> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/reference/changelog.md). # Product Changelog We're a small but mighty team that prides ourselves on regularly shipping new features. Find out about what we've been up to below. ## October 2026 ### October 10: Redesigned overview and reproduction proof steps **✨ New** * A redesigned overview puts SCA, SAST, container, and Prevent results on one page. Click a finding type to follow it from verdict to fixed or still open. * The **Needs you** panel on the overview lists the latest assessments, high-risk findings, and pull requests where the PR check found a problem nobody fixed or ignored. * The **Reproduction** tab shows numbered exploit proof steps. **What was proven** lists only the assertions the verdict rests on. **➕ Improved** * Vulnerability report triage and exploit reproductions appear in **Agents → Activity** alongside auto-fix work. * Vulnerability reports list exploitable verdicts first and unassessed ones last. Filter by repository from the stats strip; GHSA IDs link to their advisories. * The SCA **Exploitable** and **False Positives** tabs show reproduction-confirmed counts you can click to filter. Dev-only dependencies carry a "dev only" tag. * ArmorCode findings carry Konvu's confidence score as a `konvu.confidence_score` tag. Reproduced SCA findings are tagged `konvu:reproduced-exploitable` or `konvu:reproduced-false-positive`. ### October 8: Launching Konvu Guardrails Konvu Guardrails puts your security Controls in front of Claude Code at the edit, then checks every pull request against them before merge. Find it under **Prevent**, including in the free trial. Read [how Guardrails works](https://konvu.com/blog/how-konvu-guardrails-works) or [set it up for Claude Code](/konvu/prevent/claude-code-guardrails.md).
**✨ New** * Pick repositories, add optional context, and Konvu maps the Controls your code already applies, grouped by OWASP ASVS chapter. Each Control cites its ASVS requirement and the code that implements it. * Get an email or Slack message when mapping finishes. Turn it on in **Organization → Notifications**. * Roll the Guardrails plugin out to Claude Code with one managed setting. When the agent first edits code a Control covers, the plugin refuses that edit once and hands the agent the Control, with no model or network call. * Install the Guardrails GitHub App and turn on **PR check** to review every pull request against your Controls. Make the check required in branch protection to block the merge. * Ignore a PR finding as accepted risk or dismiss it as noise, with a required reason. The PR list keeps who decided and why, even after a later run passes. * The Prevent page shows, for each Control, how many agent edits it steered and which pull requests the check caught. * See every enrolled computer's status in **Integrations → Claude Code**, and revoke or restore any of them. The **Coding agents** switch on the Prevent page pauses steering for the whole company. ### October 3: Per-repository triage instructions and reproduction verdicts **✨ New** * Write triage instructions per repository in **Inventory → Knowledge**, such as behavior that is by design. Konvu applies them at the next triage. * When reproduction disproves a finding, its verdict changes to False Positive and the evidence appears on the **Reproduction** tab under "Not reproducible." * Click a summary bar to filter vulnerability reports by severity, attacker, or verdict. Sorting and filters persist in the URL. **➕ Improved** * The SCA triage page loads about 3x faster in large workspaces: 1.3 s, down from 3.5 to 4 s. * Out-of-scope findings say why they weren't assessed and link to the repository's **Coverage** page. * ArmorCode findings show their ArmorCode ID in the source badge, with an **Open in ArmorCode** link. **🔧 Fixed** * GitHub integrations showed every daily sync as failed while repository data synced correctly. * Wiz imports timed out while polling long-running reports. ## September 2026 ### September 29: Read-only API keys and report automation **✨ New** * Choose **Read only** or **Read and write** when creating an API access key. Read-only keys can retrieve data across the Konvu API but cannot change it; new keys default to read-only. * Use API keys for the full vulnerability-report CLI workflow: submit and inspect reports, read reproduction evidence, rerun triage or reproduction, rate assessments, and dismiss or reopen reports. **➕ Improved** * Existing API keys remain read and write, so SCA and SAST submission, assessment, rating, dismissal, and other automations continue without interruption. ### September 27: Finding page tabs, reproduction for all, and vulnerability report dismissal **✨ New** * Finding pages navigate via Analysis → Reproduction → Remediation tabs, replacing the old agent breadcrumb. All four finding types use the same layout. * Exploit reproduction is open to every organization member, not just admins. Select up to 20 SCA or SAST findings from the triage list to bulk-start reproductions. * Dismiss or reopen vulnerability reports from triage or the detail view; bulk-dismiss directly from the Open list. * Attach an external reference ID when dismissing any SCA, SAST, or report finding; it's stored separately from the comment and appears on the detail timeline. Each finding detail page shows a copyable Konvu ID. * Vulnerability reports show the affected version range and whether a fix is known. * Rate vulnerability report assessments from the execution row, using the same controls as SCA and SAST findings. **➕ Improved** * Triage no longer silently defaults to your main branch or active repositories. A "Hide findings from deactivated repositories" toggle in Customize view makes that filter explicit. * The Reproduction tab shows the full run detail: assertions, what was proven, the sandbox, and evidence captures. A proven exploitable finding now shows `Exploitable ✓✓` in the triage list. **🔧 Fixed** * Disproven reproduction runs appeared as "Not reproduced," identical to an inconclusive result. * Inventory asset tables and the generated-rules selector stopped loading for organizations with more than 25 repositories. ### September 20: Triage vulnerability reports from the CLI **✨ New** * `konvu finding vulnerability-report list` and `counts` filter reports by assessment, state, source, CWE and attacker position, group them, and print JSON, a table or CSV — the same shape the SCA commands already had. * `konvu finding vulnerability-report get` shows one report, and `--include` widens it with the reproduction, the narrative behind the verdict, or the stage logs. * `konvu finding vulnerability-report reproduce` runs a reproduction without leaving the terminal. `--version-mode latest` checks the current release instead of the reported one. * `konvu finding vulnerability-report reassess` re-runs triage and records what was wrong with the previous assessment, so the reason stays with the report. * `konvu finding vulnerability-report rate` records whether you agree with Konvu's assessment, with tags for what was strong or weak about it. ### September 18: Scanner exports as vulnerability reports **✨ New** * Vulnerability reports accept JSON, SARIF, and PDF files alongside Markdown and plain text. A JSON or SARIF export keeps its structure on the report page instead of collapsing into prose. * Upload a report by dropping its file into Triage > Reports. The title comes from the file, so there is nothing to type. * A scanner export holding many findings is split into one report per finding before triage, so each is deduplicated and reproduced on its own. Findings are copied out of the export verbatim, and each report links back to the file it came from. * `--source` on `konvu finding vulnerability-report submit` records the tool that produced a report, so one scanner's findings are distinguishable from another's in Triage. * Submit PDFs from the CLI with `--file report.pdf`. Konvu extracts the text on arrival, as it does for a PDF uploaded from the dashboard. **🔧 Fixed** * A SARIF export submitted without a title was named `{`. It now takes the scanning tool's name. * The CLI accepted a PDF and uploaded an unreadable body. PDFs are now sent base64-encoded, and any other non-text file is refused rather than uploaded. ### September 15: ArmorCode dismissals, live inventory maps, and assessment improvements **✨ New** * Dismiss and reopen ArmorCode-imported SCA findings from Konvu's triage view. The decision writes back to ArmorCode: ACCEPTRISK for a deliberate accept, FALSEPOSITIVE for a clear miss. * Inventory maps show your actual codebase, not sample data. A Generated Rules tab under Inventory → Controls lists every context rule Konvu inferred from the mapping, each with its source evidence. **➕ Improved** * Bulk-deliver up to 100 completed ArmorCode assessments at once; pause finding import without affecting delivery. * Request a SAST or SCA assessment from the finding detail page or triage list, without the CLI. * Reproduction results have a dedicated page at their own URL, bookmarkable and linkable from tickets. The page shows recommendations, vulnerable endpoint, root cause, blast radius, and an attacker-to-target graph. * Vulnerability reports are visible to all organization members; the Alpha badge and admin gate are gone. * Inventory endpoints, data objects, and controls each have a shareable URL that survives browser refresh. * Filter Inventory and SCA triage by repository status. Inactive shows historical assessments for archived repositories. **🔧 Fixed** * Findings across all four finding types were showing "Assessing, running now" when no assessment was in flight. * SCA triage Open filter was including fixed and dismissed Dependabot findings when a matching ArmorCode finding remained open. ### September 11: Bug bounty report triage, ArmorCode SAST write-back, and container improvements **✨ New** * Vulnerability reports from connected HackerOne programs and GitHub Security Advisories appear in a new Disclosures triage surface with full reproduction results and evidence. * SAST findings are now delivered to ArmorCode alongside SCA. Each verdict lands on the matching ArmorCode finding as a comment and `konvu.assessment_result` tag. * Push a single finding's verdict to ArmorCode from its detail page, without waiting for the next assessment cycle. * Self-hosted deployments with secret verification now show on-prem setup guidance and empty states when configuration is incomplete. **➕ Improved** * Container triage lists show SCA-style summaries, scanner provenance, and accurate image references. Jump to the matched Wiz finding directly from the assessment drawer. * The ArmorCode integrations view shows matched repositories with SCA/SAST assessment coverage visible side by side. * Wiz reports recover automatically on disconnect; scheduled polling jobs are cleaned up when you remove the integration. * Data Forwarding and Notification settings are accessible to all organization members, not just admins. * Konvu commits dependency fix PRs after a 30-minute quiet period, down from 60 minutes. **🔧 Fixed** * Some findings were routed to the wrong triage tab based on their repository's coverage state rather than the finding's own assessment status. * Misleading verdict labels and wrong logo on Wiz container check rows. ### September 4: Secrets detail page, inconclusive triage tab, and PR auto-fix **✨ New** * Secrets findings open into a dedicated page. Verdict, validity, impact, and exposure each get their own section with explicit evidence. Shared finding links preserve the masked credential context. * Triage context filters moved to a persistent left column, visible across all four triage surfaces without opening a menu. * Konvu commits fixes to eligible developer PRs after a one-hour quiet period, when the PR is under 500 lines