DeepSource

No entries match these filters. Clear filters

1. AI Review on more programming languages seen Jul 23, 2026 · issue 023

   DeepSource adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. inference, Kubernetes Gateway API, monorepo SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and expanded AI Review language support.

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable Kubernetes Gateway API on Enterprise Server so DeepSource creates HTTPRoutes instead of Ingress resources, keeping traffic within your existing Gateway.
   📍In the Admin Console, go to Config, set 'Use Gateway API?' to Yes, then provide your Gateway name and namespace.
   Turn on AI Review for a newly supported language that has no DeepSource static analyzer.
   📍In the DeepSource dashboard, go to Settings → Code Review → Analyzers, pick the target language, and click Save changes.
   • Adds DeepSource MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server exposing 30 tools across 8 categories so AI coding agents can access code review results, vulnerability data, and repository metrics via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
   • Supports Bring Your Own Key (BYOK) model provider credentials for Enterprise Server AI Review, routing inference directly to Azure OpenAI or GCP Vertex AI without passing through DeepSource Cloud.
   • Expands AI Review to ten additional programming languages that lack a DeepSource static analyzer.
   • Introduces two AI Review tiers (Standard and Advanced), with Team plan users defaulted to Standard.
   • Enables AI Review to run on-demand only when @deepsourcebot is mentioned in PR comments.

   +5 more show less

   • Simplifies AI Review billing to a single blended metric: processed lines of code (LOC).
   • Supports Kubernetes Gateway API on Enterprise Server, creating HTTPRoutes attached to an existing Gateway instead of an Ingress.
   • Runs SCA on monorepos with per-sub-repository Dependencies tabs, scoped to each sub-project's packages and lock files.
   • Adds configurable preferences for new open-source dependency vulnerability alerts, including notification recipients and severity thresholds, via Policies → OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Vulnerabilities → New Vulnerability Alerts.
   • Continuously monitors multiple vulnerability databases every hour and automatically re-scans affected repositories when newly published CVEs match dependencies, sending digest emails to org admins.

   10 details in Everything

2. AI Review on more programming languages Jul 17, 2026 · release notes

   DeepSource adds Java Maven reachability analysis, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. AI, and Gateway API support in v2026-07-16

   └──▷ HOW TO FIND IT
   Configure DeepSource Enterprise Server to use the Kubernetes Gateway API instead of Ingress resources.
   📍In the Admin Console, go to Config and set Use Gateway API? to Yes, then provide your Gateway name and namespace.
   Install the DeepSource MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for an AI coding agent using NPM.
   copy

   $ npx add-mcp deepsource --auth=oauth

   Configure notification preferences for new open-source dependency vulnerability alerts via the UI.
   📍In the DeepSource dashboard, head to Policies -> OSS Vulnerabilities -> New Vulnerability Alerts and set who gets notified and at what severity threshold.
   • pom.xml Java projects now have Reachable or Unreachable vulnerability labels based on bytecode-level reachability analysis.
   • Sub-repositories in monorepos each get a scoped Dependencies tab using their own or the root lock file.
   • Settings → Code Review → Analyzers enables AI Review for ten languages that previously lacked a static analyzer.
   • Admin Console setting Use Gateway API? (Yes/No) with gateway name and namespace configures DeepSource to create HTTPRoute resources instead of Ingresses.
   • AI Review can be configured to trigger only when @deepsourcebot is mentioned in PR comments.

   +3 more show less

   • Policies -> OSS Vulnerabilities -> New Vulnerability Alerts allows configuring notification recipients and severity thresholds for new open-source dependency advisories.
   • The DeepSource MCP Server exposes 30 tools across 8 categories via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., installed using add-mcp from NPM with OAuth authentication.
   • Enterprise Server v5.0.0+ supports Bring Your Own Key (BYOK) for AI Review inference, directing calls directly to user-owned model provider endpoints.

   8 details in Everything

3. OSS vulnerability scanning for monorepos May 21, 2026 · release notes

   DeepSource adds per-subrepo OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. vulnerability scanning, AI Review for 10 new languages, and Kubernetes Gateway API support for Enterprise Server.

