Skip to main content
​
August 4, 2026
The following changes were introduced in endorctl:
  • Fixed --segment-match-languages=c so that host toolchain validation is scoped to C when --languages is not set, allowing C-only scans to run without failing on missing toolchains for unrelated languages.
  • Scala scans now log sbt command output, so a failing sbt command surfaces its build diagnostics in the scan logs.
  • The PR-incremental dependency resolution filter is now enabled by default for the .NET plugin.
  • Fixed a loss of matched file paths when a new package version won a tie-break during dependency resolution, so packages retain all matched files and C function reachability results are accurate.
​
July 30, 2026
The following changes were introduced in endorctl:
  • Bug fixes and miscellaneous improvements.
​
July 29, 2026
The following changes were introduced in endorctl:
  • Added the --by-severity flag to endorctl container remediation list-base-image-updates so base image update options can be broken down by the severity of the findings they resolve.
  • Go pull request scans now resolve only the dependencies affected by the changes in the pull request, because the incremental dependency resolution filter is enabled by default for the Go plugin.
  • Fixed an issue where the Go plugin reused a cached package workspace across calls, which could leave linter and license results incomplete. The plugin now materializes a fresh workspace for each call.
  • Scheduled scans now skip re-evaluating packages whose dependency edges and code context are unchanged. This reduces scan time for recurring scans.
  • Fixed dependency resolution for Python uv projects that compute their version dynamically, for example from a Git tag. The root package is now matched by name.
​
July 27, 2026
The following changes were introduced in endorctl:
  • Fixed an issue where the dependency graph and the flat dependency list could fall out of sync when segment-matched dependencies were merged, which caused reachability information to be missing for carried-over dependencies.
  • Fixed an issue where PR scans updated the project scan_time, which delayed scheduled rescans of the default branch. PR scans no longer affect default-branch scan scheduling.
  • Creating or updating a custom or system secret rule now triggers a scheduled full-history rescan, so findings for the new rule appear even on repositories with no recent commits.
  • Fixed inconsistent dependency naming in Bazel scans that use a workspace subdirectory with --bazel-workspace-path, so first-party call graphs are stitched together and reachability is classified correctly.
  • Fixed an issue where findings were re-evaluated for projects that have dependency scanning or GitHub Actions scanning disabled, which produced spurious findings.
  • Fixed an issue where scans of repositories with multiple GitHub Actions packages failed with dependency-resolution errors instead of resolving every sub-package.
  • Fixed an issue where pnpm-lock.yaml was omitted from the resolved dependency_files metadata because lock-file detection matched only the .lock suffix.
  • Python PR scans now apply incremental dependency-resolution filtering by default, which reduces PR scan time. Set ENDOR_SCAN_INCREMENTAL_DEP_RES=false to opt out.
​
July 22, 2026
The following changes were introduced in endorctl:
  • Added Kotlin support to Bazel scans, so kt_jvm_library, kt_jvm_binary, and kt_jvm_test targets are covered by both software composition analysis and call graph reachability.
  • Fixed Bazel scans that generated malformed queries for projects using Bzlmod repositories.
​
July 20, 2026
The following changes were introduced in endorctl:
  • Fixed the user interface links printed by local scans so they point to the correct regional cluster. For example, app.eu.endorlabs.com for the EU cluster instead of app.endorlabs.com.
  • Fixed endorctl host-check to detect the Maven wrapper in the project root without requiring the --path flag, so it no longer falls back to the system mvn when a wrapper is present.
​
July 17, 2026
The following changes were introduced in endorctl:
  • The PR-incremental dependency resolution filter is now enabled by default for the JavaScript plugin. It also honors an explicitly pinned lock file outside the package tree with the environment variable, ENDOR_JS_LOCK_FILE_PATH.
  • Scan logs now show the actual reason a pnpm install failed instead of a generic error.
  • dotnet restore and dotnet build can now resolve Windows-targeted frameworks on non-Windows scan hosts when you set the environment variable, ENDOR_SCAN_ENABLE_WINDOWS_TARGETING.
  • Fixed an issue where credentials injected into .npmrc for dependency resolution could persist in the working tree after a scan.
  • Bazel scans now classify each dependency by its own ecosystem instead of inheriting the target’s language, so dependencies such as Cargo and PyPI packages under one target are classified correctly.
​
July 13, 2026
The following changes were introduced in endorctl:
  • Capped SARIF rule tags to a fixed allowlist of 10 tags in deterministic priority order when exporting to GitHub Advanced Security, preventing silent tag truncation and keeping rule tags consistent across exports.
