Mend Platform Release Notes

Version 26.10.1 (01-November-2026)

New Features and Updates

• (Open Beta) Introducing Mend Intelligent Agent, an AI-powered assistant embedded within the Mend Platform. Users can now interact using natural language to explore platform capabilities, receive guidance to relevant views, and obtain executive-level risk summaries. This feature provides a centralized organizational perspective, enabling security teams to identify and prioritize critical findings across all applications and projects efficiently. Mend Assist streamlines security oversight by delivering instant, actionable insights and automated navigation, all within the existing platform workflow.

  • The feature is enabled by default for organizations with signed AI consent via an addendum in your Mend.io contract. For organizations without consent, the feature remains disabled. Please contact your Customer Success Manager for more details.

• (SAST) Introduced granular control for low-probability scan categories within the Scan Profile. Users can now selectively include or exclude specific categories, such as File Read or Database Read, to refine detection and reduce noise. This update replaces the previous binary toggle with a configurable selection tree, allowing for self-service tuning tailored to specific codebase requirements. Changes are applied to the next scan and include a count indicator for selected categories.

Resolved Issues

• (SCA) Fixed an issue where certain vulnerability findings remained open in the Mend Platform even after the underlying CVE association was removed from the database.

• (SCA) Fixed an issue where vulnerability trace data was duplicated during the write process, leading to excessive database growth and potential memory exhaustion during scans.

• (SCA) Fixed an issue where `.pom` files were incorrectly reported as independent libraries in scan results. These metadata descriptors are now excluded from the inventory, preventing false positives and ensuring that CI/CD pipelines are not blocked by unknown license alerts for non-library artifacts.

• (SAST) Fixed an issue where Code report downloads failed in Chromium-based browsers, such as Chrome and Edge, when the organization name contained a comma.

Version 26.9.3 (18-October-2026)

New Features and Updates

• Custom Roles, previously in closed beta, are now generally available. In this release, the role breakdown and the Create Role wizard are enhanced to provide a more intuitive custom role management experience.

• (SCA) Introduced an option to generate a single aggregated SBOM file for application and multi-project scopes. This feature consolidates multiple project-level files into one document, deduplicating components and merging occurrence data across the selected scope. The aggregated export supports CycloneDX and SPDX standards, ensuring compliance and simplifying ingestion into downstream tooling. When multi-project scope is selected, projects must belong to the same application to maintain data integrity. Per-project generation remains the default structure for all report exports.

Resolved Issues

• Fixed an issue where the last scan date returned by the Project Summaries API did not match the date displayed in the Mend UI. This discrepancy was caused by the API incorrectly recording the batch run time instead of the actual scan completion time. The system now ensures the API consistently reports the correct scan end time, maintaining data alignment across all interfaces.

• Fixed an issue where the Mend Jira Data Center plugin created duplicate Jira tickets for the same security finding. By transitioning the deduplication and persistence logic to use a stable unique identifier instead of a transient one, the plugin now ensures only one ticket is generated per finding. This update prevents excessive ticket creation and stabilizes database growth, improving overall system performance and reliability.

• (SCA) Fixed an issue where proprietary (in-house) components were incorrectly included in automation workflows for "Empty License" conditions, leading to false-positive violations. A new organizational setting, "Include Proprietary Libraries in Workflows," has been introduced to allow for the exclusion of these components by default. This ensures that only genuine third-party components with missing license data are flagged during scans.

• (SCA) OS Inventory page fixes:

  • Fixed an issue where the OS Inventory page failed to load dependencies for certain projects, resulting in an error message and an HTTP 403 response. This was caused by a timeout during the source-file remapping process for projects with a high volume of files. The underlying logic has been optimized to handle large-scale dependency structures efficiently, ensuring the inventory grid loads correctly across all applications.

  • Fixed an issue where filtering the OS Inventory table by label caused the grid to display an error and fail to load data. This occurred due to an incorrect syntax format in the underlying API request. The filtering mechanism has been updated to ensure compatibility with the backend requirements, allowing users to successfully view and manage their inventory when label filters are applied.

