> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# endorctl changelog

> Version-by-version changes to the endorctl CLI.

<Update label="v1.7.1053" description="July 9, 2026">
  The following changes were introduced in endorctl:

  * Fixed a crash in AI security review when a generated code reference had an invalid end line number.
  * Reduced false positives in Infrastructure as Code (IaC) findings by improving the AI evaluator prompt.
  * The PR-incremental dependency resolution filter is now enabled by default for the JVM plugin.
  * Fixed Rust scans to resolve dependencies when a `Cargo.toml` file inherits workspace fields such as `version.workspace` and `edition.workspace`.
  * Fixed the segment scanner to remove stale segment match dependencies when a re-scan finds no valid matches.
  * Fixed an error in license dependency processing caused by overly long SPDX license identifiers.
</Update>

<Update label="v1.7.1045" description="July 6, 2026">
  The following changes were introduced in endorctl:

  * Added the `--segment-match-languages` flag to `endorctl scan`.
  * Fixed .NET call graph scans that failed on Azure DevOps repositories whose names contain spaces, by sanitizing percent-encoded characters in the temporary clone directory path.
  * Fixed scanning of Azure DevOps repositories that use legacy `.visualstudio.com` URLs.
</Update>

<Update label="v1.7.1037" description="July 1, 2026">
  The following changes were introduced in endorctl:

  * Fixed Python dependency resolution failing with uv 0.11 and later, where trailing-space arguments to `uv pip show` caused "invalid value" errors.
  * Added a native secrets detector for JWK private keys, covering RSA, EC, and OKP keys in both JSON and object-literal formats.
  * Fixed phantom root packages with empty paths appearing in concurrent same-language monorepo scans by ignoring transient file-not-found errors during manifest discovery.
  * Fixed non-deterministic dependency loss in Gradle multi-root repositories.
  * Python dependency-resolution failures now surface the actual `uv sync` error output instead of a generic `exit status 1` message.
</Update>

<Update label="v1.7.1033" description="June 26, 2026">
  The following changes were introduced in endorctl:

  * Fixed a regression that prevented scanning empty git repositories.
  * Ruby scans now capture resolved dependencies from `Gemfile.lock`.
</Update>

<Update label="v1.7.1024" description="June 24, 2026">
  The following changes were introduced in endorctl:

  * Bug fixes and miscellaneous improvements.
</Update>

<Update label="v1.7.1021" description="June 23, 2026">
  The following changes were introduced in endorctl:

  * Maven package scans now surface the underlying error when a POM fails to parse.
  * Maven dependency resolution now loads the `maven-bundle-plugin` extension for OSGi POMs.
  * Ruby scans now import bundler to parse gemspec files.
</Update>

<Update label="v1.7.1013" description="June 18, 2026">
  The following changes were introduced in endorctl:

  * Fixed Azure DevOps PR scans that failed due to a false staleness check.
  * SBOM export by name now returns a clear error when the package version is not found.
  * Secret scans now perform a full rescan when an explicit rescan is requested.
</Update>

<Update label="v1.7.1007" description="June 16, 2026">
  The following changes were introduced in endorctl:

  * Fixed PR identification for GitLab and Bitbucket, resolving spurious 401 errors during PR scans.
  * Added the `--secret-rules-file` flag to `endorctl scan` for supplying custom secret detection rules.
  * Improved language detection for Rust projects.
  * Python call graph generation now batches large projects by lines of code and available memory.
  * Fixed pnpm scan failures where a package referencing workspace `catalog:` dependencies could not build its lock file when scanned in isolation.
</Update>

<Update label="v1.7.1002" description="June 10, 2026">
  The following changes were introduced in endorctl:

  * Superseded PR scans are now cancelled automatically, with a dedicated return code.
  * Deleted package versions are now tracked in scan results and scan history.
</Update>

<Update label="v1.7.1001" description="June 9, 2026">
  The following changes were introduced in endorctl:

  * Fixed PR scans on shallow or partial clones, where the merge base could be unreachable and the diff silently fell back to an incorrect comparison. endorctl now deepens the clone to reach the merge base, and reports a clear error if the two branches share no history.
</Update>