  • endorctl now compares the CODEOWNERS file hash before updating its record during a scan, so an unchanged CODEOWNERS file no longer triggers unnecessary re-processing and private dependency call graph regeneration.
​
July 9, 2026
The following changes were introduced in endorctl:
  • Fixed a crash in AI security review when a generated code reference had an invalid end line number.
  • Reduced false positives in Infrastructure as Code (IaC) findings by improving the AI evaluator prompt.
  • The PR-incremental dependency resolution filter is now enabled by default for the JVM plugin.
  • Fixed Rust scans to resolve dependencies when a Cargo.toml file inherits workspace fields such as version.workspace and edition.workspace.
  • Fixed the segment scanner to remove stale segment match dependencies when a re-scan finds no valid matches.
  • Fixed an error in license dependency processing caused by overly long SPDX license identifiers.
​
July 6, 2026
The following changes were introduced in endorctl:
  • Added the --segment-match-languages flag to endorctl scan.
  • Fixed .NET call graph scans that failed on Azure DevOps repositories whose names contain spaces, by sanitizing percent-encoded characters in the temporary clone directory path.
  • Fixed scanning of Azure DevOps repositories that use legacy .visualstudio.com URLs.
​
July 1, 2026
The following changes were introduced in endorctl:
  • Fixed Python dependency resolution failing with uv 0.11 and later, where trailing-space arguments to uv pip show caused “invalid value” errors.
  • Added a native secrets detector for JWK private keys, covering RSA, EC, and OKP keys in both JSON and object-literal formats.
  • Fixed phantom root packages with empty paths appearing in concurrent same-language monorepo scans by ignoring transient file-not-found errors during manifest discovery.
  • Fixed non-deterministic dependency loss in Gradle multi-root repositories.
  • Python dependency-resolution failures now surface the actual uv sync error output instead of a generic exit status 1 message.
​
June 26, 2026
The following changes were introduced in endorctl:
  • Fixed a regression that prevented scanning empty git repositories.
  • Ruby scans now capture resolved dependencies from Gemfile.lock.
​
June 24, 2026
The following changes were introduced in endorctl:
  • Bug fixes and miscellaneous improvements.
​
June 23, 2026
The following changes were introduced in endorctl:
  • Maven package scans now surface the underlying error when a POM fails to parse.
  • Maven dependency resolution now loads the maven-bundle-plugin extension for OSGi POMs.
  • Ruby scans now import bundler to parse gemspec files.
​
June 18, 2026
The following changes were introduced in endorctl:
  • Fixed Azure DevOps PR scans that failed due to a false staleness check.
  • SBOM export by name now returns a clear error when the package version is not found.
  • Secret scans now perform a full rescan when an explicit rescan is requested.
​
June 16, 2026
The following changes were introduced in endorctl:
  • Fixed PR identification for GitLab and Bitbucket, resolving spurious 401 errors during PR scans.
  • Added the --secret-rules-file flag to endorctl scan for supplying custom secret detection rules.
  • Improved language detection for Rust projects.
  • Python call graph generation now batches large projects by lines of code and available memory.
  • Fixed pnpm scan failures where a package referencing workspace catalog: dependencies could not build its lock file when scanned in isolation.
​
June 10, 2026
The following changes were introduced in endorctl:
  • Superseded PR scans are now cancelled automatically, with a dedicated return code.
  • Deleted package versions are now tracked in scan results and scan history.
​
June 9, 2026
The following changes were introduced in endorctl:
  • Fixed PR scans on shallow or partial clones, where the merge base could be unreachable and the diff silently fell back to an incorrect comparison. endorctl now deepens the clone to reach the merge base, and reports a clear error if the two branches share no history.
​
June 8, 2026
The following changes were introduced in endorctl:
  • Added the --include-test-dependencies flag to endorctl sbom export.
  • Pre-commit secret scans now flag only added lines.
  • Expanded secret validation coverage.
  • JavaScript scans now resolve call graphs for private transitive dependencies.
  • Improved Ruby dependency resolution in scans.
​
June 4, 2026
The following changes were introduced in endorctl:
  • JavaScript scans can now fetch call graphs for private packages.
  • Improved error handling and return codes for local scans.
  • Added a return code for when the baseline is not found.
  • Secret scanning now applies the global allowlist during file walking for faster scans.
  • Fixed incomplete call graphs on large Go projects, where build metadata could exceed an internal scan buffer and silently drop required build settings.
​
June 2, 2026
The following changes were introduced in endorctl:
  • Added the --dry-run flag to endorctl container registry scan.
  • Fixed the declared license field for compound SPDX expressions.
​
June 1, 2026
The following changes were introduced in endorctl:
  • Added the --os-reachability flag to endorctl container registry scan.
