A version-by-version history of Fendix. v3.7.0 shipped October 2026: the GitHub Action fails the job when Semgrep cannot run, and a fatal Semgrep run is recorded as failed instead of passing as a clean scan. Each entry below lists what changed in that release.
Product update · November 1, 2026
Decision Intelligence brings release verdicts, Decision History, Scan Comparison, evidence-backed shared remediation points and recommended next actions into one workspace journey. Coverage and comparability stay visible, and human-reported fixes remain distinct from verification. No automatic code changes.
Explore Decision IntelligenceOctober 2026
semgrep-core, the scan recorded Semgrep as failed and coverage as incomplete, and the job still went green. The Action now requires Semgrep for every code scan through a new require-analyzers input (default auto). Before the scan it runs the scan's own Semgrep offline on a bundled rule and requires the known match, and it passes the requirement to the engine as --require-analyzers. A missing, damaged, crashing or hung Semgrep fails the job with exit 2, and extra-args cannot cancel the requirement.ok with no findings. It is now failed, so --require-analyzers semgrep, --fail-on-coverage-gap and --fail-on-scanner-error exit 2 on it, and a hosted scan's decision is incomplete instead of a pass. Per-file problems, such as a file that does not fully parse or a per-file timeout, leave the run ok and are counted in the scanner detail. Findings Semgrep printed before it failed stay in the report. The accuracy corpus result is byte-identical to v3.6.5.require-analyzers: none to scan without Semgrep; the gate then warns that coverage is not enforced. extra-args: --fast now fails a code scan unless the requirement is relaxed. The native CLI keeps its defaults, and report schema, SARIF structure, fingerprints, decision policy and the meaning of each exit code are unchanged. Fendix-app/Fendix@v1 resolved to the v3.6.2 Action at release; it was moved to the v3.7.0 release commit on 2026-10-27, so @v1 and the pinned commit now run the same fail-closed Action. Hosted scans run v3.7.0.October 2026
fendix binary fixes two checksum-database verification bypasses (GO-2026-6180, GO-2026-6179). MCP 1.29.0, which comes with Semgrep 1.182.1, fixes three MCP SDK server advisories (CVE-2025-66416, CVE-2026-52869, CVE-2026-59950); Fendix never starts Semgrep's MCP server, and the package is upgraded wherever it ships. The image also applies the Debian security updates published since its base image, and its HIGH findings fall from 102 to 44, every one of them in a Debian package with no fix published.--offline included. Fendix now turns that check off. Offline, the check waited before the scan started, up to about 96 seconds with Semgrep 1.182.1, which could time Semgrep out on a mid-size repository.extra-args: --require-analyzers semgrep to fail the job instead. GitHub-hosted runners and the official image are not affected.Fendix-app/Fendix@v1 is unchanged; its default version: latest installs this release, and version: v3.6.5 pins it. Hosted scans run v3.6.5.October 2026
emSign ECC Root CA - G3 had their private keys compromised and have been revoked. Anyone holding one of those keys and on the network path could present a valid-looking certificate for any host the engine connects to. The fendix binary is now built with Go 1.27.3, whose crypto/x509 rejects those intermediates (GO-2026-6809), and certifi 2026.10.23, which drops the affected root (GHSA-6q48-6c7w-9gw2), is in the image's Python environment and in the hash-locked engine install the GitHub Action uses.SETTINGS_INITIAL_WINDOW_SIZE frames (CVE-2026-78669, fixed in Go 1.27.2). The engine negotiates HTTP/2 with the targets it scans, so a hostile target could stall a URL scan. Go 1.27.3 includes that fix, and fixes for unbounded Range header parsing in net/http (CVE-2026-78667) and malformed ECH extensions in crypto/tls (CVE-2026-97031).x509.Certificate.Verify is no longer reported as affected by GO-2026-6809. A standalone binary uses the go on your PATH, so its results do not change..fendix-ignore rules and SARIF alerts carry over. Fendix-app/Fendix@v1 is unchanged; its default version: latest installs this release, and version: v3.6.4 pins it. Hosted scans run v3.6.4.October 2026