• (SCA) SBOM fixes:

  • Fixed an issue where SPDX SBOM imports containing circular dependencies or duplicate relationships caused the project hierarchy building process to hang, leading to scan timeouts. The import logic now correctly handles these complex dependency structures, ensuring scans complete efficiently and provide a full dependency tree.

  • Fixed an issue where CycloneDX SBOM imports failed when encountering valid SPDX license identifiers, such as FSL-1.1-MIT, in the license ID field. The import process now correctly validates these identifiers, preventing unhandled exceptions and ensuring successful SBOM processing.

  • Fixed an issue where CycloneDX SBOM imports failed due to an outdated SPDX license list. The validator now correctly handles newer SPDX license identifiers in both JSON and XML formats, preventing the rejection of valid SBOMs. Additionally, a bug was resolved that caused a generic error message instead of a specific validation failure notification.

Version 26.9.2 (04-October-2026)

New Features and Updates

• (SCA) Email notification capabilities in Automation Workflows have been enhanced, allowing workflow creators to directly control recipients by selecting specific users or groups for scan summary emails. Additionally, a new "Send Email" action has been introduced to notify you of new findings—such as newly published CVEs—independent of scans, with configurable delivery frequencies.

  • Dedicated zero-day alerts have been added, to ensure immediate awareness when your organization is vulnerable to emerging threats. These alerts can be switched off for individual organizations you’re a member of or all of them (My Profile → Email Notifications).

Resolved Issues

• (SCA) Fixed an issue where Package Health data was missing in the Remediation tab for scoped npm packages. The platform now correctly URL-encodes scoped package names when querying the health API, ensuring accurate display of age, adoption, compatibility, and confidence metrics.

• (IaC) Fixed an issue where the IaC scanner incorrectly flagged Dockerfiles as using unpinned base images when the image version was defined via a build argument default. Additionally, the remediation guidance for this policy was corrected to ensure it no longer suggests using the "latest" tag.

Version 26.9.1 (27-September-2026)

Resolved Issues

• Fixed an issue where the user key generation error notification displayed a generic message instead of the specific reason provided by the backend. The notification now surfaces the actual cause, such as reaching the maximum number of user keys, to provide clearer guidance for resolution.

• Fixed an issue where the Malicious findings banner on the Security dashboard incorrectly included removed libraries in its total count. The banner now accurately reflects only active malicious software components, ensuring consistency with the legacy interface.

• (SCA) Fixed an issue where users with application-level roles, such as Application Admin or Security Analyst, received an "Access is denied" error when attempting to create a Jira issue from an SCA finding. The system now correctly evaluates permissions at the application scope, allowing authorized users to generate Jira tickets without requiring organization administrator privileges.

• (SAST) Fixed an issue where Mend CLI SAST scans failed to return exit code 9 and did not break the pipeline, even when workflow violations were detected and the "Fail Pipeline on Violation" setting was enabled. The CLI now correctly enforces workflow policies by returning the appropriate exit code to ensure pipeline failures occur as expected when security violations are identified.

• (Container) Fixed an issue where updating a registry integration could overwrite stored service-user credentials with invalid data, causing subsequent scheduled scans to fail. The fix ensures that service-user state is managed server-side and includes a recovery mechanism to automatically refresh credentials if authentication failures occur during a scan.

• (Container) Fixed an issue where the Containers view displayed outdated scan data because the latest scan pointer failed to advance upon scan completion. The logic has been corrected to ensure the Containers view consistently reflects the most recently finished scan.

Version 26.8.2 (06-September-2026)

New Features and Updates

• Introduced a new suppression tool in Agentic Integrations, enabling developers to effectively manage security findings directly within their IDE or AI agent workflow. This update supports both single and bulk suppression or unsuppression actions across all scanning engines, including SAST and SCA. By integrating triage capabilities into the development environment and ensuring UI updates reflect within seconds, the enhancement reduces context-switching and streamlines the remediation process.

  • The feature will be rolled out gradually over the next couple of weeks.

