The following changes were introduced in endorctl:
- The PR-incremental dependency resolution filter is now enabled by default for the JavaScript plugin. It also honors an explicitly pinned lock file outside the package tree with the environment variable,
ENDOR_JS_LOCK_FILE_PATH. - Scan logs now show the actual reason a pnpm install failed instead of a generic error.
dotnet restoreanddotnet buildcan now resolve Windows-targeted frameworks on non-Windows scan hosts when you set the environment variable,ENDOR_SCAN_ENABLE_WINDOWS_TARGETING.- Fixed an issue where credentials injected into
.npmrcfor dependency resolution could persist in the working tree after a scan. - Bazel scans now classify each dependency by its own ecosystem instead of inheriting the target’s language, so dependencies such as Cargo and PyPI packages under one target are classified correctly.
The following changes were introduced in endorctl:
- Capped SARIF rule tags to a fixed allowlist of 10 tags in deterministic priority order when exporting to GitHub Advanced Security, preventing silent tag truncation and keeping rule tags consistent across exports.
endorctlnow compares theCODEOWNERSfile hash before updating its record during a scan, so an unchangedCODEOWNERSfile no longer triggers unnecessary re-processing and private dependency call graph regeneration.
The following changes were introduced in endorctl:
- Fixed a crash in AI security review when a generated code reference had an invalid end line number.
- Reduced false positives in Infrastructure as Code (IaC) findings by improving the AI evaluator prompt.
- The PR-incremental dependency resolution filter is now enabled by default for the JVM plugin.
- Fixed Rust scans to resolve dependencies when a
Cargo.tomlfile inherits workspace fields such asversion.workspaceandedition.workspace. - Fixed the segment scanner to remove stale segment match dependencies when a re-scan finds no valid matches.
- Fixed an error in license dependency processing caused by overly long SPDX license identifiers.
The following changes were introduced in endorctl:
- Added the
--segment-match-languagesflag toendorctl scan. - Fixed .NET call graph scans that failed on Azure DevOps repositories whose names contain spaces, by sanitizing percent-encoded characters in the temporary clone directory path.
- Fixed scanning of Azure DevOps repositories that use legacy
.visualstudio.comURLs.
The following changes were introduced in endorctl:
- Fixed Python dependency resolution failing with uv 0.11 and later, where trailing-space arguments to
uv pip showcaused “invalid value” errors. - Added a native secrets detector for JWK private keys, covering RSA, EC, and OKP keys in both JSON and object-literal formats.
- Fixed phantom root packages with empty paths appearing in concurrent same-language monorepo scans by ignoring transient file-not-found errors during manifest discovery.
- Fixed non-deterministic dependency loss in Gradle multi-root repositories.
- Python dependency-resolution failures now surface the actual
uv syncerror output instead of a genericexit status 1message.
The following changes were introduced in endorctl:
- Fixed a regression that prevented scanning empty git repositories.
- Ruby scans now capture resolved dependencies from
Gemfile.lock.
The following changes were introduced in endorctl:
- Bug fixes and miscellaneous improvements.
The following changes were introduced in endorctl:
- Maven package scans now surface the underlying error when a POM fails to parse.
- Maven dependency resolution now loads the
maven-bundle-pluginextension for OSGi POMs. - Ruby scans now import bundler to parse gemspec files.
The following changes were introduced in endorctl:
- Fixed Azure DevOps PR scans that failed due to a false staleness check.
- SBOM export by name now returns a clear error when the package version is not found.
- Secret scans now perform a full rescan when an explicit rescan is requested.
The following changes were introduced in endorctl:
- Fixed PR identification for GitLab and Bitbucket, resolving spurious 401 errors during PR scans.
- Added the
--secret-rules-fileflag toendorctl scanfor supplying custom secret detection rules. - Improved language detection for Rust projects.
- Python call graph generation now batches large projects by lines of code and available memory.
- Fixed pnpm scan failures where a package referencing workspace
catalog:dependencies could not build its lock file when scanned in isolation.
The following changes were introduced in endorctl:
- Superseded PR scans are now cancelled automatically, with a dedicated return code.
- Deleted package versions are now tracked in scan results and scan history.
The following changes were introduced in endorctl:
- Fixed PR scans on shallow or partial clones, where the merge base could be unreachable and the diff silently fell back to an incorrect comparison. endorctl now deepens the clone to reach the merge base, and reports a clear error if the two branches share no history.
The following changes were introduced in endorctl:
- Added the
--include-test-dependenciesflag toendorctl sbom export. - Pre-commit secret scans now flag only added lines.
- Expanded secret validation coverage.