and a confident fix is available. A few fixes have already landed. * Wiz container findings are qualified against the ECR image digest synced from your AWS integration, improving assessment accuracy for image-pinned findings. **➕ Improved** * The ArmorCode connection flow now validates your API key as you type. Automatic assessment delivery requires explicit opt-in. * Choose Compact or Detailed comment format per ArmorCode destination. Detailed includes the full AI, follow-up, and manual-review evidence trail. * Org Settings splits into Notifications and Data Forwarding. Slack and email settings are under Notifications; ArmorCode and Wiz delivery live under Data Forwarding. * Remediation plans show API-change conclusions across grouped plans, finding rows, plan headers, and banners. **🔧 Fixed** * An inconclusive SCA finding was labeled "Unassessed" in two places and "Inconclusive" in a third. All three locations now use "Inconclusive". * "Revoke" renamed to "Go to provider" on secrets triage rows. Konvu does not revoke credentials. ## August 2026 ### August 28: Secrets beta, ArmorCode write-back, and Destinations page **✨ New** * Secrets triage is in beta for all workspaces. Each finding answers three questions with evidence: is the credential live, can an attacker reach it, and what is the exposed surface. Valid secrets cost under ten cents each to assess. * ArmorCode SCA integration: import findings from ArmorCode, assess them in Konvu, push verdicts back as a comment and verdict tags. ArmorCode stays your primary dashboard. * A new Destinations page collects every output from Konvu in one place: automatic ArmorCode and Wiz pushes, a delivery log, Slack and email toggles. **➕ Improved** * Secrets triage sorts by actual exposure: validity, impact, and exposure scored independently, with proven-exposure findings first. Quick filters match. * npm dependency trees are more complete. Packages brought in through optional or peer edges were being dropped and excluded from assessment. * SAST remediation plans appear in triage alongside SCA. Plans are shareable with a direct link, and partial previews show expected files and the failure reason when a full diff can't be built. **🔧 Fixed** * Assessment routing was using the wrong repository record, silently affecting 4,107 open findings. Routing resolves through each finding's own repository. * SAST severity scoping was missing from the digest, inbox, and autofix, causing out-of-scope findings to appear in those queues. Findings that can never be scheduled no longer show "being assessed." * Findings with no verdict say why: private registry not configured, budget limit reached, or the agent's own explanation when the outcome was inconclusive. ### August 21: Secret severity scoring, faster triage operations, and SAST persistence **✨ New** * Secret findings score validity, impact, and exposure as independent signals and combine them into an overall severity. The redesigned panel structures the verdict as three direct questions: can this credential be used, what does the leak grant access to, and how exposed is it. (Beta) * SCA assessment verdicts land in ArmorCode as rich comments on matching findings as each conclusion is produced. **➕ Improved** * SAST triage verdicts, investigation ratings, and remediation plans survive scanner integration deletion and reattach on resync. * The daily exploitable Slack digest catches findings that flip to exploitable after their initial assessment, not just those that qualified on first analysis. Weekly Slack digests are on by default for all workspaces. **🔧 Fixed** * The SAST Activity tab on large workspaces (400+ repos) was returning errors; it loads correctly. * SAST investigations dispatch highest-severity findings first. The order was inverted in April, sending low/info ahead of critical/high. * The credits history page crashed for accounts with more than one SAST-linked credit row. * Black Duck Polaris npm, PyPI, Composer, and NuGet findings were stored with display names instead of package coordinates, blocking assessment and autofix. Coverage is restored for about 8,500 affected findings on large accounts. * Some SCA findings automatically dismissed earlier this week have been reverted; credits charged for those assessments have been refunded. ### August 14: GitLab finding dismissal, partial remediation plans, and Polaris for all **✨ New** * Dismiss and reopen GitLab SCA and SAST findings directly from Konvu. Works for GitLab Dependency Scanning and SAST detections via your self-hosted broker. * Black Duck Polaris is open to all users. The connect dialog includes a region picker (US, EU, or custom) and a credentials-in-broker mode that keeps your Polaris API token in your own broker. * Remediation plans appear even when private dependencies block a complete fix. A plan card surfaces the target version, API changes, and the exact lines in your code where breaking changes land. * Filter the Secrets triage tab by repository or provider. Both filters are linkable from the URL. * Multiple GitHub Self Hosted integrations per company (one per GitHub App installation). **➕ Improved** * Self-hosted integration setup is now a single copy-pasteable command in a terminal block. Reopenable from the integration gear icon after initial setup. * SCA, SAST, container, and secrets finding APIs all include `triage_url`, a direct link to the finding's triage page. **🔧 Fixed** * Triage verdicts remain visible when AI assessment is turned off for a repo. Disabling assessment previously hid verdicts that had already been produced. * On-premise static analysis no longer requires connectivity to Konvu's cloud. The agent was calling back for a token, blocking jobs in air-gapped deployments. * Polaris findings link to the correct SCM repository and branch. Polaris sync no longer overwrites the repo's default branch. * SCA triage header no longer counts unassessed findings as "being assessed." * Assessments that exhaust the analysis budget mid-run are classified as failed rather than stuck with no status. ### August 7: SAST remediation plans, Polaris integration, and secret scanning **✨ New** * SAST findings appear on the Remediate board. Preview the proposed fix and accept it as a PR the same way you do for SCA vulnerabilities. * Black Duck Polaris SAST findings can be ingested through your on-prem broker. Configure the Polaris integration from the Integrations page. * Secret scanning triage is on by default for all workspaces. A proof panel shows what each credential grants access to and whether it validated live, and secrets found across multiple repositories are grouped so you review and revoke once. **➕ Improved** * GitLab SAST findings feed into the SAST triage pipeline for self-hosted GitLab integrations with SAST scanning configured. * The triage list uses infinite scroll instead of pages. Going back preserves your filters and scroll position. * Remediation plans and PR generation are separate steps. Enable plans per repository from the coverage page; opening PRs still requires the autofix integration configured separately. * The Credits page has a new layout with an on-page ledger, a consumption chart, and a dedicated remediation credits card. **🔧 Fixed** * "Needs input" questions were generated but never shown to users. Answering a question now updates the finding's verdict, and empty command output counts as a valid response. * Remediation plan previews were stuck in "Previewing" indefinitely. Fixed the preview task to correctly identify which integration to use. * SCA findings were charged multiple credits when a scanner reported the same vulnerability across several manifests. Each triage row is charged once. ## July 2026 ### July 31: Pipeline relay bar, Needs input table, and Remediate modal **✨ New** * The Pipeline page now shows both stages of your workflow together. A relay bar connects Argus (triage) and remediation, each with live counts scoped to your current filter. * Filter Pipeline findings by type: SCA, SAST, or Container. Each assessed finding shows the agent's live reasoning step as it works. * The "Needs input" tab uses the standard findings table. Sort, filter, and act on stalled findings the same way as every other tab; the grouped-inbox view is gone. * Remediate plan and autofix job share one modal for the full lifecycle: diff preview, PR status, and job outcome. **➕ Improved** * Hover the ongoing-assessments chip in the nav bar to see which findings are actively being assessed, their type, progress, and ETA. * Assessment summaries no longer appear cut off mid-sentence. * Inventory repo drawer: J/K keyboard navigation between repositories without closing the drawer, with an active-row highlight. **🔧 Fixed** * "Default branch only" on the Triage page did nothing when unchecked; the branch filter and all derived counts were locked to the default branch. * Several Pipeline page fixes: failed findings are clickable, the live trail appears next to "Assessing" findings, and the remediation relay bar no longer shows for workspaces without autofix configured. * Remediate empty-state "Set Up Integration" opens the setup modal directly. * Autofix job detail modals showed a blank error instead of job details. ### July 24: Remediate for all, GitLab SCA, and dismissal breakdowns **✨ New** * The new Remediate page is visible to all users. Your team can review plans, preview diffs, and accept fix PRs without admin access. **➕ Improved** * GitLab Dependency Scanning findings import into SCA triage on self-hosted GitLab setups. * Dismissed tabs in SCA and SAST triage show breakdowns by reason, reviewer, and dismissal source. Filterable. * Filter SCA triage by repository glob or prefix. Type `org/*` to match all repos in an organization. * The remediation review step shows more before you act: PR body, diff preview, and a risk summary alongside the affected CVEs. Plans have shareable URLs. * SAST repository filter persists across triage tabs and matches SCA. * Per-repo SCA and SAST triage chips in the Integrations repositories table, replacing raw issue counts. * Container finding detail has prev/next navigation (↑/↓ or J/K), matching SCA and SAST. **🔧 Fixed** * SCA triage repository filter locked to one repo after picking it; the dropdown showed "No matches" for all others. * SAST triage repository filter doubled the org name (`Org/Org/repo` instead of `Org/repo`). * Accepting a remediation plan removed the card from the board until a page reload. * SCA assessments had stopped for workspaces relying on the default qualification model after its provider retired it. * Finding activity timeline loads in under 2 seconds, down from over 2 minutes. ### July 17: JFrog private registries, SAST bulk export, and credits page **✨ New** * Private npm, Maven, and PyPI registries on JFrog Artifactory work for both triage and autofix. Add credentials from the Integrations page. * A new API endpoint accepts SCA findings directly, without connecting your scanner. Minimum required fields: CVE ID, package name, and repository. API-ingested findings appear under a Konvu API card on the Integrations page. * A Credits page in Org Settings shows your assessment budget split by product (SCA, SAST, container), recent activity, and full transaction history. * Dismiss GitHub CodeQL SAST findings directly from Konvu. Works on cloud and self-hosted GitHub installations. * Select SAST findings across pages and bulk-export as Markdown. Matches the bulk-select flow already in SCA triage. * Rate SAST investigation verdicts with thumbs up/down. Assessment history and an activity timeline are on every SAST investigation page. **➕ Improved** * The Overview header has a SCA | SAST | Container scope toggle that drives the flow chart and recent assessments panel. * Inventory triage chips show per-product counts (SCA and SAST) with a coverage ring and totals