• (SCA) Introduced a unified vulnerability remediation experience across the Mend Platform by standardizing fix logic and recommendations, adding a Top Fix column in the Findings table, updating the Remediation tab, and ensuring consistent metadata for reliable and clear vulnerability fixes.

  • This update may result in fewer remediation suggestions per vulnerability and overall reduced noise-level, due to the increased accuracy of the fix logic.

  • This feature will be rolled out gradually in the next couple of weeks.

Resolved Issues

• Fixed an issue where SBOM report generation jobs could remain in a pending state indefinitely during periods of high volume.

• Fixed an issue where filtering the Application Violations table by project failed and displayed an error row.

• Fixed an issue where license status toggles in the library drawer were incorrectly enabled for users without update permissions. The interface now correctly disables these controls and provides a descriptive tooltip when a user lacks the required access, ensuring the user experience aligns with backend authorization levels and preventing non-persistent UI changes.

• (IaC) Fixed an issue where the Project Summary page incorrectly displayed "IaC Scan Not Executed" even when Infrastructure as Code (IaC) findings were present. The statistics synchronization has been corrected to ensure the summary widget accurately reflects scan results and finding counts.

Version 26.8.1 (23-August-2026)

New Features and Updates

• Introduced Account-Level (Global) Workflows, enabling administrators to define and manage workflows centrally across multiple organizations. This feature eliminates manual duplication and ensures consistent governance by allowing workflows to be configured at the account level and propagated to selected organizations. Account-level workflows are clearly identified within organization views, and administrators can control whether organization-level admins have the authority to enable or disable them locally. This update also includes comprehensive API support for managing global workflows.

• The Administration page sidebar has been updated to include a categorized, collapsible navigation structure, improving discoverability and aligning with the Application and Project pages. As part of this update, AI Usage settings have been moved from the General tab to a dedicated AI Usage tab within the new AI category. Additionally, the Engine Settings section now features specific sub-headers for AI, Code, and Dependencies for a more organized administrative experience.

Resolved Issues

• (SCA) Fixed an issue where, under certain conditions, generating the Dependencies Findings Report in Excel format at the application scope failed to produce a report, incorrectly stating that no projects matched the requested scope. The report now correctly includes all relevant project data when generated at the application level.

Version 26.7.2 (09-August-2026)

New Features and Updates

• Mend DAST now supports the new Invicti Platform, enabling seamless ingestion of assets, vulnerabilities, and scans via its latest API. This update introduces a dedicated integration card for the Invicti Platform while maintaining the existing integration, now renamed Invicti Enterprise. Users benefit from enhanced data mapping, including structured vulnerability classifications and CVSS v4 scoring, ensuring comprehensive security coverage across both legacy and modern Invicti environments.

Resolved Issues

• Fixed an issue where the Libraries tab under Security > Dependencies failed to load for certain applications, resulting in indefinite loading states or 403 errors. The system now correctly retrieves and displays the application's library list as expected.

• Fixed an issue where filtering the OS Inventory table by project caused an infinite loading spinner. The system now correctly handles project search parameters, ensuring the table updates accurately and displays the relevant results without requiring a page refresh.

• (SCA) Fixed an issue where the reachability count for libraries was reported inconsistently across different views. The reachable count now displays correctly in the Summary view, ensuring alignment with the Security Dependencies data.

Version 26.7.1 (26-July-2026)

New Features and Updates

• Mend Platform now includes a centralized Activity Log, giving administrators visibility into user and system activity.

  • Complete event trail - platform activities, configuration changes, and security & legal findings actions across all engines (Platform, Dependencies, Code, Containers, AI), with 18 months of retention.

  • Audit-grade detail - every event captures the actor, timestamp, and scope; audit events include full Before/After change records.

  • Filter, sort, investigate - slice by date, event, category, event type, engine, user, application, or project, and drill into any event via the details side panel.

  • Reporting & automation - generate an Excel Activity Log report from the Reports area or directly from the Activity Log page, or retrieve events programmatically via API.

  • Account-level coverage — account-scoped actions (custom roles, global workflows, account-level reports, SAML integrations) are logged across all organizations within the account and visible only to Account Admins.