- JavaScript scans now resolve call graphs for private transitive dependencies.
- Improved Ruby dependency resolution in scans.
The following changes were introduced in endorctl:
- JavaScript scans can now fetch call graphs for private packages.
- Improved error handling and return codes for local scans.
- Added a return code for when the baseline is not found.
- Secret scanning now applies the global allowlist during file walking for faster scans.
- Fixed incomplete call graphs on large Go projects, where build metadata could exceed an internal scan buffer and silently drop required build settings.
The following changes were introduced in endorctl:
- Added the
--dry-runflag toendorctl container registry scan. - Fixed the declared license field for compound SPDX expressions.
The following changes were introduced in endorctl:
- Added the
--os-reachabilityflag toendorctl container registry scan. - Added Harbor as a container registry type option.
- JavaScript scans now support a custom lock file location.
- Fixed a JavaScript call graph failure that could cause findings to be deleted.
- Private SCM dependency resolution across organizations is now enabled by default.
- Added secret detection rules for Azure AD client secrets (canonical Q~ format) and Azure Storage Account Keys, including a validator.
- Fixed authentication gaps in
.npmrcfile handling. - GitHub SARIF writes now retry transient 401 errors, with clearer GitHub authentication error classification.
- SBOM export now skips malformed packages instead of failing the entire export.
The following changes were introduced in endorctl:
- Fixed a Gradle issue where dependencies that failed manifest discovery were silently dropped, which inflated reported success rates. The resolver now synthesizes a path-derived package name so these scan failures are reported accurately.
- Fixed SBOM imports where SPDX documents with multiple root packages would silently abort and return zero findings. Multi-root SPDX documents are now normalized to a single root before CycloneDX conversion, so imports succeed and vulnerability matching runs.
The following changes were introduced in endorctl:
- Added environment variable support for the
scanned-onlyandexclude-scannedflags incontainer registry list, with validation that enforces mutual exclusivity between the flags and their environment variables. - Added environment variable support (
ENDOR_CONTAINER_COLLECT_*) for thekubeconfig-context,kubeconfig-path, andruntime-typeflags incontainer collect, with early validation of the kubeconfig context and runtime type.
The following changes were introduced in endorctl:
- Dependencies whose license category cannot be determined now report a category of
Unknowninstead of an empty value, so they filter consistently by license category.
The following changes were introduced in endorctl:
- Dependency metadata now includes declared and discovered SPDX license identifiers.
- Added Google Artifact Registry (GAR) support for container registry scanning, including authentication and
garas a--typeoption onendorctl container registry. - The
--imageand--image-tarflags now apply only to thecontainer scan,instrument, andcollectcommands. Thecontainer registrysubcommands no longer accept them. - Added a warning message when the default branch is switched during a scan.
- Fixed call graph generation for Java and Scala to use the JDK at
JAVA_HOMEbefore falling back toPATH, so the call graph uses your configured JDK. - Bazel targets are now resolved at the start of a scan, improving accuracy of the Bazel package include filter.
- Fixed C# PR segment-matching to handle workspaces with multiple package versions and non-root baseline versions.
- Fixed
container scanargument validation to check both CLI flags andENDOR_CONTAINER_SCAN_*environment variables, so env-only configuration is no longer ignored.
The following changes were introduced in endorctl:
- Bug fixes and miscellaneous improvements.
The following changes were introduced in endorctl:
- NuGet dependency scans now extract license information from a package’s LicenseUrl when it is not otherwise declared, improving license coverage for NuGet projects.
The following changes were introduced in endorctl:
- Added the
--insecureflag (env varENDOR_CONTAINER_REGISTRY_INSECURE) toendorctl container registrycommands, which skips TLS verification when connecting to self-signed container registries. - Renamed the environment variable for
--registry-namespacefromENDOR_CONTAINER_REGISTRY_REGISTRY_NAMESPACEtoENDOR_CONTAINER_REGISTRY_NAMESPACE.
The following changes were introduced in endorctl:
- Fixed pnpm workspace detection failing when pnpm emitted WARN lines for unresolvable variables in
.npmrcfiles. - Fixed secret policies not matching when a custom secret rule’s name differed from its description. The result name is now sourced from the rule name.
- Added
ocias a supported registry type for container scanning, enabling OCI-compliant registry support. - Fixed a race condition that could delete the old default branch when a new default branch was set.
- Fixed PR-incremental scans over-resolving dependencies on Gradle composite-build repositories. The Gradle resolver now honors the narrowed manifest set.
- Fixed
ENDOR_SCAN_LANGUAGES=typescriptnot running the JavaScript plugin. - Fixed PURL qualification for OS packages found through ELF binary cataloging in distroless images, which prevented false-positive vulnerability matches.
