https://cybertoolchain.io/tools/veracode New releases and features in Veracode, tracked by The Cyber Toolchain. en Sat, 31 Oct 2026 07:46:11 GMT https://docs.veracode.com/updates https://docs.veracode.com/updates Sat, 31 Oct 2026 07:46:11 GMT Veracode adds async Fire-and-Forget remediation, Domain field for DAST HTTP basic auth, GDPR/NIS2/DORA compliance intelligence, and C#/JDK 27/Spring AI scanning support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Veracode CLI v2.54.0 now supports asynchronous Fire-and-Forget (FnF) mode for the fix command, submitting remediation requests for background processing without waiting for fixes to be generated and pull requests to be created.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Configure an optional Domain field when setting up HTTP basic authentication for DAST web application scans, enabling authentication to applications that require domain-based credentials. • Scans now collect compliance evidence for cookie consent tracking, third-party data flows, destination countries, and privacy, legal, and copyright documentation, supporting GDPR, NIS2, and DORA assessments. • Static Analysis Engine v2026.10 now supports JDK 27. • Static Analysis Engine v2026.10 now supports LLM-powered applications built with Spring AI. • Static Analysis Engine v2026.10 now supports Scala 3.9. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Fri, 30 Oct 2026 00:00:00 GMT Veracode integrations add environment setup checks, IaC policy parameters, Veracode Fix for SCA in GitHub, and platform-managed GitHub install and scan scheduling⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `predependency_command` parameter to `veracode.yml` in the GitHub, GitLab, and Azure DevOps Workflow Integrations to run single-line or multiline commands before Veracode packages the project for scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add a `build_runs_on` parameter to `veracode.yml` in the GitHub Workflow Integration for SCA scans. • Adds a `policy` parameter to `veracode.yml` in the Azure DevOps, GitLab, and GitHub Workflow Integrations for infrastructure-as-code (IaC) scans. • Add a custom agent pool name parameter to `veracode.yml` in the Azure DevOps Workflow Integration to specify the agent pool for pipeline execution. • Veracode Scan for VS Code now adds environment setup checks to identify connectivity, proxy, DNS, firewall, and TLS issues when connecting to Veracode services. • Veracode Scan for VS Code now adds a 'Mitigated Findings' section to the Flaws That Violate Policy view for findings with approved mitigations. • Veracode Scan for VS Code now adds a 'Current File' filter to Static Scan Findings to view findings for the file currently open in the editor, plus an option to filter and group Static Scan Findings by file name, with findings for each file grouped by severity. • Veracode Scan for VS Code now adds an option to change the region during OAuth authentication and displays the current or most recently used region. • GitHub Workflow Integration v2.0.0 now lets you install, configure, and update the Veracode GitHub Integration directly from the Veracode Platform, removing the GitHub Marketplace manual steps, and adds the ability to schedule Static Analysis, SCA, and IaC scans from the Veracode Platform; GitHub Workflow Integration v2.1.1 adds a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. Breaking changes: • Veracode Azure DevOps Extension v4.0.0 deprecates Veracode Flaw Importer v3 and replaces it with VeracodeFlawImporter v4; existing pipelines must be manually migrated from v3 to v4 for both Azure DevOps Server and Azure DevOps Cloud. • Java API wrapper v26.10.20.1 changes behavior so the repository URL in the Veracode application profile is only updated when `-repourl` is explicitly specified, which may affect workflows that previously relied on automatic URL updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_static https://docs.veracode.com/updates/r/c_all_static Wed, 28 Oct 2026 00:00:00 GMT Veracode SAST adds C# source code scanning, Java source code scanning, a DryRun Security integration, and Pipeline Scan support for artifacts larger than 200 MB⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the ability to exclude specific Java `.jar` files and Java classes from static analysis using the `veracode.json` configuration file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Veracode SAST adds an integration with DryRun Security, surfacing Veracode findings and remediation guidance inside pull request and code review workflows. • Veracode SAST adds scanning of C# source code (Static Analysis Engine v2026.10) and Java source code, including viewing source on the platform (Static Analysis Engine v2026.04). • Pipeline Scan now accepts packaged artifacts larger than 200 MB with no changes to existing integrations. • The Python scanner now supports taint tracking, cross-file analysis, and pattern recognition for applications built with PySpark, Flask, Django, and FastAPI. • Veracode SAST adds support for Spring AI applications (LLM-powered), the Svelte framework in JavaScript, Angular 20, Next.js 15.x, Psycopg 3 in Python, the CloudKit framework on Apple platforms, Apple Security framework APIs, the Fast HTTP library in Go, the Go Fiber web framework, the python `google-cloud-bigquery` library, PyYAML in Python, and `httplib` for detecting CWE-295 and CWE-297 (SSL/TLS) flaws in Python. • Veracode SAST adds support for Android 17, Scala 3.9, Next.js 16.x, React 19, Kotlin 2.4, Kotlin 2.3, Dart 3.13 and Flutter 3.47, Dart 3.12 and Flutter 3.44, Dart 3.11 and Flutter 3.41, Dart 3.10 and Flutter 3.38, Apex 64 and Apex 65, Spring Boot 4, Spring Core 7, and Spring Security 7, Ruby 4.0 and Rails 8.1, and applications built with Xcode 26.4. • Veracode SAST adds detection of hardcoded values in Dart getter functions (`get` assignments modeled as getter functions), taint sinks for `send_from_directory` and `send_file` in Python (Flask CWE-73 coverage), and taint propagation support for the Swift standard library on iOS. • Veracode SAST improves taint propagation support for Apple platform framework APIs and expands .NET taint sink coverage for CWE-80 to detect `System.Web.UI.Page.Title` and `System.Web.UI.HtmlControls.HtmlHead.Title`. • Veracode SAST expands hardcoded secrets detection in Java to include application configuration files with `-local` and `-prod` naming patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Integration_updates_archive https://docs.veracode.com/updates/r/Integration_updates_archive Tue, 27 Oct 2026 21:01:01 GMT Veracode adds GitHub Workflow App for org-wide scanning, JetBrains SCA plugin, Identity REST API support, and a slew of integration improvements across 2023.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `scanpollinginterval` and `lifecyclestage` as optional parameters to the Azure DevOps Extension Upload and Scan task (`lifecyclestage` is not supported in YAML).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for the `-includenewmodules` parameter to the Java API Wrapper. • Supports proxies via the `https_proxy` environment variable in the C# API Wrapper 23.5.8.8, accepting host, port, and credentials. • Enables sending requests to the Identity REST API from within the Java API Wrapper. • Adds Dynamic Analysis scan statuses `STOPPED_VERIFYING_PARTIAL_RESULTS` and `STOPPED_PARTIAL_RESULTS_AVAILABLE` to the Java API Wrapper and Jenkins Plugin. • Adds a `Show Unstable Status for Failed Policy Evaluation` option to the Veracode Jenkins Plugin, marking a job as Unstable when a scan passes but fails security policy. • Releases the Veracode GitHub Workflow App, enabling Static Analysis, SCA, and Container Security scans across thousands of GitHub repositories from a single centralized workflow location. • Releases Veracode SCA Scan for JetBrains 0.6.0, a new extension integrating SCA into IntelliJ IDEA and PyCharm to detect vulnerabilities in open-source libraries, dependencies, and licenses. • Adds an option to the Azure DevOps Extension Flaw Import task to configure importing findings from Static Analysis and SCA only, an option to overwrite the iteration path in work items of imported flaws, and an iteration path field to the Flaw Importer task work item settings (Azure DevOps Extension 3.23.0). • Adds support for TSRV mitigations and .NET 7 in Veracode Static for Visual Studio 2019 and 2022 v1.9.0. Breaking changes: • End of support for Team Foundation Server (TFS) in Veracode Azure DevOps Extension 3.24.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/SAST_updates_archive https://docs.veracode.com/updates/r/SAST_updates_archive Tue, 27 Oct 2026 21:01:01 GMT Veracode SAST gains a new COBOL scanner, Pipeline Scan `--include` module selection, and broad language/framework additions through 2023.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--include` parameter to Pipeline Scan to specify top-level modules to include during scanning, with prescan module discovery now shown in results; available in Veracode CLI version 23.4.3-0 and Veracode Docker image version 23.4.3.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a new COBOL scanner for Veracode Static Analysis with advanced pattern recognition and static analysis techniques for more accurate vulnerability detection in COBOL code. • Adds support for Quarkus (Kubernetes-native Java stack for OpenJDK HotSpot and GraalVM) in static analysis. • Adds support for Micronaut 3.8.x (JVM-based lightweight modular application framework) in static analysis. • Adds `.NET Minimal API` support. • Adds `PHP Laravel 10` support. • Adds `iOS 17` initial support. • Adds `Go 1.21` support. • Adds `AWS SDK for Go v2` support. • Adds `KMS` support for AWS SDK for Go. Breaking changes: • Veracode deprecated support for .NET cleansers for flaw classes CWE-93, CWE-113, and CWE-117 across these functions: `antixsslibrary.dll: Microsoft.Security.Application.AntiXss.HtmlAttributeEncode`, `antixsslibrary.dll: Microsoft.Security.Application.AntiXssEncoder.HtmlAttributeEncode`, `antixsslibrary.dll: Microsoft.Security.Application.Encoder.HtmlAttributeEncode`, `antixsslibrary.dll: Microsoft.Security.Application.Encoder.HtmlEncode`, `mscorlib.dll: System.Security.SecurityElement.Escape`, `system.dll: System.Net.WebUtility.HtmlEncode`, `system.web.dll: System.Web.HttpServerUtility.HtmlEncode`, `system.web.dll: System.Web.Security.AntiXss.AntiXssEncoder.HtmlEncode`, `system.web.dll: System.Web.Util.HttpEncoder.HtmlAttributeEncode`, `system.web.dll: System.Web.Util.HttpEncoder.HtmlEncode`, `system.web.mvc.dll: System.Web.Mvc.HtmlHelper.AttributeEncode`, `system.web.mvc.dll: System.Web.Mvc.HtmlHelper.Encode`, `system.windows.browser.dll: System.Windows.Browser.HttpUtility.HtmlEncode`, `system.windows.dll: System.Net.HttpUtility.HtmlEncode`, `System.Runtime.dll: System.Net.WebUtility.HtmlEncode` — applications relying on these as cleansers will no longer have those flaws suppressed. • Python applications with flaws previously reported as `CWE-201` that should have been `CWE-918` will be recategorized, potentially breaking existing flaw matching and requiring new mitigations. • All COBOL scans now use the upgraded scanner, which may identify additional vulnerabilities and impact flaw matching for existing applications. