Google's CodeMender defaults to a deep scan, not a quick one

Google’s CodeMender, the AI agent that finds and patches vulnerabilities in open-source code, shipped version 0.16.0 on 21 October. The headline change: cm find now runs a concurrent, file-by-file deep scan by default, rather than the faster single-session quick scan it used before. Anyone who wants the old speed back has to ask for it explicitly.

The same release adds a cm health command, with --json, --strict and --timeout flags, to check credentials and configuration before a scan starts. File discovery now also covers more C++ header extensions and extensionless scripts that declare a language in their shebang line, and cm stats breaks its numbers down by scan mode so you can see how much of each you have been running.

cm find            # deep scan, now the default
cm find --quick     # the old single-session scan

Why it matters: if you run CodeMender in CI or on a schedule, the same command now takes longer and burns more compute than it did last week, in exchange for Google’s claimed higher vulnerability recall. If you have a fixed time or budget window for these scans, check which mode you are actually running and pass --quick where the old behaviour is what you need.