   • Adds per-subrepository vulnerability scanning for monorepos with a dedicated Dependencies tab scoped to each sub-project's manifest or lock file.
   • Expands AI Review coverage to Dart, Elixir, Apex, Groovy, Objective-C, VB.NET, PowerShell, Lua, Erlang, and Perl.
   • Enables Kubernetes Gateway API support in Enterprise Server via Admin Console configuration.

   3 details in Everything

4. Upgrades to AI Review Engine Apr 14, 2026 · release notes

   DeepSource adds AI Review run-on-mention mode and standard/advanced tiers

   • Switches Team plan users to the Standard tier by default, with migration path from AI & Agents policy page

   1 detail in Everything

5. Configure New Vulnerability Alerts Apr 11, 2026 · release notes

   DeepSource adds configurable OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. vulnerability alert preferences via UI

   • Adds UI path Policies -> OSS Vulnerabilities -> New Vulnerability Alerts to control OSS dependency alert notifications
   • Adds option to set notification severity threshold (critical, high, medium, low) for new open-source vulnerabilities
   • Adds toggle to include all organization admins in vulnerability alert notifications

   3 details in Everything

6. DeepSource MCP Server Apr 7, 2026 · release notes

   DeepSource MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. release enables AI agents to access code review, vulnerability, and compliance data via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.

   └──▷ TRY IT
   Install the DeepSource MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server for an AI agent using the NPM utility
   copy

   $ npx add-mcp https://mcp.deepsource.com/mcp

   • Adds add-mcp utility from NPM for installing the DeepSource MCP Server integration with AI coding agents.
   • Exposes 30 tools across 8 categories for accessing pull request findings, PR report card grades, dependency vulnerability reachability, code coverage metrics, compliance reports (OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10, SANS Top 25), and issue suppression rules.
   • Enables authentication via OAuth without manual token configuration.

   3 details in Everything

7. Bring Your Own Key (BYOK) Apr 1, 2026 · release notes

   DeepSource v5.0.0 adds BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. AI Review, allowing Enterprise Server users to direct inference to their own model providers.

   • Adds Bring Your Own Key (BYOK) capability to DeepSource Enterprise Server for AI Review, enabling inference calls to go directly to user-chosen providers.
   • Supports Anthropic Claude via Amazon Bedrock or direct API as a BYOK provider.
   • Supports OpenAI GPT Codex via Azure OpenAI or direct API as a BYOK provider.
   • Supports Google Gemini via GCP Vertex AI or direct API as a BYOK provider.

   4 details in Everything

8. .NET 10, Windows CLI, and PR feedback Mar 21, 2026 · release notes

   DeepSource adds .NET 10 analyzer support, Windows CLI with --skip-tls-verify, and PR Report Card insights

   • --skip-tls-verify flag in the DeepSource CLI for on-prem installations with self-signed certificates.
   • Windows installation via PowerShell script for the DeepSource CLI.
   • Analysis support for .NET 10 runtime.
   • PR Report Card insights included in pull request comments and Copy as Markdown exports.

   4 details in Everything

9. DeepSource CLI v2 Mar 7, 2026 · release notes

   New CLI v2 releases with JSON output and AI agent skill integration for automated code review workflows.

10. The AI Code Review Platform Feb 24, 2026 · release notes

    DeepSource adds AI Review engine, inline PR comments, and PR Report Card via new GraphQL types and UI toggles

    • Adds the Enable AI Agents flag in Policies > AI on the dashboard to activate the new AI code review engine alongside static analysis
    • Enables inline review comments on pull request diffs for GitHub, GitLab, Bitbucket (Cloud and Data Center), and Azure DevOps Services via the Settings > Quality Gates toggle
    • Generates a PR Report Card with grades A-D across Security, Reliability, Complexity, Hygiene, and Coverage dimensions for every reviewed pull request
    • Exposes new GraphQL types for retrieving AI issues, OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. vulnerabilities, and PR report card data

    4 details in Everything

11. SSO multi-IDP support Jan 23, 2026 · release notes

    DeepSource introduces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. multi-IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support with provider selection screen for users accessing multiple identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..