• Enhanced the SCA tool in the Agentic Integrations to display vulnerabilities from transitive dependencies, helping developers make more informed decisions during project analysis.

Resolved Issues

• Fixed an issue where long running scans caused projects metrics to be zeroed out in the Mend Platform.

• Fixed an issue where Jira tickets were intermittently not created during SCA scans due to unauthorized request errors and incorrect issue type mappings. The integration now correctly validates project and issue type associations to ensure reliable ticket generation.

Version 26.6.2 (12-July-2026)

New Features and Updates

• (SAST) A Project Risk Factors widget containing high-level Contextual Project Classification information is now available in the Project Summary dashboard.

• (IaC) The Infrastructure as Code (IaC) engine now includes the ability to suppress or mark findings as "In Review".

• (Container) Minor improvements to the Malicious Package management user experience.

• (SCA) Mend.io now seamlessly integrates into the Port.io platform, allowing developers to monitor application security findings within their familiar environment and access the corresponding issue details without a context switch.

Resolved Issues

• Fixed an issue where workflow violation email notifications were not sent to administrators following a Mend CLI scan. This was caused by a failure in the violations lookup process during email generation. The fix ensures that administrators correctly receive email alerts for workflow violations as expected.

• Fixed an issue where assigning an additional role to an existing user group at the application scope would not persist after saving. The system now correctly saves and retains multiple roles for user groups, ensuring consistent access management.

• Fixed an issue where user display names were incorrectly populated with email addresses during SAML SSO login, under specific conditions. The system now correctly respects custom attribute mappings, ensuring that the display name reflects the configured claim value from the identity provider.

• (SCA) Fixed an issue where exporting a Dependencies Risk Report at the project level in Full PDF format incorrectly generated a PDF overview accompanied by separate CSV files. The report now correctly exports as a single, comprehensive PDF document containing all relevant details.

Version 26.6.1 (28-June-2026)

New Features and Updates

• (SAST) Contextual Project Classification, which has been in limited availability since March 2026, is now generally available. When enabled, AI automatically analyzes your codebase, identifies applications that handle sensitive data like payments, healthcare records, and PII and assigns corresponding labels and risk factors to the project.
  This feature helps you prioritize findings across the organization.

• The Infrastructure as Code (IaC) engine, allowing users to manage the full lifecycle of IaC findings, has been enhanced with the following capabilities:

  • The user experience was improved with functional navigation in the finding drawer.

  • Support for INFO-severity findings was added.

• (Container) Malicious package detection capabilities have been extended to container images, providing the same end-to-end protection and workflows currently available for open-source dependencies. This update enables users to detect, assess, and respond to malicious packages embedded within container layers, ensuring consistent security coverage and visibility across all deployment artifacts.

• Introducing a new scan comparison feature that allows users to compare two scans from the same engine to visualize added, removed, or modified findings. This engine-agnostic tool supports SCA, SAST, Containers and AI, providing a unified view of security, legal, and library changes. Users can initiate comparisons via an intuitive UI or public API.

• The Risk Factors column on the Applications and Projects views has been consolidated into a single, unified view. This update replaces separate engine-specific columns for Dependencies, Code, and AI with a centralized display that now also includes Container risk factors. Users can view aggregated risk icons across all four engines in one cell, access a detailed breakdown via an enhanced tooltip, and utilize engine-sectioned filters for more efficient risk management and navigation.

• Updated the Containers Findings Search tab to align with the Dependencies findings search design, providing a consistent and streamlined user interface across the platform.

• The MCP server can now fetch optimized rules for any supported AI coding assistant (such as Cursor, Claude Code, VS Code Copilot, and Windsurf). To trigger it, prompt your agent with "Download the newest rules for Mend MCP". You can also periodically trigger it to check if the rules have been updated.

Resolved Issues

• (Container) Fixed an issue where project exclusions defined in workflow scope conditions were not being honored during container image scans. This resulted in policy violations being incorrectly generated for projects that should have been excluded from evaluation. The fix ensures that excluded projects are correctly identified and bypassed, preventing unnecessary violations and streamlining scan results.

