The new detect.project.version.create.when.no.components property lets release owners stop empty Black Duck SCA project versions from being created when Detect finds no components and no other scan tools are active. Set it to false to reduce portfolio noise, avoid misleading reporting, and keep release evidence focused on scans with meaningful results.
What changes for release governance
Detect 12.0.0 gives teams more explicit control over scan scope and scan-record creation. That matters where security findings, open-source obligations, and release approvals are measured against project-version data.
The new property defaults to true, preserving existing behavior. Organizations that use project versions as audit records should decide centrally when component-free builds warrant a record and when they do not.
Use this control carefully:
- Retain empty records when they serve a documented audit purpose.
- Suppress them when they create false operational signals.
- Apply the same setting across comparable CI pipelines.
- Document exceptions for products with multiple scan tools.
Detect also adds detect.diagnostic.archive.path, allowing diagnostic archives to be written to a defined location. This supports controlled retention, faster incident investigation, and collection of build evidence from ephemeral runners.
Dependency scope is more precise
Python UV, npm workspaces, and Bazel projects receive the most consequential scan-scope updates.
For UV projects, Detect now scans all dependency groups by default using . Previously, only the default group was included. This can expose development, linting, test, and other grouped dependencies that were absent from prior scan results.
