Skip to content

Johnny Changelog

[2025.21.0] - 2025-05-21

  • Added scan build ebpf command to scan C/C++ project builds using eBPF
  • Added export to sarif of data on dependency relationships within a project, direct or transitive, in the format: results.properties.relation: direct|indirect
  • Added ignoring of commented lines when parsing conanfile.py files
  • Fixed version detection from requirements of the type ==3.0.0.post1 in Python manifests
  • Fixed upload of vulnerabilities to sarif that have criticality specified without a numerical assessment
  • Fixed parsing in the Go environment: transitive dependencies for which it was not possible to determine the parent package are excluded from the scanning results

[2025.13.0] - 2025-03-28

  • Added support for parsing Swift ecosystem manifests: Package.swift and Package.resolved (starting with version 2025.13.0 of the installation)
  • Added a beta version of the console agent with the Secrets module (starting with version 2025.13.0 of the installation)
  • Added processing of corrupted scala-dependency-tree.txt files
  • Added parsing of dependencies declared in an unmerged format in the build.gradle.kts file
  • Added ignoring .nuspec files in the scan csharp command
  • Added support for AltLinux operating systems in the scan build command
  • Excluded Java archives from scanning when the --scan-archives flag is inactive
  • Fixed import SBoM in which the library has multiple values of the env property
  • Fixed processing of SBoM files in CycloneDX format containing information about components within components

[2025.7.0] - 2025-02-13

  • Added commands for scanning a directory with predefined settings depending on the selected technology (for example, ./johnny scan java)
  • Added output of information about the presence of Exploit for vulnerabilities in the agent's results
  • Added the --cloud-resolve parameter to activate cloud resolver (compatible with installation of version 2025.7.0 and higher)
  • Added support for the Selective dependency resolutions mechanism for Yarn
  • Added support for the NPM Package Aliases mechanism for package-lock.json
  • Optimized processing of large gradle-dependency-tree.txt files
  • Fixed a bug in determining package versions in the gradle.lockfile file if there are suffix versions

[2024.52.2] - 2025-01-23

  • Fixed agent behavior that caused installation's tasks-policy queue to grow

[2024.52.1] - 2025-01-16

  • Fixed handling of multiple gradle.lockfile files per module

[2024.52.0] - 2024-12-24

  • Added scan build command for build analysis for C and C++ languages
  • Added new formats for exporting work results: GitLab Dependency Scanning Report and GitLab Code Quality Report
  • Added handling of the --ignore parameter when scanning archives and files inside images
  • Added the ability to specify a link to a branch/tag and commit using the branch-or-tag and commit parameters when scanning a file and directory (when interacting with installation version 2024.52.0 and higher)
  • Added the ability to specify a hash using the hash parameter when scanning images (when interacting with installation version 2024.52.0 and higher)
  • Added the ability to specify a policy stage when creating a CLI project (when interacting with installation version 2024.52.0 and higher)
  • Added specifying paths to manifests inside scanned images where information about a vulnerable package was found
  • Added paths to manifests where a vulnerable package was found in sarif format
  • Fixed crash when processing an incorrect file in yaml format
  • Added handling of an error that occurs when a file was deleted during scanning
  • Fixed the presence of extra characters when unloading in sarif format
  • Fixed environment detection when parsing Poetry manifests
  • Fixed scanning of RedHat-based images

[2024.48.2] - 2024-12-13

  • Fixed crash when processing some gradle-dependency-tree.txt files
  • Fixed parsing of npm and yarn lock files paired with a manifest

[2024.48.1] - 2024-12-10

  • Added support for multiple versions of a single package in the poetry.lock file
  • Added the ability to run without waiting for analysis results (--no-wait parameter)

[2024.48.0] – 2024-11-29

  • Added support for parsing Conda ecosystem manifests: environment.yml, meta.yml, conda-lock.yml
  • Added support for parsing Conda components in the build environment
  • Added warning output for packages with an invalid name
  • Improved dependency graph construction for formats that allow multiple versions of a single package
  • Improved dependency graph construction when both files of a manifest-lockfile pair are present
  • Fixed errors in generating PURL and go package versions when scanning Docker images
  • Fixed handling of SBoM files in CycloneDX format containing information in the components[i].evidence.identity fields
  • Changed the logic for generating the distro property for PURL ALT Linux packages when scanning Docker images
  • Added information about Location and Fixed Version of a vulnerability to the sarif format export