    • Introduces a provider selection screen during login for users who have access to multiple IDPs

    1 detail in Everything

12. Code formatters, team invitations, performance improvements Dec 16, 2025 · release notes

    DeepSource renames Transformers to Code Formatters and adds Past Invoice view for free plan.

    • Adds code_formatters type to the Public API, replacing the deprecated transformers type.
    • Enables free plan users to view past invoices from the billing page.

    2 details in Everything

13. Bun and uv are now supported in DeepSource SCA Jun 26, 2025 · release notes

    DeepSource SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds native support for Bun and uv package managers via new discovery triggers.

    • Adds Bun package manager support in DeepSource SCA for JavaScript projects.
    • Adds uv package manager support in DeepSource SCA for Python projects.

    2 details in Everything

14. DeepSource Agents, Autofix AI, OIDC support May 28, 2025 · release notes

    DeepSource introduces autonomous Agents (Autofix, CVE prioritization, False Positive Triage), Autofix AI, Vanta SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. integration, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth.

    • Adds DeepSource Agents for autonomous code analysis including Autofix™ Autopilot, CVE Prioritization Agent, and False Positive Triage Agent
    • Enables Autofix™ AI mode via Team Settings to generate context-aware remediations using LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
    • Integrates Software Composition Analysis (SCA) with Vanta to surface vulnerable dependencies in the Vanta dashboard
    • Supports OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) authentication for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows

    4 details in Everything

15. DeepSource SCA Apr 8, 2025 · release notes

    DeepSource announces general availability of its Software Composition Analysis feature for Cloud workspaces and introduces a paid subscription tier.

16. DeepSource Directory, Globstar improvements Feb 22, 2025 · release notes

    New DeepSource Directory for checkers; Globstar supports Go-based checkers with tree-sitter API

    • Launches the DeepSource Directory, a central place to explore code quality and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checkers across 20+ Analyzers
    • Enables writing Globstar checkers in Go with an all-new API for tree-sitter scope resolution and multi-file analysis

    2 details in Everything

17. Improvements to Secrets Analyzer Jan 30, 2025 · release notes

    DeepSource improves Secrets Analyzer accuracy for Terraform and VueJS, adds API mutations and role mapping

    • Favorites section added to the sidebar in the main application navigation for quick access to repositories
    • API exposes updateRepositoryIssuePrioritySetting mutation for updating priority gates
    • API exposes updateRepositoryMetricSetting mutation for updating metric thresholds
    • GitHub MAINTAIN role mapped to ADMIN role on DeepSource for easier permission management

    4 details in Everything

18. Introducing Globstar: Open-source Static Analysis Toolkit Jan 26, 2025 · release notes

    DeepSource releases Globstar, an open-source static analysis toolkit for custom YAML checkers using tree-sitter.

    └──▷ TRY IT
    Run custom defined checkers against your codebase after creating a .globstar/ directory.
    copy

    $ globstar check

    • Adds support for writing custom checkers in .globstar/ directory using YAML format with tree-sitter S-expression syntax

    1 detail in Everything

19. Rust Support in VS Code Extension Aug 6, 2024 · release notes

    DeepSource adds Rust support to VS Code extension and new API endpoints for repository management.

    • Adds Rust language support in the DeepSource VS Code Extension for static analysis and Autofix AI
    • Adds Repository Activation/Deactivation API to activate or deactivate repositories programmatically

    2 details in Everything

20. Support for Java 21 May 14, 2024 · release notes

    DeepSource adds Java 21 analysis support and optional GitLab MR status checks.

    • Adds Java 21 support to the DeepSource Java Analyzer for new language features like record patterns and switch pattern matching
    • Enables disabling external status checks sent to GitLab with a new configuration option

    2 details in Everything

21. Community Analyzers Jan 18, 2024 · release notes

    DeepSource adds Bitbucket Data Center support and exposes SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.-based Community Analyzers via API

    • Bitbucket Data Center added as a supported VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. provider for code health monitoring
    • New Community Analyzers feature supporting Kube Linter, Dart Analyze, Slither, and AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. Linter via SARIF reports in CI pipelines
    • API types IgnoreRule and IssueCategorySetting added for issue suppression and category configuration

    3 details in Everything

22. Support for stacked pull-requests Nov 15, 2023 · release notes

    DeepSource adds stacked PR diffing, Ruff transformer, and GitLab subgroup support.

