Mend SCA

No entries match these filters. Clear filters

1. Version 26.10.1 (01-November-2026) Nov 1, 2026 · issue 128

   Mend SCA adds an AI-powered Intelligent Agent for natural-language risk exploration and executive summaries across all projects⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Mend SCA now includes the Intelligent Agent, an AI assistant embedded in the platform that accepts natural language queries to explore capabilities, navigate to relevant views, and generate executive-level risk summaries across all applications and projects — enabled by default for organizations with a signed AI consent addendum.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. announced Oct 29, 2026 · issue 127

   Mend SCA adds Bun support, scanning both bun.lock and bun.lockb lockfiles with reachability analysis for JavaScript and TypeScript⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Mend SCA now scans Bun-managed JavaScript and TypeScript projects by reading bun.lock (text format, default since Bun 1.2) with no Bun installation required in the scan environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Mend SCA now scans the legacy binary bun.lockb lockfile format when Bun is installed in the scan environment.
   • Reachability analysis is now supported for Bun projects in the Mend CLI and all repository integrations, marking each dependency vulnerability as reachable or unreachable for both JavaScript and TypeScript sources.
   • Bun workspaces and private registries are now supported with no extra configuration.
   • Any folder containing a package.json alongside a bun.lock or bun.lockb file is automatically detected and scanned as a Bun project, with no configuration required.
   • Mend SCA now scans Bun-managed JavaScript and TypeScript projects by reading bun.lock (text format, default since Bun 1.2) with no Bun installation required in the scan environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Mend SCA now scans the legacy binary bun.lockb lockfile format when Bun is installed in the scan environment.
   • Bun workspaces and private registries are now supported with no extra configuration.
   • Any folder containing a package.json alongside a bun.lock or bun.lockb file is automatically detected and scanned as a Bun project, with no configuration required.

   1 more in Everything

3. docs update Oct 20, 2026 · issue 114

   Mend SCA: Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown and Create Role wizard for more intuitive role management.

   └──▷ HOW TO FIND IT
   Prevent false-positive Empty License violations caused by proprietary libraries being swept into license-condition workflows.
   📍In the Mend platform, go to Organization Settings and enable Include Proprietary Libraries in Workflows (set it to off/excluded) so in-house components are skipped during automated license scans.
4. Version 26.9.3 (18-October-2026) Oct 18, 2026 · issue 114

   Adds aggregated CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export for application and multi-project scopes, and an Include Proprietary Libraries in Workflows org setting.

   • Introduces an option to generate a single aggregated SBOM file for application and multi-project scopes, consolidating multiple project-level files into one document with deduplication and merged occurrence data; supports CycloneDX and SPDX standards.
   • Adds the Include Proprietary Libraries in Workflows organizational setting to control whether proprietary (in-house) components are included in automation workflows for Empty License conditions.

   2 details in Everything

   • New integration GitHub repository-level security advisories as an import source
   • Updated supported platform Bun package manager GA in Mend CLI and repository integrations
5. changelog Oct 12, 2026 · issue 104

   Mend SCA adds workflow email recipient control, a new Send Email action for CVE alerts, and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. threat notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Get immediate notification when a newly published CVE affects your monitored packages, without waiting for a scheduled scan.
   📍In the Workflows editor, add a new action step, select Send Email, choose target users or groups as recipients, configure the delivery frequency, and save the workflow.
   • Adds a Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables workflow creators to directly select specific users or groups as recipients for scan summary emails.
   • Adds dedicated zero-day alerts to provide immediate notification when the organization is vulnerable to emerging threats.
   • Adds a Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dedicated zero-day alerts to provide immediate notification when the organization is vulnerable to emerging threats.

   1 more in Everything

6. docs update Oct 8, 2026 · issue 097

   Mend Renovate adds datasource reporting, crate git-index credentials, GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. extraction improvements, and exec re-run on version downgrade.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Reports the datasource which served a version lookup, giving practitioners visibility into which registry answered each dependency resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports host-rule credentials for crate git index registries via datasource/crate, enabling authenticated access to private Cargo git indexes.
   • Extracts slsa-framework/actions/* references in manager/github-actions, broadening GitHub Actions dependency tracking to SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. framework actions.
   • Updates manager/github-actions to use GitHub releases for setup-deno, improving version resolution accuracy for Deno setup actions.
   • Updates manager/github-actions to handle gh-aw-actions/setup-cli with.version fields, adding version-tracking support for that action.
   • Reports the datasource which served a version lookup, giving practitioners visibility into which registry answered each dependency resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The java-maven tool is removed from util/exec (closes #41849); any configuration or pipelines relying on Renovate installing java-maven via exec will break.
7. docs update Oct 6, 2026 · issue 096

   Mend SCA: Adds a Send Email workflow action to notify recipients of new findings independent of scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Suppress zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alert emails for a specific organization you belong to without affecting others.
   📍In the platform, navigate to My Profile → Email Notifications and toggle off zero-day alerts for the target organization.
8. docs update Oct 6, 2026 · issue 096
   └──▷ HOW TO FIND IT
   Get immediate notification when a zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. affecting your inventory is disclosed, without waiting for the next scheduled scan.
   📍In Mend SCA, go to Workflows › your workflow › Add Action, select Send Email, configure recipients (specific users or groups), set the delivery frequency, and save.
9. docs update Oct 5, 2026 · issue 095

   Adds --print-to-console to mend code for real-time stdout logging; auto-excludes /_MACOSX/..* files from all SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scan engines.

   • Adds --print-to-console flag to mend code (SAST scans) to print CLI logs directly to stdout as the scan runs, in addition to writing them to the log file — previously only available for mend dep (SCA scans).
   • Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, even when default exclusions are otherwise disabled.

