What shipped, and why it matters

When findings are past due, the Overview now says for how many Mendr can start fixes and opens them in the Queue with one button. A line under the deadline bar states the SLA that sets each deadline, and the repository map shows where the past-due findings are, with the critical ones counted on each tile.

The new Incidents page lists the attacks and vulnerabilities in the news, from the pwn.watch feed, and checks each one against your latest scans. It says which stories affect your code, which need a scan to check, and what to do first. Findings that are in the news get a badge in the queue.

The sidebar item and page that rank the findings that need action are now called Queue. Overview summarizes the workspace, Incidents carries the news, and Queue holds the work, most urgent first. Its address is now /queue, and old links still open it.

New workspaces now scan as soon as you connect GitHub, and the Overview suggests one first fix: known exploited first, then packages that ship with your app. It follows that fix to a pull request and says when a repository has no dependency files Mendr can read. New workspaces also get a weekly scan.

New workspaces open fix pull requests as drafts and mark them ready when GitHub checks pass, or after 10 minutes when a repository has no checks. Mendr then asks the person who started the workspace's first fix to review it, so GitHub notifies them.

The finding page now shows each dependency path from the direct dependency to the vulnerable package. Before, it sorted the packages by name and could name the wrong direct dependency.

Mendr now opens on an Overview of the workspace: how many findings are past due, which repositories hold them, what needs you next, and how fast findings arrive and get fixed within their SLA. The Inbox item in the sidebar shows the past-due count.

When someone deleted the Jira ticket for a fix, Mendr kept the link to the deleted ticket and did not create another. Mendr now creates a replacement ticket the next time it would create one automatically.

After one failed GitHub check, the “GitHub verification is temporarily unavailable” banner stayed until you signed out. Mendr now checks again every minute, and at once when you return to the tab or your network comes back.

When the independent review asks for a correction, the fix can now use its one extension of model requests for it, and Mendr keeps enough requests for a full review of the result. Before, these fixes could stop unresolved, or the review had too little room to check the correction.

On Pro and Max, Settings → AI models now takes keys for Anthropic, xAI and Moonshot AI's international platform, as well as OpenAI. An enabled key pays for its provider's models after your free fixes, with no Mendr limit; provider charges and limits still apply.

On a workspace with about 330 open finding groups, the inbox took up to 18 seconds to load. It now loads in about 2 seconds, and a repository page that took 5 seconds now loads in under half a second.

Running fixes keep their work when Mendr deploys an update. The replacement worker reconnects to the same sandbox, continues review and opens the pull request within the original time limit. If the sandbox is lost, Mendr can retry the fix once. An uncertain GitHub result still needs inspection.

After a Node.js security release, the inbox notice now names repositories on every patched line. Node.js published the October 22.x and 24.x patches a day before 26.x, and the notice counted only the 26.x repositories.

For Node.js, Go and Go module findings, the fix card now says whether your code reaches the flaw: exposed when govulncheck traces a call into an affected function, unlikely when a completed check finds none, and unclear with the reason otherwise. The finding page lists the traced calls and the checks, and list rows and the Exposure filter state the same answer. On Pro and Max.

Mendr checks the Go versions that your version files, Dockerfiles and setup-go workflows declare for Go security advisories and end-of-life releases. Fixes update the declarations Mendr can edit, and the finding page lists the ones you change yourself.

A fix now starts while your AI budget has money left and pays only what it used, so an estimated cost no longer stops fixes early. Billing shows the dollars left and the reset date, and shows about how many fixes a budget pays for only once real fixes on that model give an average.

Settings → AI models now lists each model once, by its name, with no Recommended entry. A model's row says when its high-risk fixes run on a more capable model. A workspace that has not chosen a model runs its provider's default model.

Free, Pro and Max each include a monthly AI budget that Mendr pays for, so you can start fixes without an OpenAI key. Free keeps your first 5 fixes on any model, then adds a small budget for fast models. Pro is $20 a month, and Max has 10 times Pro's budget for $200. Failed attempts use the budget too, and new fixes pause until the monthly reset when it runs out.

Settings → AI models lists every model Mendr offers, grouped by provider, with about how many fixes your budget has left on each. Recommended lets Mendr choose the model by fix risk. Mendr removed Recommended later the same day. On Pro and Max, your own OpenAI key pays for OpenAI models with no limit.

The Findings page now filters like the inbox: pick filters from one Filter menu, and each applied filter shows as a chip that you can change or remove. Filters apply as you pick them, and the sort order is in the Display menu.

The inbox lists the findings that are ready to fix instead of folding them. You can still fold the group.