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Veracode_CLI_Updates https://docs.veracode.com/updates/r/Veracode_CLI_Updates Tue, 27 Oct 2026 00:00:00 GMT Veracode CLI v2.53.0 adds `veracode scan static` and `veracode findings static` commands plus a `--csharp-source` packaging flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces several new commands: `veracode scan static` for running static scans and reviewing security findings within a Git workflow; `veracode findings static` for accessing cached static scan findings in the local Veracode directory; `veracode package discover` for detecting toolchains required to create scannable artifacts; `veracode sca` for SBOM generation via SCA agent-based scans, publishing results in CycloneDX 1.6 and SPDX 2.3 formats; and `auth login` for onboarding new users via OAuth2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds several enhancements to `veracode package`: the `--csharp-source` flag to package C# source code directly for Static Analysis without compiling it into binaries; the `--skip-packagers` flag to exclude specific artifacts (such as unsupported SQL) from packaging results without affecting other languages; the `--exclude` flag to prevent specified Java packages or JAR files from being scanned; the `VERACODE_PACKAGE_GOLANG_GENERATE` environment variable to enable client-side CGO code generation when packaging Go applications; the `SRCLR_MAKE_WINDOWS` environment variable to support preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler; the `--java-source` flag and `VERACODE_PACKAGE_JAVA_SOURCE=true` environment variable to enable Java source code packaging; support for `requirements-dev.txt` in Python packaging workflows to include development dependencies; support for the Poetry package management tool for Python autopackaging; automatic inclusion of `.yaml`, `.yml`, and `.properties` files when packaging Java source code; and support for packaging Go v1.24. • Supports asynchronous Fire-and-Forget (FnF) mode in `veracode fix sca`, submitting remediation requests for background processing without waiting for fixes or pull requests. • The `veracode dynamic scan` command now supports target UUIDs for triggering scans (webhook UUIDs remain supported). • `veracode package discover` now detects toolchains for JavaScript projects using npm or Yarn, provides toolchain detection for Java projects using the Gradle package manager, and introduces exit codes. • Introduces exit codes 5, 6, and 7 for `veracode package` to improve CI/CD pipeline automation and error handling. • `veracode scan` now categorizes secret-type findings as Critical, prioritizes vulnerability results from the NVD database when available, enables applying a custom policy defined in the Veracode Platform and viewing policy evaluation for individual findings, enables specifying a custom location from which vulnerability databases can be downloaded, adds support for parsing Dockerfile heredoc syntaxes, and introduces schema enhancements for container and IaC scan results. • Adds support for generic packager for Apex in `veracode package`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_was https://docs.veracode.com/updates/r/c_all_was Tue, 27 Oct 2026 00:00:00 GMT Veracode DAST gains domain-based HTTP basic auth, multi-team target ownership, custom host-to-IP mappings, and open-port scanning in Enterprise mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an optional `Domain` field when configuring HTTP basic authentication for DAST web application scans, enabling authentication to applications that require domain-based credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for custom host-to-IP address mappings in DAST scans, configurable when DNS lookup is unavailable or not desired. • Enables assigning multiple teams to a DAST target when creating a web application or API specification, improving collaborative security ownership. • Adds `Directory Restrictions` to DAST target configuration to control scan scope, and adds business unit selection when creating a web application or API specification target, or on the DAST configuration page. • Adds enhanced scheduling capabilities to the DAST `Schedule` feature, with advanced configuration options and greater flexibility for managing scan schedules. • DAST Enterprise mode now supports scanning web applications for open ports, adds downloadable scan reports for greater visibility into scan coverage and scanner behavior, and adds an AI-assisted login authentication method enabling coverage of complex login flows without recorded login scripts. • Adds new detections in the scan engine for HTTP headers, TLS, and fingerprinting. • DAST now supports manual application linking to connect analysis run results to an application in the Veracode Platform for policy evaluation and combined multi-scan reporting. • EASM now automatically creates discovered targets in DAST, which can be mapped or converted to regular DAST targets for scanning. • ISM endpoint 24.10.0 introduces a proxy exclusion list, allowing specified hosts to bypass configured proxy settings. Breaking changes: • The DAST scheduling REST API endpoints have changed. Integrations using the REST API to manage DAST schedules must be updated to use the new endpoints as defined in the DAST API specification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/EASM_updates https://docs.veracode.com/updates/r/EASM_updates Mon, 26 Oct 2026 00:00:00 GMT EASM gains KEV-flagged risk scoring, GDPR/NIS2/DORA compliance evidence collection, and real-time scan notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Validates components against the EASM knowledge base so risk scores reflect real vulnerabilities per version, not just software age.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Collects compliance evidence for cookie consent tracking, third-party data flows, destination countries, and privacy, legal, and copyright documentation to support GDPR, NIS2, and DORA assessments. • Delivers real-time in-app notifications when scans complete, fail, or are cancelled. • Adds redesigned EASM interface with improved navigation, with the previous interface still accessible as 'Legacy UI'. • Introduces multi-project visibility, scan scheduling, and AI-powered intelligence for centralized risk management and scan orchestration. • Adds a Findings view with improved prioritization workflows and expanded reporting capabilities. • Adds an Issues capability to streamline remediation efforts and improve focus on cyber hygiene. • Enables exporting web applications from EASM directly into DAST Essentials by marking assets as DAST Candidates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Veracode_CLI_Updates https://docs.veracode.com/updates/r/Veracode_CLI_Updates Fri, 23 Oct 2026 00:00:00 GMT Veracode CLI gains `veracode scan static`, `veracode findings static`, async fix mode, `--csharp-source`, `--skip-packagers`, and more across recent releases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode scan static` command to run static scans and review security findings within a Git workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode findings static` command to access cached static scan findings in the local Veracode directory. • Adds `--csharp-source` flag to `veracode package` to package C# source code directly for Static Analysis without compiling it into binaries. • Adds `--skip-packagers` flag to `veracode package` to exclude specific artifacts (e.g. unsupported SQL) from packaging without affecting other languages. • Adds `--java-source` flag and `VERACODE_PACKAGE_JAVA_SOURCE=true` environment variable to `veracode package` to support Java source code packaging. • Adds `VERACODE_PACKAGE_GOLANG_GENERATE` environment variable to `veracode package` to enable client-side CGO code generation when packaging Go applications. • Adds `SRCLR_MAKE_WINDOWS` environment variable to support preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler. • Adds `--exclude` flag to `veracode package` to prevent specified Java packages or JAR files from being scanned. • Adds `veracode fix sca` command to generate fixes for vulnerable dependencies identified in SCA scans (Limited Availability). • Adds async Fire-and-Forget (FnF) mode to `veracode fix sca`, submitting remediation requests for background processing without waiting for fixes or pull requests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Fix_updates https://docs.veracode.com/updates/r/Fix_updates Thu, 22 Oct 2026 00:00:00 GMT Veracode Fix for SCA adds async GitHub Workflow Integration and a new `veracode fix sca` CLI command for dependency remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode fix sca` CLI command (and SCM integration) to analyze vulnerable dependencies from SCA findings, generate remediation patches, and identify safe upgrade paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Veracode Fix for SCA now processes fix requests from the GitHub Workflow Integration asynchronously, freeing the GitHub Actions runner immediately and delivering fixes as a new pull request with a results comment on the original PR. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Tue, 20 Oct 2026 07:54:56 GMT Veracode CLI v2.53.0 adds `veracode scan static` and `veracode findings static` commands plus a `--csharp-source` flag for source-based C# scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--csharp-source` flag to the Veracode CLI to package C# source code directly for Static Analysis without compiling it into binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode scan static` command to run static scans and review security findings within a Git workflow. • Adds `veracode findings static` command to access cached static scan findings in the local Veracode directory. • Adds `build_runs_on` support for SCA scans in GitHub Workflow Integration v2.1.9. • Automatically includes `.properties` files when packaging Java source code in Veracode CLI v2.53.0. • EASM gains a redesigned interface with improved navigation and usability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Veracode_CLI_Updates https://docs.veracode.com/updates/r/Veracode_CLI_Updates Tue, 13 Oct 2026 00:00:00 GMT Veracode CLI v2.53.0 adds `veracode scan static` and `veracode findings static` commands plus `--csharp-source` flag for C# source packaging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new packaging support to `veracode package`: the `--csharp-source` flag to package C# source code directly for Static Analysis without compiling it into binaries, and generic packager support for Apex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces the `veracode scan static` command to run static scans and review security findings within a Git workflow, and the `veracode findings static` command to access cached static scan findings in the local Veracode directory. • Adds multiple packaging improvements to `veracode package`: the `--skip-packagers` flag to exclude specific artifacts (e.g. unsupported SQL) from packaging without affecting other languages; support for `requirements-dev.txt` in Python packaging workflows; exit codes 5, 6, and 7 to improve CI/CD automation and error handling; the `--exclude` flag to prevent specified Java packages or JAR files from being scanned; the `VERACODE_PACKAGE_JAVA_SOURCE=true` environment variable and `--java-source` flag for Java source code packaging; the `VERACODE_PACKAGE_GOLANG_GENERATE` environment variable to enable client-side CGO code generation for Go applications; the `SRCLR_MAKE_WINDOWS` environment variable to enable preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler; automatic inclusion of `.yaml`, `.yml`, and `.properties` files when packaging Java source code; support for the Poetry package management tool for Python autopackaging; support for the MSBuild .NET framework; and support for Go v1.24. • Supports the `veracode dynamic scan` command with target UUIDs for triggering scans (webhook UUIDs continue to work). • Introduces the `veracode package discover` command to detect toolchains required to create scannable artifacts. • Introduces the `veracode fix sca` command (Limited Availability) to generate fixes for vulnerable dependencies identified in SCA scans. • Adds `veracode sca` SBOM generation support via SCA agent-based scans, with output in CycloneDX 1.6 and SPDX 2.3 formats. • Introduces `auth login` command to onboard new users via oAuth2. • Enhances the `veracode package discover` command with toolchain detection for JavaScript projects using npm or Yarn, toolchain detection for Java projects using the Gradle package manager, and new exit codes. • Enhances the `veracode scan` command by allowing a custom policy defined in the Veracode Platform to be applied and viewing policy evaluation for individual findings alongside the overall policy result, enabling specification of a custom location from which vulnerability databases can be downloaded, adding support for parsing Dockerfile heredoc syntaxes, categorizing secret-type findings as Critical in scan results, and prioritizing vulnerability results from the NVD database when available. Breaking changes: • The `SRCCLR_DOWNLOAD_URL` environment variable default is now `https://sca-downloads.veracode.com`; the previous URL `https://download.sourceclear.com` is deprecated and all instances should be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Tue, 13 Oct 2026 00:00:00 GMT Veracode integrations gain new `predependency_command`, `policy`, and `build_runs_on` params across GitHub, GitLab, and Azure DevOps workflow configs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new `veracode.yml` parameters across Workflow Integrations: `predependency_command` for GitHub Workflow Integration v2.1.9, GitLab Workflow Integration v2.1.9, and Azure DevOps Workflow Integration v2.4.4, enabling single-line or multiline commands to run before Veracode packages the project; `build_runs_on` for GitHub Workflow