Patched Node.js releases for scans
Breaking change In response to CVE-2026-111497, scans that use Endor Labs toolchains now install Node.js 22.23.4, 24.22.1, or 26.12.1 in place of end-of-life and unpatched Node.js releases. Node.js 22.23.4 is the new default. Endor Labs installs the newest supported release in the major version that a project requests, including versions pinned in a scan profile. Requests for Node.js 25 get Node.js 26, and requests for Node.js 20 and earlier, 21, or 23 get the default. Outpost deployments that pin the endorctl image, and CI scans that use--install-build-tools, must update endorctl to v1.7.1239 or later. Update the engines field of projects that still require an older Node.js version to Node.js 22 or later.
For more information, see Node.js version selection.
pnpm runs on the patched Node.js, and pnpm 6 is no longer supported
Breaking change Scans that use Endor Labs toolchains now install pnpm 7 to 11 as an npm package that runs on the patched Node.js that Endor Labs installs. Earlier scans ran standalone pnpm binaries that bundle an unpatched Node.js, which CVE-2026-111497 affects. pnpm 12 and later, and pnpm versions downloaded from a mirror, still install as standalone binaries. pnpm 6 can’t run on a patched Node.js, so scans that request pnpm 6 now use the default pnpm 8.10.2. Update projects that pin pnpm 6 to pnpm 7 or later. Outpost deployments that pin the endorctl image, and CI scans that use--install-build-tools, must update endorctl to get this change.
For more information, see Node.js version selection.
Detected Yarn and pnpm versions for unsupported Node.js requests
Behavior change Scans that use Endor Labs toolchains now keep the Yarn and pnpm versions detected in a project when the project requests an unsupported Node.js version. Earlier scans fell back to the default Yarn 1.22.19 and pnpm 8.10.2, which cost Yarn 2 and later projects their reachability data. Outpost deployments that pin the endorctl image, and CI scans that use--install-build-tools, must update endorctl to get this change.
For more information, see Node.js version selection.
Noise Reduction funnel now counts potentially reachable findings
Behavior change Endor Labs now counts potentially reachable findings in the Reachable and Exploitable stages of the Noise Reduction funnel on the home dashboards. For SCA Vulnerabilities, these stages count the findings with the Reachable Function or Potentially Reachable Function attribute. For Containers, they count the findings with the Reachable Dependency or Potentially Reachable Dependency attribute. Each stage also shows how much it narrows the stage before it. This percentage compares two stages of the same funnel and is not a change over time. For more information, see Home dashboards.Remediation PRs for GitLab, Azure DevOps, and Bitbucket Cloud
New Endor Labs now opens Remediation PRs in GitLab, including self-managed GitLab, Azure DevOps Services, and Bitbucket Cloud, as well as GitHub. On GitLab, Endor Labs opens merge requests. A single PR Remediation notification integration replaces GitHub PR for Remediations and opens each PR on the platform of the project. Existing SCM integrations might need additional token permissions. For more information, see Automated Pull Requests.Home dashboards
New You can now measure the outcomes of your security program from the home dashboards. Track how much triage noise Endor Labs removes, how quickly your team resolves findings against your SLA windows, and the issues caught before code merges. You can also see how Endor Labs blocks malicious packages and how your developers adopt AI coding agents. The home dashboards also list the AI agents working in your organization, with the type and impact of each agent over the last 30 days. For more information, see Home dashboards.Azure Boards integration
New You can now integrate Endor Labs with Azure Boards to automatically create, update, and resolve work items for findings that violate an action policy or have a remediation available. Endor Labs creates each work item in the Azure DevOps project mapped to the repository, and comments on it as those findings change. You can set up the integration in the Endor Labs user interface, with endorctl, or with the REST API. Azure Boards is supported on Azure DevOps Cloud only. For more information, see Set up Azure Boards integration.Saved views for findings
New You can now save the state of the Findings table as a named view and reapply it later. A saved view captures filters, search text, column visibility and order, sort, and aggregation, so you don’t rebuild a query every time you come back to it. Keep a view personal, or share it with everyone in your namespace so your team triages from the same curated results. For more information, see Saved views.VS Code disable scripts and macOS enterprise policy profile
Enhancement The MDM scripts now include a disable script for each VS Code method,endor-vscode-disable-patch and endor-vscode-disable-policy. Each script turns off its method and keeps the other method and the package manager configuration, so you can switch methods without turning Package Firewall off. Generate them in the browser or with the local generators. endor-remove.sh now also removes the VS Code configuration when no user is signed in to the device.
With the enterprise policy enabled, generate.sh also writes a macOS configuration profile for the policy that you upload to your MDM tool. endor-vscode.sh then checks for the profile on each Mac.
For more information, see Switch or turn off a VS Code method.
GZIP compression format for S3 exports
Enhancement You can now choose the compression format of the objects that the AWS S3 exporter writes to your bucket. Setcompression_format to COMPRESSION_FORMAT_GZIP to store each export under a .gz key with the application/gzip content type, so the tools in your pipeline decompress it natively without an unzip step. Existing exporters continue to write .zip objects.
For more information, see Export findings to S3.