Mend SAST — The Cyber Toolchain

Mend SAST Version 26.10.1 (02-November-2026)

Mon, 02 Nov 2026 00:00:00 GMT

Mend SAST adds per-category scan profile controls and custom Node.js routing support via `routes.json`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Support custom Node.js routing frameworks by parsing `routes.json` manifests to identify handler functions as entry points for taint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control low-probability scan categories individually in the Scan Profile — replacing the previous binary toggle with a configurable selection tree that lets you include or exclude categories such as File Read or Database Read, with a count indicator for selected categories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST changelog-20261029-64bd0cb5

Thu, 29 Oct 2026 07:55:11 GMT

Mend SAST adds AI-based project risk factors to help prioritize which applications and projects to fix first⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Mend SAST now shows a risk factors column in the Applications and Projects lists, filterable by group or individual risk factor, to help prioritize remediation across projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • An evidence page now lists the code signals behind each risk factor classification, grouped by risk factor and file, so teams can see why a project was classified a certain way. • A risk factors widget now appears on the project summary page for at-a-glance visibility into each project's risk profile. • Enable AI-based project risk factors from organization administration — the setting requires AI consent, is off by default, and when on shares code snippets and project details with Mend's AI model to produce classifications. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST changelog-20261021-5521981f

Wed, 21 Oct 2026 07:52:13 GMT

Mend SAST: Extends the Gen 2 detection engine to Swift and PHP (now the default engine for new organizations).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.9.3 (19-October-2026)

Mon, 19 Oct 2026 00:00:00 GMT

Mend SAST 26.9.3 introduces the Gen 2 detection engine for Swift and PHP with improved CWE and framework coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces the Gen 2 detection engine for Swift and PHP, with improved CWE and framework coverage for accurate, scalable scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST changelog-20261012-b0e147dc

Mon, 12 Oct 2026 08:08:14 GMT

Mend SAST 26.9.2 adds YAML/JSON config file support for automatic API endpoint detection and entry point taint mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports YAML and JSON configuration files for entry point detection, automatically identifying API endpoints and mapping them to implementation classes for contract-first applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automatically marks all generated entry point parameters as tainted, eliminating the need for manual custom framework configuration for contract-first applications. • Improves Python engine detection accuracy across 11 CWEs including CWE-022 Path Traversal, CWE-078 OS Command Injection, CWE-079 XSS, CWE-089 SQL Injection, CWE-094 Code Injection, CWE-209 Error Message Info Exposure, CWE-295 Improper Cert Validation, CWE-532 Sensitive Info in Log, CWE-601 Open Redirect, CWE-918 SSRF, and CWE-943 NoSQL Injection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.9.2 (05-October-2026)

Mon, 05 Oct 2026 00:00:00 GMT

Mend SAST gains automatic API endpoint detection from YAML/JSON config files, eliminating manual framework setup for contract-first apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for YAML and JSON configuration files as input to the entry point detection engine, enabling automatic identification of API endpoints and mapping to their implementation classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automatically marks all generated entry point parameters as tainted for contract-first applications, removing the need for manual custom framework configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.9.1 (28-September-2026)

Mon, 28 Sep 2026 00:00:00 GMT

Mend SAST 26.9.1 adds `--print-to-console` flag to `mend code` and auto-excludes macOS metadata files from all SAST scan engines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--print-to-console` flag to `mend code` CLI scans, printing scan logs directly to stdout in real time in addition to the log file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Default exclusions in `mend code` CLI scans now automatically ignore `/_MACOSX/..*` metadata files across all SAST scan engines, even when default exclusions are otherwise disabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.8.2 (07-September-2026)

