What does the HeroDevs integration with Mend do?

npm and Maven. On npm, NES covers JavaScript packages including Angular, AngularJS, Vue 2, React, Bootstrap and Axios. On Maven, NES covers Java packages including Spring Framework and Spring Boot. Coverage follows the NES catalog, and new NES releases reach Mend through the same feed.

Do I need a subscription with HeroDevs to access fixed CVEs in end-of-life versions in Mend?

Yes, to install the fix. Mend SCA can show that an NES fix exists without an NES subscription, but your build pulls the NES package only with valid NES credentials.

How do I turn on NES pull requests in Mend Renovate?

With Mend's repository integration enabled, add the HeroDevs replacement preset to your Mend Renovate configuration. Mend Renovate then opens replacement pull requests for covered packages.

Does Mend Renovate merge the NES replacement automatically?

Only if you configure automerge. Otherwise your team reviews the NES replacement pull request, runs your tests and merges, like any other dependency update.

What changes in my code when I merge the NES pull request?

On npm, the dependency key in package.json stays the same and its value becomes an npm alias that points to the HeroDevs package, so your import statements stay the same. On Maven, NES keeps the same group and artifact IDs and uses a HeroDevs version string.

Will Mend still flag CVEs that NES has fixed?

No. HeroDevs tells Mend which CVEs each NES version resolves, so Mend SCA stops flagging those CVEs once the NES version is installed.

Is NES a substitute for upgrading off end-of-life open source?

No. NES is for end-of-life versions that no longer receive upstream patches, or where a migration will take longer than your risk tolerance allows. NES keeps your team on the version line it already runs while you plan the migration.

Mend flags the CVEs with no upstream patch. HeroDevs supplies the fix.

The HeroDevs Never-Ending Support (NES) fix now appears next to the finding in Mend SCA. With an NES subscription, Mend Renovate opens the pull request, so your team reviews a patch on the version line it already runs instead of planning a migration.

Get NES Pricing

“Knowing a vulnerability exists is half the job. Mend.io’s goal is to help customers secure their applications, and that means closing findings, not only reporting them. With HeroDevs, Mend AppSec customers using Mend SCA can now close CVEs on end-of-life open source dependencies that no longer get upstream patches.”

Asaf Saar

Chief Product Officer, Mend.io

From the Mend finding to a merged fix

01

02

03

04

UI card titled Remediation with an inactive label 'jquery 2.2.4' crossed out, an arrow pointing down, and a highlighted box containing '2.2.4-jquery-2.2.6'. Below are two green check marks with text: 'Same version line' and 'No migration'. A pink label 'HeroDevs NES' is on the top right corner.

1. Mend SCA flags the CVE

Mend scans your repositories as it does today and reports the CVE on a package version that no longer receives upstream fixes.

UI card showing a pull request labeled Open for replacing the dependency @angular/animations with @neverendingsupport/angular in package.json, displaying the removal of @angular/animations and addition of @neverendingsupport/angular. The update type is Replacement and Automerge is Disabled.

2. Mend shows the NES fix

HeroDevs continuously shares the CVEs NES fixes, by package and version, so Mend SCA can point to the NES release that fixes the CVE without a migration to a new major version.

UI card showing a security finding for CVE-2020-11023 related to jQuery 2.2.4, labeled Medium severity and End-of-life status, with an upstream fix version 3.5.0 marked as major and a message stating that the fix requires a major upgrade.

3. Mend Renovate generates the pull request

For teams with an NES subscription, Mend Renovate opens a replacement pull request that swaps the vulnerable version for its NES distribution. Your team reviews the pull request, runs your tests and merges.

UI card showing Mend SCA finding labeled as Resolved with CVE-2020-11023 crossed out, related to jquery version NES 2.2.4-jquery-2.2.6, and status stating no longer flagged in Mend SCA.

4. The finding closes

Mend recognizes which CVEs each NES version resolves, so Mend stops flagging those CVEs once the NES version is installed.

Upgrade, migrate or NES: decide per finding

A finding with no upstream patch stays open until the migration ships, and the organization carries that finding into every audit and customer security review. Mend SCA shows the HeroDevs fix alongside the other proposed fixes, so your team picks the path per finding.

An upstream fix exists on a new version of your package