> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # September 2026 We are excited to introduce the latest features and enhancements in Endor Labs. ### Conan package manager support for C/C++ SCA New Endor Labs now supports software composition analysis for C/C++ projects that use the Conan package manager. Endor Labs resolves the full transitive dependency graph from `conanfile.txt` and `conanfile.py` manifest files and maps Conan packages to vulnerability data from OSV, NVD, and other sources. Private registries including JFrog Artifactory and AWS CodeArtifact are also supported. For more information, see [Scan C/C++ projects with Conan](/scan/sca/c#scan-cc-projects-with-conan). ### Threat Center New Threat Center gives you a tenant-wide view of emerging threats across newly discovered malware, open-source packages, vulnerabilities, and AI models. For [malware](/discover/review-malware), track newly discovered malicious packages and see which of your monitored projects may be affected. Because malicious packages can enter projects through existing open-source dependencies, Threat Center helps you identify potential exposure and investigate before the risk reaches your project-level scans. For more information, see [Threat Center](/discover). ### Package Firewall for VS Code extensions New You can now use Package Firewall to block malicious VS Code extensions. Package Firewall checks every extension your developers install from the Microsoft Marketplace against your policy. It blocks or warns on extensions flagged for malware or below your minimum package age before they install. Deploy it to your developer machines through an MDM tool such as Microsoft Intune, Jamf, or Kandji. For more information, see [Block malicious VS Code extensions](/package-firewall/vscode-extensions). ### Incremental container scanning New You can now compare a container build against a baseline scan to surface only the findings the build introduced, fixed, or shares with the baseline. This helps you focus on what a new build changed instead of re-triaging the hundreds of findings it inherited from earlier builds. You can also suppress the findings shared with the baseline so only the new ones remain. For more information, see [Incremental container scanning](/scan/containers/incremental-container-scanning). ### Base image remediation New Most vulnerabilities in a container image typically come from its base image rather than your application code. Endor Labs now attributes findings to the base and application layers, then compares your current base image against a refreshed build, the next version, and the latest version. Each option reports how many findings it fixes and how many it introduces, so you can pick the upgrade that resolves the most findings at an acceptable risk. Scan with `endorctl container scan --base-image-check-updates`, then compare the update options in the Endor Labs user interface or with `endorctl container remediation list-base-image-updates`. For more information, see [Base image remediation](/scan/containers/base-image-remediation). ### Malware exposure classification New Endor Labs now classifies malware findings as **Definitely Affected** or **Potentially Affected**, based on how certain the match is between your dependency and a known malicious package version. Configure the **Potentially Affected Finding Severity** parameter in the Malware finding policy to raise findings for dependencies whose version constraints could resolve to malware. Endor Labs raises these findings even when the currently resolved version is clean. For more information, see [Determine malware exposure](/scan/malware#determine-malware-exposure). ### NuGet support in Package Firewall Enhancement You can now use Package Firewall to block malicious NuGet packages during installation. Set up NuGet through direct integration, JFrog Artifactory, or Sonatype Nexus Repository to route package requests through Package Firewall. For more information, see [Package Firewall](/package-firewall). ### watchOS, tvOS, and visionOS support for Bazel rules\_apple scans Enhancement Endor Labs now resolves dependencies for watchOS, tvOS, and visionOS application bundles built with `rules_apple` in Bazel workspaces, extending the existing iOS and macOS support. Scan targets such as `watchos_application`, `tvos_application`, `visionos_application`, and their related framework and test rules to get software composition analysis for the full app bundle. Watch apps embedded in an iOS app through `watch_application` are also resolved. For more information, see [Bazel](/scan/bazel). ### Advisory Ask Permission policies in Codex Enhancement Coding Agent Governance policies with the **Ask Permission** action no longer block tool calls in Codex. Codex cannot pause a tool call before it runs, so an **Ask** policy previously denied the call outright. The call now proceeds, the developer sees the **User Message**, and the model receives the same message as an instruction to confirm. Endor Labs records the match under **Policy Violations** as **Ask**. At Codex's own approval prompts, an **Ask** policy still defers to that prompt, and **Block** policies still deny. If you relied on **Ask** policies to stop calls in Codex, change those policies to **Block**. The new behavior ships in endorctl. A generated configuration installs and updates it at session start and checks for a newer version at most once a day. Update endorctl yourself where you manage it outside the generated configuration. For more information, see [Deploy hooks for Codex](/agent-governance/codex#codex-hook-events-used-by-coding-agent-governance). ### Poetry private registry authentication Enhancement Endor Labs now passes your configured PyPI package manager integration credentials to Poetry during scans. When a source declared in `[[tool.poetry.source]]` matches an integration by URL, Endor Labs authenticates `poetry lock` and `poetry install` so dependency resolution succeeds against private registries. For more information, see [Private package manager integration for PyPI](/integrations/package-managers/pypi-private-package-manager). ### Asynchronous SBOM and VEX export Enhancement Endor Labs now generates SBOM and VEX exports as background jobs, so large projects export without the request timing out. You can export SBOMs and VEX documents for a project, a finding, or a package version. Track the job's progress and download the file from the **Reports** page once it succeeds. The REST API supports the `AsyncJob` resource for submitting and polling export jobs. For more information, see [Export SBOMs and VEX](/inventory-insights/sbom/exporting-sboms). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.