What's New

This release extends CodeSensor language coverage to Go and Rust and adds source repository detail to the public vulnerabilities API.

Go and Rust Language Support

CodeSensor now scans Go and Rust repositories with the same depth it brings to Python. Point it at a Go or Rust repository and the resulting bill of materials populates with the AI libraries, models, data sources, and configurations found in that code.

CodeSensor also flags known vulnerabilities in the Go modules and Rust crates it detects, so security risks in these languages appear right alongside the rest of your findings.

These additions close two common blind spots. Go underpins a large share of enterprise cloud-native and mircoservice infrastructure, and Rust is increasingly the language of choice for performance-critical inference and MLOps tooling.

Repository URL on the Vulnerabilities Endpoint

Every record returned by the public vulnerabilities endpoint now includes a repositoryUrl filed identifying the source repository for the finding. The value matches the repository URL reported by the bill of materials endpoint for the same bill of materials, and it returns null when a bill of materials has no linked repository. This lets you trace each vulnerability back to the repository it came from.

Bug Fixes and Other Improvements

Cleaner public API permission model. Permissions now map directly to endpoints, with vulnerability access governed by its own dedicated read permission. Existing integrations gain and lose no access on upgrade.
Stale scan jobs no longer block new scans. Stalled scan jobs are reclaimed automatically, freeing up scan queues that were previously blocked.
BOM filter for vulnerability assessment status fixed. The filter previously failed to return expected results, and now displays them normally.

Did this answer your question?