  • Added Harbor as a container registry type option.
  • JavaScript scans now support a custom lock file location.
  • Fixed a JavaScript call graph failure that could cause findings to be deleted.
  • Private SCM dependency resolution across organizations is now enabled by default.
  • Added secret detection rules for Azure AD client secrets (canonical Q~ format) and Azure Storage Account Keys, including a validator.
  • Fixed authentication gaps in .npmrc file handling.
  • GitHub SARIF writes now retry transient 401 errors, with clearer GitHub authentication error classification.
  • SBOM export now skips malformed packages instead of failing the entire export.
​
May 26, 2026
The following changes were introduced in endorctl:
  • Fixed a Gradle issue where dependencies that failed manifest discovery were silently dropped, which inflated reported success rates. The resolver now synthesizes a path-derived package name so these scan failures are reported accurately.
  • Fixed SBOM imports where SPDX documents with multiple root packages would silently abort and return zero findings. Multi-root SPDX documents are now normalized to a single root before CycloneDX conversion, so imports succeed and vulnerability matching runs.
​
May 22, 2026
The following changes were introduced in endorctl:
  • Added environment variable support for the scanned-only and exclude-scanned flags in container registry list, with validation that enforces mutual exclusivity between the flags and their environment variables.
  • Added environment variable support (ENDOR_CONTAINER_COLLECT_*) for the kubeconfig-context, kubeconfig-path, and runtime-type flags in container collect, with early validation of the kubeconfig context and runtime type.
​
May 19, 2026
The following changes were introduced in endorctl:
  • Dependencies whose license category cannot be determined now report a category of Unknown instead of an empty value, so they filter consistently by license category.
​
May 14, 2026
The following changes were introduced in endorctl:
  • Dependency metadata now includes declared and discovered SPDX license identifiers.
  • Added Google Artifact Registry (GAR) support for container registry scanning, including authentication and gar as a --type option on endorctl container registry.
  • The --image and --image-tar flags now apply only to the container scan, instrument, and collect commands. The container registry subcommands no longer accept them.
  • Added a warning message when the default branch is switched during a scan.
  • Fixed call graph generation for Java and Scala to use the JDK at JAVA_HOME before falling back to PATH, so the call graph uses your configured JDK.
  • Bazel targets are now resolved at the start of a scan, improving accuracy of the Bazel package include filter.
  • Fixed C# PR segment-matching to handle workspaces with multiple package versions and non-root baseline versions.
  • Fixed container scan argument validation to check both CLI flags and ENDOR_CONTAINER_SCAN_* environment variables, so env-only configuration is no longer ignored.
​
May 11, 2026
The following changes were introduced in endorctl:
  • Bug fixes and miscellaneous improvements.
​
May 8, 2026
The following changes were introduced in endorctl:
  • NuGet dependency scans now extract license information from a package’s LicenseUrl when it is not otherwise declared, improving license coverage for NuGet projects.
​
May 5, 2026
The following changes were introduced in endorctl:
  • Added the --insecure flag (env var ENDOR_CONTAINER_REGISTRY_INSECURE) to endorctl container registry commands, which skips TLS verification when connecting to self-signed container registries.
  • Renamed the environment variable for --registry-namespace from ENDOR_CONTAINER_REGISTRY_REGISTRY_NAMESPACE to ENDOR_CONTAINER_REGISTRY_NAMESPACE.
​
May 4, 2026
The following changes were introduced in endorctl:
  • Fixed pnpm workspace detection failing when pnpm emitted WARN lines for unresolvable variables in .npmrc files.
  • Fixed secret policies not matching when a custom secret rule’s name differed from its description. The result name is now sourced from the rule name.
  • Added oci as a supported registry type for container scanning, enabling OCI-compliant registry support.
  • Fixed a race condition that could delete the old default branch when a new default branch was set.
  • Fixed PR-incremental scans over-resolving dependencies on Gradle composite-build repositories. The Gradle resolver now honors the narrowed manifest set.
  • Fixed ENDOR_SCAN_LANGUAGES=typescript not running the JavaScript plugin.
  • Fixed PURL qualification for OS packages found through ELF binary cataloging in distroless images, which prevented false-positive vulnerability matches.
  • Fixed PR-incremental scans to source baseline context from the baseline repository version instead of querying all packages.
  • Deprecated the --registry flag on endorctl container registry. It is now replaced by --host.
  • Fixed PR-incremental Java scans triggering full Gradle resolution when no Gradle manifest survived the PR filter.
  • Fixed include-path validation to reject directory paths without /* or /** when set through environment variables, matching the behavior of the CLI flags and preventing accidental package deletions.