• (SCA) Fixed an issue where corrected license metadata for npm and PyPI artifacts failed to sync and render accurately in the inventory. This fix ensures that license relationships consistently reflect updated metadata, allowing manually added licenses to be correctly identified and managed within the Mend Platform UI.

Version 26.5.2 (14-June-2026)

New Features and Updates

• Finding details in Mend for JetBrains now display correctly on narrow panels. Labels now stack vertically, keeping the information clear and legible regardless of how wide the panel is.

• (SCA) The Dependencies Findings Report — Org-level report generation is now backed by a new scalable reporting pipeline, resolving timeouts and failures experienced by large organizations.

• (SCA) The Dependencies Risk report is now available at the organization level in the Mend Platform UI.

Resolved Issues

• Fixed an issue where active users accessing the Mend Platform via SSO were incorrectly displayed with an "Invited" status instead of "Active" in the Users section. This status now correctly reflects the user's activity.

• Fixed an issue where Mend CLI scans failed with a timeout error during policy compliance checks. This occurred when backend processing for specific large datasets exceeded the client-side deadline. The fix optimizes server-side policy evaluation to ensure scans complete successfully within the expected timeframe.

• (Container) Fixed an issue where workflow violations were incorrectly triggered for suppressed findings during CLI image scans. Suppressed vulnerabilities are now properly excluded from workflow evaluation, ensuring that automated policies and CLI exit codes accurately reflect the project's security status.

• (Container) Fixed an issue where the total number of container findings in the Project Summary did not match the totals shown in the Security > Containers > Findings page, ensuring consistent and accurate reporting across views.

Version 26.5.1 (31-May-2026)

New Features and Updates

• Mend's MCP server now exposes security findings across SAST and SCA scanning engines so developers can query vulnerability data directly from their AI-powered tools and workflows. The findings come enriched with remediation suggestions, making it easier to understand and fix issues without leaving the tools they already use, or by instructing an agent to fix them. Developers can ask questions like "What are the top 5 security issues in this repo?" or "Explain this SQL injection finding" and their preferred agent will be able to answer these questions by communicating with the MCP server.

• Added a new setting in Administration that allows organizations to control whether newly created applications are automatically assigned to the Admin group. This update improves administrative flexibility and ensures consistent access management for new applications, without affecting existing ones.

Resolved Issues

• Fixed an issue where the “Show only vulnerable libraries” toggle in the Tree View did not filter out non-vulnerable libraries, causing all libraries to be displayed regardless of their vulnerability status. Now, enabling the toggle correctly shows only libraries with associated findings.

• (SCA) Fixed an issue where only CVSSv3 vulnerability scores were reported in the Mend CLI output regardless of the organization’s CVSS settings in the Mend Platform, ensuring accurate and uniform vulnerability profile data based on the configured CVSS version.

• (SCA) Fixed an issue where the APIv3 endpoint for exporting project SBOM reports asynchronously did not generate reports as expected.

• (SCA) Fixed an issue where users with the Product Administrator role received a failed scan status when using the SBOM Import API. The fix ensures that scans now finish with the correct status for authorized users.

Version 26.4.3 (17-May-2026)

New Features and Updates

• (Closed Beta) Introducing custom roles with granular permissions, allowing organizations to define and assign least-privilege access via groups at both organization and application levels. This update enhances security and governance by enabling fine-grained control, separation of duties, and centralized role management, while maintaining full compatibility with existing roles.

• UI Improvements:

  • Added an "Assigned by" field to each copyright entry in the OS library side panel, making it clear whether a copyright was detected by Mend.io or manually set by a user. This enhancement improves audit clarity by matching the display logic already used in the Licenses tab, helping users easily distinguish between system-detected and user-overridden copyrights.

  • Replaced the floating filter row in Admin > Applications with platform-standard filter buttons, saving vertical space and making active filters clearer. This update aligns the filtering experience with the rest of the platform for a more consistent and user-friendly interface.

Resolved Issues

• (SCA) Fixed an issue where Mend CLI dependency scans would intermittently fail during policy compliance checks, resulting in an "asyncCheckPolicyCompliace failed" message. Scans now complete successfully without unexpected interruptions.