flask-route-no-auth-decorator said the auth decorator belongs directly above @app.route(...). Flask's route() must be the outermost decorator, so following that advice left the route unauthenticated. The finding's fix text, its SARIF help and the check catalog now say the decorator goes directly below @app.route(...), and that one placed above it does not protect the route.python-eval-injection, python-jwt-decode-no-verification, python-sql-injection-string-format and python-command-injection-shell-true listed alternative patterns that all had to match at once, so none of them ever fired. They now detect eval() or exec() with a non-literal argument, jwt.decode() with signature verification disabled or the "none" algorithm, an execute() query built with %, +, an f-string or .format(), and os.system() or os.popen() with a non-literal command. jwt.decode(..., algorithms=["none"]) was caught by no analyzer before.--fail-on, a Semgrep finding without corroboration stays in the MEDIUM confidence band and its disposition is WARN, so the repaired findings do not BLOCK. A scan that was PASS can now be WARN when one of these rules reports. The verified hosted case, JWT decoding with signature verification disabled, is CRITICAL severity, WARN disposition and release decision WARN. With --enforce-confidence=false, the legacy severity-only gate, they block at or above the threshold and are marked policy_override.'$VAR' now read as fixed text; findings still name the matched symbol. No title, fingerprint, grouping key, baseline entry or .fendix-ignore match changes.Fendix-app/Fendix@v1 points to the v3.6.2 release commit, which passed the external end-to-end matrix, and is the recommended GitHub integration; the Action itself is unchanged. Set version: v3.6.3 to install this release. Hosted scans run v3.6.3.October 2026
--diff, --staged) with a relative path such as ., Semgrep and the native text scanner scanned none of the changed files while the coverage table reported both as ok. A relative and an absolute --code now scope the same files and report the same findings. The secrets scanner and the Python engine were not affected.code: . and diff: auto, a pull request adding a privileged Kubernetes container passed with zero findings; it now blocks, as it already did with an absolute path. The hook fendix hook install writes now rejects a commit that stages that manifest.--code in full, as it already did when git diff fails; it never narrows to nothing. Until diff scoping supports it, a diff-mode scan with --code set to a subdirectory also scans that directory in full.code path or diff: 'false', still work and can be removed. No report-schema, SARIF, fingerprint or exit-code change. Hosted scans stayed on v3.6.0 and moved to v3.6.3 directly.October 2026
"rules": null, which SARIF 2.1.0 forbids and GitHub's SARIF upload rejects, so a clean scan failed at the upload. fendix scan --format sarif and fendix report --format sarif now write "rules": [].PATH. There is no checksum-only fallback, and inherited FENDIX_* variables cannot redirect or weaken the install.engine_path was left empty. The Python engine is now prepared from source at the commit named by the release's signed build record, with a hash-locked dependency set. Exit 1 is a policy BLOCK, exit 2 a setup or scan error, and any other result fails closed with 2; SARIF is uploaded only when the scan wrote a report.artifacts:reports:sast, which expects GitLab's own SAST schema.actions: read and GitHub Code Security. The Action no longer installs a release without a cosign signature. The fendix scan report schema, finding policy and exit codes are unchanged. Hosted scans stayed on v3.6.0.October 2026
.fendix-ignore rules acted on the group, keyed on its first occurrence. A test fixture saved in a baseline, or matched by an ignore rule for **/tests/**, hid a new production credential that grouped with it, and whether it did depended on how the directory names sorted. Each occurrence is now fingerprinted, baselined and ignored on its own before findings are grouped.occurrences: [{endpoint, fingerprint}], and the report schema_version stays 2. --save-baseline writes baseline format v2, which records every occurrence. Baselines from v3.5.1 or earlier still load, and each entry proves only its own fingerprint and its exact recorded locations.partialFingerprints, so a GitHub Code Scanning dismissal covers one occurrence. fendix jira tracks occurrences with fendix-fp: labels, and fendix verify re-tests every occurrence and resolves a grouped finding only when all of them are fixed.**/ matches zero or more directories, so **/tests/** matches a top-level tests/, and * stays within one path segment. A secret is named after the binding that holds it: email="…", password="…" is now named password.--save-baseline. The first SARIF upload opens a new alert for every non-primary occurrence of a grouped finding, and fendix jira re-files findings that were tracked only by fendix-id: labels. Hosted scans run v3.6.0.October 2026
