Cloud updates

​

Bug fixes

• Bitbucket repositories now follow default branch changes more reliably.

​

New features

• The Cysmiq sidebar now shows current service status and links to the public status page.

​

Bug fixes

• Fixed scan result processing for repositories with deeply nested file paths so Cysmiq processes findings, manifests, and pull request comparisons reliably.

​

Bug fixes

• Re-enabled repositories now resume scanning more reliably when earlier scans are still active.
• Bitbucket Cloud connections can now be saved even when Bitbucket temporarily limits an optional setup request.

​

Bug fixes

• Dependency policy violations, counts, and filters now stay accurate after incremental scans.

​

Improvements

• Queued scans now make progress more consistently across repositories when scan capacity is limited.

​

Bug fixes

• Improved scan stability when analysis tasks time out by cleaning up unfinished processing more reliably.
• Fixed vulnerability detail pages so location counts resolve correctly and the Activity tab preserves accurate status, resolution, snooze, and transition-comment history.

​

Bug fixes

• Fixed pull request assessments that reuse older scan results with skipped paths so complete evaluations no longer remain pending.

​

Bug fixes

• Fixed code vulnerability analysis so newer local results take precedence over stale or late call-chain evidence.
• Fixed pagination on the Users and Invitations tabs so workspaces with more than 20 entries can browse every member and invitation.
• Fixed scan recovery when source history is unavailable so affected repositories can continue from the current repository state instead of remaining blocked.
• Scanning remains unavailable for archived repositories until Cysmiq confirms they are active.

​

Bug fixes

• Fixed GitHub push and pull request event processing during maintenance or transient failures so affected scans and assessments can resume.

​

New features

• The Cysmiq API now identifies whether a vulnerability comes from the current branch state or Git history and can filter vulnerability lists by that source.

​

Improvements

• Vulnerability detail pages now provide a dedicated Locations tab and preserve the originating scan’s branch or tag when opened from a scan-filtered vulnerability list.

​

Bug fixes

• GitHub status checks no longer include internal scan or policy diagnostics in their public output.
• Fixed pull request assessments for changes that include paths excluded from scanning so complete evaluations no longer remain pending because of those paths.
• Fixed stale table counts that could appear after navigating quickly between large views.

​

New features

• The Scans view now shows live analysis phases, progress through the scan pipeline, item counts, and estimated time remaining when enough comparable scan history is available.

​

Improvements

• Pull request assessment and policy status checks now show clearer outcome summaries across connected version control providers. GitHub checks also include contributing pull request results and links to relevant Cysmiq results.
• Filters load faster in large vulnerability, policy violation, and package views.

​

Bug fixes

• Metadata-only pull request and merge request edits no longer start redundant assessments when the compared commits are unchanged.
• Fixed GitHub pull request assessments when changed-file counts differ between GitHub API responses.
• Fixed source preparation for repositories with branch or tag names that contain Unicode whitespace.
• Various bug fixes improved scan recovery and result processing for large or long-running scans.

​

Improvements

• Improved source preparation reliability for concurrent scans, including cache reuse and safer recovery under storage pressure.

​

Improvements

• Incremental scans can now reuse completed analysis from scans that later failed during an unrelated step, reducing unnecessary full scans.

​

Bug fixes

• Fixed layout and wrapping in repository branch and tag tables.

​

Improvements

• Secret scan controls and progress details now use Provider checks and Context assessments, making the two assessment methods easier to distinguish. See Repository scan jobs.
• Large asset, vulnerability, scan, and policy tables now load faster.
• Improved finding ingestion performance for scans that produce large result sets.

​

Bug fixes

• Various bug fixes improved scan completion and recovery when tasks are delayed or run concurrently.

​

New features

• The Repositories and Scans views now show available repositories by default and provide an Availability filter for switching to orphaned repositories or all repositories.

​

Bug fixes

• Fixed scan post-processing for large vulnerability candidate sets so affected scans can complete successfully.
• Fixed Secret History scanning so only repository content produces findings and missing commit details no longer interrupt result processing.

​

New features

• Repository scan-job settings now let teams choose which analyses run and limit call-chain analysis to selected branches. Code analysis, call chains, and Secret History are automatically skipped for monorepos.

​

Bug fixes

• Various bug fixes improved scan orchestration, pull request assessment recovery, and dependency policy evaluation.

​

Bug fixes

• Fixed SBOM result processing for dependencies with unusually long package identifiers so affected scans can complete.