- Fixed PR-incremental scans to source baseline context from the baseline repository version instead of querying all packages.
- Deprecated the
--registryflag onendorctl container registry. It is now replaced by--host. - Fixed PR-incremental Java scans triggering full Gradle resolution when no Gradle manifest survived the PR filter.
- Fixed include-path validation to reject directory paths without
/*or/**when set through environment variables, matching the behavior of the CLI flags and preventing accidental package deletions. - Reordered path validation so include and exclude paths are validated before
.gitignorepaths are applied. - Deprecated the
--registry-typeflag onendorctl container registry. It is now replaced by--type.
The following changes were introduced in endorctl:
- Fixed a nil-pointer crash in the JavaScript call graph, which could segfault scans of some npm packages.
- Fixed the scan end time not being recorded on successful workflow scans, which caused the Scanned column to show an incorrect time.
- Fixed AI security-review findings being silently dropped when the model classified them as new features or other aspect types.
- Removed the Hugging Face organization scan flags from endorctl scan. Hugging Face organization scanning is now configured through SCM integrations in the UI.
- Dependency resolution now always runs for full scans and is skipped only for quick scans.
- Project summary calculation is now capped at 60 seconds for non-cloud scans, preventing scans from hanging.
- Fixed Yarn workspace SBOMs being non-deterministic, which had caused flapping results and dropped roughly 2,500 transitive development dependencies.
The following changes were introduced in endorctl:
- Fixed an issue where credentials and tokens could leak into logs, scan results, and serialized configuration.
- Fixed duplicate findings that could override scan results when the SBOM context lacked an identifier.
- Fixed a nil-pointer crash that could occur when checking invalid file or directory paths during a scan.
- Added an opt-in windowed incremental mode for secrets scans, enabled with
SECRETS_USE_WINDOWED_INCREMENTAL, that splits long scans into time windows with per-window checkpoint persistence. - Added support for
--diff-scopewith--secrets, so secrets scans can be limited to changed files. - Fixed incremental scans so that deleted files are included when detecting dependency impact.
- Fixed the host version check to retry on transient HTTP errors, reducing spurious failures.
The following changes were introduced in endorctl:
- The
--registry-typeflag is now optional for most container registries. Only self-hosted registries still require it. - Improved vulnerability matching for Chainguard and Wolfi apk container images through namespace canonicalization.
- Fixed uv dependency resolution for
pyproject.tomlpackage names containing underscores, following PEP 503 normalization. - Fixed call graph errors on Yarn Berry Plug’n’Play projects by forcing the node-modules linker.
- Fixed sbt dependency parsing for Maven version ranges and version evictions in
.dotoutput. - The
--reauthflag is now marked experimental. Users are directed to credential helpers instead. - Fixed Bazel Build Event Protocol nested fileset parsing.
- GitHub check-run annotations now show correct finding counts for security review after low-severity filtering.
- Fixed .NET call graph normalization for private packages that have no DLLs.
- Fixed a crash in the MCP security review tool and wired in aspect-based classification.
The following changes were introduced in endorctl:
- The
--publishflag onendorctl container instrumentnow pushes the instrumented image to the registry automatically after instrumentation.
The following changes were introduced in endorctl:
- Added a
--platformflag toendorctl container instrumentthat accepts a comma-separated list of platforms, so you can instrument container images for multiple architectures such as arm64 and amd64 in a single command while preserving the multi-arch manifest. - Improved Bazel Bzlmod scanning to better detect JavaScript dependencies.
- Faster secret scanning on Linux from an upgraded secret-detection engine with native RE2 regex support.
The following changes were introduced in endorctl:
- Private Git-based dependencies hosted in other GitHub organizations or GitLab groups now resolve for Go, SwiftPM, Python, Node.js, Rust, and Ruby.
- The AI SAST evaluator now produces more consistent security review results.
- The default
--timeoutforendorctl container registrychanged from30sto0s, so registry scans run without timing out. - C is now an officially supported language.
The following changes were introduced in endorctl:
- Host checks now gate container operations on Windows and emit a warning when prerequisites are not met.
Unable to process dependencieserrors now surface under Issues with a Partial Success scan status instead of only appearing in logs.- Merge-to-main lookback is now enabled by default, so incremental PR scans consult recent merge-to-main package versions to avoid duplicate findings across pull requests.
- Bazel scans now fail gracefully on non-executable targets instead of erroring out.
- Scan requests now complete instead of staying stuck in progress when a GitHub check-run update fails.
- C# segment scans now handle package versions that use non-native path separators.
