Written by 
JetBrains has partnered with Mend.io, a trusted name in application security. This collaboration will help us continue providing the tools you need to develop secure applications with ease and confidence in our IDEs and Qodana. For the best user experience, make sure to use the latest stable version 2024.3.2.
Why Mend?
Trusted by industry giants like Google and Comcast, Mend.io offers a reliable application security platform. It helps organizations build mature AppSec programs, shifting from reactive vulnerability management to proactive risk mitigation. With Mend’s expertise, our users gain access to a robust solution that simplifies security and boosts code quality.
What’s new?
Our Package Checker plugin has long been a reliable tool for identifying vulnerabilities in third-party dependencies and suggesting safe updates. By switching to Mend.io as our software composition analysis (SCA) provider, we’re ensuring that these capabilities remain effective and up to date.
Malicious package detection
Thanks to this partnership, you can now identify malicious packages – those specifically designed to harm systems. Mend strongly advises removing such packages immediately to protect your code and systems.
Powered by Mend.io, the Malicious Dependency inspection helps you:
- Detect harmful npm and PyPI packages.
Malicious package detection is also available in Qodana.
Vulnerability detection
The popular Vulnerable Path functionality, which helps pinpoint the exact source of a vulnerability, will return with the upcoming 2025.1 version of JetBrains IDEs, giving you added precision when managing your code dependencies.
Basic functionality remains
The bundled Package Checker plugin will continue to provide a reliable way to keep your code secure with the help of the following basic features:
- Dependency scanning. Helps identify vulnerabilities and threats in third-party dependencies.
- Safe updates. Suggests secure versions of dependencies, allowing you to fix vulnerabilities easily.
- Smooth IDE integration. Highlights issues directly in the editor and provides details in the Problems | Vulnerable Dependencies tab or via Analyze | Vulnerable Dependencies.
Looking ahead
This update brings incremental, yet valuable, improvements to the security features in JetBrains IDEs and Qodana. We’re committed to enhancing these capabilities further and providing you with the tools needed to build secure applications.
Be sure to update your tools and try the new features once they are available!
Subscribe to IntelliJ IDEA Blog updates