​

Improvements

• The vulnerability Analysis view can now filter call hierarchies by path, branch or ref, and analysis state, making large result sets easier to review.

​

Bug fixes

• Improved scan and pull request assessment reliability during concurrent processing.

​

Improvements

• The Scans view now shows repositories and organizations separately, links repository names to their Cysmiq detail pages, and keeps full names and identity details available on hover.

​

Bug fixes

• Dependency policy results now remain scoped to the correct repository when applications or environments span multiple repositories. Removed dependency evidence and policy exceptions now update matching violations consistently.
• Various bug fixes improved scan completion, SBOM result processing, and Bitbucket pull request assessments.

​

New features

• VCS status and PR decoration settings can now set the minimum finding severity that blocks security checks and choose which terminal pull request results receive comments.

​

Improvements

• Pull request comments now separate blocking findings, non-blocking warnings, exploitability changes, fixed findings, and policy outcomes, with links to the relevant Cysmiq results.

​

Bug fixes

• Bitbucket Cloud integration setup now identifies Atlassian account API tokens and app passwords and directs users to the required workspace access token.
• Fixed the vulnerability status dialog so its displayed resolution is selected correctly.
• Workspace listings no longer include workspaces scheduled for deletion.
• Improved pull request assessment reliability for large result sets.

​

Improvements

• Improved scan monitoring and pull request assessment performance.

​

Bug fixes

• Fixed analysis result processing so scans only update findings for the repository being analyzed.
• Fixed GitHub pull request comment recovery when an existing comment can no longer be found.
• Various bug fixes improved scan recovery and pull request assessment consistency.

​

New features

• Repository branch views can now start scans for unscanned branches and retry eligible failed scans. Failed scans can also be retried from the Scans view.

​

Bug fixes

• Various bug fixes improved scan queue reliability and pull request assessment consistency.

​

New features

• Code scanning now supports Swift and Dart. Framework-aware coverage includes CryptoSwift and SwiftNIO for Swift, plus common database and WebView packages for Dart.
• Dependency scanning now recognizes Dart Pub projects and CocoaPods dependencies in Swift projects.

​

Improvements

• Secret findings now identify whether Cysmiq used a provider check or a context assessment. Dedicated filters and badges make the assessment method easier to understand during triage. See Secrets scanning.

​

Bug fixes

• Fixed analysis of Scala Play configuration findings so affected scans can complete successfully.
• Various bug fixes improved GitHub and Bitbucket Cloud integration reliability.

​

New features

• Code scanning now supports Rust, including framework-aware rules for libraries such as Diesel, Reqwest, SQLx, Tower HTTP, and Warp.
• Code scanning now supports Scala, including framework-aware rules for Akka HTTP, Anorm, Play, and Slick.
• Dependency scanning now recognizes Scala projects that use sbt manifests and lock files.

​

Bug fixes

• Various bug fixes improved pull request assessment consistency and pull request decoration behavior.

​

New features

• Code scanning now supports Ruby, including Rails-aware analysis, ERB templates, and common Ruby project files.
• Code scanning now supports Kotlin, including framework-aware coverage for Android projects and Apache HTTP Client usage.

​

Improvements

• Improved reliability for large code scans by reducing memory use during call-chain analysis.

​

Bug fixes

• Improved scan completion and recovery when result processing times out.
• Prevented cancelled scans from being queued again during recovery.

​

New features

• Code scanning now supports Elixir, including framework-aware rules for Phoenix and Plug applications.
• The Cysmiq CLI can now list accessible workspaces, repositories, and applications, making it easier for scripts and coding agents to discover the identifiers they need.
• CLI checks, vulnerability lists, and vulnerability summaries can now target an application across its repositories.

​

Action required

• Existing API keys retain their original scopes. Create a key with tenants:read or applications:read when using the new tenant and application commands. See API keys.

​

New features

• The Cysmiq CLI can now install, inspect, update, and remove official Cysmiq skills for Codex, Claude Code, and portable agent layouts.

​

Bug fixes

• Disabled repositories no longer publish new VCS status updates until scanning is re-enabled. See VCS status updates.

​

New features

• Pull requests can now show separate Cysmiq Scan, Cysmiq PR Assessment, and Cysmiq Policies checks, making scan execution, vulnerability assessment, and policy enforcement independently visible. See VCS status checks.

​

Improvements

• The Scans view now separates lifecycle Status from the resulting pull request or provider outcome, including scans associated with multiple current pull requests.