[2024.44.1] - 2024-11-15

  • Fixed a bug with skipping gem packages in the scan bom command
  • Fixed the ignore flag on Windows OS
  • Fixed a bug in the parser in the Go environment on projects without dependencies

[2024.44.0] - 2024-11-02

  • Added parsing of pnpm-lock.yaml manifests. Supported versions: 5.0-5.4, 6.0, 9.0
  • Added parsing in the pnpm environment
  • Takes into account the use of the pnpm-workspaces.yaml configuration file when parsing package.json
  • Added the ability to specify a group when creating a CLI project, for admin role only
  • Added the ability to specify the format of the generated SBoM using the --bom-format parameter (starting with on-premise version 2024.44.1)
  • Implemented parsing in the pip environment
  • Implemented parsing in the composer environment
  • When resolving dependencies in the go environment, the mechanism for determining the parent library for transitive dependencies obtained from the test environment has been improved
  • Fixed the unsupported type error for composer components in the scan bom command

[2024.40.2] - 2024-10-18

  • Fixed dependency graph construction in cases where a component occurs multiple times with different bom-ref

[2024.40.1] - 2024-10-10

  • Added merging of pom.xml and mvn-dependency-tree.txt parsing results to avoid unnecessary dependency resolution
  • Fixed an error in checking for the presence of a lock file when using dependency resolution in the environment

[2024.40.0] - 2024-10-02

  • Added workspaces parsing when working with npm manifests
  • Fixed Gemfile.lock parser for cases with multiple Gem sections

[2024.39.0] - 2024-09-23

  • Separated tags when unloading in sarif format to display all versions of the found package in DefectDojo
  • Changed export of severity in sarif format to correctly display CVSS3 in DefectDojo
  • Fixed issues with scanning SBoM containing Go packages
  • Fixed panic when parsing empty cargo.lock
  • Removed duplication of vulnerabilities in sarif format for cases of multiple versions of the same package
  • Removed the ability to simultaneously use the format and no-summary flags

[2024.36.0] - 2024-09-05

  • Added the ability to configure the used parsers via the configuration file
  • Added the ability to specify the parser used in the scan file command
  • Fixed parsing of multi-project/module gradle-dependency-tree

[2024.35.0] - 2024-08-20

  • Fixed gradle-dependency-tree kotlin parsing

[2024.32.0] - 2024-08-09

  • Added analysis of standard go libraries to the parser in the go environment (--go-resolve)
  • Added the ability to specify a license when creating a project
  • Fixed an error when parsing pom.xml, which contains variables like xxx.xxx.xxx.xxx
  • Fixed scala-dependency-tree.txt parser
  • Fixed an error when scanning SBoM without a component section

[2024.29.0] – 2024-07-19

  • Added export of links and CWE to sarif format

[2024.26.0] - 2024-06-24

  • Added parsing in npm environment
  • Added parsing in dotnet environment
  • Added parsing in the poetry environment
  • Added launch parameter --block-on-empty-result (returns code 3 if the scan result is empty)
  • Added --python-version flag to specify the python version in the pypi manifest family
  • Fixed the construction of the dependency graph on the pair package.json and package-lock.json
  • Improved parsing of project.assets.json

[2024.21.0] - 2024-05-24

  • Improved yarn.lock parsing
  • Fixed parsing in yarn environment

[2024.17.0] – 2024-04-27

  • Added Johnny build for Mac with Intel processors
  • Fixed scala-dependency-tree parser

[2024.15.0] – 2024-04-11

  • Added support for uploading scan results in CSV format
  • The path to the source file in which the dependency was found has been added to the scan result upload
  • Improved search for .net packages when scanning images

