Changelog 2026

​

Open Source

​

PMG v0.33.0

• New: A sandbox profile can list the hosts that a package manager may reach. The PMG proxy enforces the list, also in the persistent proxy. deny_ip_literals: true also refuses an IP address that no rule names. See Network policy.
• New: pmg sandbox profile propose builds a network profile from the hosts that a run reached. The GitHub Action builds one from each job. See Allow Only Known Hosts in GitHub Actions.
• New: The claude, codex and pi sandbox presets allow the hosts that each agent needs. See Use a preset for a known tool.
• Breaking: pmg sandbox exec sends every outbound connection through a PMG proxy. A program that does not use the proxy variables, such as psql, ssh or nc, cannot connect. To allow direct connections again, set network_via_proxy_only: false in a child profile.

​

vet v2 alpha of October 23

• New: Each vulnerability finding says whether your code imports the vulnerable package. For Go, it also says whether your code calls the vulnerable function. vet report finding show prints the call path. Set the depth with vet scan --reach.
• Improved: Findings carry MITRE ATT&CK technique IDs in JSON and SARIF output. Attack findings come first.
• Breaking: vet does not read the saved scans of older alpha builds. Run the scan again.

​

SafeDep Cloud

​

Endpoint Hub

• New: The Package Events tab of an endpoint shows the network policy decisions of PMG: each host that PMG allowed or denied. Needs PMG v0.33.0 or later. See Package Guard.
• New: The Package Events tab shows the sandbox violations that PMG reports, with the denied operations of each run. Needs PMG v0.34.0 or later.

​

Threat Intel

• New: The Threat Intel Feed has four new indicator types: container image, Telegram bot token, Telegram chat ID and HTTP header. Needs the Threat Intel Feed add-on. See Schema.

​

Web app

• New: Maintainers of open source projects can apply for a free Team plan at app.safedep.io/oss/apply.
• Fixed: A revoked invitation can no longer give access to a tenant.

​

Open Source

​

PMG v0.30.0, v0.31.0, v0.32.0

• New: Kernel enforcement on Linux. The kernel sends package manager traffic to the persistent proxy, so a tool cannot go around PMG. Traffic from containers on the host goes through the proxy too. See Kernel enforcement.
• New: A Windows MSI installs PMG for all users. It is also on Chocolatey and winget. See System-wide install.
• New: PMG checks crates from a custom Cargo registry. The persistent proxy also checks Cargo crates and Go modules. See Private registries.

​

vet v2 first alpha

• New: vet scan scans a directory, a git URL, a container image, an SBOM or one package URL. It finds malicious packages, vulnerabilities, risky GitHub Actions workflows, lockfile tampering and changes to AI agent configs.
• New: vet scan --base-ref origin/main reports only what a pull request adds. The safedep/vet GitHub Action comments on pull requests, and vet ci init adds it to a repository.
• New: vet endpoint audit checks the AI tools, MCP servers, agent skills, editor extensions and global npm packages on a machine.
• New: vet auth login connects vet to a SafeDep Cloud tenant. PMG and the SafeDep CLI use the same login.

​

SafeDep Cloud

​

Endpoint Hub

• New: A host observation event shows the port, the entry point and the client process. Needs PMG v0.31.0 or later.

​

Threat Intel

• New: Each indicator of compromise in reports, campaigns and the snapshot export has a confidence (automated or human verified) and a disposition. The feed no longer serves a withdrawn indicator. Needs the Threat Intel Feed add-on.
• Improved: Detection flags npm packages that hide a loader in a prebuilt native addon.

​

Web app

• New: On a component page, each project links to the scan that found the component.

​

SafeDep CLI v0.10.0

• New: safedep integration bitbucket link delete removes the link to a Bitbucket workspace.