on hover. SAST-only repos no longer show "—". * Filter SAST triage by GitHub organization, matching SCA triage. **🔧 Fixed** * NuGet packages.config manifests are scanned. Dependabot findings on these manifests had no triage coverage because Konvu never analyzed those manifest files. * AWS Inspector container finding sync had been silently frozen. Affected workspaces are back in sync. * Creating new GitHub integrations returned errors since a recent backend deploy. Integration setup works again. * SCA triage page timed out on every load for large workspaces. * The container triage needs-input filter returned incorrect results. ### July 10: Container triage checklist, Snyk container findings, and CodeQL for self-hosted **✨ New** * Snyk joins AWS Inspector as a container scanner. Enable it with the container add-on and Snyk findings flow into the same triage queue. * Container triage: the vulnerability card shows the OS exploitability checklist with per-condition verdicts, sortable rows, and links through to evidence. * CodeQL imports from self-hosted and on-prem GitHub integrations. Previously cloud GitHub only. **➕ Improved** * Assessment severity scoping now applies to SAST and container triage, not just SCA. Configure per-repository from agent coverage settings. * New companies default to Critical and High severity assessments only. * Credit history shows which assessment pool each transaction moves. **🔧 Fixed** * SSO customers missing from the user list and not receiving the weekly digest. * The overview "Unassessed" count included closed findings. Scoped to open only. ### July 3: SAST auto-fix, priority tiers, and remediation previews **✨ New** * Auto-fix works on code vulnerabilities. Exploitable SAST findings get a Generate PR button; fixes land on the Autofix page alongside dependency bumps. * Sort and filter SCA findings by priority tier: act now, urgent, standard, or low. A badge shows the factors behind each tier. * Preview a remediation plan's exact diff before any PR opens. Nothing gets pushed. * Private npm registries. Add a token on the Integrations page and triage and auto-fix resolve your private packages. * Container findings open into a full investigation page: verdict, analysis trail, evidence from the image itself. **➕ Improved** * Threat profiles are visible to the whole team, previously admins only. Crown Jewel is reserved for production assets; stale repos auto-classify as peripheral. * Container triage gets the SCA quick tabs: exploitable, false positives, high-risk, not assessed. * Large workspaces load faster: SCA triage about 5x, overview about 4x, container triage no longer takes 20+ seconds. **🔧 Fixed** * Findings outside your assessment severity scope no longer stick as "Not assessed". * Empty rows in the autofix CI checks panel. ## June 2026 ### June 27: Remediation strategies, threat profiles, and container triage **✨ New** * Choose how fix PRs are grouped: batched (up to 3 bumps per PR), one PR per dependency, or most CVEs cleared first. CISA KEV status now weighs into the ordering. * Each repository gets a threat profile: what the codebase does, its attacker position, whether it handles credentials, customer data, or auth. Feeds prioritization. (Early access) * Point Konvu Community fix PRs at a separate private repository. Also new: bulk re-reproduction against the latest commit, a live patch activity feed, and custom fix instructions. * Cap monthly AI assessments from account settings. **➕ Improved** * Container findings group by repository and CVE instead of image version. A toggle switches between all versions and latest per repo. * Autofix runs have a dedicated page. The agent reviews each fix and confirms the vulnerability is resolved before opening the PR. * Large Gradle monorepos resolve reliably, thousands-of-modules included. Build failures are isolated; missing Gradle distributions are fetched automatically. **🔧 Fixed** * Findings no longer stick in `failed` after a successful reassessment. * Maven qualification failures under dependency-resolution rate limits. ### June 26: Push Konvu exploitability verdicts back to Wiz **✨ New** * Push Konvu verdicts back to Wiz. Turn on **Push results directly to Wiz** and every container finding confirmed exploitable gets a `Konvu: Exploitable` note on the matching Wiz finding. Notes only: status and severity are never touched. See [Wiz](/konvu/get-started/bring-in-findings/container-and-cloud-scanners/wiz.md#forward-assessments-to-wiz-optional). ### June 19: Daily exploitable Slack digest and per-repository severity scoping **✨ New** * Get a daily Slack digest of findings confirmed exploitable in the last 24 hours: CVE, package, repository, and an evidence-backed summary linking to the finding. Enable per workspace from the Slack panel; quiet days send nothing. See [Slack Notifications](/konvu/triage-and-remediation/monitor-and-deliver/notifications/slack-daily-digest.md). * Choose which severities Konvu auto-assesses, per repository, from agent coverage settings. Also configurable via API and CLI (v2.0.1). See [AI Triage Configuration](/konvu/administration/assessment-settings.md#scope-assessments-by-severity). **➕ Improved** * Fuller dependency paths for npm findings: when the same package version is installed in several places, every package pulling in the vulnerable dependency is listed. **🔧 Fixed** * Attacker controllability evidence now shows the supporting code excerpts, not just file names. ### June 12: Container triage for all, Wiz support, and Konvu Community re-assessment **✨ New** * Triage your container findings in Konvu, now open to all users. A guided onboarding ranks your image estate by priority, and a remediation view lists each confirmed-critical finding with the exact package version to bump. (beta) * Pull container findings from Wiz. Wiz joins AWS Inspector as a container scanner, feeding the same triage flow and evidence you already use for SCA and SAST. **➕ Improved** * Add context to a bug bounty report in Konvu Community and the agent re-runs its assessment using that information immediately, delivering an updated verdict without a manual review cycle. * After the agent assesses a report, Konvu drafts a response to the submitter automatically. You review it, adjust if needed, and send. * Receive your weekly vulnerability digest in Slack. Connect your workspace from the integrations settings and the weekly summary of exploitable findings, false positives, and pending items lands directly in a channel. * The Konvu Community submission queue now displays how many raw reports collapsed into unique findings through deduplication, so the scope of noise filtering is visible before you open a single report. ### June 5: Weekly Digest, container finding pages, and bug bounty deduplication **✨ New** * Your workspace now receives a weekly email digest summarizing what Konvu assessed that week: exploitable findings, false positives, and items still pending. Your team gets the key signal without opening the dashboard. * Container vulnerability findings now have full detail pages: assessment evidence, analysis trail, and a coverage card on the overview, at parity with SCA and SAST triage. * Duplicate bug bounty reports in Konvu Community are now automatically grouped. Matching reports surface with a Duplicate badge and collapse under the canonical entry, keeping your triage queue clean as submission volume grows. **➕ Improved** * Connecting an AWS account now walks you through a guided 3-step flow, with ECR container registry available as an explicit option in the scanner step. * The overview flow chart now starts from your total finding count, splitting into assessed and unassessed before severity and verdict. You can see exactly what fraction of your backlog has been triaged. * The Konvu Community home page now opens with your highest-exploitable findings and a reproduction funnel, so backlog priority is visible before you open a single report. ## May 2026 ### May 29: Agents workspace, CodeQL import, and automatic autofix **✨ New** * A new Agents section in the dashboard gives your specialist agents a home. See each agent's coverage at a glance: repos in scope, connected sources, and active skills, with Argus's triage pipeline showing live ongoing and completed counts. * Import CodeQL findings from GitHub code scanning directly into Konvu, alongside Semgrep and Snyk. Grant the GitHub App's code-scanning read permission and alerts flow into your findings automatically. * Turn on automatic autofix so Konvu opens a fix PR as soon as a finding is qualified exploitable, with no manual trigger. Enable it per repository or set it as the default for new repos. **➕ Improved** * Finding detail now shows the affected package version on the What card, so you can see which version is in play without opening the dependency tree. **🔧 Fixed** * Fixed the follow-up question prompt appearing on closed findings in the inbox. * Fixed the Auto-Fix setup prompt showing even when the integration was already configured. * Fixed assessment status not displaying while a finding was being re-assessed. * Fixed deleting an AWS integration leaving its container scan history behind. ### May 22: AWS Inspector integration for container and host vulnerabilities **✨ New** * Connect your AWS account to bring AWS Inspector findings into Konvu. Set it up with an IAM policy attach or a CloudFormation template, and Inspector vulnerabilities flow in automatically. * Triage container and host findings in a dedicated list, with the same assessment structure and evidence you already use for SCA and SAST. ### May 15: Command palette, bug bounty triage, and autofix hardening **✨ New** * Press Cmd+K from anywhere in the dashboard to jump to a finding, switch admin views, or trigger shortcuts. * Konvu Community is live: ingest bug bounty reports from HackerOne or GitHub Advisories, and Konvu's agent reproduces, validates, and assesses exploitability for each report. Reproduction steps and the exact commands used are attached to every assessment. * The Inventory page has a new chip-based search bar and quick filters for common technologies, so you can scope by language or stack without typing the full query. **➕ Improved** * Autofix PR descriptions are now built for a 5-second read: version change, relevant changelog, what was applied, and an explicit "no breaking changes" line. * Autofix PRs stay in draft until CI confirms the change passes. They no longer auto-undraft on unverified runs. * Each autofix job runs with isolated, per-job credentials. Prompt-injection defenses across the agent pipeline were also tightened. * Direct vs transitive dependency labels stay accurate after auto-qualification. SCA triage now uses Konvu's dependency analysis alongside the scanner's flag when classifying. * Triage tabs are now labeled SCA and SAST. * Triage and inventory pages load faster: SCA dependency-graph reads moved to a static SQLite snapshot, and an N+1 query on `/integrations` was removed. **🔧 Fixed** * Fixed AI Triage and onboarding repo selectors showing repositories with revoked SCM access. * Fixed autofix selecting a newer failed retry over the older job that produced a successful PR. * Dropped the misleading "Fix delivered in N min" time estimate from the autofix popover. ### May 8: Code-level autofix and end-to-end remediation visibility **✨ New** * Autofix can now generate PRs with code-level changes for vulnerabilities where a dependency version bump isn't enough. * A new Remediation column on the triage list shows the full autofix lifecycle for each finding, with a distinct "Fixed via Auto-Fix · PR #N" pill when Konvu's PR delivered the fix. * The Overview now includes a Remediation column tracing how exploitable findings flow through autofix into merged PRs. **➕ Improved** * The "Generate PR" button on the finding page transforms as the