    • Correctly diffs stacked pull requests to show only new issues introduced in each layer.
    • Adds Ruff as a configurable Transformer for Python formatting in .deepsource.toml.
    • Supports syncing repositories nested within GitLab subgroups of any depth.

    3 details in Everything

23. Support for Monorepos Sep 27, 2023 · release notes

    DeepSource vSep-26-2023 introduces monorepo support for GitLab, Bitbucket, and Azure DevOps; adds cyclomatic complexity configuration, Go 1.21, C/C++ standard config, and doc

    • Adds general availability of monorepo mode with support for GitLab, Bitbucket, and Azure DevOps Services VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. providers
    • Adds configurable cyclomatic complexity thresholds in the Analyzer configuration (default: medium)
    • Adds support for multiple Azure Directories (tenants) within the Azure DevOps Services integration
    • Adds Go v1.21.x runtime support to the Go analyzer
    • Adds documentation coverage metrics reporting capability in the Scala analyzer

    +1 more show less

    • Adds configurable C/C++ standard selection via Analyzer meta options

    6 details in Everything

24. VS Code Extension Aug 22, 2023 · release notes

    DeepSource releases VS Code Extension in private beta with first-class monorepo support.

    • Releases DeepSource's VS Code Extension for private beta, enabling issue detection and resolution directly within the editor
    • Adds first-class monorepo support to allow mapping subfolders as sub-repositories with independent quality gates
    • Enables Autofix on up to 1000 files at once in a single operation

    3 details in Everything

25. Integration with Vanta Jun 29, 2023 · release notes

    DeepSource adds Vanta integration, commit skip support, and new analyzer rules

    • Adds official integration with Vanta to display source code security compliance issues directly in the Vanta dashboard
    • Enables skipping analysis by adding skip ci, ci skip, no ci, or skipcq to commit messages
    • Improves GitHub organization onboarding by auto-adding users to existing teams during signup
    • Adds 15 new static analysis and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checks across C#, Java, JavaScript, and Rust
    • Adds Autofix support for 12 existing checks in JavaScript and Java

    5 details in Everything

26. Retry analysis checks Jun 2, 2023 · release notes

    DeepSource adds manual check retry capability and GitHub auto-sync toggle plus Ruby analyzer config option

    • Adds ability to retry individual or all unsuccessful analysis checks via History tab buttons
    • Adds Automatically sync access settings from GitHub toggle in Access Control tab for automatic user/org syncing on Enterprise Server
    • Adds non_public parameter to the skip_doc_coverage config key in .deepsource.toml to exclude non-public methods from documentation coverage calculations

    3 details in Everything

27. Community Analyzers May 14, 2023 · release notes

    DeepSource adds Bitbucket Data Center support and new API types for subscriptions and rule ignoring

    • Adds Community Analyzers support for Kube Linter, Dart Analyze, Slither, and AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. Linter via SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. ingestion.
    • Adds Bitbucket Data Center as a supported Version Control System (VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures.) provider in the DeepSource cloud dashboard.
    • Adds AccountSubscription, IgnoreRule, and IssueCategorySetting types to the DeepSource API.

    3 details in Everything

28. VS Code Extension Apr 28, 2023 · release notes

    DeepSource VS Code Extension launches with monorepo support and 30+ new analyzers in private beta

    • VS Code Extension enters private beta, enabling issue detection, understanding, and resolution directly within the editor
    • Adds first-class support for monorepos by allowing repository mapping of subfolders as sub-repositories with independent quality gates
    • Adds 30+ new static analysis checks across C#, Java, JavaScript, Scala, and Ruby languages
    • Enables Autofix™ for 12 specific checks including JS-W1042, JAVA-W1086, and others

    4 details in Everything

29. Audit Log Improvements Apr 22, 2023 · release notes

    DeepSource v.AuditLogImprovements adds team-level audit logs, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., multi-report coverage, and new analyzer checks.