   2 details in Everything

   • New supported platform Bun package manager support
10. docs update Oct 5, 2026 · issue 095

    Mend AI now supports Suppress and Review triage actions at the individual finding level, not just entity level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

11. docs update Oct 5, 2026 · issue 095

    Mend SCA adds workflow email controls, a new Send Email action for CVE alerts, and dedicated zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. vulnerability notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Get notified of newly published CVEs affecting your projects without waiting for a scheduled scan to trigger an email.
    📍In the Mend platform, navigate to Workflows › your workflow › Actions, add a Send Email action, select recipients (users or groups), and configure the delivery frequency for new-findings notifications.
    • Enhances workflow email notifications to allow creators to select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated zero-day alerts to provide immediate awareness when the organization is exposed to emerging threats.

    2 details in Everything

12. docs update Oct 5, 2026 · issue 095

    Mend Renovate adds Gradle rich version constraint support and re-applies Azure auto-complete settings to existing PRs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports rich version constraints in the Groovy/Kotlin DSL for the manager/gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Re-applies auto-complete settings to existing PRs on the platform/azure integration.
    • Supports rich version constraints in the Groovy/Kotlin DSL for the manager/gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

13. Version 26.9.2 (04-October-2026) Oct 4, 2026 · issue 096
    └──▷ HOW TO FIND IT
    Set up a scan-independent notification so your security team is emailed whenever a newly published CVE affects your portfolio.
    📍In Automation Workflows, add a new action, select Send Email, choose specific users or groups as recipients, pick the finding type (e.g. newly published CVEs), and configure the delivery frequency.
14. 26.9.2 Oct 4, 2026 · release notes

    Mend SCA 26.9.2 adds configurable zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. alerts and new Send Email action to Automation Workflows

    • Adds dedicated zero-day alerts for immediate awareness of emerging threats
    • Adds Send Email action in Automation Workflows to notify about new findings like newly published CVEs with configurable delivery frequencies
    • Enhances email notification capabilities in Automation Workflows to allow selecting specific users or groups as recipients for scan summary emails

    3 details in Everything

15. Version 26.9.1 (27-September-2026) Sep 27, 2026 · issue 088

    Mend SCA 26.9.1 adds Bun package manager support for automatic detection of direct and transitive JavaScript dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

16. docs update Sep 25, 2026 · issue 085

    Renovate adds matchIsBreaking package rule option, $matchRegexOrGlob JSONataJSONataA query and transformation language for JSON data, maintained as an open-source project. Cyber tools use it to extract, reshape, and map JSON payloads without writing custom parsing code. function, zstd channel tarball support for Nix, and conda backend for mise manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Suppress or label PRs that introduce breaking version bumps by targeting them with a dedicated package rule using matchIsBreaking.
    renovate.json copy

    {
      "packageRules": [
        {
          "matchIsBreaking": true,
          "addLabels": ["breaking-change"],
          "automerge": false
        }
      ]
    }

    • Adds matchIsBreaking option to package rules in Renovate config, enabling rules that target only breaking-version updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to the JSONata expression engine for flexible pattern matching in Renovate queries.
    • Adds conda backend support to the manager/mise manager, expanding the set of package ecosystems mise can update.
    • Adds support for zstd-compressed channel tarballs in the manager/nix manager.
    • Adds matchIsBreaking option to package rules in Renovate config, enabling rules that target only breaking-version updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds $matchRegexOrGlob custom function to the JSONata expression engine for flexible pattern matching in Renovate queries.

    2 more in Everything

17. docs update Sep 22, 2026 · issue 082

    Mend Renovate adds PyPI backend support for mise, regex versioning ranges, and array-of-inline-tables parsing for mise tool versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds pypi backend support to manager/mise, enabling Renovate to manage PyPI-sourced tool versions declared in mise configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds range support to the regex versioning scheme, allowing dependency version constraints expressed as ranges to be evaluated under the regex scheme.
    • Adds support for arrays of inline tables as tool versions in manager/mise, broadening the set of mise config shapes Renovate can parse.
    • Makes Image optional for volume units in manager/quadlet, reducing required fields in Quadlet configuration files.
    • Adds graceful handling of OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. database fetch failures in the dashboard, preventing crashes when the OSV feed is unavailable.

    +2 more show less

    • Adds a datasource for Forgejo by sharing the Gitea datasource, changelog source, and preset source with Forgejo instances.
    • Skips the web API of Crate registries that do not implement it in datasource/crate, avoiding unnecessary errors against non-standard registries.
    • Adds pypi backend support to manager/mise, enabling Renovate to manage PyPI-sourced tool versions declared in mise configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a datasource for Forgejo by sharing the Gitea datasource, changelog source, and preset source with Forgejo instances.

    5 more in Everything

18. docs update Sep 14, 2026 · issue 074

    Mend SCA adds IDE/AI-agent suppression triage and a unified vulnerability remediation experience with a Top Fix column⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCA, with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces a unified vulnerability remediation experience with standardized fix logic, a new Top Fix column in the Findings table, and an updated Remediation tab for consistent vulnerability fix metadata.
    • Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCA, with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

19. docs update Sep 14, 2026 · issue 074

    Mend SCA adds the EU Vulnerability Database (EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories.) from ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. as a primary security data source with dedicated CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores and exploitability data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

20. docs update Sep 7, 2026 · issue 067

    Mend SCA: Adds a Top Fix column in the Findings table and updates the Remediation tab as part of a unified vulnerability remediation experience, standardizing fix logic and recommendations across the Mend Platform for consistent metadata and clearer vulnerability fixes.

21. Version 26.8.2 (06-September-2026) Sep 6, 2026 · issue 067

    Mend SCA 26.8.2 adds a unified vulnerability remediation experience with a new Top Fix column and updated Remediation tab.