job runs (working, ready, merged, failed). A post-merge banner confirms when the scanner has verified the fix, or shows "awaiting next scan" while waiting. * Triage tabs are now split between Open and Closed, so dismissed and fixed findings stay out of your way without extra clicks. * Fixed findings show a strikethrough on the assessment badge, making it obvious at a glance which findings are resolved. ### May 1: Autofix for SCA findings **✨ New** * Autofix is live. Generate a fix PR for any SCA finding straight from Konvu. The PR carries the version bump, the exploitability context, and a link back to the finding so engineers can merge it without context-switching. * Autofix works on self-hosted deployments, including GitLab, with zero-touch setup. Credentials to your self-hosted infrastructure are provisioned automatically when you enable the integration. * The public SAST investigation API now mirrors the SCA shape, with verdicts and supporting evidence under a unified response structure. Public docs were rewritten with clearer field descriptions, sample payloads, and a glossary. **➕ Improved** * Clicking "Create PR" now checks that the autofix integration is installed and has access to the target repo. If something's missing, you get a modal with a direct link to the GitHub install settings or GitLab token, instead of a silent failure. * The autofix dashboard refreshes automatically and shows clearer error states when a job fails. * Severity filter chips now toggle off on a second click instead of requiring you to clear filters separately. **🔧 Fixed** * Fixed autofix integrations occasionally getting stuck in "in progress" after deployment. * Fixed autofix PRs being hidden by the "uses Konvu infra" filter on the SCM PRs list. ## April 2026 ### April 24: Stronger SAST triage and a unified findings API **➕ Improved** * More accurate SAST triage, especially on multi-language codebases. The agent now routes findings to the right playbook using scanner-provided CWE IDs, runs deeper auth-layer and CI threat-model checks, and verifies that existing sanitizers don't already mitigate a finding before marking it exploitable. * The public SCA findings API now mirrors the dashboard. Verdicts and supporting evidence live under a unified `assessment` object with per-analysis sub-sections, and legacy fields like `evidence`, `latest_recommendation`, and `calculated_recommendation` have been removed. * Self-hosted scans run faster and handle spiky volumes more smoothly. Broker-supported integrations now dispatch in parallel so total daily sync time is bounded by your slowest integration, and the controller throttles backend requests to keep load steady. ### April 17: Markdown export, self-hosted auto-fix, and assessment context **✨ New** * Share findings as Markdown from the triage list so engineering teams without Konvu access can review evidence-backed summaries. Select multiple findings and use the bulk Share action to export them. **➕ Improved** * Findings that cannot be assessed now explain the specific reason: a safe version was detected in your codebase, the version is unofficial, the static analyzer did not run, or vulnerability data is missing. You no longer see a generic "Not assessed" status with no path forward. * Auto-fix for SCA now works in self-hosted deployments. Automated fix suggestions are delivered through your existing self-hosted infrastructure. * The SAST investigation page now supports j/k keyboard shortcuts to move between findings. * The multi-path minimap routes edges cleanly and lets you click any node to cycle through paths passing through it. * Filter results are now copyable in one action: select any filter type and copy all matching values to your clipboard. Results auto-expand as you scroll through them. **🔧 Fixed** * Fixed direct vs transitive dependency classification for GitHub repositories, which had been lost in a March infrastructure migration. * Fixed assessment badge counts and finding redirects on the Inventory page showing incorrect values. ### April 11: CLI public release, SAST triage filters, and self-hosted GitLab **✨ New** * Konvu CLI is now open source on GitHub with packaged releases and documentation. Skills load on opt-in, so you control which capabilities are active. * Filter SAST findings by vulnerability type (Data Flow, Configuration, Design), explore multipath assessments with a new minimap, and review condensed assessment details without opening each finding. * Self-hosted customers on GitLab can now sync repositories through the broker/controller flow. **➕ Improved** * The revamped SCA triage page is now the default for all users. Branch filtering works end-to-end and pages load faster. * Assessment steps that rule out exploitability now get a green highlight, so you can immediately spot where the exploitation chain breaks. * Auto-fix now supports GitLab and responds to GitHub PR review comments in dedicated conversation threads. * API documentation redesigned with a branded reference page, authentication guide, and quick start section. **🔧 Fixed** * Fixed findings landing in wrong triage tabs: failed findings no longer appear under "Needs Input," and multi-path findings with only false-positive paths are now correctly marked. * Fixed "No recommendation" findings missing from the "Not assessed" tab. * Fixed reachability data mapping for Endor Labs and Arnica integrations, improving dependency graph accuracy. ### April 3: Redesigned triage page, Arnica integration, and assessment credits **✨ New** * The triage page has been fully redesigned with a cleaner layout, simplified filtering, and assessment summaries visible directly on the list for faster review without opening each finding. * Import your Arnica SCA findings into Konvu for AI-driven exploitability analysis. * Track your assessment budget with a credit counter in the header. The onboarding flow now introduces the credit system and helps you focus assessments on the repositories that matter most. **➕ Improved** * Dashboard loads significantly faster for large accounts. Findings and filter counts now load separately so the first page renders immediately. * SCA findings now display consistent vulnerability IDs and severity across the dashboard and CLI. * Triage navigation is streamlined. Requests for context are now grouped under Triage instead of showing as a separate menu item, and the context-needed banner only appears when an assessment actually needs your input. **🔧 Fixed** * Fixed the onboarding repo selector showing repositories without source code access, which could lead to selecting repos where assessments cannot run. ## March 2026 ### March 27: Follow-up commands, triage summaries, and Maven accuracy **✨ New** * Follow-up questions now include a suggested shell command you can copy and run to gather the information the triage agent needs. Each question also explains why it's being asked, visible under a "Why is this needed?" toggle. **➕ Improved** * More accurate dependency analysis for Maven projects. Parent POM hierarchies are now resolved, so transitive dependencies inherited through parent modules are correctly attributed. * The triage agent automatically retries assessments when its reflection phase identifies a low-confidence verdict, improving accuracy without manual intervention. **🔧 Fixed** * Fixed dependency graphs showing empty or overlaid chains on some SCA findings. * Fixed assessments not launching for transitive dependencies that lacked a dependency tree. * Fixed dismiss actions appearing on Endor Labs findings where dismissal is not supported. * Fixed project completion failing when repository URLs had case mismatches between scanner and Konvu. ### March 20: Re-trigger assessments, improved reachability graphs and default branch support **✨ New** * Re-trigger an AI assessment on any finding. Useful when you've updated your code and want Konvu to re-evaluate exploitability with fresh evidence. **➕ Improved** * When code reachability analysis is inconclusive, the dependency graph shows the missing link between your application code and the vulnerable dependency, giving you visibility into why a finding couldn't be fully assessed. * Konvu automatically detects and respects each repository's default branch (e.g., `develop` instead of `main`), so triage filters and assessments target the correct branch. **🔧 Fixed** * Resolved cases where some Go-based findings were missing their dependency tree visualization. All Go vulnerabilities now show the full dependency path. * Fixed the Request for Context panel badge showing only the repository name instead of the full GitHub organization and repository (e.g., `org/repo` instead of just `repo`). * Fixed the "Share Question" button appearing disabled even when a question was selected in the Request for Context panel. * Fixed the integration page not displaying the GitHub repository link. * Fixed unstable sort order in the SCA findings list when multiple findings shared the same manifest, vulnerability, and dependency combination. * Fixed the inbox drawer getting stuck when clicking through from a "Request for Context" item to its finding detail page. ### March 14: KEV exploitability signals, API keys, and dependency graph visibility **✨ New** * Vulnerability cards now show whether a CVE is listed in VulnCheck's Known Exploited Vulnerabilities catalog, making it easier to spot findings actively exploited in the wild. * SCA findings display the exact fix version on the vulnerability details page, no more searching advisories to figure out what to upgrade to. * Finding detail pages include an interactive dependency graph alongside reachability paths. Trace how vulnerable packages connect to your code without leaving the page. * Generate API keys from Settings to integrate Konvu data into your own tools and automation. **➕ Improved** * Redesigned triage page with a cleaner layout and faster navigation for working through large finding volumes. * A new GitHub organization filter lets you scope Inventory and Triage views to specific orgs. * The Endor Labs integration setup separates credential errors from namespace errors, with clearer messages and a cleaner modal layout. * Integration API request logs redact credentials automatically for safer auditing and debugging. * Triage error messages include specific failure reasons, so you can diagnose issues without guessing. **🔧 Fixed** * Fixed AI assessment marking a finding as exploitable even when all analyzed code paths were false positives. * Fixed low conclusiveness scores (e.g., 21%) being shown when they were below meaningful thresholds. * Fixed requests for context appearing on findings where AI assessment was disabled, even though the finding correctly showed "Not assessed". * Fixed inflated request badge counts (e.g., 50) when only a few items were actually listed. * Fixed the "Needs input" filter including findings that were already properly triaged. ### March 7: iOS and Android platform support, live reasoning indicator, and triage deduplication **✨ New** * iOS and Android vulnerabilities are now tagged by platform. Konvu detects mobile environments from project files and surfaces findings with the correct platform context. * Permanently failed assessments are now marked as "Failed" — a distinct status from "Not Assessed" or "Inconclusive." You can immediately see which findings need manual attention rather than waiting on retries that will never succeed. * A live reasoning indicator now shows which parts of your code the AI is analyzing in real time as it triages a finding. **➕ Improved** * The triage follow-up inbox now deduplicates questions across similar findings. Large accounts that previously saw \~80 redundant questions per batch now see \~30 unique ones. * The onboarding welcome page has been redesigned. **🔧 Fixed** * Fixed several import reliability issues: race