[2024.13.0] – 2024-03-28

  • Added support for uploading scan results in SARIF and XML formats

[2024.10.2] – 2024-03-07

  • Fixed merging lock files with manifests on Windows

[2024.9.0] – 2024-02-29

  • Fixed crash when parsing go.sum

[2024.7.0] – 2024-02-12

  • Reduced the size of the Docker image with the agent
  • Fixed a bug when hashing empty files

[2024.5.0] – 2024-01-31

  • Added Scala support
  • Added dependency resolution in the go environment (--go-resolve)
  • Added dependency resolution in the maven environment (--maven-resolve)
  • Added dependency resolution in yarn environment (--yarn-resolve)
  • Improved error messages in query parameters
  • Added installation variables URL (cli.api_url) and TOKEN (cli.api_token) to the config
  • The summary now counts the number of vulnerabilities, not packages
  • Increased the width of tables when it is impossible to determine the width of the terminal

[2023.49.0] – 2023-12-08

  • Added support for parsing Rust manifests cargo.lock and cargo.toml
  • Added --no-recursion parameter to disable recursive scanning of the scan dir command

[2023.48.0] – 2023-11-22

  • Added setting the output format of the table with results -f --format (with the ability to turn off colors)
  • Added setting for grouping vulnerabilities in the output of -g --group-vulnerabilities-by
  • Added setting for sorting vulnerabilities in the output of -s --sort-vulnerabilities-by
  • Added setting of analysis timeout limit -t --timeout

[2023.43.0] – 2023-10-27

  • Added summary information about the severity of vulnerabilities to the console output
  • Fixed parsing of .gradle.kts manifests

[2023.38.0] - 2023-09-20

  • Improved parsing of package.json and composer.json manifests

[2023.35.0] - 2023-08-31

  • Improved parsing of the environment field for the Gemfile and Gemfile.lock manifests
  • Removed automatic merging of cells with the same CVSS value in the table with vulnerabilities

[2023.33.0] - 2023-08-17

  • Optimized output of tables to the console on small screens

[2023.30.0] - 2023-07-27

  • Added conanfile.py parsing for Conan
  • Added indication of the active analysis process in the form of a progress bar
  • Added a table display for displaying alerts and vulnerabilities in the console
  • Unified processing of slash at the end of a line for the scan dir command

[2023.27.0] - 2023-07-06

  • Fixed panic when analyzing some Go projects
  • Fixed scanning of images in terms of incorrect detection of components that are not dependencies

[2023.26.0] - 2023-06-30

  • Improved parsing of gradle-dependency-tree in terms of working with classPath strings
  • Fixed output of Policy Alerts to the console

[2023.23.0] - 2023-06-08

  • Added parsing of different versions of the conan.lock format
  • Fixed the parser flag being reset when reaching an empty line in conanfile.txt
  • Fixed yarn.lock parsing

[2023.21.0] - 2023-05-23

  • Added launch parameter --scan-depth to configure archive scanning depth
  • Added --scan-files flag to the scan image command to scan files inside a docker image
  • Improved detection of nested dependencies of jar packages
  • Fixed Gemfile parsing

[2023.15.0] - 2023-04-14

  • Added Fixed version output
  • Added the ability to save scan results
  • Added the ability to create a project
  • Added search for system dependencies in the docker image
  • Optimized parsing of package-lock v3 manifest for NPM
  • Fixed some bugs

[2023.11.0] - 2023-03-16

  • Added support for console commands
  • Improved parsing of pyproject.toml
  • Added cleaning of the /tmp directory after scanning the docker image

[2023.5.0] - 2023-02-01

  • Added scanning of docker images
  • Changed behavior when starting without a project
  • Updated Golang to 1.19
  • Fixed hashing in archives with the --only-hashes option
  • Fixed detection of broken and password-protected archives

[2023.3.0] - 2023-01-20

  • Fixed a bug when parsing gradle-dependency-tree

[2023.2.0] - 2023-01-13

  • Added scanning of archives, flag to run --scan-archives

[2022.52.0] - 2022-12-30

  • Fixed parsing of pom.xml in terms of working with the dependencyManagement section

[2022.50.0] - 2022-12-12

  • Added support for parsing conan.lock files
  • Fixed passing additional data for the resolver from Nuget manifests