    └──▷ HOW TO FIND IT
    Review the new Top Fix recommendation for each finding directly in the Findings table to prioritize remediation without opening individual vulnerability details.
    📍In the Mend Platform, go to Findings › Findings Table and locate the new Top Fix column to see the recommended fix for each vulnerability.
    • Adds a Top Fix column in the Findings table to surface the recommended remediation action per vulnerability.

    1 detail in Everything

22. docs update Aug 31, 2026 · issue 060

    Mend SCA launches API 3.0 with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, cursor pagination, and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec in JSON/YAML

    • New Mend API 3.0 REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. provides programmatic access to SCA workflows for any user with Mend credentials via a user key from the Mend Platform profile page.
    • Supports cursor pagination and result-size limiting for scalable programmatic access to large datasets.

    2 details in Everything

23. docs update Aug 24, 2026 · issue 055

    Mend AI adds an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0.1 formats via platform UI and API.

    • Adds the AI Bill of Materials (AI-BOM) report, available through the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — across organization, application, and project scopes.
    • Supports industry-standard CycloneDX 1.7 and SPDX 3.0.1 export formats for AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. data, enabling interoperability with existing SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. toolchains.
    • Enforces metadata-only exports in AI-BOM reports to preserve data privacy while maintaining visibility into AI usage.

    3 details in Everything

24. docs update Aug 24, 2026 · issue 055

    Mend SCA adds account-level global workflows with centralized governance and full API support across organizations.

    • Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with API support for managing global workflows.
    • Adds controls for whether organization-level admins can enable or disable account-level workflows locally.
    • Updates the Administration page sidebar with a categorized, collapsible navigation structure, including a new dedicated AI Usage tab under an AI category (moved from the General tab) and sub-headers for AI, Code, and Dependencies under Engine Settings.

    3 details in Everything

25. docs update Aug 24, 2026 · issue 055

    Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. remediation.

    └──▷ USE IT
    Override the default description on a dependency update PR — useful when you want team-specific messaging in automated PRs.
    renovate.json copy

    {
      "overrideDescription": "Automated dependency update managed by the platform team"
    }

    • Adds overrideDescription option to Renovate config for customizing dependency update descriptions.
    • Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening file discovery.
    • Onboarding summary view now shows What to Expect section first for clearer initial setup guidance.
    • Onboarding clarifies that security PRs do not count against PR limits.

    4 details in Everything

26. docs update Aug 24, 2026 · issue 055

    Mend Container v26.8.1 adds Chainguard support to hardened image detection, including VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status and branding in the UI.

    • Adds Chainguard as a supported vendor in Mend Container's hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and Chainguard image layer and base image detection.
    • Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

    2 details in Everything

27. Version 26.6.1 (28-June-2026) Jun 28, 2026 · release notes

    Mend SCA adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. source transparency, organization-level reports, Unspecified Copyrights state, and a Number of Licenses column.

    • Adds CVSS scores source display (e.g. NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.) in the UI and APIs to clarify scoring discrepancies
    • Adds organization-level reports for Dependencies Attribution, Dependencies Due Diligence, and Dependencies Inventory, accessible via API at the application/project level
    • Introduces a new Unspecified Copyrights state to the OS Inventory with dedicated filtering and visual indication
    • Adds a Number of Licenses column to the OS Inventory table for quick licensing complexity assessment

    4 details in Everything

28. 26.5.2 Jun 14, 2026 · release notes

    Mend SCA adds organization-level Dependencies Risk report via new scalable pipeline

    └──▷ HOW TO FIND IT
    Generate org-wide dependency risk insights via the web interface.
    📍In the Mend Platform UI, navigate to Reports and select Dependencies Risk at the organization level
    • Dependencies Risk report is now available at the organization level in the Mend Platform UI

    1 detail in Everything

29. Version 26.4.3 (18-May-2026) May 18, 2026 · release notes

    Mend SCA v26.4.3 adds .NET deps.json resolver to CLI for improved dependency detection

30. Version 26.3.2 (12-April-2026) Apr 12, 2026 · release notes

    Mend SCA v26.3.2 adds Zero-Day response workflows with dedicated catalog, configurable enforcement, and Excel Due Diligence reports.

    • Adds the Zero-Day catalog for immediate risk visibility and audit-level transparency of critical vulnerabilities
    • Introduces configurable zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. response workflows in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform to enable user-controlled enforcement and permanent violation tracking
    • Enables generation of the Due Diligence report in Excel format

    3 details in Everything

31. Version 26.3.1 (22-March-2026) Mar 22, 2026 · release notes

    Mend SCA 26.3.1 adds uv support, zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. catalog, and RESOLVEDEPENDENCIES env var control

    └──▷ HOW TO FIND IT
    View live zero-day data independently of your inventory.
    📍In the Mend AppSec Platform, navigate to Profile › Zero-Day Catalog
    • Adds uv package manager support via Mend CLI and repository integrations for Python scanning and Reachability analysis
    • Adds a dedicated Zero-Day Catalog page accessible from the Profile menu in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform

    2 details in Everything

32. Version 26.2.2 (08-March-2026) Mar 8, 2026 · release notes

    Mend SCA adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Score column to UI findings table and dependencyContexts field to Get Project Security Findings API

    └──▷ TRY IT
    Retrieve vulnerability data with immediate visibility into how components appear in the dependency graph via the API.
    copy

    $ GET /rest/project/security/findings?include=dependencyContexts

    Sort vulnerabilities by exploit likelihood directly in the UI to prioritize triage.
    📍In the console, go to Dependencies → Findings and click the EPSS Score column header.
    • Adds dependencyContexts field to the Get Project Security Findings API to show direct vs. transitive dependency roots.
    • Adds a new EPSS Score column to the Dependencies → Findings table for in-place risk sorting.

