Hey everyone, I’ve been running Mend (formerly WhiteSource) for a few months now and generally love the security coverage it gives us. But I’ve hit a snag recently that's starting to really impact our dev flow.
After the latest couple of updates, our CI/CD pipeline has started taking an extra 10 to 15 minutes to complete when Mend’s SCA scan kicks in. This is happening consistently across several of our mid-sized Node.js and Python projects. We're using the standard Mend Azure DevOps integration.
Has anyone else seen a similar slowdown? I'm trying to figure out if this is:
- Something specific to our configuration
- A known issue with recent versions
- Just the new normal for deeper scanning
I’m all for thorough security, but adding that much time to every pipeline run is tough for our sprint cadence. Would love to hear if others have experienced this and if you found any tweaks to speed things up without sacrificing scan quality. Maybe a cache setting or a different agent configuration?
Yeah, that's a noticeable hit for sure. I haven't seen widespread reports on a recent slowdown like that, which suggests it might be more specific to your setup or project structure. A 10-15 minute jump sounds like more than just a "new normal" for deeper scanning.
Have you checked if the agent is pulling down the full vulnerability database each time instead of using a cached version? That's a common culprit. Also, maybe the scan is now traversing node_modules/python packages it previously skipped?
Mend's support is usually pretty good at diagnosing these pipeline time spikes if you can give them a specific scan log. Might be worth opening a ticket and linking it here if you find a cause.
Keep it civil, keep it real.
That's a big jump. I've been using the Mend GitHub Action, and while it's usually pretty smooth, I've seen similar slowdowns when our project's dependency count creeps up.
One thing I had to double-check was the scan scope. In our case, the default settings ended up scanning test dependencies and dev tooling directories (like `cypress` for us) that we didn't really need in the pipeline. Adding a `includes` filter to the config shaved a few minutes off. Could your `mend.yaml` or Azure task parameters have changed subtly?
Also, is your pipeline using a fresh agent every time, or is there any chance the Mend agent/CLI itself is being reinstalled on each run instead of cached? That download overhead can add up fast.
Keen to hear what you find, as I'm trying to optimize our own setup! 😅
Learning by breaking
Agreed on the scope creep being a huge factor, but I'd push back slightly on the caching angle being a primary suspect for a 10+ minute delta. Downloading the CLI or even a fresh vulnerability DB, unless you're on a terribly slow connection, is usually a matter of seconds, not minutes.
The real time sink is almost always the file system traversal and analysis. I've seen Mend, and tools like it, get absolutely bogged down when they hit a directory with tens of thousands of files, like a massive `node_modules` or a Python virtual environment with a sprawling dependency tree. Your point about `cypress` is spot on. Another classic culprit is scanning `__pycache__` directories or `.next` build caches if they aren't excluded.
Beyond simple includes/excludes, you might want to check if the recent updates changed the `maxDepth` setting or started resolving symbolic links differently. A symlink to a monorepo root can suddenly cause it to scan the entire company codebase.
Show me the benchmarks
That's a rough slowdown, especially for a sprint cadence. I haven't used the Azure DevOps integration myself, but I'm seeing something similar with the Mend GitHub Action on a Python project lately.
> Maybe a cache setting or a different agent configuration?
This made me double-check my own setup. I realized my pipeline wasn't caching the Mend CLI tool between runs at all, so it was downloading it fresh every time. It wasn't the full 10 minutes, but it was a chunk. Are you using the built-in Azure task, and if so, are you letting it handle the agent install automatically? That could be a hidden reinstall each run.
Also, for your Node.js projects, are you scanning the `node_modules` folder directly, or are you letting Mend read from your lockfile? I've heard scanning the directory itself can get way slower as the dependency tree grows.
Learning by breaking