FossID has released version 24.3 of its Software Composition Analysis (SCA) application, Workbench. This release delivers enhancements requested by our clients and team of auditors, particularly those focused on AppSec management.
AppSec Management
To tackle the growing challenges of Application Security (AppSec) in today’s increasingly complex software supply chains, FossID 24.3 is heavily focused on enhancing your ability to uncover and share actionable insights on security vulnerabilities and exploitability.
- VEX (Vulnerability Exploitability eXchange) integration to provide an enhanced security-centric user experience in the Workbench UI, better complementing the license-centric experience. VEX information helps software development teams go beyond identifying the presence of vulnerable components to understand and communicate their potential exploitability and mitigate risks more effectively.
- SBOM (Software Bill of Materials) + VEX support to import, merge and export VEX data within CycloneDX and SPDX SBOM file formats ensuring compliance with existing and emerging regulatory requirements.
- A security-centric user experience for faster, more intuitive access to security risk-related information.
New Vulnerabilities screen and API actions along with support for VEX information.
Notice File Report
Our new component-level Notice File report complements the existing file-level version and displays components grouped by license identifier (i.e. MIT, AGPL, Apache). The information is based on the list of components identified in the code scan.
Choose file-level or component-level Notice File Reports.
Miscellaneous Enhancements
In addition to the AppSec-focused features, 24.3 includes a host of improvements such as:
- SPDX reports include a scan’s comments on components
- CycloneDX reports include additional metadata
- New API actions and documentation
Upgrade Today
FossID clients can take advantage of the new enhancements by accessing the Delivery Portal, downloading the new version, and upgrading their Workbench to version 24.3. Please let the FossID team at (support@fossid.com) if you have any questions.