go install …@latest, which never resolved, and the GitLab and CircleCI files downloaded a tarball current releases do not publish. All three now pin FENDIX_VERSION to the release that generated them, fetch the official installer at that release's commit, so moving a tag cannot swap the script, and require a verified cosign signature. The CircleCI job installs a checksum-pinned cosign first, and all three accept an optional FENDIX_SHA256 pin.64, which current Homebrew ranks above every 3.x release, so those installs were never offered an upgrade. The formula now sets version_scheme 1, which ranks every release above them.FENDIX_REQUIRE_SIGNATURE=1 refuses the install when cosign is missing or the release carries no signature, and FENDIX_SHA256 refuses any binary whose hash differs from the pin. Both are opt-in; the default curl … | sh behaviour is unchanged.github.com/Fendix-app/Fendix/go in go version -m, stack traces and SBOMs. Remote go install is not a supported installation method.v3.7.0 shipped October 2026 — the GitHub Action requires Semgrep for code scans and fails the job when it cannot run, installs wheels only and uploads SARIF only for a finished scan, and a fatal Semgrep run is recorded as failed; no report-schema, SARIF, fingerprint or decision-policy changes, and every exit code keeps its meaning. v3.6.5 shipped October 2026 — Semgrep 1.182.1, MCP 1.29.0 and golang.org/x/mod 0.40.0 fix the last fixable HIGH advisories in the official image, Semgrep no longer contacts semgrep.dev, and self-hosted Linux CI runners need glibc 2.34 or later for Semgrep; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.6.4 shipped October 2026 — rebuilt on Go 1.27.3 and certifi 2026.10.23, so TLS no longer trusts the eight compromised emSign intermediate CAs and a hostile HTTP/2 scan target can no longer burn the scanner's CPU; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.6.3 shipped October 2026 — four bundled Semgrep rules that never matched now report, WARN by default under the confidence-gated --fail-on; the Flask auth advice says the decorator goes below @app.route(...); eleven checks have static catalog copy; no finding-identity change. v3.6.2 shipped October 2026 — diff-aware scans with a relative --code scan the changed files again, and a diff scope that cannot be represented safely falls back to a full scan. v3.6.1 shipped October 2026 — SARIF for a scan with no findings is valid, and the GitHub Action verifies the release signature before it runs the binary. v3.6.0 shipped October 2026 — baselines, .fendix-ignore rules and SARIF act on each security occurrence, so a baselined or ignored test fixture can no longer hide a new production credential grouped with it; baseline format v2, one SARIF result per occurrence, and fendix jira and fendix verify track every occurrence. v3.5.1 shipped October 2026 — fendix init writes CI that installs a pinned, signature-verified Fendix, brew upgrade reaches installs older Homebrew recorded as version 64, and the installer can require a signature or a pinned SHA-256; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.5.0 shipped October 2026 — --fail-on refuses an invalid threshold instead of silently scanning with none, fendix verify no longer reads missing input as a fix, and images publish to Docker Hub; no fingerprint, report-schema or decision-policy changes. v3.4.1 shipped September 2026 — the engine images now ship Go 1.27, raising govulncheck's module ceiling from 1.25; no scanner, fingerprint or exit-code changes, and the Go module floor stays 1.25. v3.4.0 shipped September 2026 — a scan can no longer look complete when it wasn't: every analyzer records whether it ran and why not, the report carries a coverage block that names the gaps, a URL scan with zero endpoints writes its report instead of vanishing, and two opt-in flags turn a coverage gap into a failing build. v3.3.0 shipped September 2026 — an upgrade no longer splits a finding you were already tracking into a closed one and a new one, and the list of checks a scan ran is built from what completed rather than what was configured. v3.2.0 — every blocking decision explains itself. A BLOCK now carries the policy it was made under and the evidence class that justified it, all the way through Fendix's own storage into the SARIF you export, so a failed pipeline is answerable from the report alone. Findings held back say why, confidence scores come with the rules that produced them, and a build blocked only because confidence enforcement was switched off is labelled as such. v3.1.0 stopped findings claiming more than they proved — wildcard CORS with credentials, rate-limit prioritisation, response-aware header grading, path-traversal wording, test-fixture credentials and dependency applicability all became more precise. v3.0 gave findings a stable identity based on which rule fired, in which file, in which function, about which operation. Re-save your baselines once after upgrading from before v3.0, and rewrite any .fendix-ignore rule that pins a fingerprint: value — rules using the supported id, endpoint or category selectors are unaffected by the fingerprint change, although positional SEC-NNN ids are suitable only for short-lived triage.