Mon, 07 Sep 2026 00:00:00 GMT

Mend SAST 26.8.2 improves JavaScript/TypeScript detection accuracy across 11 CWEs including XSS, SQLi, SSRF, and NoSQL injection. • Improves JavaScript/TypeScript analysis engine detection accuracy across 11 CWEs: CWE-22 (Path Traversal), CWE-78 (OS Command Injection), CWE-79 (XSS), CWE-89 (SQL Injection), CWE-90 (LDAP Injection), CWE-94 (Code Injection), CWE-117 (Log Neutralization), CWE-295 (Certificate Validation), CWE-601 (Open Redirect), CWE-918 (SSRF), and CWE-943 (NoSQL/query-language injection). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.8.1 (24-August-2026)

Mon, 24 Aug 2026 00:00:00 GMT

Mend SAST 26.8.1 adds per-data-flow probability risk factors and expands CWE detection for JS/TS and Rust. • Adds probability risk factor display next to each data flow in finding details within the Mend Platform, enabling more granular triage. • Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript. • Adds detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) for Rust. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.5.2 (15-June-2026)

Mon, 15 Jun 2026 00:00:00 GMT

Mend SAST v26.5.2 adds natural language data flow explanations to findings API and improves detections for XSS and credentials • SAST findings API now includes natural language descriptions for each step in a vulnerability's data flow trace. • Extended support for JWT callbacks and anonymous classes in Java. • Improved detection of CWE-79: Cross-site Scripting (XSS) in JavaScript/TypeScript. • Improved detection of hard-coded credentials for JavaScript/TypeScript, PL/SQL, and VB.Net. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.5.1 (01-June-2026)

Mon, 01 Jun 2026 00:00:00 GMT

Mend SAST v26.5.1 adds Scala support, enhanced secret scanning, and suppression workflow controls via `.whitesource` config. • Adds new detection capabilities for hardcoded private keys (`.pem`, `.key`) and certificate files (`.pfx`, `.p12`) • Adds PowerShell scripts (`.ps1`) to the default set of file types scanned by secret scanning • Adds 'Information Requested' state to suppression requests in the UI to allow reviewers to request additional context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.4.2 (04-May-2026)

Mon, 04 May 2026 00:00:00 GMT

Mend SAST 26.4.2 adds Python smbclient taint analysis, server-side only SSRF for JS, and VS Code integration. • Adds `taint analysis support for Python smbclient` to enhance detection of path traversal vulnerabilities. • Changes SSRF reporting in JavaScript to report only when detected on the server side, improving finding accuracy. • Adds Secret scanning availability in Mend for Visual Studio Code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.4.1 (20-April-2026)

Mon, 20 Apr 2026 00:00:00 GMT

Mend SAST 26.4.1 adds Gen 2 Go engine, Rust auto-remediation, incremental secrets scanning, and deep links to CSV exports. • Introduces the Gen 2 Go detection engine for improved CWE and framework coverage • Adds automated remediation suggestions for Code findings in Rust • Enables incremental scanning for secrets detection to analyze only changed files • Adds a Deep Link column to CSV exports with direct URLs to findings in the Mend AppSec Platform UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 26.3.1

Mon, 23 Mar 2026 00:00:00 GMT

Mend SAST 26.3.1 adds org-wide suppression request view with CSV export and improves Go analysis performance. • Adds `Findings --> Suppression Requests` view for Organization admins to filter by application, project, status, or reason • Enables exporting suppression requests to CSV via the new Suppression Requests view for compliance audits Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.2.2 (09-March-2026)

Mon, 09 Mar 2026 00:00:00 GMT

Mend SAST v26.2.2 adds CWE-457/828 C/C++ detection and GitHub suppression audit trail • Adds support for CWE-457 (Use of Uninitialized Variable) and CWE-824 (Access of Uninitialized Pointer) to C/C++ analysis in low probability mode. • Suppressions synchronized with GitHub now add a comment to the linked issue containing the suppression reason, extra comments, and the user who performed the suppression. • Suppression request tables now display a "Reviewed By" column showing who approved or rejected each request. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 26.1.2