conditions during concurrent imports, connection timeouts, silent failures, and cascading errors that blocked subsequent imports. * Fixed duplicate vulnerability signatures inflating confidence scores in triage recommendations. * Fixed stack analysis status always showing "not run" on the finding detail page after analysis had already completed. * Triage agents now explore the full repository in monorepo projects, not just the manifest subdirectory. ## February 2026 ### February 27: User input for triage assessments and overview redesign **✨ New** * You can now answer the triage agent's clarifying questions to resolve inconclusive findings. When a finding can't be fully assessed, the agent generates targeted questions and re-runs analysis with your answers. Find findings waiting for input using the new "Has follow-up question" filter on the triage page. * The Overview page has been redesigned with a cleaner layout and a setup checklist that tracks your key integration steps: SCM connected, SCA connected, analysis running, and results available. **➕ Improved** * More findings now receive a conclusive verdict. The triage agent continues assessing checklist conditions even when reachability analysis fails instead of stopping completely, and automatically recovers from checklist generation failures. Both changes increase the share of findings that get a clear triage outcome. ### February 20: Endor Labs integration, assessment transparency, and faster onboarding **✨ New** * Endor Labs Integration: Konvu now supports Endor Labs as an SCA source. Import your Endor Labs findings to get AI-driven exploitability analysis on top of your existing Endor Labs results. **➕ Improved** * Faster Time to First Assessment: New repositories added to existing integrations and newly imported SCA issues now automatically trigger AI triage, with no manual intervention needed. * "Not Assessed" Explanations: Findings marked as "Not Assessed" now explain the specific reason (assessment failed, queued, or not eligible for agentic triage) instead of showing a generic status. * "Check Skipped" Transparency: When a triage step isn't performed because earlier checks were sufficient to reach a verdict, findings now display an explicit "Check skipped" entry instead of showing nothing. * Faster Onboarding: New users see their first triage results sooner. A welcome page now guides users until initial results are available. * Redesigned Integrations Page: Updated layout for connecting and managing your SCA and SCM integrations. ### February 13: SAST investigations, Gradle dependency resolution, and self-hosted improvements **✨ New** * SAST Investigation Pages: View detailed investigation pages for SAST findings, with assessment details, analysis trail, and supporting evidence. * MCP Integrations: The Integrations page now includes a dedicated section for connecting AI assistants (Claude, Cursor) via Konvu MCP. **➕ Improved** * Gradle Dependency Resolution: Gradle projects are now automatically detected and their dependencies resolved before analysis, including support for monorepos and per-directory JDK version selection. This leads to more accurate triage for teams using Gradle. * Self-Hosted Dismiss/Reopen: Self-hosted customers can now dismiss and reopen SCA issues directly from the UI. **🔧 Fixed** * Fixed Semgrep findings with `provisionally_ignored` triage state showing as open instead of dismissed. * Fixed "See issues" link from the SCA integration modal not applying the correct source filter. ### February 6: Expanded triage coverage, "Not Assessed" status, and improved assessment transparency **✨ New** * "Not Assessed" Triage Assessment Status: A new status clearly distinguishes findings that haven't been analyzed yet from those where the analysis was inconclusive. This is a first step toward more actionable next steps on inconclusive findings. **➕ Improved** * Expanded Triage Agent Coverage: The agent now runs reachability and attacker-controllability checks even when code configuration checks are inconclusive, increasing conclusiveness rates by 10-20% across accounts. * Assessment steps are now always displayed even when the outcome is inconclusive, so you can follow the agent's full reasoning. * Reachability Graph for False Positives: The reachability graph now displays even when no entry points reach vulnerable code, serving as visual proof that your application doesn't reach the vulnerable code path. ## January 2026 ### January 30: Confidence scores, expanded triage coverage, and Java cross-package mapping **✨ New** * Confidence Scores on Recommendations: Each AI triage recommendation now displays a low/medium/high confidence score with a breakdown of the underlying factors. * Improved NuGet (.NET) Ecosystem Support: .NET vulnerabilities using NuGet packages are now eligible for automated vulnerability checklist generation and AI triage. **➕ Improved** * Expanded AI Triage Coverage: The triage agent now runs on more issues, including partial analyses where only a checklist and dependency tree are available. A background job automatically re-triggers newly covered or outdated issues every 3 hours, driving higher conclusiveness rates across accounts. * Java Cross-Package Vulnerability Mapping: AI triage now covers \~600 more Java vulnerabilities, improving accuracy for teams with complex dependency trees. * Multi-Path Triage Accuracy: The agent now returns "False positive" when some paths are inconclusive instead of overclaiming certainty, which lowers the confidence score accordingly and gives you a more honest signal. * Self-Hosted Broker Consolidation: GitHub data now flows through a single broker service, simplifying setup and eliminating duplicate storage. Dependabot alerts are fetched repo-by-repo, reducing the risk of silently dropped security data when permissions or repos are missing. * Inconclusive assessments are now displayed as grey in the assessment UI instead of an ambiguous empty state. * Finding details page layout improved for better display consistency. * Background package import jobs are now split by ecosystem (Java, Go, JavaScript), reducing processing time. **🔧 Fixed** * Fixed the Overview Sankey diagram — the data mapping logic was rewritten to correct incorrect flows and counts. * Fixed Dependabot issue links and code snippet "view source" URLs so they work correctly with GitHub Enterprise Server and self-hosted instances, not just github.com/gitlab.com. ### January 23: Self-hosted monitoring, reachability UX, and ecosystem reliability improvements **✨ New** * Self-Hosted Monitoring Dashboard: New dashboard to track, abort, and retry broker and controller tasks with improved error and job-count reporting between controller and backend. **➕ Improvements** * Reachability Assessment Display: Inconclusive reachability assessments are now hidden to avoid confusion. * Improved Python support: Enabled recursive directory discovery for requirements.txt analysis, resulting in more triaging coverage. * Major reliability fixes across PyPI, Maven, npm, and Go package downloaders leading to more accurate assessments. * Improved Gradle support * Added filtering capabilities to the overview sankey diagram for better data exploration. **🔧 Fixed** * Self-Hosted Infrastructure: Fixed orphaned jobs and transient error handling ### January 16: Multi-path triage, Rust & Go coverage, and UI polish **✨ New** * Multi-path triage analysis: Get more accurate assessments for complex vulnerabilities by seeing exactly which code paths are exploitable and which are safe. A new path selector lets you audit each path's reasoning independently.
* Self-hosted customers get a new onboarding checklist guiding broker setup, SCM/SCA connections, and LLM configuration. **➕ Improved** * Vulnerability details now show explicit sources for each checklist item, so you can quickly verify why Konvu reached its conclusion.
* Rust coverage expanded significantly—more Rust vulnerabilities now receive automated triage with workspace support and RUSTSEC/OSV enrichment. * Go coverage improved with broader dependency resolution and better version matching for edge cases. * Code snippets now include syntax highlighting for easier reading.
* Smoother feedback flow when rating triage assessments. * Self-hosted deployments are now more reliable with improved error handling. **🔧 Fixed** * Tool outputs now clearly indicate when a search returned no results vs. when it returned data.
* Conclusion messages now consistently match the investigation steps shown. * Clarified static analysis wording: "dependency installed" (in lockfile) vs. "dependency imported" (used in code) are now distinct. ### January 8: Plenty of product improvements **✨ New** * Introduced a reachability graph visualization:
* Feedback on vulnerability triage assessments is now enabled for users:
* Share Triage Assessments: New functionality allows sharing of vulnerability triage assessments in text or Markdown. Seamlessly integrate by copying and pasting into Jira or similar platforms.
* Introduced a time filter on the Triage page to allow review scoping by the last X days.
**➕ Improved** * Enhanced the precision of triage for Go and Rust vulnerabilities. * Updated the manifest side panel for visual consistency with the dashboard. * Revised the Overview graph's default breakdown to "open findings → severity → assessment" for more effective triage. ## December 2025 ### December 19: More improvements to the issue details page **➕ Improved** * Revamp Issue Details Page for Better Explainability & Trust * Added timeline connectors and assessment completion blocks
* Enhanced the dismiss/reopen flow for Dependabot findings * Implemented a sticky vulnerability sidebar **🔧 Fixed** * **Go Language Coverage**: We've released better version matching and fixed enrichment issues that impacted the Go assessments ### December 12: Improvements to the issue details page **➕ Improved** * **Issue Details Page Redesign**: Updated layout to show the agent's verdict first with concrete proof directly underneath, followed by recommended actions. Added hover-highlighting for exploitability conditions and improved evidence layout to make the agent's reasoning easier to audit and trust.
### December 5: Self-hosted Analysis release **✨ New** * **Self-hosted analysis support**: Konvu analysis can now run entirely within your own infrastructure. The on-premises controller handles code analysis jobs directly in your environment. Here is the documentation to set it up [Self-Hosted Analysis](/konvu/get-started/connect-your-environment/source-code/self-hosted-analysis.md) * **Download-Only Access Tokens**: You can now [create specialized tokens](https://app.konvu.com/configuration/api_keys) that only allow downloading Konvu sensors and images, separate from ingestion tokens. This provides better security control by limiting token permissions to specific use cases.
* The new issue page has been released. It improves the interpretability Konvu's assessment
**➕ Improved** * **Enhanced Onboarding Experience**: New repositories added to existing integrations now automatically trigger analysis without manual intervention. You'll see real-time progress indicators showing assessment status immediately after adding repositories
* **Better Issue List Navigation**: Navigate the issues list more efficiently with keyboard shortcuts (J/K to select issues, Enter to open) and improved status consistency between list and detail views.