Integration v2.1.9 SCA scans; `policy` for Azure DevOps Workflow Integration v2.4.5, GitLab Workflow Integration v2.1.9, and GitHub Workflow Integration v2.1.7 infrastructure-as-code (IaC) scans; and support for a custom agent pool name parameter for Azure DevOps Workflow Integration v2.4.3, letting you specify the agent pool for pipeline execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `analysis_branch` support in `veracode.yml` for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against the specified branch instead of the default branch. • Adds a `Scan Scope` setting to Veracode Scan for Visual Studio v0.8.0 to scan the full project directory or only the active solution for faster, more focused results. • Adds a `Current File` filter and an option to filter and group Static Scan Findings by file name, with findings for each file grouped by severity, to Static Scan Findings in Veracode Scan for VS Code v1.16.3. • Adds an option to change the region during OAuth authentication in Veracode Scan for VS Code v1.16.3, displaying the current or most recently used region below `Authentication`. • Adds a `Mitigated Findings` section to the `Flaws That Violate Policy` view in Veracode Scan for VS Code v1.16.4 for findings with approved mitigations. • Adds a new uninstallation workflow on the Veracode Platform for removing the Veracode app from GitHub organizations (GitHub Workflow Integration v2.1.1). • Enables installing, configuring, and updating the Veracode GitHub Integration directly from the Veracode Platform (eliminating manual GitHub Marketplace steps), and enables scheduling Static Analysis, SCA, and IaC scans for GitHub organizations directly from the Veracode Platform (GitHub Workflow Integration v2.0.0). • Adds autopackaging support for Apex, VB6, and Perl in GitHub Workflow Integration v2.0.0. • Adds support for Jira 11 in Veracode Integration for Jira Server v5.0.2, including required Java 21 and platform compatibility updates. Breaking changes: • Veracode Azure DevOps Extension v4.0.0 requires manual migration of existing pipelines from v3 to v4 for both Azure DevOps Server and Azure DevOps (Cloud); the deprecated `Veracode Flaw Importer` v3 task is replaced by `VeracodeFlawImporter` v4. • Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x on November 30, 2026; upgrade to Jira 10 or later to continue using a supported version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_sca https://docs.veracode.com/updates/r/c_all_sca Mon, 12 Oct 2026 00:00:00 GMT Veracode SCA gains `--appname` and `--show-cli` flags, malicious package detection, Poetry support, and SBOM generation in the agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--appname` and `--show-cli` flags to the SCA agent scan command: `--appname` (Commercial region) links scan results to an application profile and requires OAuth or HMAC authentication, while `--show-cli`, used with `--json`, saves JSON output to a file while still displaying a human-readable CLI summary in the console, returning an error if used without `--json`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds malicious package detection to SCA upload and agent-based scans, reporting malicious packages found in scanned libraries with no extra configuration or agent update required. • Adds SBOM support to SCA scans: SBOM generation during SCA agent-based scans and SBOM file scanning support as part of SCA upload scans. • Adds support for Python projects using the `Poetry` package manager to both SCA agent-based scans and SCA Upload scans. • Adds Python 3.12 environment support for SCA agent-based scans. • Adds Unified Policy assignment to SCA agent-based scan workspaces in the US Federal region and the European region, allowing policies to create issues and break builds based on defined criteria. • Changes default Veracode URLs for SCA: the Platform backend API URL for Commercial region scans moves to `https://sca-api.veracode.com` (from `https://api.sourceclear.io`), the European region API URL moves to `https://sca-api.veracode.eu` and the US Federal region API URL moves to `https://sca-api.veracode.us` (replacing `platform-backend.analysiscenter.veracode.eu` and `platform-backend.analysiscenter.veracode.us`), and the SCA agent download URL moves to `https://sca-downloads.veracode.com` (from `https://download.sourceclear.com`); all legacy URLs remain available for 12 months. • Adds deep-link support for SCA pages: unauthenticated users opening a scan-results link are redirected to login and then back to the original page. Breaking changes: • The default SCA agent download URL changes from `https://download.sourceclear.com` to `https://sca-downloads.veracode.com`; scripts or pipelines that hardcode the old URL must be updated within 12 months before `https://download.sourceclear.com` is retired. • The default Veracode Platform backend API URL for Commercial region SCA agent scans changes from `https://api.sourceclear.io` to `https://sca-api.veracode.com`; any configuration referencing the legacy SourceClear URL must be updated within 12 months. • The default Veracode Platform backend API URLs for European region customers change from `https://platform-backend.analysiscenter.veracode.eu` to `https://sca-api.veracode.eu`, and for US Federal region customers from `https://platform-backend.analysiscenter.veracode.us` to `https://sca-api.veracode.us`; legacy URLs retire in 12 months. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Fri, 09 Oct 2026 00:00:00 GMT Veracode integrations gain IaC policy controls, Git metadata in scans, Veracode Fix for SCA in GitHub, and new platform-based install/schedule workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Java API wrapper v26.10.20.1 changes Git metadata collection so the repository URL in the Veracode application profile is updated only when `-repourl` is explicitly specified. Breaking changes: • Veracode Azure DevOps Extension v4.0.0 requires manually migrating existing pipelines from v3 to v4 for both Azure DevOps Server and Azure DevOps (Cloud); the deprecated 'Veracode Flaw Importer' v3 task is replaced by `VeracodeFlawImporter` v4. • Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x on November 30, 2026; upgrade to Jira 10 or later to continue using a supported version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Thu, 08 Oct 2026 00:00:00 GMT Veracode integrations gain IaC policy enforcement, pre-dependency commands, Git metadata in scans, and Fix for SCA across major workflow plugins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `policy` parameter to `veracode.yml` in the Azure DevOps Workflow Integration for infrastructure-as-code (IaC) scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `predependency_command` parameter to `veracode.yml` in the GitLab Workflow Integration to run single-line or multiline commands before Veracode packages the project. • Adds `predependency_command` parameter to `veracode.yml` in the Azure DevOps Workflow Integration to run single-line or multiline commands before Veracode packages the project. • Adds `policy` parameter to `veracode.yml` in the GitHub Workflow Integration for infrastructure-as-code (IaC) scans. • Adds custom agent pool name parameter to `veracode.yml` in the Azure DevOps Workflow Integration to specify the agent pool for pipeline execution. • Adds `analysis_branch` support in Azure DevOps Workflow Integration so that scheduled scans run against a specified branch when a value is set in `veracode.yml`. • Java API wrapper v26.10.20.0 automatically includes Git repository and commit metadata (branch, commit, author, repository, and Git provider) in Static Analysis scans submitted from a Git repository for JAR, WAR, EAR, and ZIP archives. • Adds a Mitigated Findings section to the Flaws That Violate Policy view in Veracode Scan for VS Code for findings with approved mitigations. • Adds a 'Current File' filter to Static Scan Findings in Veracode Scan for VS Code, letting you view findings for the file currently open in the editor. • Adds an option to filter and group Static Scan Findings by file name in Veracode Scan for VS Code. • Adds an option to change the region during OAuth authentication in Veracode Scan for VS Code, displaying the current or most recently used region. • GitHub Workflow Integration v2.0.0 enables installing and configuring the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace installation steps. • GitHub Workflow Integration v2.0.0 adds the ability to schedule Static Analysis, SCA, and IaC scans for organizations from the Veracode Platform. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. • GitHub Workflow Integration adds a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations. • Adds support for Jira 11 (including Java 21 compatibility) in Veracode Integration for Jira Server v5.0.2. • Veracode Scan for Visual Studio v0.8.0 adds a 'Scan Scope' setting to scan either the full project directory or only the active solution. • Veracode Scan for JetBrains v1.8.1 adds support for JetBrains IDE versions 2024.2 through 2026.3. • Veracode Scan for JetBrains v1.8.1 adds dynamic IDE name tracking to identify the JetBrains IDE variant. Breaking changes: • Veracode Azure DevOps Extension v4.0.0 deprecates Veracode Flaw Importer v3 and replaces it with VeracodeFlawImporter v4; existing pipelines must be manually migrated from v3 to v4. For Azure DevOps Server, upgrade from v3.35.0 to v4.0.0 without uninstalling the previous version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Mon, 05 Oct 2026 07:56:00 GMT Veracode adds `predependency_command` for Azure DevOps pipelines and team-availability controls in Security Labs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Existing Azure DevOps pipelines using the v3 tasks (`VeracodeFlawImporter v3`, Upload and Scan v3) must be manually migrated to v4; Azure DevOps Server users should upgrade from v3.35.0 to v4.0.0 without uninstalling the previous version first. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Sun, 04 Oct 2026 07:49:29 GMT Veracode adds team filtering for large orgs, a new `predependency_command` param, and VS Code mitigated-findings view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `predependency_command` parameter to Azure DevOps Workflow Integration v2.4.4, letting pipelines run single-line or multiline commands before Veracode packages the project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Mitigated Findings` section to the `Flaws That Violate Policy` view in Veracode Scan for VS Code v1.16.4, surfacing findings with approved mitigations. • Enables organizations with more than 500 teams to select which teams are available for use in Security Labs. • Replaces Veracode Flaw Importer v3 with `VeracodeFlawImporter v4` and updates Upload and Scan to v4 in the Azure DevOps Extension v4.0.0. Breaking changes: • Azure DevOps Extension v4.0.0 deprecates Flaw Importer v3 and requires manually migrating existing pipelines from v3 to v4 for both Azure DevOps Server and Azure DevOps (Cloud). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Wed, 30 Sep 2026 00:00:00 GMT Veracode: Adds the `policy` parameter to `veracode.yml` for infrastructure-as-code (IaC) scans in GitHub Workflow Integration v2.1.7.