    2 details in Everything

33. Version 26.2.1 (22-February-2026) Feb 22, 2026 · release notes

    Mend SCA v26.2.1 introduces Source File Matching with new page and column, plus auto-classification for NVIDIA proprietary license.

    • Adds manual grouping of source files into logical libraries via the new dedicated Source Files page and manual override options.
    • Introduces a new Source File column in Mend Platform tables to display file-grouping data.
    • Auto-detects and classifies NVIDIA Proprietary Software License as proprietary without manual configuration.

    3 details in Everything

34. 26.2.1 Feb 22, 2026 · release notes

    Mend SCA 26.2.1 adds Source File Matching with new UI columns and pages, plus proprietary license detection.

    └──▷ HOW TO FIND IT
    Navigate to the new Source Files page to manually associate ungrouped source files with known libraries for better compliance reporting.
    📍In the Mend Platform console, go to Source Files to review and override automatic groupings.
    • Adds a Source File column in Mend Platform to group source files into logical libraries.
    • Adds a dedicated Source Files page for manual grouping and override of library associations.
    • Automatically detects and classifies the NVIDIA Proprietary Software License as proprietary.

    3 details in Everything

35. Version 26.1.1 (25-January-2026) Jan 25, 2026 · release notes

    Mend SCA v26.1.1 adds Major/Minor upgrade recommendations to the Least Vulnerable Package strategy.

    └──▷ BREAKING ON UPGRADE

    • !The legacy Library Page in the SCA module has been removed; users must access library data via dedicated side-panels.
36. 26.1.1 Jan 25, 2026 · release notes

    Mend SCA 26.1.1 enhances Least Vulnerable Package remediation with minor version recommendations via side-panels.

    └──▷ HOW TO FIND IT
    View new minor version upgrade suggestions for vulnerable packages in your project's side-panel.
    📍In the Mend SCA console, navigate to a project and open the Library side-panel to view remediation recommendations.
    └──▷ BREAKING ON UPGRADE

    • !The legacy Library Page from the SCA module has been removed; all library-related data is now available through dedicated side-panels.
37. (13-January-2026) Jan 13, 2026 · release notes

    Mend SCA adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.-ID field visibility and multi-license name support under single identifiers

    • SPDX-ID field visible in the license side panel for managing multiple distinct license names under a single SPDX identifier

    1 detail in Everything

38. Version 25.12.2 (11-January-2026) Jan 11, 2026 · release notes

    Mend SCA adds three async account-level APIs to export Dependency reports in Excel format.

    • Adds asynchronous, account-level API endpoints for exporting Dependencies reports in EXCEL format with targeted filters for library name or finding ID.

    1 detail in Everything

39. 25.12.2 Jan 11, 2026 · release notes

    Mend SCA 25.12.2 adds three account-level API endpoints for exporting Dependency reports in Excel format.

    └──▷ TRY IT
    Generate a comprehensive inventory of all dependencies in Excel format via API.
    copy

    $ curl -H 'Authorization: Bearer <TOKEN>' https://<domain>/api/dependencies/report/excel/inventory

    Export a filtered Excel report containing only findings for a specific library.
    copy

    $ curl -H 'Authorization: Bearer <TOKEN>' "https://<domain>/api/dependencies/report/excel/findings?library_name=log4j"

    • Introducing GET /api/dependencies/report/excel/inventory and GET /api/dependencies/report/excel/findings account-level API endpoints for exporting Dependencies reports in EXCEL format
    • Adds targeted filter support for library_name and finding_id on the new Excel export endpoints

    2 details in Everything

40. Version 25.12.1 (28-December-2025) Dec 28, 2025 · release notes

    Mend SCA v25.12.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import API 3.0 endpoint for automation.

    • Adds support for SBOM import via a new API 3.0 endpoint under the Application scope
    • Retrieves detailed import logs for improved automation and observability

    2 details in Everything

41. Version 25.11.2 (14-December-2025) Dec 14, 2025 · release notes

    Mend SCA v25.11.2 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. API 3.0 import, Logs API, account-level Reports tab, and Jira integration for Legal workflows.

    • Added support for SBOM import through API 3.0
    • Added a dedicated logs API for enhanced traceability
    • Added a new Reports tab in the Accounts view for Inventory and Security Alerts reports
    • Legal and Compliance workflows now support Jira Issue creation

    4 details in Everything

42. 25.11.2 Dec 14, 2025 · release notes

    Mend SCA 25.11.2 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. 3.0 API import, accounts-level report tab, and Jira legal workflow support.

    └──▷ HOW TO FIND IT
    Navigate to the Accounts view to access the new Reports tab for generating inventory and alert reports.
    📍In the Mend SCA console, go to Accounts › [Account Name] and click the Reports tab.
    • Adds SBOM 3.0 import capability via the application API
    • Adds a dedicated logs API for enhanced traceability
    • Adds a Reports tab in the Accounts view for Inventory and Security Alerts reports
    • Extends Legal and Compliance workflows with Jira Issue creation support

    4 details in Everything

43. Version 25.11.1 (30-November-2025) Nov 30, 2025 · release notes

    Mend SCA v25.11.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import UX improvements, dependency path visibility, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. ID display, CSV export for logs, and log download limits.

    • SBOM import experience now features a step-by-step process with status indicators and actionable guidance for validation or structure issues
    • Added a new field to the license side panel displaying the SPDX identifier for each license
    • Enhanced project view displays each direct library occurrence with its specific dependency path
    • Users receive clear notifications when actions affect all occurrences in the project view
    • Added export to CSV option to SBOM import logs

    +2 more show less

    • Added refresh options to SBOM import logs
    • Added 5 MB log view limit with download options for larger logs

    7 details in Everything

44. 25.11.1 Nov 30, 2025 · release notes

    Mend SCA 25.11.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import log viewing limits with download, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. ID display in license side panel, and direct dependency path visualization.

