Conan package manager support for C/C++ SCA
New Endor Labs now supports software composition analysis for C/C++ projects that use the Conan package manager. Endor Labs resolves the full transitive dependency graph fromconanfile.txt and conanfile.py manifest files and maps Conan packages to vulnerability data from OSV, NVD, and other sources. Private registries including JFrog Artifactory and AWS CodeArtifact are also supported.
For more information, see Scan C/C++ projects with Conan.
Threat Center
New Threat Center gives you a tenant-wide view of emerging threats across newly discovered malware, open-source packages, vulnerabilities, and AI models. For malware, track newly discovered malicious packages and see which of your monitored projects may be affected. Because malicious packages can enter projects through existing open-source dependencies, Threat Center helps you identify potential exposure and investigate before the risk reaches your project-level scans. For more information, see Threat Center.Package Firewall for VS Code extensions
New You can now use Package Firewall to block malicious VS Code extensions. Package Firewall checks every extension your developers install from the Microsoft Marketplace against your policy. It blocks or warns on extensions flagged for malware or below your minimum package age before they install. Deploy it to your developer machines through an MDM tool such as Microsoft Intune, Jamf, or Kandji. For more information, see Block malicious VS Code extensions.Incremental container scanning
New You can now compare a container build against a baseline scan to surface only the findings the build introduced, fixed, or shares with the baseline. This helps you focus on what a new build changed instead of re-triaging the hundreds of findings it inherited from earlier builds. You can also suppress the findings shared with the baseline so only the new ones remain. For more information, see Incremental container scanning.Base image remediation
New Most vulnerabilities in a container image typically come from its base image rather than your application code. Endor Labs now attributes findings to the base and application layers, then compares your current base image against a refreshed build, the next version, and the latest version. Each option reports how many findings it fixes and how many it introduces, so you can pick the upgrade that resolves the most findings at an acceptable risk. Scan withendorctl container scan --base-image-check-updates, then compare the update options in the Endor Labs user interface or with endorctl container remediation list-base-image-updates.
For more information, see Base image remediation.
Malware exposure classification
New Endor Labs now classifies malware findings as Definitely Affected or Potentially Affected, based on how certain the match is between your dependency and a known malicious package version. Configure the Potentially Affected Finding Severity parameter in the Malware finding policy to raise findings for dependencies whose version constraints could resolve to malware. Endor Labs raises these findings even when the currently resolved version is clean. For more information, see Determine malware exposure.NuGet support in Package Firewall
Enhancement You can now use Package Firewall to block malicious NuGet packages during installation. Set up NuGet through direct integration, JFrog Artifactory, or Sonatype Nexus Repository to route package requests through Package Firewall. For more information, see Package Firewall.watchOS, tvOS, and visionOS support for Bazel rules_apple scans
Enhancement Endor Labs now resolves dependencies for watchOS, tvOS, and visionOS application bundles built withrules_apple in Bazel workspaces, extending the existing iOS and macOS support. Scan targets such as watchos_application, tvos_application, visionos_application, and their related framework and test rules to get software composition analysis for the full app bundle. Watch apps embedded in an iOS app through watch_application are also resolved.
For more information, see Bazel.
Advisory Ask Permission policies in Codex
Enhancement Coding Agent Governance policies with the Ask Permission action no longer block tool calls in Codex. Codex cannot pause a tool call before it runs, so an Ask policy previously denied the call outright. The call now proceeds, the developer sees the User Message, and the model receives the same message as an instruction to confirm. Endor Labs records the match under Policy Violations as Ask. At Codex’s own approval prompts, an Ask policy still defers to that prompt, and Block policies still deny. If you relied on Ask policies to stop calls in Codex, change those policies to Block. The new behavior ships in endorctl. A generated configuration installs and updates it at session start and checks for a newer version at most once a day. Update endorctl yourself where you manage it outside the generated configuration. For more information, see Deploy hooks for Codex.Poetry private registry authentication
Enhancement Endor Labs now passes your configured PyPI package manager integration credentials to Poetry during scans. When a source declared in[[tool.poetry.source]] matches an integration by URL, Endor Labs authenticates poetry lock and poetry install so dependency resolution succeeds against private registries.
For more information, see Private package manager integration for PyPI.
Asynchronous SBOM and VEX export
Enhancement Endor Labs now generates SBOM and VEX exports as background jobs, so large projects export without the request timing out. You can export SBOMs and VEX documents for a project, a finding, or a package version. Track the job’s progress and download the file from the Reports page once it succeeds. The REST API supports theAsyncJob resource for submitting and polling export jobs.
For more information, see Export SBOMs and VEX.