* **On-Premises Integration Resilience**: GitHub Enterprise integrations now include robust webhook handling and scheduled jobs to automatically recover from network interruptions and keep integration state synchronized. **🔧 Fixed** * Fixed an issue where the overview counts didn't match the filtered SCA findings list when code sensor and main branch filters were applied. * Resolved inconsistencies where issues marked as "Ongoing" in the detail view weren't showing the ongoing status in the list view. * Corrected Go dependency version storage to properly handle version prefixes, enabling more accurate vulnerability matching and triage assessments. ## November 2025 ### November 28: Improved issue details, Gradle support and onboarding **➕ Improved** * Refined the issue details page for improved clarity; additional updates on the way! * Enhanced the onboarding process to accelerate the triaging of integrated issues, ensuring a more efficient and seamless experience. * Konvu now supports repositories using Gradle without lockfiles **🔧 Fixed** * Fixed import issue with Snyk CLI * Fixed issues with onboarding progress bar. ### November 21: Github Enterprise Server support **✨ New** * Added support of Github Enterprise Server as an SCM integration. **➕ Improved** * Improve menu on configuration page and unified layout structure across other pages. ### November 14: Gitlab support **✨ New** * GitLab support: GitLab is now available as an SCM integration so you can connect GitLab and start pulling projects into Konvu. ### November 7: AI triage now runs by default **✨ New** * AI triage runs by default for all users. The AI policy choice has been removed so every issue automatically goes through agentic analysis without extra setup. **➕ Improved** * Configuration: The main configuration page has been revamped to unify AI related settings and API key management in a single, clearer view. ## October 2025 ### October 31: Onboarding & UI Enhancements **➕ Improved** * Improved onboarding experience * Added proper technology icons for inventory and issues pages **🔧 Fixed** * Code Sensor deletion flow now properly clears related issues from the issues table ### October 24: Several UI improvements **➕ Improved** * Improved stack analysis issue summaries by providing richer context and refining prompts, resulting in fewer misleading summaries * Upgraded the UI with several enhancements: * Vulnerability ID facets are now ordered by descending count for quicker prioritization * The "Install GitHub" option is hidden in Triage Assessment facets when there are no relevant items * Confidence scores are no longer shown when assessments are inconclusive to avoid confusion * Fixed the edit button in the Inventory to directly open the manifest side panel in edit mode * The manifest's branch location now appears in the issue details for greater traceability * Vulnerability details now display additional identifiers to support more comprehensive vulnerability tracking ### October 17: Improving accuracy of triage in transitive dependencies & .NET runtime sensor **✨ New** * Added support for .NET on our Runtime Sensor * Introduced intuitive keyboard shortcuts for faster navigation between issues **➕ Improved** * Enhanced accuracy of vulnerability triage for transitive dependencies * Refined the Inventory page with multiple usability improvements **🔧 Fixed** * Resolved an issue with missing code paths in reachability analysis ### October 10: Increased agentic accuracy & visibility on ongoing analysis **✨ New** * We've completely redesigned our agentic triaging system, delivering higher accuracy of assessments. * We've introduced a streamlined onboarding experience that features a dynamic assessment status progress bar, giving new users a clear, real-time view of their triage progress.\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FkWKlWkRTkWAr3BUvmLaF%2FScreenshot%202025-10-10%20at%2016.58.46.png?alt=media\&token=5ad4ead1-d19d-4d85-abef-baa700b37b39) * Ongoing analyses are now easily monitored directly within the main issues table. We've also added a distinctive marker next to the triage assessment badge to consistently reflect the status. **➕ Improved** * Several performance improvements for quicker triaging assessments. ### October 3: Improvements on issue timelines and analysis details **➕ Improved** * Updated product wordings for greater clarity and consistency: * "Dismiss" is now "False positive" * "Prioritize fix" is now "Exploitable" * "Recommendation" is now "Triage Assessment" * The triage assessment timeline now displays changes with clear rationale, helping users understand decision progressions. * Issue details now show live assessment status, alerting users when an assessment is ongoing. * Loader icons now appear when the Runtime sensor is actively searching for evidence, clarifying background processes. **🔧 Fixed** * Corrected inconsistencies between issue summaries and triage assessments * Consistent detailed evidence for each assessment checklist Item * Issue details now include complete manifest location paths for more precise distinction between issues ## September 2025 ### September 26: Revamped analysis details tab **➕ Improved** * We improved the analysis details tab. All analysis types (static, runtime, stack, AI) now appear in a single intuitive checklist that guides you through each step. This provides a clear global assessment and confidence score (now factoring in all analyses, not just AI). Individual analysis sections are revamped to ensure everything fits together for easier decision-making. **🔧 Fixed** * Fixed a couple of compatibility issues of the Python Runtime Sensor * Fixed bug with the search function of vulnerabilities ### September 19: New Runtime Sensor heartbeat **✨ New** * We have introduced a heartbeat feature for the Runtime Sensor! The new heartbeat periodically confirms the sensor's operational status, allowing teams to instantly verify if a sensor is deployed and running across their environments. This enhancement provides better visibility into deployment coverage and supports faster troubleshooting. **➕ Improved** * The inventory page now shows counts for recommendations/assessments per asset. ### September 12: Improvements to triage agents capabilities & K8s attacher **➕ Improved** * Enhanced agent triage capabilities for more accurate and efficient results. * Increased robustness and reliability of the Kubernetes attacher and the injected init container. Deployment is now more resilient in edge cases, reducing failure rates and supporting smoother upgrades in complex environments. ## August 2025 ### August 28: Performance improvements & Snyk CLI auto-mapping **✨ New** * Snyk CLI support: Konvu now fully supports Snyk CLI projects. You can easily map Snyk CLI results to repositories and manifest files from your SCM integration. **➕ Improved** * We've made several performance enhancements to the issues list, resulting in faster loading times for both issues and filters. ### August 21: New quick filters on the issues list **✨ New** * We've introduced new quick filters to the issues list. You can now: * Filter issues to show only those on the default branch * View issues from repositories with the Code Sensor enabled * Filter by repositories with AI Policy enabled These updates help you quickly narrow down your vulnerability backlog and work more efficiently.
### August 17: New Python Runtime Sensor **✨ New** * Konvu now includes a dedicated Runtime Sensor for Python, providing real-time monitoring and detection of vulnerable Python functions within your applications. Refer to the documentation for installation instructions. ### August 1: Design refresh **✨ New** * We've rolled out a full design refresh across the Konvu platform! The new look delivers a cleaner interface, making it easier to understand and get work done. **➕ Improved** * We released quick improvements to the user onboarding flow. * Added handling for GitHub App install request flow to streamline the integration process. ## July 2025 ### July 25: New Ruby Runtime Sensor **✨ New** * Konvu now offers a dedicated Runtime Sensor for Ruby, enabling real-time monitoring and detection of vulnerable Ruby functions in your applications. Check the documentation for installation steps and integration details. **➕ Improved** * Improved empty states on the Overview page. ### July 18: Improvements to the AI triage agent **➕ Improved** * The AI triage agent view now offers greater clarity and transparency, making it easier to follow the agent's reasoning and understand the context behind each decision. These improvements help you quickly assess vulnerabilities and take informed action with confidence. ### July 11: Improvement to the integrations page **➕ Improved** * The integration list now clearly displays the most recent sync date and current status for each integration, making it easier to monitor connections at a glance. ### July 3: AI-Powered Repository Tiering **✨ New** * Building on last week's commit and LLM analysis, we've now launched an AI-powered tiering agent that automatically ranks repositories based on business context and activity, helping you focus on what matters most. This is only enabled for customers who have enabled AI policies. **➕ Improved** * Multiple improvements to the performance of the Triage Agent. * The Overview now has a Daily/weekly selector ## June 2025 ### June 27: Basic tiering of repositories **✨ New** * Initial rollout of an automated tiering of repositories and manifest files. Commit activity and simple LLM analysis now run automatically after integration import, paving the way for deeper, AI-powered prioritisation. **➕ Improved** * Ensured the agentic triage only launches on direct dependencies (transitive dependencies support will follow) * Better transitivity discovery from the code sensor **🔧 Fixed** * Improved error handling for Snyk integration ### June 20: New Agentic Triage #### ✨New * Agentic Triage: Let AI agents automatically assess the exploitability of vulnerabilities in your code. Konvu's AI agents essentially "think through" each vulnerability the way a security engineer would: 1. **Vulnerability Context Retrieval:** Pulls all relevant exploitability conditions, vulnerable functions and metadata for the flagged vulnerability from Konvu's database. 2. **Code-Level Reasoning:** Greps through your repository to see if the vulnerability might be exploitable and examines control- and data-flows around the vulnerable code paths. 3. **Final Verdict:** Provides a clear recommendation if it can: `Dismiss` , `Prioritize Fix` 4. This flow mirrors how a human analyst would gather context, search for relevant code, and mentally simulate an attack. ### June 13: New Overview page & Dismissal recommendations #### ✨New * Rolled out a redesigned Overview page that makes it easier to track key vulnerability metrics across your account. Get a quick snapshot of your open issues, recent activity, and top priorities—all in one place.\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FyBnOFDeuzdJdeJ5fF6g8%2FGroup%2039620%20\(1\).png?alt=media\&token=760bbe5b-ef34-4d3c-bdfd-a83bcdcf7849) * Dismissal recommendations now group similar issues together, so you can clear out false positives in one go. It's the fastest way to make a real dent in your vulnerability backlog.\ ### June 6: Improved Ruby support & PR policies #### ✨New * You can now create specific policies for PR comments and labels bases on Konvu's context\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FgpECX4K3KbeHeNnBmJyc%2Fimage.png?alt=media\&token=93c90838-a5ba-4cfe-ac7e-23157e7b30b7) **➕ Improved** * Added new heuristics for Ruby CVEs ## May 2025 ### May 22: Konvu MCP Server #### ✨New * We release the Konvu MCP server. Konvu MCP Server allows MCP-enabled security tools to leverage Konvu triage insights directly from your favorite AI-powered assistant. [Learn more](/konvu/reference/mcp-integration.md) **➕ Improved** * Turn PR-commenting on or off per repository for finer control. * Withdrawn vulnerabilities are now auto-dismissed. * Stacktraces label each frame as "in-app" or "external" for quicker debugging. ### May 14: Token Management & Dependabot Audit Trail #### ✨New * Revoke Konvu tokens directly from the UI

