via CLI and visibility for exclusion patterns

    • Adds the --python-engine-generation CLI parameter to specify which generation of the detection engine is used to perform scans
    • Makes scan configuration exclusion patterns visible in the scan's configuration view

    2 details in Everything

92. 24.9.1 Sep 23, 2024 · release notes

    Mend SAST introduces configurable Python detection engine generation and explicit exclusion pattern visibility.

    └──▷ USE IT
    Force the new Python detection engine generation for an on-demand scan using the CLI.
    shell copy

    mend-sast scan --python-engine-generation v2

    • Adds the --python-engine-generation CLI parameter to select which generation of the Python detection engine performs scans
    • Makes the specific exclusion patterns configured for a single scan visible in the scan's configuration view

    2 details in Everything

93. Version 24.8.2 (09-September-2024) Sep 9, 2024 · release notes

    Mend SAST 24.8.2 adds automated remediation suggestions in UI/Jira and gen 2 JS support for .html/.ejs files

    • Adds Automated Remediation Suggestions for Code findings in Java, JavaScript/TypeScript, and C# within the Mend Platform web UI and Jira tickets.
    • Enables end-to-end remediation flow in GitHub.com and GitHub Enterprise repositories allowing developers to update feature branches with one click.
    • Extends gen 2 JavaScript detection engine to analyze .html and .ejs files.

    3 details in Everything

94. 24.8.2 Sep 9, 2024 · release notes

    Mend SAST 24.8.2 adds automated remediation suggestions and GitHub remediation flows for Java/JS/C# findings, plus gen 2 JS support for .html/.ejs files.

    └──▷ HOW TO FIND IT
    View automated fix suggestions for a Java vulnerability directly in the Mend Platform web UI
    📍In the Mend Platform UI, navigate to the Code finding details pane to view remediation suggestions
    Update a GitHub feature branch with suggested fixes without leaving the browser
    📍In the Mend Platform web UI, trigger the end-to-end remediation flow for a finding linked to a GitHub.com or GitHub Enterprise repository
    • Adds automated remediation suggestions for Code findings in Java, JavaScript/TypeScript, and C# to the Mend Platform web UI
    • Integrates remediation suggestions into Jira tickets generated for Code findings
    • Enables end-to-end remediation flow in GitHub.com and GitHub Enterprise repositories to update feature branches with one click

    3 details in Everything

95. 24.8.1 Aug 26, 2024 · release notes

    Mend SAST 24.8.1 adds .vbproj support to VB.net detection and fixes incremental scan handling for frontend files.

    • The VB.net detection engine now supports .vbproj project files

    1 detail in Everything

96. 24.7.2 Aug 12, 2024 · release notes

    Mend SAST 24.7.2 introduces asynchronous scan processing with a new Processing state, requiring API clients to check for it.

    • Introduces Processing as a mandatory intermediate scan state between Running and completion, improving overall scan performance via async handling.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !API queries for SAST findings must now verify that the scan status is neither Running nor Processing to retrieve results.
97. Version 24.7.2 (12-August-2024) Aug 12, 2024 · release notes

    Mend SAST 24.7.2 introduces asynchronous scan processing with a new Processing state and optimized import handling for JavaScript/TypeScript.

    • Introduces Processing as a new SAST scan status to indicate asynchronous result processing
    • Enforces API validation requiring scan status to be neither Running nor Processing before querying findings
    • Adds graceful resource monitoring to fail scans before they run out of resources, ensuring partial results are available
    • Improves import handling efficiency in the new engine generation for Java, C#, and JavaScript/TypeScript to reduce scan times

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Querying SAST findings via an API now requires verifying that scan status is neither Running nor Processing; queries during these states may fail or return incomplete data.
98. Version 24.7.1 (28-July-2024) Jul 28, 2024 · release notes

    Mend SAST 24.7.1 allows configuring gen 2 analysis steps and excludes Angular runtime files by default

    • Configurable number of analysis steps for gen 2 engines via analysis type configuration.
    • Exclusion of auto-generated Angular files (e.g., runtime.js, polyfill.js) in JavaScript/TypeScript analysis.