    • Adds a 5 MB log view limit for SBOM imports with download options for larger logs
    • Displays the SPDX identifier for each license in the license side panel
    • Enhances project view to display specific dependency paths for each direct library occurrence
    • Adds export to CSV and refresh options to SBOM import logs

    4 details in Everything

45. (25-November-2025) Nov 25, 2025 · release notes

    Mend SCA adds Shai-Hulud zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. detection via dedicated workflow event condition.

    └──▷ HOW TO FIND IT
    Automate detection and response for libraries impacted by the Shai-Hulud zero-day via Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform workflows.
    📍In Mend AppSec Platform workflows, configure an automation rule triggered by the new Shai-Hulud event condition.
46. Version 25.10.3 (16-November-2025) Nov 16, 2025 · release notes

    Automation workflows now apply in every CLI dependencies scan; enhanced Project view shows specific dependency paths.

    • mend dependencies scans now universally apply Automation Workflows, removing the previous requirement for the --update parameter
    • Project view now displays each direct library occurrence with its specific dependency path to distinguish multiple instances

    2 details in Everything

47. 25.10.3 Nov 16, 2025 · release notes

    Mend SCA 25.10.3: CLI automation workflows apply to all scans; Project view shows dependency paths for library occurrences.

    • Automation Workflows are now enabled by default in every CLI dependencies scan without requiring the --update flag
    • Project view now displays specific dependency paths for each direct library occurrence and clarifies actions affecting all occurrences

    2 details in Everything

48. Version 25.10.2 (02-November-2025) Nov 2, 2025 · release notes

    This release enables immediate analysis of C++ Conan dependencies in Mend CLI without config changes.

    • Mend CLI now scans Conan package manager dependencies with reachability analysis out-of-the-box

    1 detail in Everything

49. Version 25.10.1 (19-October-2025) Oct 19, 2025 · release notes

    Mend SCA 25.10.1 adds Security Assistant MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration for real-time vulnerable library replacement in IDEs.

50. 25.10.1 Oct 19, 2025 · release notes

    Mend SCA introduces Security Assistant MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration and adds support for Node.js 24.x, npm 11.x, and Gradle 9.x in version 25.10.1

    • Adds the Mend Security Assistant MCP protocol integration for real-time vulnerable library detection in AI-native IDEs.
    • Adds support for scanning projects using the Node.js 24.x runtime environment.
    • Adds support for scanning projects managed by the npm 11.x package manager.
    • Adds support for scanning Gradle projects built with Gradle 9.x.

    4 details in Everything

51. Version 25.9.1 (28-September-2025) Sep 28, 2025 · release notes

    Mend SCA v25.9.1 adds import/export support for CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and new SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. sources (Syft, Dependency-Track).

    • Adds support for importing Syft-generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Adds support for importing Dependency-Track-generated SBOMs
    • Adds support for importing self-generated SBOMs
    • Enables CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 format for both import and export

    4 details in Everything

52. 25.9.1 Sep 28, 2025 · release notes

    Mend SCA adds import for Syft/DependencyTrack/self-generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. support

    • Adds Syft, DependencyTrack and self-generated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import targets
    • Supports CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 format for both import and export operations
    • Improves reliability and accuracy of npm package resolution during SBOM processing

    3 details in Everything

53. Version 25.8.2 (07-September-2025) Sep 7, 2025 · release notes

    New SCA conditions for direct dependencies, multiple licenses, and exploit-linked vulnerabilities; grouped findings in Direct Library side-panel.

    • Introduces new SCA conditions for direct dependencies, multiple licenses, and publicly available exploits to enhance workflows
    • Adds grouping of findings in the Findings tab within the Direct Library side-panel via collapsible/expandable Library Rows
    • Enables aggregated information and individual CVE details display in the new grouped view

    3 details in Everything

54. 25.8.2 Sep 7, 2025 · release notes

    Mend SCA 25.8.2 adds new workflow conditions for direct dependencies, multi-license detection, and exploit prioritization plus grouped findings UI.

    • Adds three new SCA conditions to enhance workflows: trigger actions for direct dependencies, detect components with multiple licenses, and prioritize vulnerabilities with publicly available exploits.
    • Enables grouping of findings in the Findings tab within the Direct Library side-panel via collapsible/expandable Library Rows.

    2 details in Everything

55. Version 25.7.2 (10-August-2025) Aug 10, 2025 · release notes

    Mend SCA v25.7.2 enables organization-level Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license alignment updates

    • Dependencies SBOM report is now generatable at the organization level, in addition to the existing application/project level support.
    • Improved license alignment with the SPDX format by replacing legacy license identifiers: Eclipse 1.0 → BSD 3, Jaxen Werken → BSD 3, Cryptix General License → BSD 2, and Cup Parser Generator License → Standard ML of New Jersey.
    • The Dependencies SBOM report can now be generated at the organization level, expanding access beyond the previous application/project scope.
    • Updated internal license mapping: Eclipse 1.0 replaced by BSD 3, Jaxen Werken replaced by BSD 3, Cryptix General License replaced by BSD 2, and Cup Parser Generator License replaced by Standard ML of New Jersey for SPDX compliance.

    4 details in Everything

56. 25.7.2 Aug 10, 2025 · release notes

    Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report can now be generated at the organization level in Mend SCA.

    └──▷ HOW TO FIND IT
    Generate a consolidated SBOM for all applications within an organization via the web console.
    📍In the Mend SCA console, navigate to Organization › Reports and select Dependencies SBOM.
    • Adds Dependencies SBOM report generation at the organization level
    • Improves license alignment with SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format (e.g., Eclipse 1.0 → BSD 3)

    2 details in Everything

57. Version 25.7.1 (27-July-2025) Jul 27, 2025 · release notes

    Mend SCA v25.7.1 adds library violation count columns, In Review/'Issue Created statuses, and org-level Dependencies Findings reports.