  • Reordered path validation so include and exclude paths are validated before .gitignore paths are applied.
  • Deprecated the --registry-type flag on endorctl container registry. It is now replaced by --type.
​
April 27, 2026
The following changes were introduced in endorctl:
  • Fixed a nil-pointer crash in the JavaScript call graph, which could segfault scans of some npm packages.
  • Fixed the scan end time not being recorded on successful workflow scans, which caused the Scanned column to show an incorrect time.
  • Fixed AI security-review findings being silently dropped when the model classified them as new features or other aspect types.
  • Removed the Hugging Face organization scan flags from endorctl scan. Hugging Face organization scanning is now configured through SCM integrations in the UI.
  • Dependency resolution now always runs for full scans and is skipped only for quick scans.
  • Project summary calculation is now capped at 60 seconds for non-cloud scans, preventing scans from hanging.
  • Fixed Yarn workspace SBOMs being non-deterministic, which had caused flapping results and dropped roughly 2,500 transitive development dependencies.
​
April 21, 2026
The following changes were introduced in endorctl:
  • Fixed an issue where credentials and tokens could leak into logs, scan results, and serialized configuration.
  • Fixed duplicate findings that could override scan results when the SBOM context lacked an identifier.
  • Fixed a nil-pointer crash that could occur when checking invalid file or directory paths during a scan.
  • Added an opt-in windowed incremental mode for secrets scans, enabled with SECRETS_USE_WINDOWED_INCREMENTAL, that splits long scans into time windows with per-window checkpoint persistence.
  • Added support for --diff-scope with --secrets, so secrets scans can be limited to changed files.
  • Fixed incremental scans so that deleted files are included when detecting dependency impact.
  • Fixed the host version check to retry on transient HTTP errors, reducing spurious failures.
​
April 15, 2026
The following changes were introduced in endorctl:
  • The --registry-type flag is now optional for most container registries. Only self-hosted registries still require it.
  • Improved vulnerability matching for Chainguard and Wolfi apk container images through namespace canonicalization.
  • Fixed uv dependency resolution for pyproject.toml package names containing underscores, following PEP 503 normalization.
  • Fixed call graph errors on Yarn Berry Plug’n’Play projects by forcing the node-modules linker.
  • Fixed sbt dependency parsing for Maven version ranges and version evictions in .dot output.
  • The --reauth flag is now marked experimental. Users are directed to credential helpers instead.
  • Fixed Bazel Build Event Protocol nested fileset parsing.
  • GitHub check-run annotations now show correct finding counts for security review after low-severity filtering.
  • Fixed .NET call graph normalization for private packages that have no DLLs.
  • Fixed a crash in the MCP security review tool and wired in aspect-based classification.
​
April 9, 2026
The following changes were introduced in endorctl:
  • The --publish flag on endorctl container instrument now pushes the instrumented image to the registry automatically after instrumentation.
​
April 8, 2026
The following changes were introduced in endorctl:
  • Added a --platform flag to endorctl container instrument that accepts a comma-separated list of platforms, so you can instrument container images for multiple architectures such as arm64 and amd64 in a single command while preserving the multi-arch manifest.
  • Improved Bazel Bzlmod scanning to better detect JavaScript dependencies.
  • Faster secret scanning on Linux from an upgraded secret-detection engine with native RE2 regex support.
​
April 7, 2026
The following changes were introduced in endorctl:
  • Private Git-based dependencies hosted in other GitHub organizations or GitLab groups now resolve for Go, SwiftPM, Python, Node.js, Rust, and Ruby.
  • The AI SAST evaluator now produces more consistent security review results.
  • The default --timeout for endorctl container registry changed from 30s to 0s, so registry scans run without timing out.
  • C is now an officially supported language.
​
April 1, 2026
The following changes were introduced in endorctl:
  • Host checks now gate container operations on Windows and emit a warning when prerequisites are not met.
  • Unable to process dependencies errors now surface under Issues with a Partial Success scan status instead of only appearing in logs.
  • Merge-to-main lookback is now enabled by default, so incremental PR scans consult recent merge-to-main package versions to avoid duplicate findings across pull requests.
  • Bazel scans now fail gracefully on non-executable targets instead of erroring out.
  • Scan requests now complete instead of staying stuck in progress when a GitHub check-run update fails.
  • C# segment scans now handle package versions that use non-native path separators.
  • JavaScript and npm phantom dependencies are now correctly tagged as phantom and marked transitive instead of direct.
  • TypeScript call graph generation now handles race conditions for more reliable scans.