Version 26.4.2 (03-May-2026)

New Features and Updates

• Mend for Visual Studio Code will be available on the Open-VSX registry starting May 8th, 2026, making it installable directly from AI-native IDEs such as Cursor, Windsurf, Kiro, and Antigravity. Developers using these editors will be able to find and install the extension from their built-in extensions marketplace without any additional steps.

• UI Improvements:

  • Updated the administration screens to feature a modern floating bulk actions toolbar at the bottom, making bulk actions more visible and accessible. This change streamlines the user experience by consolidating selected item counts and available actions into a single, easy-to-reach toolbar, ensuring consistency and reducing clicks across all administration screens.

Resolved Issues

• Fixed an issue where violations linked to a deleted workflow were not removed, which caused data inconsistencies. Now, when a workflow is deleted, all associated violations are properly deleted to maintain data integrity.

• Fixed an issue where manual Jira issue creation from Mend for Jira Cloud displayed a success message but failed to create a Jira ticket if the required issue type was missing or misconfigured in the target Jira project.

• Fixed an issue where workflow email notifications weren’t sent, ensuring that notifications are now delivered as expected when workflow conditions are met.

• Fixed an issue where filtering the File Path column in the Source Files tab of the OS Inventory did not return results as expected. Filtering now works correctly, allowing users to search for files by path.

• Fixed an issue where the Mend Advise browser extension would display a timeout error when analyzing the NJsonSchema 11.0.2 package.

Version 26.4.1 (19-April-2026)

New Features and Updates

• Introducing the Users & Groups report, allowing admins and security teams to generate comprehensive reports of all users, their roles, and group memberships within an organization. Reports can be generated from the UI or via API, supporting multiple formats for streamlined auditing, compliance, and user management.

• Added support for recognizing CPE (Common Platform Enumeration) identifiers during SBOM imports in both SPDX and CycloneDX formats. When a PURL is missing, the importer now uses CPEs to identify components, ensuring broader compatibility and successful imports even when only CPEs are provided.

• Enabled Application Admins to remap source files within their assigned applications, improving operational scalability and reducing reliance on organization admins. Application Admins are now restricted to application-level remapping, with UI and API updates ensuring clear permission boundaries and consistent role-based access control.

• UI Improvements:

  • Revamped the organizational Findings table with a streamlined column structure, improved filtering and sorting options, and enhanced search functionality. The update introduces clearer terminology, modern UX patterns, and a more intuitive interface to simplify vulnerability analysis and boost usability.

  • Enhanced the Report Page UI for improved visual consistency and usability. Updates include refreshed scan engine icons, optimized column layouts, ellipsis overflow for text cells, and unified status chip designs to align with current UX/UI standards. The “Generated By” cell is now hidden by default for a cleaner look.

Version 26.3.2 (12-April-2026)

New Features and Updates

• Introducing new Zero-Day response workflows in the Mend AppSec Platform, offering immediate risk visibility, audit-level transparency, and user-controlled enforcement for critical vulnerabilities. Users benefit from prominent alerts, a dedicated Zero-Day catalog, configurable workflows, and permanent violation tracking—streamlining investigation and remediation without added operational burden.

• Enhanced Jira security tickets now provide direct links to relevant areas in the Mend AppSec Platform, display project-level violation details, show violation counts per vulnerability, and make CVE identifiers clickable for quick investigation. These updates give security and AppSec teams richer context and faster access to remediation tools, streamlining the triage and resolution process.

• UI Improvements:

  • The toggle button group component has been redesigned with a modernized look. Border and divider visibility have been improved across all states, ensuring selected button fills no longer obscure borders and dividers remain clearly visible between buttons.

  • Updated the bulk actions in the My Integrations and Containers Security pages to use a new floating bulk action toolbar, improving clarity of available bulk actions for selected assets.

Resolved Issues

• Fixed an issue where typing at a certain speed in the Applications or Projects search box could cause letters to be removed from the search phrase. The search input now consistently retains all characters as typed.