    • Adds Team-level Audit Log tracking activity such as team membership changes, billing info, and repository permissions in the Security tab of team settings
    • Adds Search, Filter by timeframe, and CSV Export capabilities to the audit log interface
    • Enables SCIM (System for Cross-domain Identity ManagementSystem for Cross-domain Identity ManagementA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.) provisioning for Enterprise Cloud users alongside SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.-based SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
    • Supports implicit merging of multiple CI-generated test coverage reports sent under the same key name
    • Tracks documentation coverage in the Rust Analyzer with meta fields for configuration

    +3 more show less

    • Adds 50 new static analysis and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checks (CXX-W2030, CS-R1111, SC-A1005, JS-W1040, RS-E1034, JAVA-E1106) to existing analyzers
    • Adds Autofix support for 11 specific checks across C#, Java, and JavaScript (CS-R1032, CS-R1107, CS-R1113, CS-W1069, CS-W1084, JAVA-W0379, JAVA-W1010, JAVA-W1032, JAVA-W1075, JS-W1040)
    • Adds Team object to the public API for querying team member lists

    8 details in Everything

30. Improved commits and PRs for Autofix™️ Mar 31, 2023 · release notes

    DeepSource v2023-03-30 adds Autofix for PHP, LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. coverage support, report inference settings, and conventional commit formatting.

    • Adds Enable report inference toggle under Settings → Code Coverage to track code coverage metrics when tests are skipped on default branch merges
    • Adds Autofix capability for PHP analyzer with support for over 10 auto-fixable issues
    • Adds LCOV format support for Test Coverage reporting in analyzers
    • Adds 2 new PHP detections: PHP-A1012 and PHP-T1006
    • Adds 15 new Rust detections: RS-W1049, RS-W1066, RS-W1047, RS-W1065, RS-W1067, RS-E1013, RS-A1002, RS-A1003, RS-A1004, RS-W1038, RS-W1039, RS-P1005, RS-W1045, and RS-W1046

    +1 more show less

    • Formats Autofix-generated commits to adhere to the Conventional Commits standard

    6 details in Everything

31. Azure DevOps Mar 17, 2023 · release notes

    DeepSource adds Azure DevOps VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. support and SAML2.0 SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.

    • Adds Azure DevOps as a supported Version Control System (VCS) provider alongside GitHub, GitLab, and Bitbucket
    • Adds SAML2.0-based Single Sign-On (SSO) authentication with Okta, OneLogin, and Azure AD Identity Provider support

    2 details in Everything

32. ClangFormat Transformer Feb 23, 2023 · release notes

    DeepSource adds ClangFormat Transformer and 25 new static analysis checks for C#, Scala, C/C++, Ruby

    • Adds ClangFormat transformer to automate C/C++ code formatting via .deepsource.toml
    • Adds 25 new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checks including CS-A1013, SC-R1059, CXX-P2008, and RB-LI1103 across C#, Scala, C/C++, and Ruby
    • Adds Autofix support for six Ruby Analyzer checks: RB-LI1103, RB-LI1104, RB-LI1105, RB-E1001, RB-W1002, RB-W1004
    • Adds BitBucket Cloud as a VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. provider for Enterprise Server installations
    • Adds in-built APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. integration allowing direct metadata sending to Sentry on Enterprise Server

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Breaking schema changes to Check and Repository types in the GraphQL API and webhook payloads for events analysis_run.started and analysis_run.updated.
33. Improved User Settings Feb 14, 2023 · release notes

    DeepSource vFeb 13 adds manual repo sync, access settings override control, Electron checks, and Rust autofixes.

    • Manual Sync option for individual repositories added to the repository search interface during activation.
    • Access settings override control available when performing a manual sync, with an overview of changes that will be overridden.
    • Five new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checks in JavaScript Analyzer: JS-S1015, JS-S1016, JS-A1005, JS-A1006, and JS-A1007.
    • Autofix support added for Rust checks RS-W1001, RS-W1046, RS-W1062, RS-W1074, RS-W1080, and RS-W1095.

    4 details in Everything

34. Improved role-based access sync from GitHub Jan 26, 2023 · release notes

    DeepSource improves GitHub role-based access sync and adds Enterprise Server log export; 41 new analyzer checks added across multiple languages.