​
March 31, 2026
The following changes were introduced in endorctl:
  • Fixed Yarn dependency graphs that contained dangling edges when alias
  • Fixed the Scala fallback path stripping version suffixes from package names, which previously caused scans to be rejected.
  • Yarn version detection now prefers the lockfile format over the installed runtime binary version.
​
March 27, 2026
The following changes were introduced in endorctl:
  • JavaScript scans start faster because the plugin now lazy-loads its TreeSitter queries.
  • .NET scans now attempt a solution-level dotnet restore before falling back to per-project restore.
  • The --base-image-scan flag on endorctl container scan now defaults to true, so base image scanning runs by default.
  • Filesystem secret scans now respect the --include-path and --exclude-path flags.
  • Dependency resolution is now correct when a monorepo root and a workspace child share the same package name.
  • .NET scans now suppress the .NET SDK first-run welcome banner, which previously interfered with MSBuild property extraction.
  • JavaScript scans of non-workspace monorepos now check the repository root node_modules when resolving subpackage lockfiles.
​
March 25, 2026
The following changes were introduced in endorctl:
  • Java dependency resolution now requires actual artifact detection. The legacy identification of dependencies without Java artifacts has been removed.
  • Added Python support for Bazel scans through the rules_python aspects plugin.
  • Raised the custom tag maximum length from 63 to 255 characters.
  • Added Swift support for Bazel scans through the rules_swift aspects integration.
  • Python scans now auto detect unlisted .txt files as pip requirements through content analysis, beyond the files passed with the requirements-file option.
  • Increased the default scan timeout from 10 minutes to 30 minutes.
​
March 20, 2026
The following changes were introduced in endorctl:
  • Fixed a failure scanning Java projects that use private registries over mTLS by merging your custom CA into the default truststore, so public and private dependencies both resolve.
  • Lifecycle scripts are now suppressed during dependency resolution for pnpm, Yarn Berry, and Rush installs, preventing arbitrary code execution.
  • .NET scans now evaluate complex MSBuild property expressions using native MSBuild property evaluation, with a static XML fallback.
​
March 18, 2026
The following changes were introduced in endorctl:
  • JavaScript call graph generation now fails with a clear error when node_modules were not fully downloaded, instead of producing incorrect results.
  • C# builds now preserve the order of imported prop files in .csproj projects, correcting .NET dependency resolution.
  • .NET scans now shut down the MSBuild build server, preventing orphaned worker processes from accumulating between retries.
  • Incremental PR scans now match root-level packages correctly when the baseline uses pr/* version tags.
  • Incremental PR scans now handle segment-match dependencies correctly for C/C++ and C# projects.
​
March 16, 2026
The following changes were introduced in endorctl:
  • Reduced the default Maven connect timeout to 30 seconds and read timeout to 60 seconds so scans against slow package repositories fail faster.
  • Added Quay container registry support to the endorctl container registry list and endorctl container registry scan commands.
  • Fixed .NET package name mismatches by assigning unresolved package names to the resolved package and call graph response.
  • Fixed incorrect package names for Python projects that use a dynamic version field in pyproject.toml.
  • Secret scanning of git logs now assumes files are git tracked, so findings from historical commits are included.
  • Java scans now skip the OWASP dependency-check Maven plugin during the mvn install build step, avoiding a 212MB NVD database download.
​
March 10, 2026
The following changes were introduced in endorctl:
  • PR scans now fall back to a full-history fetch when baseline refs are missing, improving baseline comparison reliability.
  • Fixed Bazel scala_library call graph generation to resolve the correct artifact path.
  • Added support for the latest rules_python hermetic toolchain runfile locations in Bazel Python call graphs.
  • Yarn scans now respect the yarnPath and nodeLinker settings in .yarnrc.yml and handle Yarn registry credentials more reliably.
  • Fixed SPDX SBOM import failures caused by temporary path collisions.
  • Fixed false positive package detection where module setup.py files were misclassified as setuptools manifests.
  • Policy validation now checks for typos in customer-authored policies, surfacing clearer validation errors.
​
March 5, 2026
The following changes were introduced in endorctl:
  • Fixed a crash when normalizing Python package names with malformed coordinates.
  • Fixed a Docker client connection leak that could accumulate during container scans.
  • Fixed missing pedigree information in SBOM output, including patch and purl fields, with purl now used for dependency lookups.
  • Added the endorctl ignore command that adds findings or vulnerability IDs to the ignore file, which dismisses findings during scans.
  • Added the endorctl validate ignore command that validates the ignore file syntax.
  • The Go registry resolver now handles standard library packages, including direct download and metadata.
  • Fixed handling of URL-encoded slashes in function reference versions for .NET and Java call graphs.