<Update label="v1.7.998" description="June 8, 2026">
  The following changes were introduced in endorctl:

  * Added the `--include-test-dependencies` flag to `endorctl sbom export`.
  * Pre-commit secret scans now flag only added lines.
  * Expanded secret validation coverage.
  * JavaScript scans now resolve call graphs for private transitive dependencies.
  * Improved Ruby dependency resolution in scans.
</Update>

<Update label="v1.7.994" description="June 4, 2026">
  The following changes were introduced in endorctl:

  * JavaScript scans can now fetch call graphs for private packages.
  * Improved error handling and return codes for local scans.
  * Added a return code for when the baseline is not found.
  * Secret scanning now applies the global allowlist during file walking for faster scans.
  * Fixed incomplete call graphs on large Go projects, where build metadata could exceed an internal scan buffer and silently drop required build settings.
</Update>

<Update label="v1.7.990" description="June 2, 2026">
  The following changes were introduced in endorctl:

  * Added the `--dry-run` flag to `endorctl container registry scan`.
  * Fixed the declared license field for compound SPDX expressions.
</Update>

<Update label="v1.7.988" description="June 1, 2026">
  The following changes were introduced in endorctl:

  * Added the `--os-reachability` flag to `endorctl container registry scan`.
  * Added Harbor as a container registry type option.
  * JavaScript scans now support a custom lock file location.
  * Fixed a JavaScript call graph failure that could cause findings to be deleted.
  * Private SCM dependency resolution across organizations is now enabled by default.
  * Added secret detection rules for Azure AD client secrets (canonical Q\~ format) and Azure Storage Account Keys, including a validator.
  * Fixed authentication gaps in `.npmrc` file handling.
  * GitHub SARIF writes now retry transient 401 errors, with clearer GitHub authentication error classification.
  * SBOM export now skips malformed packages instead of failing the entire export.
</Update>

<Update label="v1.7.980" description="May 26, 2026">
  The following changes were introduced in endorctl:

  * Fixed a Gradle issue where dependencies that failed manifest discovery were silently dropped, which inflated reported success rates. The resolver now synthesizes a path-derived package name so these scan failures are reported accurately.
  * Fixed SBOM imports where SPDX documents with multiple root packages would silently abort and return zero findings. Multi-root SPDX documents are now normalized to a single root before CycloneDX conversion, so imports succeed and vulnerability matching runs.
</Update>

<Update label="v1.7.978" description="May 22, 2026">
  The following changes were introduced in endorctl:

  * Added environment variable support for the `scanned-only` and `exclude-scanned` flags in `container registry list`, with validation that enforces mutual exclusivity between the flags and their environment variables.
  * Added environment variable support (`ENDOR_CONTAINER_COLLECT_*`) for the `kubeconfig-context`, `kubeconfig-path`, and `runtime-type` flags in `container collect`, with early validation of the kubeconfig context and runtime type.
</Update>

<Update label="v1.7.976" description="May 19, 2026">
  The following changes were introduced in endorctl:

  * Dependencies whose license category cannot be determined now report a category of `Unknown` instead of an empty value, so they filter consistently by license category.
</Update>

<Update label="v1.7.973" description="May 14, 2026">
  The following changes were introduced in endorctl:

  * Dependency metadata now includes declared and discovered SPDX license identifiers.
  * Added Google Artifact Registry (GAR) support for container registry scanning, including authentication and `gar` as a `--type` option on `endorctl container registry`.
  * The `--image` and `--image-tar` flags now apply only to the `container scan`, `instrument`, and `collect` commands. The `container registry` subcommands no longer accept them.
  * Added a warning message when the default branch is switched during a scan.
  * Fixed call graph generation for Java and Scala to use the JDK at `JAVA_HOME` before falling back to `PATH`, so the call graph uses your configured JDK.
  * Bazel targets are now resolved at the start of a scan, improving accuracy of the Bazel package include filter.
  * Fixed C# PR segment-matching to handle workspaces with multiple package versions and non-root baseline versions.
  * Fixed `container scan` argument validation to check both CLI flags and `ENDOR_CONTAINER_SCAN_*` environment variables, so env-only configuration is no longer ignored.
</Update>