    • Adds No Permission option to Member Base Permissions setting in team access control settings to allow members read-only access to public repositories by default
    • Automatically syncs the organization's base permission from GitHub to DeepSource when connecting a new GitHub organization, overriding previous Maintain default
    • Shows the source of a member's addition (organization or repository) in the Organization → Settings → My team and Repository → Settings → Repository members list
    • Adds ability to regenerate DSN for a repository from the dashboard and the API
    • Makes enabled attribute optional in .deepsource.toml, defaulting to true when disabled analyzers are not explicitly set

    +3 more show less

    • Adds RabbitMQ High Availability support for standalone DeepSource Enterprise Server installations
    • Enables exporting DeepSource Enterprise Server logs to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. tools
    • Adds 41 new checks across Java, JavaScript, Go, Terraform, C/C++, Rust, and Scala analyzers

    8 details in Everything

35. OneLogin support in DeepSource Enterprise Server Jan 18, 2023 · release notes

    DeepSource Enterprise Server gains OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support, LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. coverage reporting, and new PHP/Rust analyzers

    • Adds OneLogin as a supported Identity Provider for SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. in DeepSource Enterprise Server
    • Adds support for LCOV format in Test Coverage reporting
    • Enables Autofix capability for PHP issues (10+ rules)

    3 details in Everything

36. New webhook events Dec 24, 2022 · release notes

    Adds three new DeepSource webhook events (resolved autofix run), Go 1.18 support, and 5 new analyzer issues across PHP/C#

    • Adds repository_issue.resolved webhook event that triggers when an issue is resolved in the default branch of a repository
    • Adds autofix_run.started webhook event that triggers when a new Autofix is created
    • Adds autofix_run.updated webhook event that triggers when the status of the corresponding PR of an Autofix is updated
    • Adds support for Go 1.18 projects in the DeepSource Go Analyzer with auto-detection via go.mod

    4 details in Everything

37. Account Switcher Dec 17, 2022 · release notes

    DeepSource vDec16 adds account switcher search and Autofix for JS-S1013

    • Adds search functionality to the DeepSource dashboard account switcher to filter between team and personal accounts
    • Adds new checks JAVA-W1066, JAVA-S1065, JAVA-A1057, and JAVA-C1003 for Java analysis
    • Adds new checks JS-S1012, JS-S1013, and JS-S1014 for JavaScript/JS analysis
    • Enables Autofix for the JS-S1013 rule

    4 details in Everything

38. Pinned Reports Dec 10, 2022 · release notes

    Adds pinned reports on dashboard and account/repository-level API queries for reports

    • Adds the ability to pin specific reports on the DeepSource dashboard at both team and repository levels via the ellipsis menu
    • Adds API capability to query reports associated with an Account or a Repository

    2 details in Everything

39. Analyzer Updates Dec 3, 2022 · release notes

    DeepSource adds 15 new analyzer checks and Autofix for Ruby, C#, and Java.

    • Adds Autofix support for RB-S1000 (Ruby), CS-W1067 and CS-R1101 (C#)

    1 detail in Everything

40. Composite Test Coverage Metric Nov 26, 2022 · release notes

    DeepSource adds Composite Coverage metric, Public Reports sharing, and Jira/Slack integrations

    • Adds the Composite Coverage metric, aggregated from line and branch/condition coverage, viewable at Metrics → Composite Coverage.
    • Adds Public Reports feature to share external links for repository or team reports, with optional password protection.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Requires running the new kube-janitor service to clean up old jobs in the atlas-jobs namespace before upgrading the Enterprise Server version.
41. Code Health Trend report Nov 19, 2022 · release notes

    DeepSource adds Code Health Trend and Issues Prevented reports plus 39 new analyzer checks

    • Adds the Code Health Trend report under Reports → Code Health Trend to visualize net new code health issues in the repository view and team overview.
    • Adds the Issues Prevented report available for individual repositories and teams to show the total number of code health issues prevented in pull requests.
    • Adds 39 new analyzer checks across Java, C#, Rust, Go, Terraform/Azure, Terraform/GCP, and Ruby (re-enabled).

    3 details in Everything

42. Slack integration, Autofix for C#, and more May 25, 2022 · release notes

    Adds Slack integration, C# Autofix, GitLab Pipeline integration, and new analyzer detections.