- JavaScript and npm phantom dependencies are now correctly tagged as phantom and marked transitive instead of direct.
- TypeScript call graph generation now handles race conditions for more reliable scans.
The following changes were introduced in endorctl:
- Fixed Yarn dependency graphs that contained dangling edges when alias
- Fixed the Scala fallback path stripping version suffixes from package names, which previously caused scans to be rejected.
- Yarn version detection now prefers the lockfile format over the installed runtime binary version.
The following changes were introduced in endorctl:
- JavaScript scans start faster because the plugin now lazy-loads its TreeSitter queries.
- .NET scans now attempt a solution-level dotnet restore before falling back to per-project restore.
- The
--base-image-scanflag onendorctl container scannow defaults totrue, so base image scanning runs by default. - Filesystem secret scans now respect the
--include-pathand--exclude-pathflags. - Dependency resolution is now correct when a monorepo root and a workspace child share the same package name.
- .NET scans now suppress the .NET SDK first-run welcome banner, which previously interfered with MSBuild property extraction.
- JavaScript scans of non-workspace monorepos now check the repository root
node_moduleswhen resolving subpackage lockfiles.
The following changes were introduced in endorctl:
- Java dependency resolution now requires actual artifact detection. The legacy identification of dependencies without Java artifacts has been removed.
- Added Python support for Bazel scans through the
rules_pythonaspects plugin. - Raised the custom tag maximum length from 63 to 255 characters.
- Added Swift support for Bazel scans through the
rules_swiftaspects integration. - Python scans now auto detect unlisted
.txtfiles as pip requirements through content analysis, beyond the files passed with the requirements-file option. - Increased the default scan timeout from 10 minutes to 30 minutes.
The following changes were introduced in endorctl:
- Fixed a failure scanning Java projects that use private registries over mTLS by merging your custom CA into the default truststore, so public and private dependencies both resolve.
- Lifecycle scripts are now suppressed during dependency resolution for pnpm, Yarn Berry, and Rush installs, preventing arbitrary code execution.
- .NET scans now evaluate complex MSBuild property expressions using native MSBuild property evaluation, with a static XML fallback.
The following changes were introduced in endorctl:
- JavaScript call graph generation now fails with a clear error when
node_moduleswere not fully downloaded, instead of producing incorrect results. - C# builds now preserve the order of imported prop files in
.csprojprojects, correcting .NET dependency resolution. - .NET scans now shut down the MSBuild build server, preventing orphaned worker processes from accumulating between retries.
- Incremental PR scans now match root-level packages correctly when the baseline uses
pr/*version tags. - Incremental PR scans now handle segment-match dependencies correctly for C/C++ and C# projects.
The following changes were introduced in endorctl:
- Reduced the default Maven connect timeout to 30 seconds and read timeout to 60 seconds so scans against slow package repositories fail faster.
- Added Quay container registry support to the
endorctl container registry listandendorctl container registry scancommands. - Fixed .NET package name mismatches by assigning unresolved package names to the resolved package and call graph response.
- Fixed incorrect package names for Python projects that use a dynamic version field in
pyproject.toml. - Secret scanning of git logs now assumes files are git tracked, so findings from historical commits are included.
- Java scans now skip the OWASP dependency-check Maven plugin during the mvn install build step, avoiding a 212MB NVD database download.
The following changes were introduced in endorctl:
- PR scans now fall back to a full-history fetch when baseline refs are missing, improving baseline comparison reliability.
- Fixed Bazel
scala_librarycall graph generation to resolve the correct artifact path. - Added support for the latest
rules_pythonhermetic toolchain runfile locations in Bazel Python call graphs. - Yarn scans now respect the
yarnPathandnodeLinkersettings in.yarnrc.ymland handle Yarn registry credentials more reliably. - Fixed SPDX SBOM import failures caused by temporary path collisions.
- Fixed false positive package detection where module
setup.pyfiles were misclassified as setuptools manifests. - Policy validation now checks for typos in customer-authored policies, surfacing clearer validation errors.
The following changes were introduced in endorctl:
- Fixed a crash when normalizing Python package names with malformed coordinates.
- Fixed a Docker client connection leak that could accumulate during container scans.
- Fixed missing pedigree information in SBOM output, including patch and purl fields, with purl now used for dependency lookups.
- Added the
endorctl ignorecommand that adds findings or vulnerability IDs to the ignore file, which dismisses findings during scans. - Added the
endorctl validate ignorecommand that validates the ignore file syntax. - The Go registry resolver now handles standard library packages, including direct download and metadata.
- Fixed handling of URL-encoded slashes in function reference versions for .NET and Java call graphs.