Spring is here, and so is a new Minor Release of Lucent Sky AVM - welcome to Lucent Sky AVM version 2203 MR. This release is headlined with support for Ruby and Scala applications, new features and improvements of dependency analysis, and the first preview of real-time intelligence. In fact, calling 2203 MR a Minor Release really doesn’t do it justice as it is packed with over 100 improvements and fixes. To learn more about this release, visit Lucent Sky AVM version 2203 release notes.

Dependency analysis and update guidance

Dependency analysis, a form of software composition analysis, was introduced in Lucent Sky AVM in version 2103 MR. In the one year after, dependency analysis and update guidance have helped developers identify over 3 million vulnerable dependencies and update them to secure versions. In version 2203 MR, we are making further improvements to dependency analysis and update guidance.

• Dependencies and SBOM queries - with a single SQL-like query, developers and other stakeholders can have a holistic view of the dependency landscape of all of their applications. For instance, if a new vulnerability has been discovered in open source package FooBar up to version 2.5.2, with a query like SELECT ApplicationId FROM Dependencies WHERE Name = 'FooBar' AND Version <= '2.5.2', Lucent Sky AVM will identify all applications that contain a vulnerable version of the FooBar library.
• Executive order-compliant SBOMs - directed by the U.S. Presidential Executive Order on Improving the Nation’s Cybersecurity, the NTIA published the minimum requirements of SBOM that includes seven data fields. The XML reports generated by Lucent Sky AVM are now in compliance with the executive order.

Scala and Ruby applications support

Scala applications, as well as Java and Groovy applications built with sbt, are now supported. Ruby applications targeting Ruby 2 and Ruby 3 are also supported.

Real-time intelligence

With real-time intelligence, Lucent Sky AVM uses localized machine learning and proprietary real-time data to more accurately identify vulnerable software dependencies, generate Instant Fixes and dependency update guidance, and automatically suppress false positives. Some features of real-time intelligence are only available in select markets or only available to customers in the Lucent Sky AVM Preview Program. To learn more about the Lucent Sky AVM Preview Program, visit Introducing Lucent Sky AVM Preview Program.

Updating to 2203 MR

If you are using Lucent Sky AVM Enterprise or Standard Edition (either on-premise or cloud) and have an active subscription, you can update to 2203 MR immediately. Our support team will reach out to you shortly to schedule an update. If you are using Lucent Sky AVM On-Demand, your server will be updated to 2203 MR in the next few days.