• Fixed an issue where Organization Member users could not view data in the "Proprietary" section of the Applications page, instead seeing an "ERR" row. Data now displays correctly in this view.

Version 26.3.1 (22-March-2026)

New Features and Updates

• Contextual Project Classification is now available on request in Mend Forge. When enabled, AI automatically analyzes your codebase, identifies applications that handle sensitive data like payments, healthcare records, and PII and assigns corresponding labels to the project.

• The MCP server used in the agentic integrations now supports an optional X-OrgId header in its configuration. Users who belong to multiple organizations can use this to specify which organization the MCP tools should operate against.

• Added a “Select all results” option when creating a Legal automation workflow with the Licenses event condition, allowing users to quickly select all visible licenses (up to 50 per page).

• Updated the security dashboard header with new filter buttons for scan engine, labels, and timeframe, providing a streamlined and consistent user experience that matches the value dashboard. Outdated text was removed and filter accessibility was improved.

Resolved Issues

• (SCA) Fixed an issue where the package URL for NuGet packages in the due diligence report was incorrectly generated with an unnecessary “api.” prefix. The URL construction logic has been updated to ensure accurate links.

Version 26.2.2 (08-March-2026)

New Features and Updates

• Added a new EPSS Score column to the Dependencies → Findings table, allowing users to view exploit likelihood at a glance and sort by risk. This enhancement streamlines vulnerability triage and prioritization by making EPSS data directly accessible without drilling into details.

• Added a new pre-defined "Auditor" role that grants read-only access for integrations, automations, or users who need visibility into Mend data without permission to modify it.

  • Auditor role assignments in Legacy SCA will automatically be reflected as such in the Mend AppSec Platform and vice versa.

• Added support for filtering scans, reports, findings, and violations by the AI scan engine across the Mend AppSec Platform. The AI option is always visible in Scan Engine filters and enabled for customers with relevant entitlements.

• Added a new dependencyContexts field to the Get Project Security Findings API. This field lets you see how each vulnerable component appears in the dependency graph (direct vs. transitive and its root libraries), enabling clear mapping to the Get Root Libraries Security Findings endpoint and improving reachability analysis.

• UI Improvements:

  • Updated the table selection experience by moving the select all/deselect all controls into a single checkbox in the table header.

  • Redesigned and relocated the “Refresh” button for a more intuitive user experience.

  • Updated the Workflows and Reports pages by replacing filters with new filter buttons, making filtering more streamlined and user-friendly.

  • The Reports page now displays the "Delete" bulk action button only when a table row is selected, and the button text has been updated from “Remove” to “Delete” for improved clarity.

Resolved Issues

• Fixed an issue where suppression comments longer than 255 characters were being truncated when retrieved via the UI, API, or CSV export, despite being saved correctly. Now, comments up to 500 characters are fully supported and displayed consistently across all interfaces.

Version 26.2.1 (22-February-2026)

New Features and Updates

• (SCA) Source File Matching in Mend Platform introduces automatic and manual grouping of source files into logical libraries, improving vulnerability detection, license attribution, and compliance reporting. This update adds a new “Source File” column, a dedicated Source Files page, and manual override options, streamlining workflows for Security and Legal teams while ensuring more accurate and actionable insights.

• UI improvements:

  • Standardized the placement and design of refresh and update indicators across all main pages for a more consistent and intuitive user experience.

  • Added a rows-per-page selector to paginated tables, allowing users to choose between 50 (default) and 100 rows per page directly from the pagination footer.

    This improves usability by reducing page navigation and making it easier to review larger datasets.

Resolved Issues

• Fixed an issue where tag values were not displayed in the scan summary, even though they appeared correctly in project scans. Tag values now consistently show in both views.

• Fixed an issue where users switching from the Legacy UI to the Mend AppSec Platform were redirected to the login screen instead of being automatically authenticated, under certain conditions.

• Fixed an issue where users could not search for all Jira projects in the mappings input fields of the Legacy UI.

• Fixed an issue where importing platform OpenAPI schema definitions into API management tools resulted in syntax errors.