Mon, 09 Feb 2026 00:00:00 GMT

Mend SAST 26.1.2 adds resolved findings export and improved detection accuracy. • Adds CSV, XML, and JSON export for SAST reports containing resolved (historical) findings via API and Platform UI • Increases accuracy of CWE-79: Cross-site Scripting detection for JavaScript • Improves Rust detection accuracy with multiple minor enhancements • Enhances secret scanning to detect hardcoded database connection strings in configuration files without code changes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.1.2 (09-February-2026)

Mon, 09 Feb 2026 00:00:00 GMT

Adds historical SAST report export in CSV/JSON/XML via API and UI; improves CWE-79, Rust, and secret scanning detection. • Added `sast.report.historical` capability to generate reports including resolved findings for a selected time frame, exported as CSV, XML, or JSON via API and Platform UI • Improved accuracy of CWE-79 (Cross-site Scripting) detection specifically for JavaScript files • Multiple minor improvements to increase the accuracy of Rust language detection in the SAST engine • Enhanced secret scanning to better detect hardcoded database connection strings in code changes • Triggered secret scanning on configuration file changes even when no actual code is present in the repository Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 26.1.1

Mon, 26 Jan 2026 00:00:00 GMT

Mend SAST 26.1.1 adds GitHub suppression approval workflows, C/C++ auto-remediation, Rust GA, .pbxproj secret scanning, and multi-threading. • Supports suppression approval workflows for GitHub repositories • Adds automated remediation suggestions for Code findings in C and C++ (CWE-22, CWE-79, CWE-89, CWE-117, CWE-601) • Rust detection is now generally available with expanded CWE coverage • Added support for .pbxproj files in secret scanning • SAST detection for Android, Objective-C and Cold Fusion now supports multi-threading to reduce scan time Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 26.1.1 (26-January-2026)

Mon, 26 Jan 2026 00:00:00 GMT

Mend SAST adds GitHub suppression workflows, C/C++ auto-remediation, GA Rust detection, and .pbxproj secret scanning. • Adds support for suppression approval workflows in GitHub repositories to let developers request suppressions while managers retain control • Adds automated remediation suggestions for Code findings in C and C++ covering CWE-22, CWE-79, CWE-89, CWE-117, and CWE-601 • Makes Mend SAST Rust detection generally available with expanded CWE coverage • Adds support for .pbxproj files in secret scanning to detect sensitive information in Xcode configuration files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.12.2 (12-January-2026)

Mon, 12 Jan 2026 00:00:00 GMT

Mend SAST adds suppression approval workflows for Azure DevOps and new Express entry points. • Supports suppression approval workflows for Azure DevOps repositories • Adds additional entry points for Express framework Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.12.1 (05-January-2026)

Mon, 05 Jan 2026 00:00:00 GMT

Mend SAST 25.12.1 adds Bitbucket suppression approval workflows and improves Rust double-unwrapping analysis • Supports suppression approval workflows for Bitbucket repositories, allowing developers to request suppressions and security managers to approve or reject them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.11.2

Mon, 15 Dec 2025 00:00:00 GMT

Mend SAST 25.11.2 adds PCI DSS 4.0/MISRA compliance support, C++ gen 2 for new orgs, and enhanced analysis accuracy. • Adds PCI DSS 4.0 and MISRA as supported compliance standards in code findings table and reports • Enables C++ gen 2 engine by default for newly created organizations • Adds filtering, sorting, and grouping of findings by project in the applications view • Improves accuracy of Java, JavaScript/TypeScript and Python analysis for CWE-78, CWE-79 and CWE-89 • Enhances support for Rust macros to ensure proper parsing of tainted data • Adds ability to filter suppression requests by predefined reasons (false positive or acceptable risk) in the review UI Breaking changes: • Scans are now automatically stopped if the CLI cannot retrieve required engine configuration, which will interrupt scans on unreliable networks where this previously may have hung or produced inconsistent results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.11.2 (15-December-2025)