<Update label="v1.7.968" description="May 11, 2026">
  The following changes were introduced in endorctl:

  * Bug fixes and miscellaneous improvements.
</Update>

<Update label="v1.7.967" description="May 8, 2026">
  The following changes were introduced in endorctl:

  * NuGet dependency scans now extract license information from a package's LicenseUrl when it is not otherwise declared, improving license coverage for NuGet projects.
</Update>

<Update label="v1.7.960" description="May 5, 2026">
  The following changes were introduced in endorctl:

  * Added the `--insecure` flag (env var `ENDOR_CONTAINER_REGISTRY_INSECURE`) to `endorctl container registry` commands, which skips TLS verification when connecting to self-signed container registries.
  * Renamed the environment variable for `--registry-namespace` from `ENDOR_CONTAINER_REGISTRY_REGISTRY_NAMESPACE` to `ENDOR_CONTAINER_REGISTRY_NAMESPACE`.
</Update>

<Update label="v1.7.957" description="May 4, 2026">
  The following changes were introduced in endorctl:

  * Fixed pnpm workspace detection failing when pnpm emitted WARN lines for unresolvable variables in `.npmrc` files.
  * Fixed secret policies not matching when a custom secret rule's name differed from its description. The result name is now sourced from the rule name.
  * Added `oci` as a supported registry type for container scanning, enabling OCI-compliant registry support.
  * Fixed a race condition that could delete the old default branch when a new default branch was set.
  * Fixed PR-incremental scans over-resolving dependencies on Gradle composite-build repositories. The Gradle resolver now honors the narrowed manifest set.
  * Fixed `ENDOR_SCAN_LANGUAGES=typescript` not running the JavaScript plugin.
  * Fixed PURL qualification for OS packages found through ELF binary cataloging in distroless images, which prevented false-positive vulnerability matches.
  * Fixed PR-incremental scans to source baseline context from the baseline repository version instead of querying all packages.
  * Deprecated the `--registry` flag on `endorctl container registry`. It is now replaced by `--host`.
  * Fixed PR-incremental Java scans triggering full Gradle resolution when no Gradle manifest survived the PR filter.
  * Fixed include-path validation to reject directory paths without `/*` or `/**` when set through environment variables, matching the behavior of the CLI flags and preventing accidental package deletions.
  * Reordered path validation so include and exclude paths are validated before `.gitignore` paths are applied.
  * Deprecated the `--registry-type` flag on `endorctl container registry`. It is now replaced by `--type`.
</Update>

<Update label="v1.7.946" description="April 27, 2026">
  The following changes were introduced in endorctl:

  * Fixed a nil-pointer crash in the JavaScript call graph, which could segfault scans of some npm packages.
  * Fixed the scan end time not being recorded on successful workflow scans, which caused the Scanned column to show an incorrect time.
  * Fixed AI security-review findings being silently dropped when the model classified them as new features or other aspect types.
  * Removed the Hugging Face organization scan flags from endorctl scan. Hugging Face organization scanning is now configured through SCM integrations in the UI.
  * Dependency resolution now always runs for full scans and is skipped only for quick scans.
  * Project summary calculation is now capped at 60 seconds for non-cloud scans, preventing scans from hanging.
  * Fixed Yarn workspace SBOMs being non-deterministic, which had caused flapping results and dropped roughly 2,500 transitive development dependencies.
</Update>

<Update label="v1.7.940" description="April 21, 2026">
  The following changes were introduced in endorctl:

  * Fixed an issue where credentials and tokens could leak into logs, scan results, and serialized configuration.
  * Fixed duplicate findings that could override scan results when the SBOM context lacked an identifier.
  * Fixed a nil-pointer crash that could occur when checking invalid file or directory paths during a scan.
  * Added an opt-in windowed incremental mode for secrets scans, enabled with `SECRETS_USE_WINDOWED_INCREMENTAL`, that splits long scans into time windows with per-window checkpoint persistence.
  * Added support for `--diff-scope` with `--secrets`, so secrets scans can be limited to changed files.
  * Fixed incremental scans so that deleted files are included when detecting dependency impact.
  * Fixed the host version check to retry on transient HTTP errors, reducing spurious failures.
</Update>

