Skip to main content
We are excited to introduce you to the latest version of Endor Labs and endorctl - v1.6.273. This release includes new features and enhancements.

​
New Features

​
Detect GitHub Actions (Beta)

Endor Labs provides comprehensive visibility into GitHub Action workflows used in your code repositories and helps you to:
  • Assess the authenticity and reliability of the dependencies in your CI environment. This enables you to determine potential exposure to known or headline incidents.
  • Ensures that the code in your CI workflows does not change without your knowledge. This reduces breaking changes and helps you manage your supply chain risks.
  • Detect and identify if any vulnerable or malicious software is part of your CI environment. For more information, see View GitHub Action findings.
View GitHub Action findings To detect and view GitHub Action findings, run the endorctl scan with the --ghactions flag. For more information, see endorctl scan command.

​
Enhancements

​
Dashboard widgets

Endor Labs introduces new widgets on the Dashboard to help you track the development hours and the cost metrics of your organization.
  • The newly introduced Vulnerability Prioritization Funnel systematically assesses and categorizes vulnerabilities based on their severity and category. By applying this funnel approach, organizations can prioritize addressing the most critical, exploitable, and actionable vulnerabilities first, maximizing their security efforts.
  • Visualize Dev Hours Saved and Cost Saved metrics on the dashboard to make more informed decisions, optimize resource allocation, and better manage project budgets.
Dashboard For more information, see View Dashboards.

​
Support for .NET Prop files (Beta)

Endor Labs now provides the support to scan the following .NET Prop files.
  • Package references in Directory.Build.props or Directory.Packages.props files.
  • Package references in any *.props file and the prop file is imported in the *.csproj file.
  • Package references in *.Targets file
For more information, see Scan .NET projects

​
npm for Windows operating systems

You can now use npm to install endorctl on Windows operating systems. For more information, see Install endorctl with npm

​
Finding policies for Repository Security Posture Management

The following new out-of-the-box finding policies are included in the application for repository security posture management (RSPM). For more information, see RSPM Policies.

​
endorctl commands

Note the updates to the following flags used with the endorctl scan. For more information, see endorctl scan command.

​
Dependency reachability

Note the following updates when you perform a deep scan for the following languages:
  • Python - The dependencies that are used in source code but not declared in the package’s manifest files are detected by default when you perform a deep scan on Python projects.
  • JavaScript/TypeScript - You must include the flag --call-graph-languages with value javascript,typescript to detect dependencies that are used in the source code but not declared in the JavaScript or TypeScript package’s manifest files.
The flag --phantom-dependencies and its corresponding environment variable ENDOR_SCAN_PHANTOM_DEPS is deprecated from this release.