Mon, 15 Dec 2025 00:00:00 GMT

Mend SAST adds PCI DSS 4.0/MISRA compliance filters, C++ gen2 default for new orgs, and findings view enhancements. • `PCI DSS 4.0` and `MISRA` standards are now visible in the code findings table and code reports for compliance filtering • Newly created organizations automatically have the `C++ gen 2 engine` enabled by default • Suppression request review now supports filtering by predefined reasons: `false positive` or `acceptable risk` • The applications view adds the ability to filter, sort, and group findings by project Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.11.1 (01-December-2025)

Mon, 01 Dec 2025 00:00:00 GMT

Mend SAST v25.11.1 adds batched findings for Agentic detection and expands low-probability taint sources for Rust/C++. • Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation. • Added low probability taint sources for file, database, console, and environment variable reads in Rust. • Reclassified CWE-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++. • Added reading from local files as a low probability taint source. • Organizations are now sorted alphabetically in the Mend CLI’s organization selection step. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.11.1

Mon, 01 Dec 2025 00:00:00 GMT

Mend SAST 25.11.1 adds batched Agentic SAST findings, expanded low-prob taint sources for Rust and C/C++, and sorted org selection in CLI • Agentic SAST detection now reports all detected findings in the generated code at once instead of just one finding per invocation • Added low probability taint sources for file, database, console, and environment variable reads in Rust, improving analysis accuracy • Reading from local files has been added as a low probability taint source • Reclassified CWE-242: Use of Inherently Dangerous Function and CWE-676: Use of Potentially Dangerous Function to low probability category for C/C++, enhancing scan accuracy when scanning with the default configuration • Further improved detection accuracy for C/C++ gen 2 , most notably for the following CWEs: CWE-121: Buffer Overflow CWE-369: Divide by Zero CWE-606: Loop Denial of Service CWE-611: XML External Entity (XXE) Injection CWE-789: Uncontrolled Memory Allocation • Organizations are now sorted alphabetically in the Mend CLI’s organization selection step, making it easier and faster to navigate large lists Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.10.3

Mon, 17 Nov 2025 00:00:00 GMT

Mend SAST 25.10.3 adds IDE extension, Wiz integration, and improved Rust detection • `Mend.io` code extension provides security findings and remediation suggestions directly in the IDE • SAST findings can now be uploaded into `Wiz` to correlate static vulnerabilities with runtime context • Detection accuracy for `Rust` projects improved, specifically addressing CWE-614, CWE-943, and CWE-1004 • `SAST secret scanning` now includes `.xcconfig` files by default for hardcoded API key detection • Gradle wrapper distribution files automatically excluded from scans to reduce false positives Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.10.3 (17-November-2025)

Mon, 17 Nov 2025 00:00:00 GMT

Mend SAST v25.10.3 adds Mend io Code IDE extension, Wiz integration, and .xcconfig secret scanning. • `Mend io Code` extension provides real-time security findings and remediation suggestions directly in the IDE before code is committed • SAST findings can now be uploaded to `Wiz` for correlation with runtime cloud context • Secret scanning now includes `.xcconfig` files by default, detecting hardcoded API keys and sensitive data • Detection accuracy improved for Rust projects covering CWE-614, CWE-943, and CWE-1004 • C/C++ (Gen 2) macro expansion handling updated to ensure accurate method names and data flow traces • Gradle wrapper distribution files are now automatically excluded from scans by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.10.2 (03-November-2025)

Mon, 03 Nov 2025 00:00:00 GMT

Mend SAST v25.10.2 adds PySpark support and new CWEs for Rust and C/C++ engines • Adds `PySpark` framework detection to the Python scan engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.10.2

Mon, 03 Nov 2025 00:00:00 GMT

Mend SAST v25.10.2 adds new CWE coverage for Rust and C/C++, and PySpark support for Python detection. • Adds CWE-79, CWE-327, CWE-328, CWE-614, CWE-798, CWE-942, CWE-943, and CWE-1004 to the Rust detection engine • Adds CWE-606 to the Gen 2 C/C++ detection engine • Adds support for the PySpark framework to the Python detection engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.10.1