Mendr checks declared Node.js versions for runtime CVEs and end-of-life releases. Runtime findings share your inbox, deadlines and integrations. New advisories are matched hourly, and after a Node.js security release the inbox names the affected repositories and reviews their fixes together. Fixes update each supported line and move end-of-life versions to the newest LTS. The finding page lists the files you change yourself, such as workflow pins. Rebuild or redeploy after merging.

When Mendr restarted for an update, a fix in progress failed, and you had to start it again. Mendr now starts that fix again once by itself, and the fix page says that Mendr retried it.

A fix that makes real progress, such as an upgraded lockfile and a check that passes, now gets more model requests once. Mendr keeps time for the final review, so when a limit stops a fix that already addresses some packages, that reviewed part can still open a pull request. A retry after a limit starts from the earlier attempt's report.

Mendr never changes some files, such as those under .github/. A fix no longer counts the copies of a package in those files, so it can finish the copies it can reach. The pull request and the fix review list the other copies as a manual change, and a finding with no copy in reach says that it needs one instead of offering a fix.

A package that no published version fixes can now get a fix. The fix can replace or remove the package and change the code that uses it, or report that there is no safe fix. On Pro and Max, batch planning suggests a separate pull request for that package. The pull request's versions table names the replacement package.

Search now shows suppressed findings in their own section below the active matches, with each suppression's end date. Before, a search for a suppressed CVE showed no results; now you can open the suppression to see who suppressed it and why.

A fix pull request now opens with a summary of the advisories, what the checks show and what is still open, followed by sections with headings: What changed, Checks, Advisories and How Mendr made this fix. One table holds every check, and the versions table marks packages that the fix removes. Repositories with their own pull request template keep their headings.

When an upgrade changes how a framework or bundler loads modules, Mendr now tries a configuration change first and keeps your repository's import style. It rewrites imports only when no configuration change works, and the fix summary says what it tried.

The Fixes page now has three sections: what needs you, what Mendr is working on, and what it finished. Earlier attempts at a finding fold into its newest one, and a pull request whose checks passed waits under Needs you, ready to merge.

Deleting the OpenAI key or disconnecting Jira, Slack or Vanta now asks first, and Settings warns before it discards edits that you have not saved. A suppression that fails keeps the dialog and your reason, and one that works offers Undo.

Lists keep their rows on screen while a filter, sort or page loads, and an empty list offers a way out, such as Clear filters. On tablets, the sidebar keeps its counts and names each icon.

Each fix and CI state now has one name everywhere, and a disabled button says why on hover or keyboard focus. In the inbox, a click on a next step such as Start fix opens the finding, and the repositories page says why each repository needs attention.

When a fix made a change too large for Mendr to review, the fix page showed only a generic sandbox error. It now says which size limit stopped the fix and what you can do next. One cause is build output that the repository commits, such as a bundled dist/ folder.

A fix that covered several packages with many advisories could fail within seconds of starting, before any work ran. Those fixes now run like any other.

Right after you installed Mendr on an organization, the inbox could ask for a GitHub role check although nothing had changed. Mendr now compares the installation with the version GitHub showed at your last check, so the notice appears only after a real change.

GitHub can keep Dependabot alerts open after a fix merges, because its dependency graph lags behind main. When Mendr's own scan of main no longer finds the vulnerable version, the finding now shows Fixed on main and its SLA clock pauses until GitHub closes the alerts. A fix that finds the vulnerability already gone ends as Already fixed on main and shows what it found, instead of a failure.

OSV and GitHub can spell one package differently, for example werkzeug and Werkzeug. Mendr showed two findings and could open two fixes for one vulnerability. Mendr now compares names by each registry's rules for Python, Rust, NuGet and Composer packages. The next scan merges the copies into one finding and keeps its plan, assignee, tags, Jira link and SLA date.

A notice that arrived at almost the same time as another one could stay on screen until you closed it. Notices now close after five seconds, also after you close one with the keyboard.

Billing settings show who pays for the AI cost, free fixes left, repositories in use and the scan cadence in one readout. The plan picker states what a switch changes and what you pay before you confirm. The landing page shows the two paid answers to who pays, with Free as the starting point.

The fix page now shows the change Mendr made, read from GitHub and not stored, with each package version that moved. A fix that failed or stopped has a Retry button that starts a new fix for the same findings, and the page links each attempt.

When a repository has a pull request template, written rules for pull request descriptions, or a script that checks them, Mendr now writes the fix's description in that format, in plain language. Mendr runs the check script on the text first, and when the check fails, the pull request says so.

You can now email support from the account menu, from a fix that failed, and from the setup steps. The email already names your workspace and the page you were on, and for a failed fix it also names the fix, so we can look at the problem without first asking for details.

