WhiteSource Azure Repository Integration Launched
January 26, 2022

WhiteSource released an Azure DevOps repository integration, allowing Azure DevOps users to detect all open source components and automatically enforce security policies directly from their repository.

Users can now receive alerts on vulnerabilities along with detailed remediation information, including suggested fixes and prioritization advice, all in the comfort of their native environment, free from the burden of learning a new user interface (UI).

As the time-to-market for applications becomes shorter each year, software development teams are challenged with accelerating their processes without compromising on security. Many Software Composition Analysis (SCA) vendors scan for vulnerabilities in the repository, but only provide results exclusively in their own UI, which slows the development process down. The WhiteSource for Azure Repos integration automatically scans open source code for security vulnerabilities or license violations on every merge request, before the code is merged. If a merge request introduces a new error, the developer is given immediate feedback to resolve any newly introduced vulnerabilities. Positive feedback is given when a pull request resolves vulnerabilities. This differential view between feature branches and mainline branches prevents interruptions to workflows. In addition to WhiteSource's existing integrations with all major code repositories, including GitHub, GitHub Packages, JFrog, Bitbucket, and GitLab, the new WhiteSource for Azure Repos integration allows users to generate inventory, security, and compliance reports.

With the WhiteSource for Azure Repos cloud-based integration, users can:

- View automated remediation suggestions — WhiteSource Enterprise automatically generates pull requests in the repository to update vulnerable open source components to the lowest non-vulnerable version.

- Enforce policies – policies are automatically enforced in the repository for each merge request. The status and results of each scan appear on the Commits page.

- Merge with confidence – WhiteSource's "Merge Confidence" feature uses crowdsourced data to show how likely an open source component can be updated without breaking the build. Merge Confidence includes data on upgrade age, adoption, and compatibility to create a confidence score.

- Scan for IaC misconfigurations – Protect production environments and provide security for the cloud, containers, and Kubernetes directly from Azure Repos.

"Scanning for vulnerabilities within the repository is the 'furthest left' organizations can shift their security efforts while still enforcing policies and requiring all developers to scan their code," said Ori Bach, EVP of Product at WhiteSource. "The cost of remediating vulnerabilities is higher the further you progress into your software development life cycle. With the WhiteSource for Azure Repos integration, developers can receive feedback on their code when it is fresh in their minds, making it easier to remediate vulnerabilities while helping organizations ultimately save time and money."

Share this

Industry News

May 25, 2022

JFrog introduced Project Pyrsia, an open-source software community initiative that utilizes blockchain technology to secure software packages (A.K.A Binaries) from vulnerabilities and malicious code.

May 25, 2022

Kasm Technologies, in partnership with Docker, has developed Kasm Workspaces as a Containerized Desktop Infrastructure platform for streaming remote workspaces directly to your web browser.

May 25, 2022

Cascadeo announced the integration of Amazon DevOps Guru with cascadeo.io, Cascadeo’s cloud monitoring and management platform that provides users with a single view of multi-cloud or hybrid infrastructure environments.

May 24, 2022

Oracle announced the availability of Java 18, the latest version of the programming language and development platform.

May 24, 2022

Docker announced the acquisition of Tilt, makers of a development environment as code for teams on Kubernetes.

May 24, 2022

F5 announced the release of F5 NGINX for Microsoft Azure, an Azure-native service offering developed in partnership with Microsoft, that helps customers deliver modern applications on Azure with just a few clicks.

May 24, 2022

Pegasystems announced a strategic partnership with Google Cloud that will help enable joint clients to accelerate their digital transformations with Pega’s low-code enterprise software on Google Cloud’s highly scalable cloud services.

May 23, 2022

Sauce Labs announced the release of contract testing with mocking on the Sauce Labs API Testing Platform.

May 23, 2022

Pure Storage announced a series of updates to its Portworx portfolio.

May 23, 2022

StackHawk has secured $20.7 million in capital.

May 19, 2022

Jellyfish announced the launch of Jellyfish Benchmarks, a way to add context around engineering metrics and performance by introducing a method for comparison.

May 19, 2022

Solo.io announced the addition and integration of Cilium networking into its Gloo Mesh platform, providing a complete application-networking solution for companies’ cloud-native digital transformation efforts.

May 19, 2022

Aqua Security announced multiple updates to Aqua Trivy, making it a unified scanner for cloud native security.

May 18, 2022

Red Hat unveiled updates across its portfolio of developer tools designed to help organizations build and deliver applications faster and more consistently across Kubernetes-based hybrid and multicloud environments.

May 18, 2022

Armory announced public early access to their new Continuous Deployment-as-a-Service product.