Mon, 20 Oct 2025 00:00:00 GMT

Mend SAST 25.10.1 adds Gen 2 C/C++ engine, finding suppression approval workflow, and HTTP handler entry points for JS/TS • `Gen 2` C/C++ detection engine with improved CWE and framework coverage • New approval process for security finding suppressions in code repositories • Reading HTTP Handler Methods from an array as entry points for JavaScript/TypeScript Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.10.1 (20-October-2025)

Mon, 20 Oct 2025 00:00:00 GMT

Gen 2 C/C++ engine, finding suppression approval process, JS/TS HTTP entry points, and PR-based repo onboarding in Mend SAST 25.10.1 • Introduces the Gen 2 C/C++ detection engine for improved CWE and framework coverage • Adds a new approval workflow for security finding suppressions where developers propose and security managers approve or reject changes • Enables repository onboarding via the first pull request when no prior scans exist, causing initial findings to fail the check rather than becoming backlog • Supports reading HTTP Handler Methods from an array as entry points in JavaScript/TypeScript • Updates SCMs .whitesource or .mend onboarding configuration templates to explicitly list available options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.9.1

Mon, 29 Sep 2025 00:00:00 GMT

Mend SAST 25.9.1 adds Rust support and allows custom encryption keys via API • Adds Rust as a supported language for static analysis • Adds an API endpoint to provide a custom encryption key for code snippets instead of the default service-managed key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.9.1 (29-September-2025)

Mon, 29 Sep 2025 00:00:00 GMT

Mend SAST adds Rust support and a new API endpoint for custom encryption keys. • Adds new API endpoint to provide custom encryption keys for code snippets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.8.2 (08-September-2025)

Mon, 08 Sep 2025 00:00:00 GMT

Mend SAST 25.8.2 adds Windsurf AI code scanning and UUID-based deep links for findings. • Adds the capability to scan AI-generated code within Windsurf • `uuid`-based deep links replace older finding identifiers in Mend CLI report outputs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.8.1

Mon, 25 Aug 2025 00:00:00 GMT

Mend SAST 25.8.1 adds Terraform and requirements.txt support for secret scanning with new local log file output • Secret scanning now supports Terraform files • Secret scanning now supports requirements.txt files • The local log file for secret scans now includes a list of all scanned files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.8.1 (25-August-2025)

Mon, 25 Aug 2025 00:00:00 GMT

Mend SAST 25.8.1 adds Terraform and requirements.txt to secret scanning with new log details • Secret scanning now supports Terraform files as well as requirements.txt files. • The local log file for secret scans now includes a list of all scanned files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.7.2 (11-August-2025)

Mon, 11 Aug 2025 00:00:00 GMT

Mend SAST 25.7.2 adds `` taint source for Angular/React and fixes JS/TS analysis timeouts. • Improves JavaScript/TypeScript analysis performance with substantially reduced duration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.7.1

Mon, 28 Jul 2025 00:00:00 GMT

Mend SAST 25.7.1 adds exact line numbers to code remediation suggestions and improves JS entry point detection. • Code Remediation Suggestions now display exact line numbers in addition to the existing code diff view. • React event-handlers defined in separate files are now picked up as entry points when analyzing JavaScript code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.7.1 (28-July-2025)

Mon, 28 Jul 2025 00:00:00 GMT

Mend SAST 25.7.1 adds exact line numbers to code remediation and improves JavaScript entry point detection • Adds `exact line numbers` to the code diff view for Code Remediation Suggestions • Improves analysis of React event handlers defined in separate files, picking them up as entry points in JavaScript Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.6.2 (14-July-2025)

Mon, 14 Jul 2025 00:00:00 GMT

Mend SAST adds compliance violations as workflow conditions and detailed CLI progress indicator. • Adds `compliance standard violations` as direct conditions in the workflow engine • Adds historical findings handling to prevent reappearing of suppressed issues older than 90 days • Adds a detailed progress indicator for code analysis in the Mend SAST CLI • Adds "Violations", "Endpoint Access", and "Exploitable" data columns to findings reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.6.1

