Black Duck Detect 12.0.0: Tighter Scan Scope and CRA Readiness

The new detect.project.version.create.when.no.components property lets release owners stop empty Black Duck SCA project versions from being created when Detect finds no components and no other scan tools are active. Set it to false to reduce portfolio noise, avoid misleading reporting, and keep release evidence focused on scans with meaningful results.

What changes for release governance

Detect 12.0.0 gives teams more explicit control over scan scope and scan-record creation. That matters where security findings, open-source obligations, and release approvals are measured against project-version data.

The new property defaults to true, preserving existing behavior. Organizations that use project versions as audit records should decide centrally when component-free builds warrant a record and when they do not.

Use this control carefully:

• Retain empty records when they serve a documented audit purpose.
• Suppress them when they create false operational signals.
• Apply the same setting across comparable CI pipelines.
• Document exceptions for products with multiple scan tools.

Detect also adds detect.diagnostic.archive.path, allowing diagnostic archives to be written to a defined location. This supports controlled retention, faster incident investigation, and collection of build evidence from ephemeral runners.

Dependency scope is more precise

Python UV, npm workspaces, and Bazel projects receive the most consequential scan-scope updates.

For UV projects, Detect now scans all dependency groups by default using uv tree --all-groups. Previously, only the default group was included. This can expose development, linting, test, and other grouped dependencies that were absent from prior scan results.

Teams that need a narrower policy can use detect.uv.dependency.groups.only with a comma-separated list, such as dev,lint. The setting applies only to groups under [dependency-groups]; it does not include extras under [project.optional-dependencies]. When a group is both included and excluded, the exclusion wins and Detect logs a warning.

For npm monorepos, the new settings provide workspace-level control:

• detect.npm.included.workspaces selects workspaces to scan.
• detect.npm.excluded.workspaces removes specified workspaces.
• detect.npm.ignore.all.workspaces=true excludes every workspace.

Exclusions take precedence over inclusions. Release engineering teams should treat these options as governed policy, not ad hoc pipeline flags, because omitted workspaces can leave software inventory incomplete.

Bazel users running Bzlmod on Bazel 7.1 or later now receive direct-versus-transitive classification for Bazel Central Registry dependencies. This improves triage because accountable application dependencies can be distinguished from dependencies introduced deeper in the graph.

Platform lifecycle decisions cannot wait

Java 8 support has been removed to meet EU Cyber Resilience Act requirements. Support for Java versions below 17 is deprecated in this release and will be removed in Detect 13.0.0.

The practical implication is clear: scan runners, shared build images, developer workstations, and any wrapper scripts that execute Detect need a Java 17 migration plan now. A successful scan on an older environment during this transition should not be interpreted as long-term support.

Docker Inspector is also deprecated in 12.0.0 and is scheduled for removal in 13.0.0. Support for Docker Inspector on RPM-based Linux platforms, including CentOS and Red Hat, is removed in this release. Teams should identify all dependent jobs, map their container-scanning requirements, and test a supported replacement before the next major version creates an avoidable release interruption.

Reliability and compatibility updates

Detect extends support for current ecosystem versions, including RubyGems 4.0.15, Gradle 9.6.1, Maven 3.9.16, pnpm 11.8.0, npm 11.13.0, and Node.js 24.17.0. These updates reduce pressure to hold back language and build-tool upgrades solely to preserve scan compatibility.

The pnpm detector also now reads pnpm-lock.yaml as UTF-8 and completes when the lockfile has no dependencies. This removes failures caused by emojis or other non-ASCII text and supports valid projects with dependency-free lockfiles.

Configuration cleanup requires review in managed pipeline templates:

• detect.quack.patch.output is renamed to detect.quack.patch.output.path.
• detect.bazel.workspace.rules is removed.
• Detect container images now use Chainguard.

Treat renamed and removed properties as configuration-as-code changes. Search centralized templates, repository pipeline files, and shared runner images before deployment.

Network and download controls

Detect code downloads should use repo.blackduck.com and detect.blackduck.com; Detect scripts should be downloaded only from detect.blackduck.com. Detect 10.0.0 and later require repo.blackduck.com.

Organizations using SCA Scan Service must also ensure firewalls and allow lists permit the documented SCASS endpoints and IP addresses. Network changes need coordination between application security, platform engineering, and network security teams; otherwise scans may fail after pipeline changes despite correct Detect configuration.

Recommended upgrade actions

Before promoting Detect 12.0.0 broadly, run a controlled assessment across representative repositories and build platforms.

• Inventory Java versions used by all Detect execution paths.
• Locate Docker Inspector usage and define replacement scanning workflows.
• Compare UV findings before and after all dependency groups are scanned.
• Define approved npm workspace inclusion and exclusion rules.
• Decide whether component-free scans should create project versions.
• Update deprecated property names in shared templates.
• Validate download endpoints and SCASS firewall routes.
• Preserve diagnostic archives where release investigations require them.

This release changes both evidence quality and execution prerequisites. Governance owners should approve the intended scan scope before making 12.0.0 the default across CI/CD estates.

How Merito helps

Merito helps enterprises assess Detect 12.0.0 readiness across CI/CD runners, network controls, repository templates, and Black Duck SCA governance rules. We can define scan-scope standards for monorepos and Python projects, plan Java 17 and Docker Inspector transitions, test upgrade outcomes, and produce auditable rollout criteria for release teams.

Merito is an authorized Black Duck reseller and services partner. Our Black Duck Detect team can scope licensing, sizing, and rollout for 12.0.0, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.