    • Integrates with Slack to deliver issue updates via the Integrations tab in organization settings
    • Enables Autofix for C# with 20 supported issues in the DeepSource C# Analyzer
    • Adds native integration with GitLab Pipelines and Commit Statuses for merge request workflows
    • Adds dotnet-format Transformer for C# in the Analyzers section
    • Expands Test Coverage Analyzer to support reporting for C#

    5 details in Everything

43. OneLogin support in DeepSource Enterprise Server May 10, 2022 · release notes

    DeepSource Enterprise Server adds OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support and LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. test coverage reporting

    • Adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. integration with OneLogin for DeepSource Enterprise Server admins to configure custom connectors

    1 detail in Everything

44. New webhook events Apr 27, 2022 · release notes

    DeepSource adds three new webhook events (repository_issue.resolved, autofix_run.started, autofix_run.updated) and Go 1.18 support

    • Adds repository_issue.resolved webhook event to trigger when an issue is resolved in the default branch.
    • Adds autofix_run.started webhook event to trigger when a new Autofix is created.
    • Adds autofix_run.updated webhook event to trigger when the status of the corresponding PR of an Autofix is updated.
    • Enables Go 1.18 support via auto-detection from go.mod, requiring no changes to .deepsource.toml.

    4 details in Everything

45. Detect unexecuted code in tests Apr 12, 2022 · release notes

    DeepSource adds detection of unexecuted code in test files via TCV-002.

    • Adds TCV-002 to Test Coverage Analyzer to detect unexecuted dead code in any test files.
    • Adds JAVA-A1027, JAVA-A1028, JAVA-A1029, JAVA-A1030, JAVA-S1031 for Java analysis.
    • Adds PHP-W1083, PHP-W1087, PHP-W1088 for PHP analysis.
    • Adds GO-E1003, GO-R1001, GO-R1002, GO-W1003, GO-E1004, GO-E1005, GO-W1004, GO-W1005, GO-E1006, GO-E1007, GO-S1029, GO-W1006 for Go analysis.
    • Adds CS-W1016, CS-W1017, CS-W1018, CS-W1019, CS-W1020, CS-W1021, CS-R1039, CS-R1040, CS-P1005, CS-P1006, CS-A1008, CS-A1009, CS-A1010, CS-S1000 for C# analysis.

    5 details in Everything

46. 6 new issues, and a new login button Apr 6, 2022 · release notes

    DeepSource adds six new code analysis issues and fixes default JS module type to ESM

    • Adds three new PHP issue codes: PHP-A1010, PHP-W1086, and PHP-T1005.
    • Adds two new JavaScript issue codes: JS-S1009 and JS-S0011.
    • Reports syntax errors as DeepSource issues using the new code JS-0833.
    • Changes the default module type for JavaScript to ESM, so ESModules are no longer ignored when module_system is unspecified in .deepsource.toml.

    4 details in Everything

47. New webhook events Mar 29, 2022 · release notes

    DeepSource adds team_member webhook events and updates analyzers for Java 17 and more.

    • Adds team_member.added, team_member.removed, and team_member.updated webhook events to monitor team roster changes
    • Expands Go Autofix coverage to include RVV-A0001, RVV-A0009, SCC-S1007, SCC-SA4017, SCC-SA4018, and SCC-SA9003
    • Adds Java 17 support in the Java Analyzer for projects using the latest LTS release

    3 details in Everything

48. New webhooks Jan 25, 2022 · release notes

    DeepSource adds analysis_run.updated and repository_issue.introduced webhook events.

    • analysis_run.updated webhook event added: triggered each time an analyzer publishes its results on DeepSource.
    • repository_issue.introduced webhook event added: triggered when an issue is introduced to the main/default branch of your repository.

    2 details in Everything

49. Improved repository sync for GitLab Jan 11, 2022 · release notes

    DeepSource adds a Sync repositories button for GitLab and integrates its changelog into the dashboard.

    • Adds a Sync repositories button in the GitLab integration to manually trigger syncs.
    • Integrates the DeepSource changelog (hosted on Canny) directly into the application sidebar.

    2 details in Everything