Workspace members and admins can now link each person to their Jira account in Settings → Jira. Assign to requester uses the link, so a ticket reaches the right person even when Jira hides email addresses.

An opened pull request, a scan, or a teammate's fix now shows as a one-line notice that names the package, and it waits while you point at it or use another tab. A failed fix, a question, or an error shows as a card that stays until you act on it, and a failed fix shows one card, not two.

While Mendr works on a fix, the Fixes item in the sidebar shows a pulsing blue dot, so you can see it from any page. The dot goes away when the fix opens its pull request, needs your decision, or stops.

Create ticket now works on a repository without a Jira ticket policy. It asks for the project, issue type, default assignee, and title format, saves them as the repository's policy, and creates the ticket. Before, it showed an error and you had to finish setup in Settings.

The finding page now shows the due date, owner, Jira ticket, and tags in one band under the title, and you can assign a finding to yourself in one click. The fix card names the next step, and the record shows each owner change, with an undo for the latest one.

The Reports page now shows what Mendr fixed, how its pull requests landed, and how open findings changed each day, and it exports confirmed fixes as CSV. A Needs attention list names overdue findings, fixes not yet started, ready and stale pull requests, and repositories without CI checks, each with a link to act on it.

A fix page summary now puts each fact on its own row: the change and its files, validation, independent review, validation limits, and packages. Each package shows its outcome and evidence, where before it showed only a status.

A new workspace can now start its first five fixes without an OpenAI key. Mendr covers their AI cost, and a started fix uses one whether or not it opens a pull request. After that, fixes use your workspace's OpenAI key.

After you install Mendr from GitHub or the GitHub Marketplace, you now land on the inbox, where the setup guide starts your first scan. Before, you landed on the repository list, which has no setup guide.

Mendr no longer publishes a fix that changes lockfile sources or hashes, install scripts, Git hooks, package-manager or CI settings, CODEOWNERS, or file modes, and it tells the agent why. Agent text in the pull request can no longer mention people, show HTML, or link to sites other than github.com.

A finding that a batch pull request already fixes no longer offers Start fix. Before, the button stayed active when the batch covered packages at different versions, and starting it did nothing.

Select findings in the inbox and choose Fix. Mendr starts one fix for each repository, covers up to ten packages in one pull request, and names those packages in its title.

The pull request list and page show each finding a pull request addresses, with the highest severity and earliest SLA deadline among them. Before, a pull request could show unknown severity and no finding after the Sep 13 repair engine change.

The inbox now lists only work that needs attention, with Filter and Display menus to narrow, group, and sort it. Planned and suppressed findings share the new On hold page, and the inbox search field is gone.

Mendr no longer publishes a repair that changes a .env file or anything under .github/; the agent must remove those changes first. A repair that changes an auth, crypto, migrations, or payments folder opens as a draft and lists those files.

Repair pull requests again follow the repository's pull request template, and they note a selected npm release that is inside the repository's release cooldown. Both stopped with the Sep 13 repair engine change.

With requester assignment on, a Jira ticket you create for a finding that has no fix is now assigned to you. Before, the setting applied only to findings with a fix.

Scan and repair settings now sit together at the edge of the repository header, and one line states when the last scan ran and how much it covered. The build-and-test setting moved out of the page into Repair settings, behind the header's slider icon.

Select findings across the inbox or findings list and give them an owner in one step, up to a hundred at a time. Each bulk assignment can be undone, and findings you cannot assign are reported rather than skipped in silence.

Mendr judges whether an advisory applies to the way your repository actually uses the package, and shows the verdict — exposed, conditional, unclear, or unlikely — with its confidence and the requirements behind it. A verdict ranks and explains a finding; it never suppresses one, changes an SLA clock, or decides what gets repaired. On Pro Beta.

Findings are grouped by the next move they ask of you: changes to review, decisions and input, ready pull requests and fixes, high exploitation risk, then overdue and due soon. A finding waiting on a scheduled review now reads as planned instead of idle.

Assign an open finding to yourself or another workspace member, then filter the inbox and finding lists by owner. Assignment changes stay with the finding.

The Not fixing now action shows planning and suppression together, including how each choice affects visibility and SLA tracking. The Planned queue now orders work by its return date.

Start a repository's first scan and add a workspace AI key from the inbox onboarding card. The page advances in place, so you can begin the first fix without losing your context.

Record why repair work is waiting, the next step, and when it should return. Planned findings stay visible with their SLA clock running and return to Needs attention when due.

When a large repository repair approaches a model request limit, Mendr checkpoints the completed work and continues in the same sandbox. Setup and file changes carry forward instead of starting over.