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for the `predependency_command` parameter in `veracode.yml` for Azure DevOps Workflow Integration v2.4.4, enabling single-line or multiline commands to run before Veracode packages the project. • Adds support for Jira 11 (including Java 21 and platform compatibility) in Veracode Integration for Jira Server v5.0.2. • Replaces `Veracode Flaw Importer v3` with `VeracodeFlawImporter v4` and updates `Upload and Scan` to v4 in Veracode Azure DevOps Extension v4.0.0. Breaking changes: • Veracode Azure DevOps Extension v4.0.0 deprecates `Veracode Flaw Importer v3` and replaces it with `VeracodeFlawImporter v4`; existing pipelines must be manually migrated from v3 to v4 (Azure DevOps Server must upgrade from v3.35.0 to v4.0.0 without uninstalling the previous version). • On November 30, 2026, Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x; users must upgrade to Jira 10 or later to remain on a supported version. • The GitHub Veracode Workflow App no longer has administration permissions, meaning it can no longer alter or remove repositories where it is installed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_training https://docs.veracode.com/updates/r/c_all_training Tue, 29 Sep 2026 00:00:00 GMT Veracode Security Labs gains team selection for large orgs, Veracode Platform IAM integration, and updated Get Lesson Progress API with new parameters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `updatedAfter` parameter to the Get Lesson Progress API to support incremental loads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `excludeNotStarted=true` parameter to the Get Lesson Progress API to filter out lessons that have not been started. • Adds `stack` field and `updated_on` field to the Get Lesson Progress API response; shows 'Not Started' when both `start_time` and `end_time` are null. • Enables organizations with more than 500 teams to select which teams are available for use in Security Labs. • Integrates Security Labs users and teams management with the Veracode Platform, authenticating Security Labs users through Veracode IAM (Identity and Access Management). • Allows Security Labs administrators and managers to search teams within Security Labs. • Adds in-app guidance for creating campaigns and using reporting in Security Labs. • Adds new OWASP Top 10:2025 Security Labs covering all 10 categories, including two new categories: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. • Adds new OWASP Top 10 for LLM applications Security Labs lessons covering LLM01 through LLM09 in Flask. • Adds Container Security in Docker Security Labs lessons covering Users, Virtualization, Networking, Resources, Inventory, and Orchestration topics. • Adds six new eLearning secure coding courses aligned to OWASP Top 10:2025 for .NET, Java, JavaScript, PHP, Python, and Security Awareness, available with English, Spanish, French, Portuguese, and Chinese captions. • Adds CWE tagging for Security Labs lessons, enabling admins to search lessons by CWE and learners to see lessons linked to specific CWEs. • Adds code syntax highlighting in Security Labs lessons tailored to programming languages. • Extends eLearning report date range selection to up to one year in the past. • Adds assessment quiz eLearning courses for User and application setup, Static Analysis, Dynamic Analysis, Scan and fix in your IDE, and SCA agent-based scanning, available in English, Portuguese, and Spanish. Breaking changes: • The default Security Labs URL has changed from `https://securitylabs.veracode.com/` to `https://securitylabs.veracode.com/security-labs/`; customers using SSO with a stand-alone account must update their Security Labs URL. • In Security Labs, 'Teams' are now called 'Organizations' and 'Roles' are now called 'Teams'; any documentation or automation referencing the old terminology must be updated. • The Veracode eLearning REST API has reached end of support and will no longer receive updates or technical support. • 33 deprecated eLearning courses (OWASP 2017, OWASP Top 10 (2021), Secure Coding for .NET, Java, JavaScript, PHP, Python — 6 courses each, Python 3 courses) are no longer available; certification levels have been updated to include newer replacement courses. • The OWASP Top 10 (2021) Security Labs lessons are no longer available. • The Security Labs community edition is deprecated as of July 31, 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Mon, 28 Sep 2026 00:00:00 GMT Veracode integrations gain IaC policy param, Veracode Fix for SCA in GitHub, VS Code file filters, and new GitHub platform management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for custom predependency commands in the Veracode YAML file to prepare projects before scanning in GitHub Workflow Integration v2.1.3. • Adds a custom agent pool name parameter to `veracode.yml` in Azure DevOps Workflow Integration v2.4.3 to specify the agent pool for pipeline execution. • Adds support for scheduling `analysis_branch` scans in Azure DevOps Workflow Integration v2.3.10, so scheduled scans run against the specified branch instead of the default branch when `analysis_branch` is set in `veracode.yml`. • Enables scheduling of scans for every organization where the Azure DevOps Workflow Integration is installed, driven by `veracode.yml` configuration. • Adds a `Current File` filter to Static Scan Findings in Veracode Scan for VS Code v1.16.3, allowing findings to be scoped to the file open in the editor. • Adds an option to filter and group Static Scan Findings by file name in Veracode Scan for VS Code v1.16.3, with findings grouped by severity per file. • Adds an option to change the region during OAuth authentication in Veracode Scan for VS Code v1.16.3, displaying the current or most recently used region below the `Authentication` screen. • Adds a `Mitigated Findings` section to the `Flaws That Violate Policy` view in Veracode Scan for VS Code v1.16.4 for findings with approved mitigations. • Enables installation, configuration, and credential updates for the GitHub Workflow Integration directly from the Veracode Platform, eliminating GitHub Marketplace manual steps. • Adds a new uninstallation workflow for the Veracode app from GitHub organizations via the Veracode Platform. • Adds autopackaging support for Apex, VB6, and Perl in GitHub Workflow Integration v2.0.0. • Enables scheduling of Static Analysis, SCA, and IaC scans from the Veracode Platform for GitHub organizations where the integration is installed. • Adds a `Scan Scope` setting in Veracode Scan for Visual Studio v0.8.0 to scan either the full project directory or only the active solution. • Adds usage analytics to Veracode Scan for JetBrains v1.8.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds usage analytics to Veracode Scan for VS Code v1.16.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds usage analytics to Veracode Scan for Visual Studio v0.8.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds page size support to the Platform Applications API (`/appsec/v1/applications`) in Java API Wrapper v26.3.19.0 to improve efficiency when retrieving large application lists. • Introduces support for the Veracode Platform paginated Sandbox REST API in Java API Wrapper v26.3.19.0, enabling retrieval of sandbox lists using pagination. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Sat, 26 Sep 2026 12:45:44 GMT Veracode adds multi-team DAST targets, DryRun Security integration, iOS 27 and Go 1.27 static analysis, and European region IDE/CLI dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `policy` parameter to the GitHub Workflow Integration v2.1.7 for infrastructure-as-code (IaC) scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables assigning multiple teams to a DAST target when creating a web application or API specification. • Integrates Veracode Static Analysis with DryRun Security, surfacing Veracode findings and remediation guidance inside pull request and code review workflows. • Makes the IDE and CLI Usage Explore and Dashboard available in the European Region. • Adds support for Jira 11 (including Java 21 compatibility) in Veracode Integration for Jira Server v5.0.2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Fri, 25 Sep 2026 07:51:33 GMT Veracode: Adds support for Jira 11 (including Java 21 and platform compatibility) in Veracode Integration for Jira Server v5.0.2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Thu, 24 Sep 2026 13:07:40 GMT Veracode: Adds support for iOS 27 in the Static Analysis Engine v2026.09. • Adds support for Go 1.27 in the Static Analysis Engine v2026.09. • Redesigns the EASM interface with improved navigation and usability, with a legacy UI fallback option. • Improves detection of CWE-259 and CWE-798 flaws in the Static Analysis Engine v2026.09, reducing false positives. • Improves detection of CWE-89 flaws in PySpark applications and improves SQLAlchemy analysis to reduce CWE-89 false positives in the Static Analysis Engine v2026.09. • Improves detection of CWE-200 flaws in the Static Analysis Engine v2026.09, reducing false positives. • Improves analysis of `CALL` commands to enhance detection of CWE-252 flaws in the Static Analysis Engine v2026.09. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_platform https://docs.veracode.com/updates/r/c_all_platform Thu, 24 Sep 2026 00:00:00 GMT Veracode adds Custom PDF REST API, OAuth for XML APIs, IDE/CLI Usage Analytics, and new Reporting API fields and filters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Custom PDF REST API to programmatically generate custom PDF reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds OAuth Client Credentials authentication support for Veracode XML APIs, in addition to the existing REST API support. • Adds `most_recent_scan` filter to the Reporting API Scans report; when set to `true`, returns only the most recent scan per asset. • Adds `custom_severity` filter to the Reporting API Findings report. • Adds `collections_list` field to the Finding Reporting API response, returning a list of collection names associated with the application. • Adds `library_instance_ref` field to the Veracode Reporting API findings response to uniquely identify the specific library instance associated with a finding. • Adds `data_refresh_date` field to the Reporting API to indicate the most recent Analytics data refresh time. • Adds `action_type` filter to the Audit Log report in the Reporting REST API for retrieving audit log records based on specific user actions. • Adds an Audit Log report to the Reporting REST API to query Veracode Analytics for detailed user activity information. • Introduces the IDE and CLI Usage Explore and Dashboard in Veracode Analytics to visualize your organization's IDE and CLI plugin usage. • Adds a Firewall Usage Dashboard and Firewall Usage Explore in Veracode Analytics for metrics on Veracode Firewall. • Adds Collections fields to the Applications explore in Veracode Analytics, and new Collections visualizations to the Policy Compliance Overview dashboard. • Adds support for creating and managing OAuth 2.0 Client credentials on the API Credentials page in the Veracode Platform. • Adds Manual Penetration Testing (MPT) Flaw Matching to correlate findings across tests, providing consistent flaw IDs, status values, and inclusion in remediation grace periods. • Adds container and IaC scan results from CLI scans to the Veracode Platform, including severity counts, filtering, scan history, and mitigation guidance. • Enables mapping multiple domains to a single identity provider (IdP) for organizations using SP-initiated SAML SSO. • Allows disabling Veracode-defined roles for users who use custom roles, via the Identity API. • Updates the Auto-Update OWASP rule and Auto-Update CWE Top 25 rule to enforce OWASP Top 10:2025 and MITRE CWE Top 25 for 2025 standards. • Adds six new built-in security policies to the Veracode Platform. • Upgrades Veracode Analytics to Looker 26.6, adding finer widget size granularity, persistent filtering, and tabbed dashboards. • Customizable PDF now includes SCA Component License Risk policy compliance in the Executive Summary and Detailed SCA Findings by Component sections. • Reduces Veracode Analytics data refresh time from four hours to two hours. Breaking changes: • The Veracode Healthcheck endpoint `/healthcheck/status` has been removed and now returns 404; use the `v2/principal` endpoint in the Identity REST API instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Wed, 23 Sep 2026 07:43:53 GMT Veracode adds DryRun Security integration, IaC policy parameter, Jira 11 support, and a redesigned EASM UI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `policy` parameter to GitHub Workflow Integration v2.1.7 for infrastructure-as-code (IaC) scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Integrates Veracode Static Analysis with DryRun Security, surfacing Veracode findings and remediation guidance inside pull request and code review workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Veracode_CLI_Updates https://docs.veracode.com/updates/r/Veracode_CLI_Updates Wed, 23 Sep 2026 00:00:00 GMT Veracode CLI gains SCA fix generation, new package discovery, auth login, SBOM export, and a raft of new flags across scan and package commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode fix sca` command to generate fixes for vulnerable dependencies identified in SCA scans (Limited Availability).