• (SCA) Fixed an issue where generating an application-level SBOM report in Excel format resulted in an empty file.

Version 26.1.2 (08-February-2026)

Resolved Issues

• Fixed an issue where Jira tickets created by the Mend for Jira Cloud integration did not receive comments when related Mend alerts were resolved, ensuring resolution status is now properly communicated within Jira.

• Fixed an issue where the path to the dependency file was missing in the UI for some dependencies. File locations are now displayed consistently.

• (SCA) Fixed an issue where importing a valid SBOM could fail without displaying an error message. Users will now receive clear feedback if an import fails.

New Features and Updates

• UI improvements:

  • The top navigation has been redesigned to be fully responsive, ensuring all menu items remain accessible without horizontal scrolling. Buttons that do not fit are grouped under a “more” dropdown, and profile and admin options are now consolidated into a single menu. Updated styling and hover effects provide a modern, consistent look across the platform.

  • Updated the sidebar across the platform with a modern design, improved selected tab visibility, and consistent collapse/expand behavior. The new sidebar enhances usability and accessibility, making navigation clearer and more user-friendly for all users.

Version 26.1.1 (25-January-2026)

New Features and Updates

• Introduced a centralized Scans View, providing organization-wide visibility into all scan activities. This feature enables administrators and security teams to monitor, filter, and analyze scan metadata, supporting audit readiness, compliance, and executive reporting. Users can easily track scan coverage, investigate issues, and access detailed scan information across multiple applications and projects.

• Removed the legacy Library Page from the SCA module. All library-related data is now available through dedicated side-panels, streamlining navigation and improving usability for security, development, and compliance workflows.

  • As part of this change, the Least Vulnerable Package remediation strategy (LVP) has been enhanced and can now recommend both major and minor version upgrade paths.
    The LVP suggestions are available in the library side-panel under the Remediation tab.

(05-January-2026)

• Mend Agentic Integration is now available for Google’s Gemini CLI, Gemini Code Assist and Antigravity.

Version 25.12.1 (28-December-2025)

New Features and Updates

• Introducing a natural language search bar powered by AI, enabling users to filter applications and projects with intuitive prompts. This feature streamlines finding critical information, offers smart filter suggestions, and enhances the overall user experience with quick, relevant results and improved filter management.

• Enhanced SAML integration with new configuration options, improved user provisioning controls, and a modernized UI for a more flexible and secure authentication experience. Updates include, but are not limited to, the following enhancements:

  • Disabling local logins

  • Toggling just-in-time user creation

  • Uploading or editing metadata in multiple formats

  • Notifications and visual indicators when the SAML certificate is close to expiration

  • A two-way SSO enforcement across the Mend AppSec Platform and Legacy SCA application.

Version 25.11.2 (14-December-2025)

New Features and Updates

• (Open Beta) A new integration with ServiceNow’s Vulnerability Response module is now available, enabling Dependencies and Code findings to sync directly from Mend.io into ServiceNow. The integration provides drill-down visibility from Applications to Projects and their findings, along with bi-directional updates.

• (SCA) Added support for SBOM import through API 3.0, enabling users to upload SBOM files within the application context. A dedicated logs API provides enhanced traceability and integration.

• (SCA) Added a new Reports tab in the Accounts view, enabling account administrators to generate and manage Inventory, Security Alerts by Library, and Security Alerts by Vulnerability reports at the account level. Reports use an asynchronous flow with updated email notifications and permissions aligned to the Legacy SCA model.

• (SCA) Legal and Compliance workflows now support Jira Issue creation, aligning with other workflows in the Mend AppSec Platform.

  • The Create Issue action for legal findings is available in the OS Inventory table as well as Automation Workflows with ‘Licenses’ conditions.

Version 25.11.1 (30-November-2025)

New Features and Updates

• UI improvements:

  • Introducing streamlined filter buttons for a cohesive user experience on Applications and Projects views.

  • Buttons that do not fit are grouped under a “more” dropdown

  • Profile and admin options are now consolidated into a single menu.

  • Updated styling and hover effects provide a modern, consistent look across the platform.