<Update label="v1.7.932" description="April 15, 2026">
  The following changes were introduced in endorctl:

  * The `--registry-type` flag is now optional for most container registries. Only self-hosted registries still require it.
  * Improved vulnerability matching for Chainguard and Wolfi apk container images through namespace canonicalization.
  * Fixed uv dependency resolution for `pyproject.toml` package names containing underscores, following PEP 503 normalization.
  * Fixed call graph errors on Yarn Berry Plug'n'Play projects by forcing the node-modules linker.
  * Fixed sbt dependency parsing for Maven version ranges and version evictions in `.dot` output.
  * The `--reauth` flag is now marked experimental. Users are directed to credential helpers instead.
  * Fixed Bazel Build Event Protocol nested fileset parsing.
  * GitHub check-run annotations now show correct finding counts for security review after low-severity filtering.
  * Fixed .NET call graph normalization for private packages that have no DLLs.
  * Fixed a crash in the MCP security review tool and wired in aspect-based classification.
</Update>

<Update label="v1.7.924" description="April 9, 2026">
  The following changes were introduced in endorctl:

  * The `--publish` flag on `endorctl container instrument` now pushes the instrumented image to the registry automatically after instrumentation.
</Update>

<Update label="v1.7.922" description="April 8, 2026">
  The following changes were introduced in endorctl:

  * Added a `--platform` flag to `endorctl container instrument` that accepts a comma-separated list of platforms, so you can instrument container images for multiple architectures such as arm64 and amd64 in a single command while preserving the multi-arch manifest.
  * Improved Bazel Bzlmod scanning to better detect JavaScript dependencies.
  * Faster secret scanning on Linux from an upgraded secret-detection engine with native RE2 regex support.
</Update>

<Update label="v1.7.918" description="April 7, 2026">
  The following changes were introduced in endorctl:

  * Private Git-based dependencies hosted in other GitHub organizations or GitLab groups now resolve for Go, SwiftPM, Python, Node.js, Rust, and Ruby.
  * The AI SAST evaluator now produces more consistent security review results.
  * The default `--timeout` for `endorctl container registry` changed from `30s` to `0s`, so registry scans run without timing out.
  * C is now an officially supported language.
</Update>

<Update label="v1.7.912" description="April 1, 2026">
  The following changes were introduced in endorctl:

  * Host checks now gate container operations on Windows and emit a warning when prerequisites are not met.
  * `Unable to process dependencies` errors now surface under Issues with a Partial Success scan status instead of only appearing in logs.
  * Merge-to-main lookback is now enabled by default, so incremental PR scans consult recent merge-to-main package versions to avoid duplicate findings across pull requests.
  * Bazel scans now fail gracefully on non-executable targets instead of erroring out.
  * Scan requests now complete instead of staying stuck in progress when a GitHub check-run update fails.
  * C# segment scans now handle package versions that use non-native path separators.
  * JavaScript and npm phantom dependencies are now correctly tagged as phantom and marked transitive instead of direct.
  * TypeScript call graph generation now handles race conditions for more reliable scans.
</Update>

<Update label="v1.7.909" description="March 31, 2026">
  The following changes were introduced in endorctl:

  * Fixed Yarn dependency graphs that contained dangling edges when alias
  * Fixed the Scala fallback path stripping version suffixes from package names, which previously caused scans to be rejected.
  * Yarn version detection now prefers the lockfile format over the installed runtime binary version.
</Update>

<Update label="v1.7.906" description="March 27, 2026">
  The following changes were introduced in endorctl:

  * JavaScript scans start faster because the plugin now lazy-loads its TreeSitter queries.
  * .NET scans now attempt a solution-level dotnet restore before falling back to per-project restore.
  * The `--base-image-scan` flag on `endorctl container scan` now defaults to `true`, so base image scanning runs by default.
  * Filesystem secret scans now respect the `--include-path` and `--exclude-path` flags.
  * Dependency resolution is now correct when a monorepo root and a workspace child share the same package name.
  * .NET scans now suppress the .NET SDK first-run welcome banner, which previously interfered with MSBuild property extraction.
  * JavaScript scans of non-workspace monorepos now check the repository root `node_modules` when resolving subpackage lockfiles.
</Update>