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--exclude` flag to `veracode package` to prevent specified Java packages or JAR files from being scanned. • Adds `--skip-packagers` flag to `veracode package` to exclude specific artifacts (e.g. unsupported SQL) from packaging results without affecting other languages. • Adds `VERACODE_PACKAGE_GOLANG_GENERATE` environment variable to enable client-side CGO code generation when packaging Go applications. • Adds `SRCLR_MAKE_WINDOWS` environment variable to enable preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler. • Adds `--strict` flag to `veracode package`: when enabled, returns exit code 4 for any build failures during packaging. • Introduces `veracode package discover` command to detect toolchains required to successfully create scannable artifacts. • Introduces `veracode auth login` command to onboard new users via OAuth2. • Adds `veracode dynamic scan` support for target UUIDs when triggering scans (webhook UUIDs remain supported). • Introduces exit codes 5, 6, and 7 for `veracode package` to improve CI/CD pipeline automation and error handling. • Introduces exit codes for `veracode package discover`. • Enables `veracode scan` to apply a custom policy defined in the Veracode Platform and view policy evaluation for individual findings. • Adds SBOM generation via `veracode sca` agent-based scans, with output in CycloneDX 1.6 and SPDX 2.3 formats. • Adds `requirements-dev.txt` support in Python packaging workflows to include development dependencies. • Enables `veracode scan` to specify a custom location from which vulnerability databases can be downloaded. • Adds Dockerfile heredoc syntax parsing support to `veracode scan`. • Adds `veracode package discover` toolchain detection for Java projects using Gradle. • Adds `veracode package discover` toolchain detection for JavaScript projects using npm or Yarn. • Categorizes secret-type findings as Critical in `veracode scan` results. • Prioritizes vulnerability results from the NVD database in `veracode scan` when available. • Adds support for the Poetry package management tool in Python autopackaging. • Adds support for preprocessing C/C++ source code on Linux via `veracode package`, replacing the existing Linux autopackaging solution. • Adds support for preprocessor header files (PCH) and processing all Makefiles in a directory tree in `veracode package`. • Creates a separate asset for each repository in the ADO workflow in `veracode scan`. • Introduces schema enhancements for container and IaC scan results in `veracode scan`. • Adds support for Go v1.24 in `veracode package`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_static https://docs.veracode.com/updates/r/c_all_static Wed, 23 Sep 2026 00:00:00 GMT Veracode Static Analysis adds iOS 27, Go 1.27, DryRun Security integration, and Pipeline Scan support for artifacts larger than 200 MB⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for excluding Java `.jar` files from static analysis using `veracode.json`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for excluding specific Java classes from Static Analysis through the `veracode.json` configuration file. • Pipeline Scan now supports scanning packaged artifacts larger than 200 MB with no changes to existing integrations required. • Adds support for Dart 3.13 and Flutter 3.47. • Adds support for Android 17. • Adds support for Next.js 16.x. • Adds support for the Python `google-cloud-bigquery` library. • Enhances the Python scanner with improved taint tracking, cross-file analysis, and pattern recognition, and adds support for PySpark, Flask, Django, and FastAPI applications. • Adds support for Dart 3.12 and Flutter 3.44. • Adds support for Kotlin 2.4. • Adds support for the CloudKit framework on Apple platforms. • Adds support for Apple Security framework APIs. • Adds support for JDK 25 (enhanced support). • Adds support for applications built with Xcode 26.4. • Adds support for scanning Java source code. • Adds support for viewing Java source code on the platform. • Expands hardcoded secrets detection to include application configuration files with `-local` and `-prod` naming patterns. • Adds support for React 19. • Adds support for Kotlin 2.3. • Adds support for Psycopg 3 in Python applications. • Adds support for Fast HTTP in Go. • Adds support for Angular 20. • Adds support for Next.js 15.x. • Adds taint sinks for the `send_from_directory` and `send_file` functions in Python. • Adds support for PyYAML in Python. • Adds support for Apex 64 and Apex 65. • Adds support for Spring Boot 4, Spring Core 7, and Spring Security 7 in Java. • Adds support for the Svelte framework in JavaScript. • Adds support for Ruby 4.0 and Rails 8.1. • Adds support for Dart 3.10 and Flutter 3.38. • Adds support for the Go Fiber web framework. • Adds support for AWS Glue in Python. • Adds support for Dart 3.11 and Flutter 3.41. • Adds taint propagation support for the Swift standard library. • Expands `.NET` taint sink coverage for CWE-80 to detect `System.Web.UI.Page.Title` and `System.Web.UI.HtmlControls.HtmlHead.Title`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_was https://docs.veracode.com/updates/r/c_all_was Wed, 23 Sep 2026 00:00:00 GMT Veracode DAST gains multi-team targets, custom host-to-IP mappings, directory restrictions, open-port scanning, and EASM integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports assigning multiple teams to a single DAST target when creating a web application or API specification, enabling shared security ownership.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the ability to select a business unit when creating a web application or API specification target, or on the DAST configuration page. • Adds `Directory Restrictions` to DAST target configuration to control scan scope. • Introduces custom host-to-IP address mappings for DAST scans when DNS lookup is unavailable or not desired. • Dynamic Analysis and DAST Enterprise mode now support scanning web applications for open ports. • Adds new detections for HTTP headers, TLS, and fingerprinting in the scan engine. • EASM now automatically creates discovered targets in DAST, which can be mapped or converted to regular DAST targets for scanning. • DAST Enterprise mode now supports downloadable scan reports providing visibility into scan coverage and scanner behavior. • DAST Enterprise mode now provides an AI-based authentication method (`AI-Assisted Login`) to cover complex login flows without recorded login scripts. • DAST now supports manual application linking to connect analysis run results to a Veracode Platform application for policy evaluation and combined multi-scan-type reporting. • The ISM endpoint 24.10.0 introduces a proxy exclusion list allowing specified hosts to bypass the configured proxy settings. • The DAST Target Configuration Service REST API is now publicly available to automate management of DAST targets and trigger analyses. • API Scanning now supports uploading and scanning Postman Collections in the Veracode Platform. • Web application and API scans now support time-based one-time password (TOTP) seeds for multi-factor authentication (MFA), configurable via the REST API. • Web application and API scans now support custom cookies for authentication. • Adds the ability to set URL scan settings at the organization level via the Dynamic Analysis REST API. • API Scanning adds Scriptable Request Modification (SRM), allowing JavaScript to modify HTTP requests at runtime during authentication. • Adds a similarity threshold setting for web application analyses to ignore similar web pages during scanning. • Adds the ability to schedule an analysis pause and resume on specific days of the week, during specific periods, or both. • DAST Enterprise mode adds support for login scripts, scanner variables, client certificates, and Scriptable Request Modifications (SRM) for APIs as additional authentication configuration options. • DAST Enterprise mode adds Internal Scanning Management (ISM) support for scanning web applications and APIs behind a corporate firewall. Breaking changes: • The DAST scheduling API endpoints have changed as part of the enhanced scheduling rollout; integrations using the REST API to manage schedules must be updated to use the new endpoints per the DAST API specification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Tue, 22 Sep 2026 07:44:54 GMT Veracode adds Jira 11 support, a redesigned EASM UI, and improved Python scanner flaw matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Veracode Integration for Jira Server v5.0.2 adds support for Jira 11, including Java 21 and platform compatibility with Jira 11.3.10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enhanced Python scanner now uses each application's initial scan baseline for consistent flaw matching across subsequent scans. Breaking changes: • Customers who transitioned to the enhanced Python scanner on July 22, 2026 may find that previously identified flaws no longer match historical findings and previously applied mitigations may need to be reapplied. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/EASM_updates https://docs.veracode.com/updates/r/EASM_updates Mon, 21 Sep 2026 00:00:00 GMT Veracode EASM gains redesigned UI, real-time scan notifications, multi-project visibility, scan scheduling, and AI-powered intelligence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds real-time in-app notifications when scans complete, fail, or are cancelled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds multi-project visibility for centralized risk management across all projects. • Adds scan scheduling to streamline scan orchestration across projects. • Adds AI-powered intelligence for accelerated risk prioritization. • Introduces redesigned EASM UI with improved navigation and usability, with the Legacy UI still available. • Adds a Findings view to surface large volumes of security data as actionable insights with prioritization workflows and expanded reporting. • Adds Issues capability to streamline remediation efforts and improve focus on cyber hygiene. • Adds Dashboard widgets — Heatmap, World map, and Things — with filterable data views and a shortcut to create reports. • Adds Business Units management, enabling creation, assignment, and domain association. • Enables export of web applications from EASM directly into DAST Essentials by marking assets as DAST Candidates to create discovered targets for DAST scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_static https://docs.veracode.com/updates/r/c_all_static Wed, 16 Sep 2026 00:00:00 GMT Veracode: Skips `@isTest` methods during Apex scans to reduce noise and improve result quality. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Wed, 16 Sep 2026 00:00:00 GMT Veracode integrations gain GitHub Fix for SCA, VS Code file filters, custom agent pools in YAML, and platform-managed GitHub install/scheduling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for custom predependency commands in the Veracode YAML file to prepare projects before scanning (GitHub Workflow Integration v2.1.3).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a custom agent pool name parameter in `veracode.yml` to specify the agent pool for pipeline execution (Azure DevOps Workflow Integration v2.4.3). • Adds `analysis_branch` support in `veracode.yml` so scheduled scans run for the specified analysis branch instead of the default branch (Azure DevOps Workflow Integration v2.3.10). • Adds page size support to the Platform Applications API (`/appsec/v1/applications`) for efficient retrieval of large application lists (Java API Wrapper v26.3.19.0). • Introduces support for the Veracode Platform paginated Sandbox REST API, enabling retrieval of sandbox lists using pagination (Java API Wrapper v26.3.19.0). • Adds a `Current File` filter to Static Scan Findings in Veracode Scan for VS Code, allowing you to view findings only for the file currently open in the editor. • Adds an option to filter and group Static Scan Findings by file name in Veracode Scan for VS Code, with findings for each file grouped by severity. • Adds an option to change the region during OAuth authentication in Veracode Scan for VS Code, displaying the current or most recently used region. • Adds a `Scan Scope` setting in Veracode Scan for Visual Studio to scan the full project directory or only the active solution for faster, more focused results. • Enables installation and configuration of the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps. • Enables scheduling of Static Analysis, SCA, and Infrastructure as Code (IaC) scans for GitHub organizations directly from the Veracode Platform. • Adds a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations. • Enables scheduling scans for every organization in which the Azure DevOps Workflow Integration is installed, based on `veracode.yml` configurations. • Adds usage analytics in Veracode Scan for JetBrains v1.8.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds usage analytics in Veracode Scan for Visual Studio v0.8.