Token Revocation Feature

* Audit trail for Dependabot: see who dismissed or re-opened each vulnerability. **➕ Improved** * Richer attributes enrichment for Python and Go vulnerabilities. ### May 7: Python & Go First-Class Support #### ✨New * Full analysis for Python and Go projects, with automatic false-positive detection. **🔧 Fixed** * Issue-list filters now behave correctly. * Items marked for dismissal are no longer shown in the "Monitoring" phase. ## April 2025 ### Apr 25: PR comments for Dependabot & Snyk #### ✨New * Post PR comments on Snyk or Dependabot auto-fix pull requests: Konvu will add context to flag vulnerabilities that need your attention or mark false positives for dismissal.\* View a dedicated panel of all open Dependabot/Snyk PRs to quickly add comments. * Java Sensor now supports Java 24. **➕ Improved** * Enhanced exploit-checklist heuristics. **🔧 Fixed** * Corrected dependency matching in the Java Sensor for fat-JAR applications. ### Apr 18: Improved exploit checklist display and heuristics **➕ Improved** * Refined exploit-checklist display and heuristics. ### Apr 11: Improved Java dependency mapping for better recommendations & Exploitability checklist #### ✨New * We've significantly enhanced how Konvu associates Java dependencies in your project by better merging static and runtime data. This leads to more accurate detection of false and true positives. * Static analysis now builds a full manifest tree of your project. * Runtime dependencies are mapped to the right node—not just the root. * First version of an exploitability checklist for CVEs—helping you triage vulnerabilities Konvu couldn't auto-dismiss. You can find the on the vulnerability details tab.\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FRSRFThDqDOAlHpSgUsGB%2Fimage.png?alt=media\&token=6022569c-c8fe-4424-b351-14511af93ae7) **🔧 Fixed** * Resolved incorrect suggestions to install a runtime sensor when none were available * Fixed recommendation ordering issues * SCA filter now uses OR logic instead of AND * Fixed Java Runtime Sensor bug causing unnecessary dependency rescans * Added direct link to GitHub from the manifest panel ### Apr 4: Multiple improvements and fixes **➕ Improved** * Rolled out asset re-mapping mechanisms to improve code-to-cloud mapping * We now retrigger a stack analysis when a user updates a stack attribute **🔧 Fixed** * Fixed an issue causing empty analysis details when dismissing vulnerabilities * Updated timestamps to use UTC uniformly * Improved graph display on Overview page * Added an error message when dismissing a vulnerability fails ## March 2025 ### Mar 28: Grep-based analysis #### ✨New * Grep-based analysis of vulnerable functions — quickly check if a vulnerable method is used anywhere in your codebase. **🔧 Fixed** * Improvements and bug fixes on the integration page. ### Mar 21: Runtime Sensor improvements #### ✨New * Runtime Sensor supports namespace allow-lists and Cilium network policies **➕ Improved** * Have init container fail when it fails to download the Sensor to prevent silent misconfigurations ### Mar 14: Enhanced stacktrace presentation and Maven resolution **➕ Improved** * Improved the stacktraces provided on the issue details * Improved path handling to ensure consistent resolution of Maven manifest files **🔧 Fixed** * Resolved a few bugs with lockfiles analysis impacting the quality of stack analysis ### Mar 7: Increased false positives dismissal rate **➕ Improved** * Refined stack analysis heuristics, increasing the flagging of false positives from SCAs and improving overall accuracy. **🔧 Fixed** * Resolved an issue that duplicated `package.json` and `package-lock.json` files, which disrupted stack analysis. This fix significantly improved dismissal accuracy. ## February 2025 ### Feb 28: Plenty of improvements on the Inventory, Sensor Activity and Issue details pages **➕ Improved** * **Inventory Page:** Cleaner flow for adding/removing attributes, improved display of the manifest file location, and better sorting. * **User Registration:** improved process for a smoother onboarding experience. * **Sensor Activity Page:** Now includes older sensors for debugging purposes. * **Dependabot Issue Dismissals:** Enhanced reasons for dismissals. * **Issue Details Page:** Added a direct link to the GitHub Advisory Database **🔧 Fixed** * Various quick fixes on the Overview and Issue Details pages. * Resolved import issues with Semgrep vulnerabilities. ### Feb 21: Konvu recommendations and dimissing of non-applicable Dependabot issues #### ✨New * You can now dismiss non-applicable Dependabot vulnerabilities directly from Konvu.

Dismiss Dependabot vulnerabilities

* We now offer a clearer recommendation based on Konvu's context: a vulnerability should either be prioritized, discarded, or flagged for more runtime context to make an informed decision.\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FQh9nyGRGN7iNek6LzZaV%2Fimage.png?alt=media\&token=c70ac4b5-f2fb-49a6-8a2d-46cc3232fffb) **➕ Improved** * Improved Overview page * Enhanced issue detail page with clearer next steps and multiple UI improvements. **🔧 Fixed** * Fix various UI bugs ### Feb 14: Expanded issue details, improved visibility, and enhanced onboarding #### ✨New * Added vulnerability enrichment information and Konvu's analysis detail on the issue page\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FtbQB6JHKqTJX2zt8yZ6s%2Fimage%20\(19\).png?alt=media\&token=7b2b235e-a27b-4e04-b0f1-c559d4ca1a55) * All issues, including those from integrations, now have dedicated detail pages * Added the ability to update stack attributes on repositories\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FPTnAQpYtU9lV01g5RIdb%2Fimage%20\(17\).png?alt=media\&token=16fb130e-934a-413c-9f90-5284d6df568a) * V0 of a new Overview page that highlights key vulnerability metrics per account * Users can now find the issues that are open in any of their SCA with the new filter on the issue page #### ➕ Improved * Revamped the onboarding flow for a more streamlined experience * Java Runtime Sensor: improved the ECS installation process * Manifests are now grouped by repositories on the inventory page * Visual feedback is now provided when a new Runtime Sensor is connected #### 🔧 Fixed * Semgrep import issue is fixed * Multiple manifest files in the same directory are now correctly detected and reported ### Feb 07: new and simplified install method for the Java Runtime Sensor & Heroku support #### ✨New * Java Runtime Sensor: new and simplified installation process with a Kubernetes admission controller * Java Runtime Sensor: added Heroku support #### ➕ Improved * Improved stack-related vulnerability enrichments and heuristics * Added vulnerability applicability filter on the issues list\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2Fp1MJ4GAhaZr5DDGB5rpM%2Fimage.png?alt=media\&token=2e5d7dc2-c2d9-42d3-93f3-9dd9cfe06288) ## January 2025 ### Jan 31: New vulnerability filtering capabilities based on your stack & easier Java runtime sensor install #### ✨New * We've rolled out a major new capability to Konvu! Now, we automatically analyze your repositories to detect your stack—frontend/backend, frameworks, OS, web servers, etc.—and help you filter out irrelevant SCA issues.