Send overdue and soon-due findings to Slack on a daily, weekday, or weekly schedule. Set the delivery time and route individual repositories to different channels.

Every fix now uses an AI repair agent and an independent AI review, so each fix needs a workspace AI key. Fixes without AI, @mendr revision requests, CI failure repair, conflict rebuilds, and the base-and-candidate advisory scan are no longer available.

When Jira authorization expires or needs updated access, workspace owners can reconnect it from settings without removing and rebuilding the integration.

Set story points, an initial status, and original-requester assignment for new Jira tickets. Repository defaults keep each team's tickets consistent without manual cleanup.

Repairs now report which project scopes and dependency sources were resolved and which remain. Partial coverage stays explicit instead of presenting a limited change as a complete repair.

Repair pull requests now follow the repository's pull request template while preserving the fix facts and verification evidence. Later metadata updates also preserve external edits.

Repair sandboxes now include pinned tools for Go, Rust, Python, Ruby, Java, Kotlin, and PHP. Mendr also handles nested project toolchains and pnpm 11 repositories.

Fix pages now group the reported change, repair checks, current GitHub status, and evidence gaps in one review summary. Inbox rows also state the next action.

Mendr no longer starts a repair from a Python package version that the scanner inferred but could not confirm in the repository. Affected findings now explain that the dependency version is unconfirmed.

The inbox remembers your priority filter for each workspace. Finding rows also show the Jira assignee, including when the issue is unassigned.

Tag changes now update every open finding view immediately. Jira links also open the correct finding after a workspace or repository context changes.

Generated pull request descriptions now put the change, security reason, compatibility result, and verification evidence in a shorter review-ready structure.

When a repair can proceed safely with an explicit assumption, Mendr records it and keeps working. Any owner call-out appears on the pull request before merge.

Repair pull requests now report the release guidance that Mendr checked, including migrations, removals, runtime requirements, and unresolved compatibility risks.

Mendr can run a separate review round against a repair candidate and revise the change when the review finds a concern. Any unresolved reviewer dissent stays visible on the pull request.

When a repair needs your choice, the fix page shows the question and available answers. The same repair resumes after you respond.

Mendr can investigate more than one repair candidate within a bounded run, compare the evidence, and publish only a candidate that passes the required gates.

When a repair depends on a runtime change, the fix page now shows the detected constraints, the available options, and the evidence behind Mendr's recommendation.

Repair pull requests no longer add an unrelated packageManager pin to package.json. The diff stays limited to the dependency that carries the advisory.

Fix pages now name each check on its own row: candidate gates, project checks, and GitHub verification. When no checks ran, Mendr says so and asks you to review the draft.

The repair sandbox now runs npm and pnpm under a Node runtime that your repository supports. Repairs on repositories with their own toolchain pin no longer fail during install.

A link to a fix, finding, or repository now opens in the workspace that owns it. When more than one workspace matches, Mendr asks which one to open.

When the default branch moves and a revision conflicts, Mendr rebuilds the branch from the latest head and reapplies the fix. Mendr also replies when the default branch already carries the remediation.

Fix pages now name the repository and whether a member or Mendr started the run. The repository name links to its page.

Mention @mendr on a repair pull request to request changes. Mendr checks the update, publishes it to the same pull request, and reports the revision number, the commit, and the changed files.

Fix pages show the current repair phase and a last-heartbeat time while an attempt runs, and refresh on their own until the fix completes. A long healthy run no longer looks stuck.

CI repair and merge repair now share one durable pipeline: the same planner, the same sandbox, and the same verification spine. Repairs resume from checkpoints after an interruption.

Mendr reads your target Node runtime before it plans a fix. When the safe fix needs a newer runtime, deployed applications get an explicit pin decision instead of a silent major bump.

The fix decision panel is now a terminal-style prompt: one question, the evidence behind it, and the exact change you approve.

Set a title template per repository so Mendr's pull requests match your commit conventions — Conventional Commits, ticket prefixes, or your own format.

Members control when Mendr creates Jira issues and which fields it fills in.

Finding pages show the full history of a vulnerability: every scan, repair attempt, and outcome, in order.

Connect Mendr to Vanta and open findings sync automatically, so compliance evidence stays current without manual exports.

Standard upgrades now run without AI. Mendr reserves the model for repairs that need reasoning, which makes routine fixes faster and cheaper.

Every repair PR includes a reviewer-scannable “Why this fix” section: the advisory, the chosen version, and the verification result.

Mendr analyzes what blocks a repair before it starts — peer-dependency conflicts, lockfile traps, parent version ranges — and shows the blockers on the finding.