endor-upgrade

To identify safe dependency upgrades, you retrieve vetted options from pre-computed Upgrade Impact Analysis data. Each recommendation includes findings fixed, upgrade risk, and whether it is the best or latest version, minimizing the chance of introducing breaking changes.

Dependency upgrade impact analysis assesses safe upgrades before applying them by using pre-computed data. It helps vulnerability remediation by recommending pre-vetted dependency upgrades that fix security findings while minimizing the risk of breaking changes.

No, you do not need to run a new scan to get upgrade risk assessment. The system retrieves vetted upgrade options from pre-computed VersionUpgrade data, providing risk-aware guidance based on existing Endor Labs scans.

Before retrieving safe upgrade recommendations, you must run the Endor MCP server setup and register and scan your project. This ensures your software project with vulnerable dependencies appears in the Endor Labs catalog.

Yes, you can check if an upgrade is the best or latest version when fixing vulnerabilities. Risk-aware guidance for each recommendation explicitly states whether the suggested dependency upgrade is the best and/or latest available option.

The limitation of using pre-computed VersionUpgrade data for software maintenance is that it applies only to software projects previously scanned with the Endor MCP server. Projects without a prior scan and Project UUID cannot retrieve upgrade recommendations.