<Update label="v1.7.901" description="March 25, 2026">
  The following changes were introduced in endorctl:

  * Java dependency resolution now requires actual artifact detection. The legacy identification of dependencies without Java artifacts has been removed.
  * Added Python support for Bazel scans through the `rules_python` aspects plugin.
  * Raised the custom tag maximum length from 63 to 255 characters.
  * Added Swift support for Bazel scans through the `rules_swift` aspects integration.
  * Python scans now auto detect unlisted `.txt` files as pip requirements through content analysis, beyond the files passed with the requirements-file option.
  * Increased the default scan timeout from 10 minutes to 30 minutes.
</Update>

<Update label="v1.7.893" description="March 20, 2026">
  The following changes were introduced in endorctl:

  * Fixed a failure scanning Java projects that use private registries over mTLS by merging your custom CA into the default truststore, so public and private dependencies both resolve.
  * Lifecycle scripts are now suppressed during dependency resolution for pnpm, Yarn Berry, and Rush installs, preventing arbitrary code execution.
  * .NET scans now evaluate complex MSBuild property expressions using native MSBuild property evaluation, with a static XML fallback.
</Update>

<Update label="v1.7.887" description="March 18, 2026">
  The following changes were introduced in endorctl:

  * JavaScript call graph generation now fails with a clear error when `node_modules` were not fully downloaded, instead of producing incorrect results.
  * C# builds now preserve the order of imported prop files in `.csproj` projects, correcting .NET dependency resolution.
  * .NET scans now shut down the MSBuild build server, preventing orphaned worker processes from accumulating between retries.
  * Incremental PR scans now match root-level packages correctly when the baseline uses `pr/*` version tags.
  * Incremental PR scans now handle segment-match dependencies correctly for C/C++ and C# projects.
</Update>

<Update label="v1.7.882" description="March 16, 2026">
  The following changes were introduced in endorctl:

  * Reduced the default Maven connect timeout to 30 seconds and read timeout to 60 seconds so scans against slow package repositories fail faster.
  * Added Quay container registry support to the `endorctl container registry list` and `endorctl container registry scan` commands.
  * Fixed .NET package name mismatches by assigning unresolved package names to the resolved package and call graph response.
  * Fixed incorrect package names for Python projects that use a dynamic version field in `pyproject.toml`.
  * Secret scanning of git logs now assumes files are git tracked, so findings from historical commits are included.
  * Java scans now skip the OWASP dependency-check Maven plugin during the mvn install build step, avoiding a 212MB NVD database download.
</Update>

<Update label="v1.7.870" description="March 10, 2026">
  The following changes were introduced in endorctl:

  * PR scans now fall back to a full-history fetch when baseline refs are missing, improving baseline comparison reliability.
  * Fixed Bazel `scala_library` call graph generation to resolve the correct artifact path.
  * Added support for the latest `rules_python` hermetic toolchain runfile locations in Bazel Python call graphs.
  * Yarn scans now respect the `yarnPath` and `nodeLinker` settings in `.yarnrc.yml` and handle Yarn registry credentials more reliably.
  * Fixed SPDX SBOM import failures caused by temporary path collisions.
  * Fixed false positive package detection where module `setup.py` files were misclassified as setuptools manifests.
  * Policy validation now checks for typos in customer-authored policies, surfacing clearer validation errors.
</Update>

<Update label="v1.7.867" description="March 5, 2026">
  The following changes were introduced in endorctl:

  * Fixed a crash when normalizing Python package names with malformed coordinates.
  * Fixed a Docker client connection leak that could accumulate during container scans.
  * Fixed missing pedigree information in SBOM output, including patch and purl fields, with purl now used for dependency lookups.
  * Added the `endorctl ignore` command that adds findings or vulnerability IDs to the ignore file, which dismisses findings during scans.
  * Added the `endorctl validate ignore` command that validates the ignore file syntax.
  * The Go registry resolver now handles standard library packages, including direct download and metadata.
  * Fixed handling of URL-encoded slashes in function reference versions for .NET and Java call graphs.
</Update>