Black Duck Detect 12.1.0: Broader ecosystem support and more reliable dependency scans

Black Duck Detect 12.1.0 adds support for OpenJDK 25 for teams running scans against this Java runtime. The release also broadens package ecosystem compatibility, improves scan diagnostics, and addresses failures or inaccurate bill-of-material results in most detectors.

OpenJDK 25 support

Detect can now run with OpenJDK 25. The release also notes important Java lifecycle notices: Java 8 is no longer supported, while support for Java releases earlier than 17 remains deprecated and is scheduled for removal in Detect 13.0.0.

Updated package manager support

Detect 12.1.0 extends compatibility for these package-manager versions:

• pip 26.1.2
• Pipenv 2026.6.2
• Setuptools 83.0.0
• uv 0.11.29
• Poetry 2.4.1
• Go 1.26.5

These updates affect teams scanning projects that use the listed ecosystem tools and versions.

UV Lockfile dependency-group configuration

The detect.uv.dependency.groups.only option now also applies to the UV Lockfile (buildless) detector. Teams using that detector can apply the setting when defining which uv dependency groups Detect includes.

PNPM detector logging

PNPM detector logs now provide clearer informational and debug detail for workspace modules and dependencies identified during a scan. This change improves log-level visibility into what Detect discovers in PNPM workspaces.

Detector and scan reliability fixes

The release groups several corrections affecting scan completion and dependency output:

• NuGet Inspector no longer fails with a null-pointer error when multiple detect.nuget.packages.repo.url values are configured.
• SCASS retry behavior now includes operations for smaller files, not only chunked uploads of large files.
• npm direct-dependency aliases appear in the BOM, and multiple aliases for one underlying package resolve correctly.
• Cargo version parsing handles pre-release suffixes and malformed or non-standard version output more reliably.
• Component Location Analysis correctly identifies packages with partially specified versions in package-lock.json.
• Maven scans avoid incomplete or incorrect BOM output caused by extra lines in mvn dependency:tree output.
• Detect no longer hangs indefinitely when bazel cquery stalls on an unresolvable local_repository entry in WORKSPACE.bzlmod with Bazel 7.1.

Bundled dependency and inspector updates

Detect 12.1.0 updates Jackson to 2.22.3, FreeMarker to 2.3.35, NuGet Inspector to 2.6.1, and Component Locator Library to 2.4.8. These are included dependency and component updates within the release.

Upgrade notices

Code downloads should use repo.blackduck.com and detect.blackduck.com; Detect script downloads should use detect.blackduck.com only. Detect 10.0.0 and later works only with repo.blackduck.com.

Docker Inspector remains deprecated and is scheduled for removal in Detect 13.0.0. SCASS customers must configure the stated service IP addresses in network firewalls or allow lists so scan data can reach the service.

Based on the official Black Duck release notes.

How Merito helps

Merito can help teams plan and validate self-managed Detect upgrades through implementation services and premium support. Review the Black Duck portfolio for related software composition analysis information.

Merito is an authorized Black Duck reseller and services partner. Our Black Duck Detect team can scope licensing, sizing, and rollout for 12.1.0, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.