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds usage analytics in Veracode Scan for VS Code v1.16.0 to provide insights into plugin adoption, feature usage, and scan activity. • Adds support for Jira 11, including required Java 21 and platform compatibility updates (Veracode Integration for Jira Server v5.0.2). • Adds support for Visual Studio 2026 in Veracode Scan for Visual Studio v0.7.2. Breaking changes: • The `Veracode Flaw Importer` task (which contains spaces in the task name) is deprecated and replaced by `VeracodeFlawImporter` in Veracode Azure DevOps extension v3.35.0; the deprecated task is scheduled for removal in a future release. • Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x on November 30, 2026; upgrade to Jira 10 or later to remain supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Mon, 14 Sep 2026 07:43:25 GMT Breaking changes: • Veracode eLearning REST API has reached end of support — Veracode will no longer update this API or provide technical support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Sun, 13 Sep 2026 07:42:28 GMT Veracode adds `veracode fix sca` CLI command, IDE/CLI Usage Analytics dashboard, Dart 3.13, Flutter 3.47, PHP 8.4/8.5 support, and GitHub Workflow SCA fix generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for Dart 3.13 and Flutter 3.47 in Static Analysis. • Adds support for PHP 8.4 and PHP 8.5 in Static Analysis. • Improves detection of CWE-80 flaws involving React `useState` in Static Analysis. Breaking changes: • The Veracode eLearning REST API has reached end of support — it will no longer receive updates or technical support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Sat, 12 Sep 2026 10:43:56 GMT Veracode adds Fix for SCA via `veracode fix sca` CLI command, IDE/CLI Usage Analytics, and Dart/Flutter/PHP static analysis support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode fix sca` CLI command to analyze vulnerable dependencies from SCA findings, generate remediation patches, and identify safe upgrade paths (Limited Availability).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds IDE and CLI Usage Explore and Dashboard in Veracode Analytics to visualize and explore organization-wide IDE and CLI usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_training https://docs.veracode.com/updates/r/c_all_training Thu, 10 Sep 2026 00:00:00 GMT Veracode training adds LLM security labs, OWASP Top 10:2025 courses, Get Lesson Progress API enhancements, and Veracode Platform SSO integration for Security Labs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `updatedAfter` parameter to the Get Lesson Progress API to support incremental loads of lesson progress data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `excludeNotStarted=true` parameter to the Get Lesson Progress API to filter out lessons that have not been started. • Adds `stack` field and `updated_on` field to the Get Lesson Progress API response. • Get Lesson Progress API now returns `Not Started` status when both `start_time` and `end_time` are null. • Integrates Security Labs user and team management with the Veracode Platform, authenticating Security Labs users through Veracode IAM so administrators manage users from a single console under Security Training. • Adds team search capability for Security Labs administrators and managers in Security Labs. • Adds full OWASP Top 10:2025 Security Labs curriculum including two new categories: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. • Adds new eLearning courses aligned to OWASP Top 10:2025 for .NET, Java, JavaScript, PHP, Python, and general Software Security Awareness, available with English, Spanish, French, Portuguese, and Chinese captions. • Adds skills assessment quiz courses for Static Analysis, Dynamic Analysis, SCA agent-based scanning, Scan and fix in your IDE, and User and application setup, available in English, Portuguese, and Spanish. • Adds Container Security in Docker lesson series covering capabilities, users, networking, virtualization, resources, orchestration, and inventory topics. • Adds in-app guidance for creating campaigns and using reporting in Security Labs. • Adds CWE tagging to Security Labs lessons, enabling admins to search lessons by CWE and learners to see lessons linked to specific CWEs. • Adds code syntax highlighting tailored to programming languages in Security Labs lessons. • Extends eLearning report date range selection to up to one year in the past. • Upgrades OWASP API Security Top 10 coverage in Security Labs from the 2019 list to the 2023 list, adding lessons for three new categories (API 6, API 7, API 10). Breaking changes: • The Veracode eLearning REST API has reached end of support and will no longer receive updates or technical support. • The Security Labs default URL has changed from `https://securitylabs.veracode.com/` to `https://securitylabs.veracode.com/security-labs/` — customers using SSO must update their configured Security Labs URL. • In Security Labs, 'Teams' are renamed to 'Organizations' and 'Roles' are renamed to 'Teams' — any documentation, integrations, or scripts referencing the old terminology must be updated. • 33 deprecated eLearning courses (OWASP 2017, OWASP Top 10 (2021), and Secure Coding for .NET/.Java/.JavaScript/.PHP/.Python (6 courses each, 3 for Python)) are no longer available; certification levels have been updated to include newer replacement courses. • OWASP Top 10 (2021) Security Labs lessons are no longer available following their deprecation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_training https://docs.veracode.com/updates/r/c_all_training Wed, 09 Sep 2026 00:00:00 GMT Veracode training adds LLM security labs, OWASP Top 10:2025 courses, Get Lesson Progress API enhancements, and platform-integrated user management. • Adds `updatedAfter` parameter to the Get Lesson Progress API to support incremental data loads. • Adds `excludeNotStarted=true` parameter to the Get Lesson Progress API to filter out lessons that have not been started. • Adds `stack` field and `updated_on` field to the Get Lesson Progress API response, and surfaces a 'Not Started' status when both `start_time` and `end_time` are null. • Integrates Security Labs user and team management into the Veracode Platform, with authentication routed through Veracode IAM — administrators manage users and teams from the Veracode Platform under Security Training. • Adds team search capability for Security Labs administrators and managers. • Adds eLearning date-range filter allowing report start dates up to one year in the past. • Adds six new OWASP Top 10:2025 secure coding courses covering .NET, Java, JavaScript, PHP, Python, and general software security awareness, with English, Spanish, French, Portuguese, and Chinese captions. • Adds complete OWASP Top 10:2025 Security Labs lab series (A01–A10), including two new categories: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. • Adds Container Security in Docker Security Labs lesson track spanning Capabilities, Users, Virtualization, Networking, Resources, Orchestration, and Inventory topics. • Adds in-app guidance in Security Labs for creating campaigns and using reporting. • Adds CWE tagging to Security Labs lessons, enabling admins to search by CWE or title and learners to see CWE associations per lesson. • Adds code syntax highlighting to Security Labs lessons, tailored to the programming language of each code sample. • Adds OWASP API Top 10 2023 Security Labs lessons, upgrading coverage from the 2019 list and adding three new categories (API 6, API 7, API 10) in Java, Node, and .NET. • Adds five assessment quiz eLearning courses (User and application setup, Static Analysis, Dynamic Analysis, Scan and fix in your IDE, SCA agent-based scanning — Skills assessment) in English, Portuguese, and Spanish. Breaking changes: • The default Security Labs URL has changed from `https://securitylabs.veracode.com/` to `https://securitylabs.veracode.com/security-labs/` — organizations using SSO with the old URL must update their SSO configuration. • In Security Labs, 'Teams' are renamed to 'Organizations' and 'Roles' are renamed to 'Teams' — any documentation, scripts, or integrations referencing these terms must be updated. • 33 deprecated eLearning courses (OWASP 2017, OWASP Top 10 2021, Secure Coding for .NET/Java/JavaScript/PHP/Python — 6 courses each, Secure Coding for Python — 3 courses) are no longer available as of June 2026; certification levels have been updated to reference the replacement OWASP Top 10:2025 courses. • OWASP Top 10 (2021) Security Labs lessons are no longer available as of June 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Fix_updates https://docs.veracode.com/updates/r/Fix_updates Tue, 08 Sep 2026 00:00:00 GMT Veracode Fix gains SCA remediation via `veracode fix sca` CLI command, analyzing vulnerable dependencies and suggesting safe upgrade paths. • Adds `veracode fix sca` CLI command (and source control management integration) to analyze SCA findings, generate remediation patches, and identify safe dependency upgrade paths (Limited Availability). • Adds COBOL support with fix suggestions for CWE-78, CWE-209, CWE-248, CWE-489, and CWE-252, available in the Veracode CLI and in Visual Studio Code, Visual Studio, and JetBrains IDEs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Tue, 08 Sep 2026 00:00:00 GMT Veracode integrations gain Fix for SCA in GitHub, new VS Code filters, ADO agent pool config, and platform-managed GitHub scan scheduling. • Adds custom agent pool name parameter in `veracode.yml` for Azure DevOps Workflow Integration v2.4.3 to specify the agent pool used for pipeline execution. • Implements a configurable retry mechanism for the Veracode Platform Applications API (`appsec/v1/applications`) in Java API Wrapper v26.2.18.0 to handle transient failures, timeouts, and network issues. • GitHub Workflow Integration now supports Veracode Fix for SCA, generating fixes for vulnerable dependencies identified in SCA scans. • GitHub Workflow Integration v2.0.0 enables install, configuration, and credential updates for the GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. • GitHub Workflow Integration v2.0.0 adds the ability to schedule Static Analysis, SCA, and IaC scans for GitHub organizations directly from the Veracode Platform. • GitHub Workflow Integration v2.1.1 adds a new uninstallation workflow on the Veracode Platform for removing the Veracode app from GitHub organizations. • Adds support for Visual Studio 2026 in Veracode Scan for Visual Studio v0.7.2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_platform https://docs.veracode.com/updates/r/c_all_platform Tue, 08 Sep 2026 00:00:00 GMT Veracode adds IDE/CLI usage analytics, a Custom PDF REST API, OAuth on XML APIs, and several new Reporting API fields and filters. • Adds the `Custom PDF REST API` to programmatically generate custom PDF reports. • Adds support for OAuth Client Credentials authentication with the Veracode XML APIs (previously REST APIs only). • Adds the `most_recent_scan` filter to the Reporting API Scans report; when set to `true`, returns only the most recent scan per asset. • Adds the `custom_severity` filter to the Reporting API Findings report. • Adds the `action_type` filter to the Reporting API Audit Log report to retrieve audit log records based on specific user actions. • Adds the `collections_list` field to the Finding Reporting API response, returning a list of collection names associated with the application. • Adds the `library_instance_ref` field to the Veracode Reporting API findings response to uniquely identify the specific library instance associated with a finding. • Adds the `data_refresh_date` field to the Reporting API to indicate the most recent time Analytics data was refreshed. • Introduces a new IDE and CLI Usage Explore and Dashboard in Veracode Analytics to visualize organization-wide IDE and CLI plugin usage. • Adds Firewall Usage Explore and Dashboard to Veracode Analytics, surfacing metrics for Veracode Firewall. • Adds Collections fields to the Applications explore in Veracode Analytics, including new Collections visualizations in the Policy Compliance Overview dashboard. • Introduces a new Audit Log report in the Reporting REST API to query detailed user activity from Veracode Analytics. • Adds support for creating and managing OAuth 2.0 Client credentials on the API Credentials page in the Veracode Platform. • Enables mapping multiple domains to a single identity provider (IdP) for organizations using SP-initiated SAML SSO. • Adds the ability to disable Veracode-defined roles for users who use custom roles, via the Identity API. • Makes container and IaC scan results (performed from the CLI) available on the Veracode Platform, with severity counts, filtering, scan history, and