    • Adds new sortable/filterable security violation count columns in the main table and side panels for direct libraries
    • Adds In Review and Issue Created statuses for direct libraries in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform
    • Enables generation of Dependencies Findings reports at the organization level

    3 details in Everything

58. 25.7.1 Jul 27, 2025 · release notes

    Mend SCA 25.7.1 adds violation count columns to libraries, new In Review statuses, and org-level Dependency Findings reports.

    • Adds sortable and filterable violation counts columns for security violations directly within library tables in both the main table and side panels
    • Introduces In Review and Issue Created statuses for direct libraries in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform to track remediation workflows
    • Enables generation of the Dependencies Findings report at the organization level, extending previous project-only availability

    3 details in Everything

59. Version 25.4.3 (18-May-2025) May 18, 2025 · release notes

    Mend SCA adds Remediation section to findings UI and MEND_SCA_EXCLUDE_DEP_CLASS env var for Gradle scan filtering

    • Unreviewed items in Direct Libraries, Libraries, and Findings tables now show a blue dot indicator and hover tooltip; suppressed item backgrounds change to light gray.
    • Introduces the MEND_SCA_EXCLUDE_DEP_CLASS environment variable for Gradle scans via the Mend CLI to exclude specific configurations from scan results.

    2 details in Everything

60. 25.4.3 May 18, 2025 · release notes

    Mend SCA 25.4.3 adds remediation details to findings UI, Unreviewed status indicators, and MEND_SCA_EXCLUDE_DEP_CLASS env var for Gradle scans.

    • Enhances item status differentiation in Direct Libraries, Libraries, and Findings tables with Unreviewed blue dot indicators and hover tooltips

    1 detail in Everything

61. Version 25.4.2 (04-May-2025) May 4, 2025 · release notes

    Mend SCA 25.4.2 introduces Legal compliance UI and fixes API field naming

    • Adds a new Legal section in the left navigation menu to manage licensing risks for open-source, proprietary, and commercial libraries.
    • Adds a dedicated side panel for license-related details within the Legal workflow.

    2 details in Everything

62. 25.4.2 May 4, 2025 · release notes

    Mend SCA 25.4.2 adds a dedicated Legal section for license risk management and corrects the Get Project Security Findings API response.

    └──▷ HOW TO FIND IT
    Navigate the new Legal workflow to identify critical licensing risks in the UI.
    📍In the left navigation menu, click Legal › Applications to view and manage license comments.
    Consume the corrected reachability status from the Mend SCA API instead of the previous effective field.
    copy

    $ GET /rest/projects/{projectId}/security/findings
    { "reachability": "REACHABLE" }

    • Introduces a new Legal section in the left navigation menu to manage licensing risks, superseding the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and Attribution pages
    • Adds a dedicated side panel for license details with comment support within the legal workflow

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Get Project Security Findings API response field effective is removed; clients must now read reachability (values: REACHABLE, POTENTIALLY_REACHABLE, UNREACHABLE).
63. Version 25.4.1 (20-April-2025) Apr 20, 2025 · release notes

    Mend SCA v25.4.1 adds HeroDevs commercial mitigation paths, C# transitive fix recommendations, and a Top 10 libraries widget.

    • Adds identification and display of HeroDevs libraries in the Commercial section of the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. page (requires a HeroDevs license)
    • Adds alternative mitigation solution for vulnerabilities in deprecated open-source libraries by suggesting an upgrade path to an available commercial version by HeroDevs
    • Introduces a widget showcasing the Top 10 High-Risk Direct Libraries by criticality on the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform Application and Project Summary pages
    • Implements a hierarchical panel user experience with breadcrumb navigation combining three side panels

    4 details in Everything

64. 25.4.1 Apr 20, 2025 · release notes

    Mend SCA 25.4.1 adds HeroDevs commercial lib detection, C# transitive fix recommendations, and a Top 10 widget with hierarchical UI.

    └──▷ HOW TO FIND IT
    Visualize and navigate high-risk dependencies directly from the project dashboard to prioritize remediation efforts.
    📍Navigate to Application › Summary in the Mend AppSec Platform UI to view the Top 10 High-Risk Direct Libraries widget.
    Review the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for commercial libraries covered by your HeroDevs license during a security review.
    📍Open the SBOM page in the Mend AppSec Platform and filter or view the Commercial section to see identified HeroDevs libraries.
    • Identifies HeroDevs libraries in the Commercial section of the SBOM page in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform (requires a HeroDevs license).
    • Adds a widget showcasing the Top 10 High-Risk Direct Libraries by criticality on Application and Project Summary pages.

    2 details in Everything

65. Version 25.2.2 (09-March-2025) Mar 9, 2025 · release notes

    Mend SCA v25.2.2 adds Bower, Poetry, Packrat, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., Cocoapods to CLI; extends Reachability to Lerna, pnpm, Conda, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code..

    • Adds Bower (JavaScript) package manager support in the Mend CLI
    • Adds Poetry (Python) and Conda (Python) package manager support in the Mend CLI
    • Adds Cocoapods (Swift & Objective C) package manager support in the Mend CLI
    • Extends Reachability Analysis to Lerna and pnpm for JavaScript
    • Extends Reachability Analysis to Conda and Poetry for Python

    +1 more show less

    • Extends Reachability Analysis to NuGet (C#) package manager

    6 details in Everything

66. 25.2.2 Mar 9, 2025 · release notes

    Mend SCA 25.2.2 adds Bower, Poetry, Packrat, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., and CocoaPods support to Mend CLI; extends Reachability Analysis

    • Mend CLI now supports Bower, Poetry, Packrat, SBT, and Cocoapods package managers for scanning.
    • Reachability Analysis now covers Lerna, pnpm (JavaScript), Conda, Poetry (Python), and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. (C#) to filter vulnerabilities by actual code execution paths.

