Breadcrumbs

SCA Reachability vs. Prioritize

Prioritize (Legacy)

  • Supported languages: Java, JavaScript, Python

  • Unified Agent only (no support in the Mend CLI nor in the repo integrations)

  • Only available in Core SCA

  • Provides 4 different shield types: Red, Yellow, Green, Gray

  • Does not support Java reflection

  • Does not support Java 21

  • Supports a deeper “method-level” analysis as well as a “class-level” analysis

  • More information on Prioritize: Mend Prioritize

SCA Reachability (New)

  • Supported languages: Java, JavaScript/TypeScript, Python (beta)

  • Available in the repository (GitHub only)

  • Available in the Mend CLI with minimal configuration - majority of configuration is done automatically

  • Actionable results - reachable or unreachable, no “in-between”

  • No more confusing shields - only reachable or unreachable

    • Note: Shields will still be displayed in the Core Application UI; they will not be displayed in the CLI, GitHub repo or the new Mend Platform UI.

  • No more “unknown”: If there’s no data about what class is vulnerable, every class is considered vulnerable . If any class is reachable - it’s reachable. If no class is reachable - it’s unreachable.

  • Java reflection support

  • Only “class-level” analysis, does not support “method-level” analysis.