mitigation guidance. • Introduces Manual Penetration Testing (MPT) Flaw Matching to correlate findings across tests for consistent flaw IDs, status values, and remediation grace period support. • Adds six new built-in security policies to the Veracode Platform. • Updates the Auto-Update OWASP rule and Auto-Update CWE Top 25 rule in application security policies to enforce OWASP Top 10:2025 and MITRE CWE Top 25 for 2025. Breaking changes: • The Veracode Healthcheck endpoint `/healthcheck/status` has been removed and now returns a 404 error; use the `v2/principal` endpoint in the Identity REST API instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Mon, 07 Sep 2026 00:00:00 GMT Veracode integrations gain GitHub Platform install, scan scheduling, VS Code file filters, ADO agent pool config, and expanded API pagination support. • Adds `debug` configuration option in `veracode.yml` for debugging and troubleshooting pipeline runs (GitHub Workflow Integration v1.0.6, Azure DevOps Workflow Integration v2.3.6). • Adds `analysis_branch` support in `veracode.yml` so scheduled scans run against a specified branch instead of the default branch (Azure DevOps Workflow Integration v2.3.10). • Adds custom agent pool name parameter in `veracode.yml` to specify the agent pool used for pipeline execution (Azure DevOps Workflow Integration v2.4.3). • Adds support for custom predependency commands in the Veracode YAML file to prepare projects before scanning (GitHub Workflow Integration v2.1.3). • Adds page size support to the Platform Applications API (`/appsec/v1/applications`) to improve efficiency when retrieving large application lists (Java API Wrapper v26.3.19.0). • Adds support for the Veracode Platform Findings REST API to access open and mitigated application findings (Java API Wrapper v26.2.18.0). • Introduces support for the Veracode Platform paginated Sandbox REST API, enabling retrieval of sandbox lists using pagination (Java API Wrapper v26.3.19.0). • Adds a `Current File` filter to Static Scan Findings in VS Code, allowing you to view findings for the file currently open in the editor (Veracode Scan for VS Code v1.16.3). • Adds an option to filter and group Static Scan Findings by file name in VS Code, with findings for each file grouped by severity (Veracode Scan for VS Code v1.16.3). • Adds an option to change the region during OAuth authentication in VS Code, displaying the current or most recently used region (Veracode Scan for VS Code v1.16.3). • Enables installing and configuring the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace installation steps (GitHub Workflow Integration v2.0.0). • Enables scheduling Static Analysis, SCA, and IaC scans for GitHub organizations directly from the Veracode Platform (GitHub Workflow Integration v2.0.0). • Adds autopackaging support for Apex, VB6, and Perl in the GitHub Workflow Integration (GitHub Workflow Integration v2.0.0). • Adds a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations (GitHub Workflow Integration v2.1.1). • Enables scheduling scans for every organization in which the Azure DevOps Workflow Integration is installed, based on `veracode.yml` configuration (Azure DevOps Workflow Integration v2.3.9). • Adds a `Scan Scope` setting in Veracode Scan for Visual Studio to scan the full project directory or only the active solution (Veracode Scan for Visual Studio v0.8.0). • Adds usage analytics to Veracode Scan for Visual Studio to provide insights into plugin adoption, feature usage, and scan activity (Veracode Scan for Visual Studio v0.8.0). • Adds usage analytics to Veracode Scan for VS Code to provide insights into plugin adoption, feature usage, and scan activity (Veracode Scan for VS Code v1.16.0). • Adds usage analytics to Veracode Scan for JetBrains to provide insights into plugin adoption, feature usage, and scan activity (Veracode Scan for JetBrains v1.8.0). • Adds Visual Studio 2026 support to Veracode Scan for Visual Studio (Veracode Scan for Visual Studio v0.7.2). • Implements a configurable retry mechanism for the Veracode Platform Applications API (`appsec/v1/applications`) to improve handling of transient failures and timeouts (Java API Wrapper v26.2.18.0). Breaking changes: • The `Veracode Flaw Importer` task (containing spaces in the task name) is deprecated and replaced by `VeracodeFlawImporter` in the Veracode Azure DevOps extension v3.35.0; the deprecated task is scheduled for removal in a future release. • Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026 — upgrade to Jira 10 or later to maintain a supported configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_static https://docs.veracode.com/updates/r/c_all_static Thu, 03 Sep 2026 00:00:00 GMT Veracode SAST gains Dart 3.13/Flutter 3.47, PHP 8.4/8.5, Pipeline Scan 200 MB+ artifact support, and an enhanced Python scanner with PySpark/Flask/Django/FastAPI coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode.json` support for excluding specific Java `.jar` files from static analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `veracode.json` support for excluding specific Java classes from Static Analysis. • Expands hardcoded secrets detection to include application configuration files with `-local` and `-prod` naming patterns in Java. • Adds `send_from_directory` and `send_file` as taint sinks for CWE-73 detection in Python. • Adds .NET Semantic Kernel (SK) `InvocationFilter` and `Filter` support for .NET SAST. • Updates Gen IR: the `--capture` flag now includes diagnostic data in `.xcarchive` files for iOS troubleshooting. • Adds support for scanning packaged artifacts larger than 200 MB in Pipeline Scan. • Adds support for Dart 3.13 and Flutter 3.47. • Adds support for PHP 8.4 and PHP 8.5. • Adds support for Android 17. • Adds support for Next.js 16.x. • Adds support for the Python `google-cloud-bigquery` library. • Adds enhanced Python scanner with improved taint tracking, cross-file analysis, and pattern recognition, covering PySpark, Flask, Django, and FastAPI. • Adds support for .NET 10. • Adds support for Dart 3.12 and Flutter 3.44. • Adds support for Kotlin 2.4. • Adds support for the `CloudKit` framework for Apple Platforms. • Adds support for Apple Security framework APIs. • Adds support for applications built with Xcode 26.4. • Adds support for JDK 26. • Adds support for scanning Java source code. • Adds support for viewing Java source code on the Veracode platform. • Adds support for React 19. • Adds support for Kotlin 2.3. • Adds support for Psycopg 3 in Python applications. • Adds support for Fast HTTP in Go. • Adds support for Angular 20. • Adds support for Next.js 15.x. • Adds support for Go 1.26. • Adds support for PyYAML in Python. • Adds support for Apex 64 and Apex 65. • Adds support for Spring Boot 4, Spring Core 7, and Spring Security 7 in Java. • Adds support for the Svelte framework in JavaScript. • Adds support for Ruby 4.0 and Rails 8.1. • Adds taint propagation support for the Swift standard library on iOS. • Adds support for the Go Fiber web framework. • Adds support for AWS Glue in Python. • Adds support for Semantic Kernel (SK) `KernelContent` and Taint Injection for .NET. • Adds support for Azure Functions v4 on .NET 9 in isolated process mode. • Adds support for .NET Semantic Kernel (SK) detection of hardcoded credentials (CWE-798) and configuration control issues (CWE-15). • Adds support for PySpark, DynamoDB, and FastAPI in Python. • Adds support for Semantic Kernel (SK) `InvocationFilter` and `Filter` for .NET. • Adds support for JDK 25 (LTS). • Adds initial support for iOS 26. • Adds support for Go 1.25. • Adds support for Micronaut 4.x in Java. • Adds support for Node.js 22.x in JavaScript. • Adds taint propagation support for Apple Platforms framework APIs. • Adds taint sink coverage for `System.Web.UI.Page.Title` and `System.Web.UI.HtmlControls.HtmlHead.Title` in .NET for CWE-80 detection. • Adds support for Dart 3.11 and Flutter 3.41. • Adds support for Dart 3.10 and Flutter 3.38. • Adds support for Dart 3.9 and Flutter 3.35. • Adds support for Dart 3.8 and Flutter 3.32. • Adds support for `httplib` in Python for detecting CWE-295 and CWE-297 flaws related to SSL/TLS. • Adds support for `os.path` propagation in Python taint analysis. • Expands third-party library detection to include Fluxnova in Java. • Expands support for `pnpm` modules in JavaScript to improve dependency resolution. • Enhances COBOL parsing to automatically detect copybooks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/Veracode_CLI_Updates https://docs.veracode.com/updates/r/Veracode_CLI_Updates Mon, 31 Aug 2026 00:00:00 GMT Veracode CLI gains toolchain discovery, new packaging flags, SBOM export, OAuth2 login, and expanded scan capabilities across v2.38–v2.52 • Adds `--exclude` flag to `veracode package` to prevent specified Java packages or JAR files from being scanned (v2.51.0). • Adds `--skip-packagers` flag to `veracode package` to exclude specific artifacts (e.g. unsupported SQL) from packaging without affecting other languages (v2.48.0). • Adds `--java-source` flag and `VERACODE_PACKAGE_JAVA_SOURCE=true` environment variable to `veracode package` for Java source code packaging (v2.46.0). • Adds `VERACODE_PACKAGE_GOLANG_GENERATE` environment variable to enable client-side CGO code generation when packaging Go applications (v2.43.0). • Adds `SRCLR_MAKE_WINDOWS` environment variable to enable preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler (v2.44.0). • Introduces `veracode package discover` command to detect toolchains required to successfully create scannable artifacts (v2.44.0). • `veracode package discover` adds toolchain detection for Java projects using Gradle (v2.46.0). • `veracode package discover` adds toolchain detection for JavaScript projects using npm or Yarn (v2.52.0). • `veracode package discover` introduces exit codes (v2.48.0). • Introduces `veracode auth login` command for onboarding new users via OAuth2 (v2.41.0). • `veracode package` introduces exit codes 5, 6, and 7 to improve CI/CD pipeline automation and error handling (v2.49.0). • Adds `--strict` flag to `veracode package`: when enabled, returns exit code 4 for any build failures during packaging (v2.39.0). • `veracode dynamic scan` now supports target UUIDs (in addition to webhook UUIDs) for triggering scans (v2.51.0). • `veracode scan` allows applying a custom policy defined in the Veracode Platform and enables viewing policy evaluation for individual findings alongside the overall policy result (v2.44.0). • `veracode scan` introduces schema enhancements for container and IaC scan results (v2.51.0). • `veracode scan` categorizes secret-type findings as Critical in scan results (v2.45.0). • `veracode scan` prioritizes vulnerability results from the NVD database when available (v2.45.0). • `veracode scan` enables specifying a custom location for downloading vulnerability databases (v2.41.0). • `veracode scan` adds Dockerfile heredoc syntax parsing support (v2.41.0). • `veracode sca` command now supports SBOM generation via SCA agent-based scans, with results publishable in CycloneDX 1.6 and SPDX 2.3 formats (v2.41.0). • `veracode package` adds support for `requirements-dev.txt` in Python packaging workflows to include development dependencies (v2.48.0). • `veracode package` supports the Poetry package management tool in Python for autopackaging (v2.47.0). • `veracode package` adds support for generic packager for Apex (v2.43.0). • `veracode package` supports Go v1.24 (v2.40.0). • `veracode package` supports .NET 9 (v2.38.2). • `veracode package` supports MSBuild .NET framework packaging (v2.42.0). • `veracode package` adds support for preprocessor header files used to build PCH (v2.41.0). • `veracode package` adds the option to process all Makefiles in a directory tree (v2.41.0). • Preprocessed source code scanning is now the default method for C/C++ projects on Windows, and support is now available on Linux as well (v2.39.0). • `veracode static scan` displays the Static Engine version in the scan summary (v2.42.0). • `veracode policy` command now automatically determines and generates appropriate output artifacts based on the policy created (v2.50.0). • `veracode scan` creates a separate asset for each repository in the ADO workflow for easier individual scan result tracking (v2.44.0). • The `SRCCLR_DOWNLOAD_URL` environment variable now defaults to `https://sca-downloads.veracode.com` (v2.39.0). Breaking changes: • The previous `SRCCLR_DOWNLOAD_URL` default of `https://download.sourceclear.com` is now deprecated; all instances in your environment should be updated to `https://sca-downloads.veracode.com` (v2.39.0). • Using old CLI versions (prior to v2.48.0) with the `veracode scan` command will result in incomplete data displayed in the Veracode Platform (v2.48.0). • The `veracode static scan` command no longer includes the `--verbose` flag by default (v2.38.2). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Fri, 28 Aug 2026 02:34:23 GMT Veracode adds region switching in VS Code OAuth, custom predependency commands in GitHub Workflows, and Next.js 16.x / Android 16 static analysis support. • Adds support for custom `predependency` commands in the Veracode YAML file for the GitHub Workflow Integration v2.1.3, enabling project preparation steps before scanning. • Adds a 'Current File' filter to Static Scan Findings in Veracode Scan for VS Code v1.16.3, scoping displayed findings to the file open in the editor. • Adds an option to filter and group Static Scan Findings by file name, with findings for each file grouped by severity, in VS Code v1.16.3. • Adds an option to change the region during OAuth authentication in VS Code v1.16.3, with the current or most recently used region displayed on the OAuth screen. • Static Analysis Engine v2026.08 adds support for Next.js 16.x. • Static Analysis Engine v2026.08 adds support for Android 16. • Static Analysis Engine v2026.08 adds support for the Python `google-cloud-bigquery` library. • Static Analysis Engine v2026.08 adds detection of hardcoded values in `get` assignments modeled as getter functions. • Static Analysis Engine v2026.08 improves detection of hardcoded passwords and credentials associated with CWE-259 and CWE-798. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Mon, 24 Aug 2026 00:00:00 GMT Veracode integrations gain GitHub Platform install/scheduling, ADO agent pool config, scan scope selection, and expanded API wrapper capabilities. • Adds a custom agent pool name parameter in `veracode.yml` for Azure DevOps Workflow Integration v2.4.3, letting you specify the agent pool used for pipeline execution. • Adds `analysis_branch` support in `veracode.yml` for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against a specified branch instead of the default branch. • Adds the `debug` configuration option in `veracode.yml` for the Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 to enable debugging and troubleshooting. • Adds page size support to the Platform Applications API (`/appsec/v1/applications`) in Java API Wrapper v26.3.19.0 to improve efficiency when retrieving large application lists. • Introduces support for the Veracode Platform paginated Sandbox REST API in Java API Wrapper v26.3.19.0, enabling pagination-based retrieval of sandbox lists. • Adds support for the Veracode Platform Findings REST API in Java API Wrapper v26.2.18.0 to access open and mitigated application findings. • Implements a configurable retry mechanism for the Platform Applications API (`appsec/v1/applications`) in Java API Wrapper v26.2.18.0 to handle transient failures and timeouts. • GitHub Workflow Integration v2.0.0 enables installing, configuring, and updating credentials for the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps. • GitHub Workflow Integration v2.0.0 adds the ability to schedule Static Analysis, SCA, and Infrastructure as Code (IaC) scans for GitHub organizations from the Veracode Platform. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. • GitHub Workflow Integration v2.1.1 introduces a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations. • Adds a `Scan Scope` setting in Veracode Scan for Visual Studio v0.8.0 to scan either the full project directory or only the active solution for faster, more focused results. • Adds usage analytics in Veracode Scan for Visual Studio v0.8.0 and Veracode Scan for JetBrains v1.8.0 and VS Code v1.16.0 to provide insights into plugin adoption, feature usage, and scan activity. • Azure DevOps Workflow Integration v2.3.9 adds the ability to schedule scans for every organization where the integration is installed, based on configurations in `veracode.yml`. • Veracode Azure DevOps extension v3.35.0 replaces the deprecated `Veracode Flaw Importer` task (with spaces) with the new `VeracodeFlawImporter` task for compatibility with a future Microsoft TFX packaging library upgrade. • Veracode Scan for Visual Studio v0.7.2 adds support for Visual Studio 2026. • GitHub Workflow Integration v2.1.1 updates the default runner image to `scm-packaging-5.0.0`, adding Alpine v3.24.0, Ubuntu v26.04, .NET v10, PipEnv v2026.6.2, libicu v78, Node.js v22.22.1, and Python v3.14.4. • GitHub Veracode Workflow App permissions are downgraded to remove administration permissions, preventing the app from altering or removing repositories where it is installed. Breaking changes: • The `Veracode Flaw Importer` task (with spaces in the task name) in the Veracode Azure DevOps extension is deprecated and scheduled for removal in a future release; replace it with `VeracodeFlawImporter`. • Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026; upgrade to Jira 10 or later to continue using a supported version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Wed, 19 Aug 2026 17:55:00 GMT Veracode eLearning reports now support date ranges up to one year in the past. • eLearning reports now support a start date up to one year in the past, enabling longer historical reporting windows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Wed, 19 Aug 2026 00:00:00 GMT Veracode integrations gain GitHub/Azure DevOps platform-managed installs, scan scheduling, new `veracode.yml` keys, and expanded Java API Wrapper support. • Adds `analysis_branch` key support in `veracode.yml` for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against a specified branch instead of the default branch. • Adds `debug` configuration option in `veracode.yml` for Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 to enable debugging and troubleshooting. • Adds custom agent pool name parameter in `veracode.yml` for Azure DevOps Workflow Integration v2.4.3 to specify the agent pool used for pipeline execution. • Java API Wrapper v26.3.19.0 adds page size support to the Platform Applications API (`/appsec/v1/applications`) and introduces support for the paginated Sandbox REST API for retrieving sandbox lists. • Java API Wrapper v26.2.18.0 adds support for the Veracode Platform Findings REST API to access open and mitigated application findings, and implements a configurable retry mechanism for `appsec/v1/applications`. • GitHub Workflow Integration v2.0.0 enables installing, configuring, and updating credentials for the GitHub integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. • GitHub Workflow Integration v2.0.0 enables scheduling Static Analysis, SCA, and Infrastructure as Code (IaC) scans for GitHub organizations from the Veracode Platform. • GitHub Workflow Integration v2.1.1 adds a new uninstallation workflow on the Veracode Platform to uninstall the Veracode app from GitHub organizations. • Azure DevOps Workflow Integration v2.3.9 enables scheduling scans for every organization where the integration is installed, driven by `veracode.yml` configuration. • Azure DevOps Workflow Integration v2.3.3 enforces SCA scan failure when vulnerabilities are found under a custom policy with the 'Build Action: error' configuration for agent-based scans. • Veracode Scan for Visual Studio v0.8.0 adds a 'Scan Scope' setting to choose between scanning the full project directory or only the active solution. • Veracode Scan for Visual Studio v0.8.0 and Veracode Scan for JetBrains v1.8.0 add usage analytics for plugin adoption, feature usage, and scan activity. • Veracode Scan for VS Code v1.16.0 adds usage analytics for plugin adoption, feature usage, and scan activity. • GitHub Workflow Integration v2.1.1 updates the default runner image to `scm-packaging-5.0.0`, including Alpine v3.24.0, Ubuntu v26.04, .NET v10, PipEnv v2026.6.2, libicu v78, Node.js v22.22.1, and Python v3.14.4. • GitHub Veracode Workflow App permissions are downgraded to remove administration permissions, preventing the app from altering or removing installed repositories. Breaking changes: • The `Veracode Flaw Importer` task (with spaces in the task name) in the Veracode Azure DevOps extension v3.35.0 is deprecated and replaced by `VeracodeFlawImporter`; the old task is scheduled for removal in a future release. • Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x on November 30, 2026; upgrade to Jira 10 or later to maintain a supported configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates https://docs.veracode.com/updates Wed, 12 Aug 2026 09:48:15 GMT Veracode adds business unit selection for DAST targets and real-time in-app scan notifications. • Adds business unit selection when creating a web application or API specification target, or on the DAST configuration page. • Adds real-time in-app notifications when scans complete, fail, or are cancelled. • Adds improved detection for CAA record checks on SSL certificates for CWE-862 in both Dynamic Analysis and DAST. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode https://docs.veracode.com/updates/r/c_all_int https://docs.veracode.com/updates/r/c_all_int Mon, 10 Aug 2026 00:00:00 GMT Veracode integrations gain GitHub/ADO platform-managed installs, scan scheduling, autopackaging for Apex/VB6/Perl, and new Java API Wrapper endpoints. • Adds `analysis_branch` key to `veracode.yml` in the Azure DevOps Workflow Integration v2.3.10: scheduled scans now run against the specified branch instead of the default branch. • Adds `debug` configuration option to `veracode.yml` across Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 for debugging and troubleshooting. • Adds page size support to the Platform Applications API (`/appsec/v1/applications`) in Java API Wrapper v26.3.19.0 to improve efficiency when retrieving large application lists. • Adds support for the Veracode Platform paginated Sandbox REST API in Java API Wrapper v26.3.19.0, enabling retrieval of sandbox lists using pagination. • Adds support for the Veracode Platform Findings REST API in Java API Wrapper v26.2.18.0 to access open and mitigated application findings. • Implements a configurable retry mechanism for the Platform Applications API (`appsec/v1/applications`) in Java API Wrapper v26.2.18.0 to handle transient failures and timeouts. • GitHub Workflow Integration v2.0.0 enables installing, configuring, and updating credentials for the Veracode GitHub Integration directly from the Veracode Platform, removing the requirement for manual GitHub Marketplace steps. • GitHub Workflow Integration v2.0.0 adds scan scheduling for Static Analysis, SCA, and IaC scans directly from the Veracode Platform for organizations using either the platform or GitHub Marketplace install path. • GitHub Workflow Integration v2.0.0 adds autopackaging support for Apex, VB6, and Perl. • GitHub Workflow Integration v2.1.1 ships an updated default runner image `scm-packaging-5.0.0` with Alpine v3.24.0, Ubuntu v26.04, .NET v10, PipEnv v2026.6.2, libicu v78, Node.js v22.22.1, and Python v3.14.4. • GitHub Workflow Integration v2.1.1 adds a new uninstallation workflow accessible from the Veracode Platform to remove the Veracode app from GitHub organizations. • Azure DevOps Workflow Integration v2.3.9 adds the ability to schedule scans for every organization where the integration is installed, driven by `veracode.yml` configuration. • Veracode Scan for Visual Studio v0.8.0 adds a Scan Scope setting to choose between scanning the full project directory or only the active solution. • Veracode Scan for Visual Studio v0.8.0 adds usage analytics providing insights into plugin adoption, feature usage, and scan activity. • Veracode Scan for Visual Studio v0.7.2 adds support for Visual Studio 2026. • Azure DevOps Workflow Integration v2.3.3 enforces `Build Action: error` custom policy behavior for SCA agent-based scans, causing the scan to fail when vulnerabilities are found. • The `VeracodeFlawImporter` task replaces the deprecated `Veracode Flaw Importer` task (space-separated name) in Veracode Azure DevOps extension v3.35.0; both are currently supported. • Reduces GitHub Veracode Workflow App permissions by removing administration access, preventing the app from altering or removing installed repositories. Breaking changes: • The `Veracode Flaw Importer` task (with spaces) in the Veracode Azure DevOps extension is deprecated and scheduled for removal in a future release; replace it with `VeracodeFlawImporter`. • Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026; upgrade to Jira 10 or later to maintain a supported configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/veracode