    2 details in Everything

67. 25.2.1 Feb 24, 2025 · release notes

    Mend SCA 25.2.1 adds isProprietary field to API 3.0 and updates Dependencies Risk Report with metadata.

    • Adds isProprietary boolean field to the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform API 3.0 to indicate whether a library is proprietary
    • Enhances the Dependencies Risk Report with organization, application, and project names on the first page

    2 details in Everything

68. Version 25.2.1 (24-February-2025) Feb 24, 2025 · release notes

    Mend SCA v25.2.1 adds isProprietary field to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. via API 3.0 and updates risk report metadata/columns.

    • Introduces the isProprietary boolean field in SBOM reporting (hidden for non-proprietary libraries) via the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform and API 3.0
    • Enhances the Dependencies Risk Report with organization, application, and project names metadata on the first page based on scope
    • Adds a Last Scan column to application and project-level risk reports displaying recent scan dates

    3 details in Everything

69. Version 25.1.1 (26-January-2025) Jan 26, 2025 · release notes

    Mend SCA adds indicators, filters and reports for malicious packages in the main dashboard.

    • Main dashboard now shows a special indicator for malicious packages present in the organization
    • New indicators, filters and reports added to streamline detecting and removing malicious packages

    2 details in Everything

70. 25.1.1 Jan 26, 2025 · release notes

    Mend SCA adds malicious package indicators, filters, and reports to the main dashboard for v25.1.1

    └──▷ HOW TO FIND IT
    Quickly assess risk by looking for the new malicious package indicator on the main Mend SCA dashboard.
    📍In the Mend AppSec Platform, navigate to the Main Dashboard and look for the malicious package indicator.
    • Adds a special indicator on the main dashboard of the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform to signal the presence of malicious packages in the organization

    1 detail in Everything

71. 24.12.2 Jan 12, 2025 · release notes

    Mend SCA adds .NET reachability analysis (Open Beta) and Python direct/transitive fix recommendations.

    • Adds Reachability for .NET support in the Mend CLI and GitHub integration for C# projects using NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code.
    • Adds fix recommendations for both direct and transitive dependencies in Python projects across the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform, Developer Platform, and repo integrations (excluding self-hosted)

    2 details in Everything

72. Version 24.11.2 (15-December-2024) Dec 15, 2024 · release notes

    Mend SCA 24.11.2 introduces remediation-strategy configuration for choosing between Least Vulnerable Package or First Fix.

73. 24.11.2 Dec 15, 2024 · release notes

    Mend SCA adds remediation strategy configuration to Platform, Jira integration and API

    • Introduces a new remediation_strategy configuration option allowing selection of Least Vulnerable Package (LVP) or First Fix
    • Propagates the selected remediation strategy consistently across the Mend Platform UI, Jira integration sync, and Platform API 3.0

    2 details in Everything

74. Version 24.11.1 (01-December-2024) Dec 1, 2024 · release notes

    Mend SCA adds the --dev parameter to scan development dependencies for npm, Maven, Gradle, Go, Ruby and SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development..

    • Adds --dev parameter to enable scanning of development tools and dependencies
    • Supports npm, Maven, Gradle, Go, Ruby and SBT package managers for development dependency scans

    2 details in Everything

75. 24.11.1 Dec 1, 2024 · release notes

    Mend SCA adds --dev parameter to scan development-only dependencies

    └──▷ USE IT
    Scan a project including dev dependencies during CI/CD analysis.
    shell copy

    mend-sca scan --dev <project_path>

    • Introduces the --dev parameter for scanning development tools and dependencies not included in final application builds

    1 detail in Everything

76. 24.10.3 Nov 18, 2024 · release notes

    Open Beta: Risk Factors column grouping Reachability, Exploitability and Maliciousness statuses with filterable icons.

    └──▷ HOW TO FIND IT
    Filter findings by risk to reduce alert fatigue in the Mend SCA dashboard.
    📍In the Mend SCA web console, open a project view, locate the Risk Factors column in the dependencies table, and click the dropdown to filter by icons representing Reachability, Exploitability, or Maliciousness.
77. Version 24.10.3 (18-November-2024) Nov 18, 2024 · release notes

    Mend SCA introduces Risk Factors (Reachability, Exploitability, Maliciousness) and Python Poetry support

    • Adds a filterable Risk Factors column that groups Reachability, Exploitability, and Maliciousness statuses into icon-based representations for prioritizing findings.
    • Extends Reachability analysis to the Poetry package manager within supported repository integrations.

    2 details in Everything

78. 24.10.2 Nov 4, 2024 · release notes

    Mend SCA 24.10.2 adds Open Beta reachability analysis for Python (pip/Pipenv) to CLI and GitHub integrations

    • Adds reachability analysis for Python projects using pip or Pipenv in the Mend CLI, now available in Open Beta.
    • Adds reachability analysis for Python projects using pip or Pipenv in the GitHub repo integration, now available in Open Beta.

    2 details in Everything

79. 24.10.1 Oct 20, 2024 · release notes

    Mend SCA 24.10.1: SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Import GA lets users upload files to create or update projects.

80. Version 24.10.1 (20-October-2024) Oct 20, 2024 · release notes

    SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Import reaches GA, enabling project creation and updates via upload.

    • SBOM Import feature is generally available to upload SBOM files for creating new projects or updating existing ones in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.