    2 details in Everything

99. 24.7.1 Jul 28, 2024 · release notes

    Mend SAST 24.7.1 adds configurable gen 2 analysis steps and excludes Angular auto-generated files by default.

    • gen 2 engine analysis steps (type analysis) are now configurable
    • Angular runtime.js, polyfill.js, and other auto-generated files are excluded by default in JavaScript/TypeScript analysis

    2 details in Everything

100. Version 24.6.1 (30-June-2024) Jun 30, 2024 · release notes

     Mend SAST v24.6.1 adds Jira ticket linking in findings and Gen 2 C# entry point support for Azure Service Bus

     • Adds Jira ticket status monitoring within the Code findings table, including hyperlinks to tickets and details in the Code Finding Details drawer
     • Extends the Gen 2 C# detection engine to support entry points from Azure Service Bus

     2 details in Everything

101. 24.6.1 Jun 30, 2024 · release notes

     Jira integration for Mend SAST findings with status monitoring and hyperlink support

     └──▷ HOW TO FIND IT
     Monitor the lifecycle of a security finding's remediation ticket directly in Mend SAST without switching context.
     📍In the Code findings table, locate the column showing Jira Status and click the linked ticket ID to open the Jira issue in a new tab.
     View detailed Jira metadata for a specific finding without leaving the Mend interface.
     📍In the Code findings table, select a row with a linked Jira ticket and open the Code Finding Details drawer to view the associated ticket information.
     • Adds Jira ticket status monitoring within the Code findings table when a finding generates a Jira ticket
     • Adds hyperlinks to Jira tickets directly from the Code findings table
     • Adds Jira ticket details in the Code Finding Details drawer
     • Extends Gen 2 C# detection engine to support entry points from Azure Service Bus

     4 details in Everything

102. Version 24.5.3 (17-June-2024) Jun 17, 2024 · release notes

     Adds organization-level Code scan configuration templates to Mend SAST for managing scans at scale

103. 24.5.3 Jun 17, 2024 · release notes

     Mend SAST adds organization-level Code scan configuration templates for global management.

     • Adds Code scan configuration templates at the organization level to manage code scans across all projects or specific applications.

     1 detail in Everything

104. 24.3.2 Apr 8, 2024 · release notes

     Mend SAST 24.3.2 adds configurable C#/JS engine generations with CLI params and deep links.

     └──▷ USE IT
     Force the scanner to use the new generation engines for JavaScript and C# during execution.
     shell copy

     mend-sast scan --js-engine-generation=2 --csharp-engine-generation=2

     • Adds --js-engine-generation and --csharp-engine-generation CLI parameters to control detection engine version
     • Enables deep link generation for findings in the Code Findings view

     2 details in Everything

105. Version 24.3.2 (08-April-2024) Apr 8, 2024 · release notes

     Mend SAST v24.3.2 adds configurable engine generation flags, JS/C#/TS engine upgrades, and UI enhancements.

     • Adds --js-engine-generation and --csharp-engine-generation CLI parameters to specify which detection engine generation to use for JavaScript and C# scans.
     • Introduces a new generation of detection engines for C#, JavaScript and TypeScript with up to 50% faster scan speed, higher precision, and recall rates compared to the first generation.
     • Increases the default timeout per file for the new Java engine to 10 minutes.
     • Integrates Secure Code Warrior training solution into the Code Finding Details view for each finding to provide corresponding training resources.
     • Redesigns the Code Findings view with additional capabilities including browsing findings from the Details view and generating deep links for findings.

     +1 more show less

     • Enhances Scan Log view to display breakdown of scan duration per language, report number of files analyzed during incremental scans, and report status/error messages individually for each language.

     6 details in Everything