Sonatype Nexus Repository support for Package Firewall
New You can now route package installations for npm, PyPI, Go, and Maven through the Package Firewall using Sonatype Nexus Repository. Configure a proxy repository with the Package Firewall URL as its remote storage. Every request is then checked against the Endor Labs malware database and your Package Firewall policy before the package reaches your environment. For more information, see Configure the Package Firewall with Sonatype Nexus Repository.Allow safe versions in Package Firewall
New You can now configure Package Firewall to install a safe version automatically instead of blocking the request, when a package is flagged for malware or doesn’t meet the minimum package age. Select Allow safe versions only (curate) for these conditions so the package manager resolves and installs a safe version instead of failing — developers get a working install without seeing a block. This action is available for the npm and PyPI ecosystems. For more information, see Allow safe versions.Call graph support for Ruby
New Endor Labs now generates call graphs and performs reachability analysis for Ruby projects. To enable call graph generation, set theENDOR_SCAN_RUBY_CALL_GRAPH environment variable to true, and then view call paths to trace how a vulnerable method in a dependency gets invoked from your code.
For more information, see Ruby call graphs.
Native dependency scope on findings
Enhancement Endor Labs now writes the un-normalized dependency scope on findings and dependency metadata after a scan. The value is the scope the package manager reports, such as Mavenprovided or npm devDependencies. You can filter on it through the API and write exception policies against it. Normal, Test, and Build stay as they are. Gradle source scans and JVM binary scans always report compile. Rescan a project to fill the field on findings from earlier scans.
For more information, see Working with finding filters.
Block Azure DevOps merges on PR scan findings
Enhancement You can now block pull requests from merging in Azure DevOps when a PR scan detects findings that match an action policy. Configure an action policy that breaks the build to choose which findings gate a merge, and an Azure DevOps branch policy that requires the Endor Labs status check. This ensures that the findings your action policy targets are resolved before code reaches your default branch. For more information, see Block pull requests on findings.PR scans on monitored non-default branches
New You can now enable PR scans on any monitored branch. Once the branch has a baseline scan, allow it as a PR scan target branch in the project’s settings, and its pull requests get the same PR scan coverage as your default branch. For more information, see Enable PR scans on monitored non-default branches.OpenCode support for the MCP server
Enhancement The Endor Labs MCP server now supports OpenCode, so you can scan dependencies, detect vulnerabilities, find leaked secrets, and review code for security issues directly inside OpenCode. For more information, see Endor Labs MCP server in OpenCode.Bazel support for rules_apple
New Endor Labs now resolves dependencies for iOS and macOS application bundles built withrules_apple in Bazel workspaces. Scan targets such as ios_application, ios_framework, macos_application, and their related bundle and test rules to get software composition analysis for the full app bundle, including Swift, Objective-C, and prebuilt framework or XCFramework dependencies. This support requires rules_apple 4.0.0 or later with Bazel aspects, and scans must run on a macOS host.
For more information, see Bazel.