    1 detail in Everything

81. Version 24.9.2 (13-October-2024) Oct 13, 2024 · release notes

    Mend CLI wraps Unified Agent; Dependency table adds Direct/Transitive column

    • Adds a Direct/Transitive parameter to the Dependency column in Security -> Dependencies -> Libraries, Security -> Dependencies -> Findings, and Compliance -> SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. -> OOS List tables

    1 detail in Everything

82. 24.9.2 Oct 13, 2024 · release notes

    Adds mend ua subcommand to run SCA scans via Mend CLI and adds Direct/Transitive parameter to Dependency tables

    └──▷ TRY IT
    Run an SCA scan using the Unified Agent directly from the command line.
    copy

    $ mend ua --help

    View whether libraries are direct or transitive dependencies in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report.
    📍Security -> SBOM -> OOS List (look for Direct/Transitive column)
    • Wraps the Unified Agent within the Mend CLI, exposing the mend ua subcommand to run SCA scans.
    • Adds a Direct/Transitive parameter to the Dependency column in Security -> Dependencies -> Libraries table.
    • Adds a Direct/Transitive parameter to the Dependency column in Security -> Dependencies -> Findings table.
    • Adds a Direct/Transitive parameter to the Dependency column in Compliance -> SBOM -> OOS List table.

    4 details in Everything

83. Version 24.8.2 (08-September-2024) Sep 8, 2024 · release notes

    Mend SCA 24.8.2 adds package health insights, npm maintenance status, and optional vulnerability data in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports

    • Adds Package Health information on the Recommended Fix tab to guide optimal upgrade paths for vulnerable packages
    • Adds maintenance status (Deprecated or Maintained) to npm package versions in the UI to help assess upgrade safety
    • Adds toggle in the Create Report wizard to exclude vulnerability data from Dependencies SBOM reports in SPDX format

    3 details in Everything

84. 24.7.2 Aug 11, 2024 · release notes

    Mend SCA v24.7.2 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 support to the Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report.

    └──▷ HOW TO FIND IT
    Export your software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in the widely adopted CycloneDX 1.5 format for downstream dependency analysis.
    📍Select CycloneDX 1.5 from the SBOM format dropdown in the Dependencies report view.
    • The Dependencies SBOM report now includes CycloneDX 1.5 as an available output standard.

    1 detail in Everything

85. 24.7.1 Jul 28, 2024 · release notes

    Mend SCA 24.7.1 adds vulnerability exclusion in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., library copyright overrides via modal, and label support in Attribution Reports.

    • Adds an option in the Create Report wizard to exclude vulnerabilities from Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports in the CycloneDX standard
    • Adds a modal interface for overriding copyrights for a selected library in attribution data
    • Labels are now supported in the Attribution Report

    3 details in Everything

86. Version 24.7.1 (28-July-2024) Jul 28, 2024 · release notes

    Mend SCA v24.7.1 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. vulnerability exclusion toggle, library copyright override modal, and label support in Attribution Report

    • Adds a toggle in the Create Report wizard to exclude vulnerabilities from Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports (CycloneDX standard)
    • Adds a modal interface to override copyrights for selected libraries in attribution data

    2 details in Everything

87. Version 24.6.1 (30-June-2024) Jun 30, 2024 · release notes

    Mend SCA 24.6.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import for new projects, commercial library tracking, package health insights, and npm maintenance status.

    • Adds support for creating new Mend SCA projects by importing a previously generated Dependencies SBOM report file
    • Enables defining libraries as commercial and displaying them in a separate tab on the Libraries page
    • Adds Package Health information to the Recommended Fix tab of vulnerable packages to indicate optimal upgrade paths
    • Adds maintenance status (Deprecated or Maintained) for npm package versions

    4 details in Everything

88. 24.6.1 Jun 30, 2024 · release notes

    Mend SCA 24.6.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import for new projects, commercial library filtering, Package Health data on Recommended Fix tab, and npm maintenance status.

    └──▷ HOW TO FIND IT
    Initialize a Mend SCA project directly from an existing SBOM without manual dependency mapping.
    📍Import the Dependencies SBOM report file via the New Project workflow in the Mend SCA interface
    Filter or manage commercial libraries separately from open-source ones within the Libraries view.
    📍Define a library as commercial in its settings, then view it in the dedicated Commercial tab on the Libraries page.
    Assess upgrade viability for vulnerable packages using Package Health insights.
    📍Navigate to the Recommended Fix tab of a vulnerable package and review the Package Health information provided.
    Check npm package longevity before upgrading to mitigate risk of unmaintained dependencies.
    📍View the maintenance status (Deprecated or Maintained) listed for specific npm package versions in Mend SCA.
    • Enables creating a new project by importing a previously generated Dependencies SBOM report file
    • Adds the ability to define libraries as commercial, listing them in a separate tab on the Libraries page
    • Adds Package Health information on the Recommended Fix tab for vulnerable packages
    • Adds maintenance status (Deprecated or Maintained) for npm package versions

    4 details in Everything

89. 24.5.3 Jun 17, 2024 · release notes

    Mend SCA 24.5.3 adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. support and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-embedded CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. to Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report

    • Dependencies SBOM report now supports SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 as an output format
    • Dependencies SBOM report in CycloneDX standard now includes embedded VEX data

    2 details in Everything

90. Version 24.3.2 (8-April-2024) Apr 8, 2024 · release notes

    Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4, Reachability, Exploitability & Malicious Package ML risk data; adds on_demand Jira integration and BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. Historical Scans view.

    • Risk Data now includes CVSS 4 scores, Exploitability metrics, Reachability analysis, and a Malicious Package ML score.
    • Adds BOM Historical Scans view for comparing past bill-of-materialsbill-of-materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. scans.
    • Integration Engine adds support for creating Jira tickets automatically upon Scan Complete or Policy Violation events.

    3 details in Everything