Mon, 30 Jun 2025 00:00:00 GMT

Mend SAST 25.6.1 adds automated GitLab repo integration for base branch and MR scanning. • Adds Mend for GitLab repository integration allowing developers to set automated SAST scans for base branches and merge requests • Excludes files named `test.*` or `tests.*` from analysis by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.6.1 (30-June-2025)

Mon, 30 Jun 2025 00:00:00 GMT

Mend SAST v25.6.1 adds GitLab repo integration for automated base/PR scans and excludes test.* files by default. • Adds support for GitLab Repository Integration to enable automated SAST scanning of base branches and merge requests within the GitLab environment. • Excludes files named `test.*` or `tests.*` from analysis by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.5.2

Mon, 23 Jun 2025 00:00:00 GMT

Mend SAST 25.5.2-HF1 adds DAST correlation for 'Exploitable' findings and AI code scanning via MCP server. • Correlates SAST findings with Invicti DAST results, marking confirmed vulnerabilities with the "Exploitable" risk factor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.5.2-HF1 (23-June-2025)

Mon, 23 Jun 2025 00:00:00 GMT

Mend SAST v25.5.2-HF1 adds Invicti DAST correlation for exploitable findings and MCP server scanning with Cursor IDE support. • Correlates SAST findings with dynamic analysis results from the Invicti integration, marking confirmed vulnerabilities with an 'Exploitable' risk factor to prioritize remediation • Enables scanning of AI-generated code via the MCP server, with optimized integration for the Cursor IDE to maintain secure coding practices within existing workflows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.5.2 (16-June-2025)

Mon, 16 Jun 2025 00:00:00 GMT

Mend SAST 25.5.2 adds Code Risk Factors to workflow conditions, OWASP Top 10 templates, and CLI-based secrets detection. • `Code Risk Factors` column and workflow condition support allows prioritizing findings by endpoint access or high-probability risk • New workflow templates for OWASP Top 10 2021, SANS/CWE Top 25, and PCI DSS standards • C# parser runtime environment updated to .NET 8.0 • Added detection for CWE-208, CWE-256, and CWE-352 in Java • Enhanced detection accuracy for CWE-79 (XSS/DOM-based XSS) in JavaScript/TypeScript and CWE-89 (SQL Injection) in Java • Scan source code and configuration files for exposed credentials with new CLI flag `--secrets-detection` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.4.3

Mon, 19 May 2025 00:00:00 GMT

Mend SAST v25.4.3 adds 'Endpoint Access' risk factor for API findings and AI-driven rule customization. • Adds new 'Endpoint Access' risk factor to findings accessible through API endpoints to improve prioritization • Adds option to share additional project data with Mend.io for AI processing and custom rule candidate generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.4.3 (19-May-2025)

Mon, 19 May 2025 00:00:00 GMT

Mend SAST adds API endpoint context to findings and AI-driven rule customization • Adds `Endpoint Access` as a new Risk Factor for findings accessible via API endpoints • Adds ability to share additional project data with Mend.io for AI-assisted detection rule customization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.4.2

Mon, 05 May 2025 00:00:00 GMT

Mend SAST v25.4.2 adds configurable scan timeouts exceeding 30 minutes via CLI and SCM integrations. • `SAST scanning now supports timeout values exceeding 30 minutes, configurable via both the CLI and SCM integrations.` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST Version 25.4.2 (05-May-2025)

Mon, 05 May 2025 00:00:00 GMT

Mend SAST 25.4.2 adds configurable scan timeouts (>30 min) and improves Angular/C# detection. • Adds support for SAST scanning timeouts exceeding 30 minutes, configurable via CLI and SCM integrations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast

Mend SAST 25.4.1

Mon, 21 Apr 2025 00:00:00 GMT

Mend SAST 25.4.1 adds support for scanning Python files with BOM encoding and optimizes incremental dump storage. • Supports scanning Python files that use BOM (Byte Order Mark) encoding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mend-sast