EU data residency
New Endor Labs now offers a dedicated EU-hosted environment for customers who require EU data residency. When you onboard as an EU tenant, all your data is stored and processed on Azure infrastructure in the EU region. EU tenants use distinct endpoints:https://app.eu.endorlabs.com for the Endor Labs application and https://api.eu.endorlabs.com for API and CLI access. API keys are region-bound and must be created from within your EU tenant.
Hugging Face organization model inventory
New Endor Labs can now scan all models in a Hugging Face organization, and score them for security, activity, popularity, and quality. Connect your organization using a Hugging Face access token to scan public and private models and score them. For more information, see Hugging Face organization models.Finding Refresh scan type in scan history
New Endor Labs now surfaces finding-refresh scans in scan history. A finding-refresh scan is a system-triggered, lean scan that recomputes vulnerability findings using stored dependency metadata after new security intelligence is ingested, so findings are updated without waiting for the next scheduled scan cycle. You can identify these scans by their Finding Refresh label in the Type column and filter for them using the Scan Type dropdown. For more information, see Scan history.Google Artifact Registry support for Package Firewall
New You can now route package installations for npm, PyPI, and Maven through the Package Firewall using Google Artifact Registry. Configure a remote repository with the Package Firewall as its custom upstream, and every request is checked against the Endor Labs malware database and your policies to block, warn, or allow the package installation. For more information, see Configure the Package Firewall with Google Artifact Registry.User attribution for Package Firewall
New Each package installation request routed through the Package Firewall can now be attributed to the developer and machine that initiated it. User attribution tags every request with the requester’s identity in the format<user>@<machine>. Configure user attribution through the MDM deployment scripts and view the attributed identity in the Package Firewall logs.
For more information, see User attribution.
Slack notifications for Package Firewall
New You can now receive a Slack message when the Package Firewall blocks or warns on a package installation, so you know about risky installations in real time. Set up the policy to configure notifications when a package installation matches specific reasons such as malware, minimum package age, restricted licenses, or vulnerabilities. For more information, see Set up notifications.Azure DevOps App PR scans
Beta New The Endor Labs Azure DevOps App now supports automated pull request scanning for security vulnerabilities, policy violations, and exposed secrets. You can also configure PR comments directly on your pull requests when issues are detected, helping developers address security concerns before merging code. For more information, see Azure DevOps App PR scans.Discontinuation of the Visual Studio Code extension
Deprecation notice The Endor Labs extension for Visual Studio Code has been deprecated and is no longer supported.Child ticket issue type for Jira tickets
Enhancement You can now choose the issue type for the child tickets that Endor Labs creates under a parent ticket when you set up a Jira integration with Endor Labs. This lets you align tickets with your team’s existing Jira hierarchy instead of grouping everything under sub-tasks. Set the child ticket issue type according to the Jira issue type hierarchy. Endor Labs supports configuring the child ticket issue type for Jira Cloud only. For more information, see Set up Jira integration.Dismiss multiple notifications
Enhancement You can now select multiple notifications and dismiss them together. Dismissed notifications appear in the new Dismissed category, where you can review them and undismiss them individually or in bulk. For more information, see Notifications.Segment-based analysis using scan profiles
Enhancement You can now configure segment-based analysis directly in a scan profile. Select the languages you want under Segment Match Languages to scan them using segmentation and embeddings instead of resolving dependencies from a manifest. For more information, see Configure scan profile through Endor Labs user interface, Configure scan profile through Endor Labs API, and Configure scan profile through scanprofile.yaml.Change in C/C++ scan behavior
Enhancement You can now scan C/C++ projects using the--segment-match-languages=c flag instead of languages=c flag to identify dependencies.
For more information, see Scan C/C++ projects with segment-based analysis.