Konvu inventory with stack attributes

* Easier Java Runtime Sensor Installation: You can now deploy the sensor using a Helm chart, which sets up a Kubernetes Admission Controller for seamless integration. ### Jan 24: Performance improvements #### ➕ Improved * Memory consumption improvements on the Java runtime sensor ### Jan 17: New app-level runtime sensor for Java ☕ #### ✨New * We're excited to announce the first beta release of our new app-level runtime sensor for Java! This lightweight, infrastructure-agnostic sensor is easy to set up—just download the JAR and run your app with the sensor installed. Read more ### Jan 3: Improvements to the code-to-runtime mapping UI #### ➕ Improved * Simplified the code-to-runtime mapping UI ## December 2024 ### Dec 19: Improvements to the vulnerability database enrichment #### ➕ Improved * Improved enrichment heuristics on the vulnerability database ### Dec 13: Improved asset code-to-runtime mapping and performance of Runtime Sensor #### ✨New * Implemented basic rules-based logic to map containers (asset instances) to VCS and manifest locations

Mapping containers with repositories

#### 🔧 Fixed * Fixed a bug in the Runtime Sensor that caused high memory and CPU usage. ## November 2024 ### Nov 29: Snyk and Semgrep integrations ✨ **New** * Synk and Semgrep integrations have been released. Konvu can now help identify the vulnerabilities detected by Snyk and Semgrep that are reachable at runtime.

Integration Page with Snyk and Semgrep integrations

### Nov 22: Sensor Activity & ECS support ✨ **New** * Added a new Sensor activity page to monitor the different connected sensors

New Sensor Activity page

* Konvu now support ECS via Terraform or manual installations ➕ **Improved** * Various UI improvements * Improved memory consumption of the Runtime Sensor ### Nov 15: Tomcat support & usability improvements ✨ **New** * Java applications running on Tomcat are now supported ➕ **Improved** * The frequency of Konvu Code Sensor can bow be configured from the dashboard
* Konvu analysis of each vulnerability is now front and center on the issue list and issue details
### Nov 8: Enhanced User Auth. & Streamlined Runtime Sensor Installation ✨ **New** * Authentication flow now support added security options: SSO, 2FA, passkeys, and more.
➕ **Improved** * The Runtime Sensor installation now uses Konvu Tokens for authentication, replacing Username/Password for a smoother setup experience. * Improved Runtime Sensor matching with Java packages, enabling more accurate detection of executed dependencies and vulnerable functions. ## October 2024 ### Oct 25: Improvements to the vulnerability database ➕ **Improved** * Improved vulnerable signatures for Java, Ruby and Node.js ### Oct 18: Runtime Sensor supports Node.js ✨ **New** * Our Runtime Sensor is now able to catch vulnerable NodeJS functions and their corresponding stack traces ### Oct 11: Runtime Sensor supports Ruby ✨ **New** * Our Runtime Sensor is now able to catch vulnerable Ruby functions and their corresponding stack traces ### Oct 4: OpenShift support & runtime stack traces ✨ **New** * Added OpenShift support to the runtime sensor * Introduced stack traces for runtime executions ➕ **Improved** * Enhanced issue filtering on the dashboard 🔧 **Fixed** * Resolved asset graph issue that caused incomplete display ## September 2024 ### Sep 27: Static reachability evidence & one-click GitHub Action #### ✨ New * We now offer code location evidence that identifies the reachable dependencies or vulnerable functions within the static reachability analysis.

Code Location for reachable dependencies and vulnerable functions

#### ➕ Improved * Issues list: improved layout and filtering * Code Sensor: one-click installation of the Konvu GitHub action ### Sep 20: Detection of reachable & executed vulnerable methods for Java #### ✨ New * We've added the initial set of vulnerable methods for Java vulnerabilities to our vulnerability database. This allows us to detect whether the vulnerable functions associated with a CVE are reachable within your code, and if they are executed at runtime. A reachable or runtime-executed vulnerable function significantly increases the risk of exploitation, making these vulnerabilities higher priority for remediation. Conversely, vulnerabilities that are not reachable or executed at runtime can be deprioritized.

Highlighting the runtime execution of vulnerable functions

#### ➕ Improved * Github integration now continuously syncs with Konvu * Improved security issue detail page:

Updated issue details page

### Sep 13: Added issues list & Dependabot integration #### ✨ New * We have introduced a new list of issues that consolidates insights from both the Code Sensor and the Runtime Sensor. This will allow users to easily identify vulnerabilities that are not only installed in a manifest, but also actively reachable and executed during runtime. * Integration with Dependabot: users can now sync Dependabot findings into Konvu to enrich them with code and runtime context #### 🔧 Fixed * Fixed bugs in the Code Sensor ### Sep 6: Added support for Arm64 and the capacity to restrict nodes on the helm chart #### ➕ Improved * It's now possible to restrict on which nodes the Runtime Sensor will run using helm chart configurations `nodeSelector`, `nodeAffinity` or `tolerations.` * Arm64 architecture is now available for the helm chart. Most customers running Linux instances can now deploy the Runtime Sensor #### 🔧 Fixed * Fixed an issue on the Runtime Sensor that wouldn't detect the execution of some Java applications ## August 2024 ### Aug 23: Expanded data on vulnerabilities #### ➕ Improved * Expanded vulnerability data: now includes information such as the presence of available fixes or criticality ### Aug 16: Additional metadata collection #### ➕ Improved * Detection of git repository metadata in the Code Sensor * The eBPF sensor now detects additional metadata for both containers and Git repositories ### Aug 9: Fixes #### 🔧 Fixed * Fixed an eBPF sensor issue that mixed findings in-between apps (Python apps would have Go Dependencies) ### Aug 2: Dashboard improvements #### ➕ Improved * Applications can now be filtered by names in the dashboard * Dependency metadata is now automatically deployed and regularly enriched with the latest information ## July 2024 ### July 25: Memory cap for the Runtime Sensor #### ➕ Improved * The eBPF Runtime Sensor now has capped memory consumption, providing safer and more reliable deployments for customers. ### July 12: Support for non-Kubernetes environments #### ✨ New * Support has been added for environments that do not use Kubernetes, allowing the tool to be deployed and operated in a wider range of infrastructure setups ### July 12: Konvu GitHub Action #### ✨ New * The Konvu GitHub Action is now live, automatically reporting findings to the backend. Users can gain visibility into their Java libraries, including those that are imported and actively called within their projects ### July 4: Java Code Sensor now supports most stacks #### ✨ New * The Java Code Sensor is now compatible with Linux x86\_64, Linux Aarch64, Mac x86\_64, Mac ARM64, Windows x86\_64 #### ➕ Improved * Java packages are now reported directly to the backend for better tracking of dependencies. * The eBPF Runtime Sensor also communicates with the backend, reporting packages across all supported stacks, ensuring consistent monitoring and visibility across your environments.\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FsQvaVYXZmMbfASkI8MSK%2FUntitled%20\(2\).png?alt=media\&token=35611597-2820-418d-a612-4a1c87354fe5) ## June 2024 ### June 30: eBPF sensor run on Kubernetes #### ✨ New * eBPF sensor can now run under Kubernetes & be deployed with a helm chart\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FFY2zJpBFnUvVzlYMj90v%2FUntitled%20\(1\).png?alt=media\&token=b8f36390-289a-468e-8bbc-d5eeecdae816) #### ➕ Improved * Improved reachability corner cases for the Java Code Sensor #### 🔧 Fixed * Fixed a few bugs on the Java Code Sensor ### June 21: eBPF sensor now supports Go #### ✨ New * eBPF Runtime Sensor now supports Go #### ➕ Improved * Fetching missing POMs (manifest files for java projects) from Maven Central * Fetching missing jar metadata from Maven Central * eBPF sensor consumes a lot less CPU/memory ### June 14: eBPF sensor now supports Node and PHP #### ✨ New * The eBPF Sensor can now capture NodeJS and PHP package calls (in addition to Java, Ruby and Python)\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FuaPYy33YhaC7snBPQCbe%2Fslite-backupchannelsOperationsOperationsWeekly_updatesmedia_CW24oueykbFzKm-lQC-image.png?alt=media\&token=f475c2ef-bf4d-4294-9000-a1283dffd53d) #### ➕ Improved * We now download missing packages information from Maven Central ### June 7: eBPF sensor now supports Ruby and Python #### ✨ New * eBPF now supports Ruby and Python #### ➕ Improved * Java reachability analysis of libraries * Monorepo support for Java ## May 2024 ### May 31: Our Runtime Sensor support Java #### ✨ New * Our Runtime Sensor now supports Java, leveraging an eBPF profiler #### ➕ Improved * We now accurately retrieve transitive dependencies along with their version numbers. ### May 24: Konvu can now analyze statically packages in Java #### ✨ New * Konvu can now analyze statically packages in Java (Maven only for now)\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FxIdFLT62DgFaqfzyzlpQ%2Fslite-backupchannelsOperationsOperationsWeekly_updatesmedia_CW21FTFrsHFvCZqM14-image.png?alt=media\&token=c2219765-fa48-48ec-b7e3-86c46628136c) #### ➕ Improved * UI changes to better surface the differences between the Code Sensor and the Runtime Sensor\ ![](https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FfMuk0b4PkuCl7PnTi4NG%2Fslite-backupchannelsOperationsOperationsWeekly_updatesmedia_CW21KSKutH8E2l3bJd-image.png?alt=media\&token=52a9700a-9643-4d9b-a6cc-541ca8e418f4) ### May 17: Improvements on service sorting and Docker setup #### ➕ Improved * The application table can now be sorted by last seen #### 🔧 Fixed * Users are no more logged out after 1h --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/reference/changelog.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.