SCA Reachability vs. Prioritize

Prioritize (Legacy)

• Supported languages: Java, JavaScript, Python

• Unified Agent only (no support in the Mend CLI nor in the repo integrations)

• Only available in Core SCA

• Provides 4 different shield types: Red, Yellow, Green, Grey

• Does not support Java reflection

• Does not support Java 21

• Supports a deeper “method-level” analysis as well as a “class-level” analysis

• More information on Prioritize: Mend Prioritize

SCA Reachability (New)

• Supported languages: Java, JavaScript/TypeScript, Python (beta)

• Available in the repository (GitHub only)

• Available in the Mend CLI with minimal configuration - majority of configuration is done automatically

• Actionable results - reachable or unreachable, no “in-between”

• No more confusing shields - only reachable or unreachable

  • Note: Shields will still be displayed in the Core Application UI; they will not be displayed in the CLI, GitHub repo or the new Mend Platform UI.

• No more “unknown”: If there’s no data about what class is vulnerable, every class is considered vulnerable . If any class is reachable - it’s reachable. If no class is reachable - it’s unreachable.

• Java reflection support

• Only “class-level” analysis, does not support “method-level” analysis.