Cloud updates

​

Improvements

• You can now use Scan branch to scan the connected provider’s current branch head, including a head that has already been scanned.

​

Bug fixes

• Improved dependency scanning reliability for projects with many version-range dependencies and during temporary advisory lookup failures.

​

Bug fixes

• Pull request summaries now exclude closed and resolved findings from pre-existing unresolved issue counts.

​

Improvements

• Secret verification history now distinguishes missing verification materials and temporary failures from credentials confirmed as no longer live.

​

Bug fixes

• Scheduled secret verification now retries temporary provider failures more reliably.
• Cysmiq now clears outdated Needs Review states on code findings when newer analysis resolves the reason for review.
• Repository vulnerability trends now reflect fixes on the selected branches correctly.

​

Improvements

• Code scanning now detects Python subprocess calls that pass dynamic commands to Windows cmd.exe.
• Secret scanning now detects additional hard-coded credentials in YAML files.

​

New features

• Eligible organizations can now review discovered HTTP endpoints for a repository and follow linked code findings to the endpoints they may reach.
• The new repository experience now shows a security grade based on current default-branch scan evidence and findings that need action.

​

Bug fixes

• Improved policy evaluation reliability when scans overlap on the same asset.

​

Bug fixes

• Dependency findings now remain accurate when scans update or remove the same packages concurrently.

​

Improvements

• Pull request checks now refresh automatically after vulnerability triage, snooze changes, and policy decisions.

​

Bug fixes

• Full secret scans now mark removed secret locations as fixed while preserving provider verification for credentials.
• When a Go dependency graph is unavailable, pull request checks now finish without blocking and report that the assessment is unavailable.

​

Action required

• Update API and CLI automation that sets vulnerabilities to Fixed. This resolution is now scanner-managed.

​

Improvements

• Dependency scanning now supports Go 1.27 projects.

​

Improvements

• Dependency scanning now processes supported lock files even when the matching manifest is missing.

​

Bug fixes

• Dependency policies now stop reporting packages after their manifests are removed.

​

Bug fixes

• Pull requests now keep the latest Cysmiq assessment when results finish out of order.
• Incremental scans now remove outdated call-chain results when code resolves to a different API or framework.
• Dependency scanning now preserves valid packages during partial processing and removes outdated packages after a complete scan.

​

Bug fixes

• Various bug fixes improved SBOM processing and pull request assessment reliability during concurrent scans.

​

Bug fixes

• Bitbucket repositories now follow default branch changes more reliably.

​

New features

• The Cysmiq sidebar now shows current service status and links to the public status page.

​

Bug fixes

• Fixed scan result processing for repositories with deeply nested file paths so Cysmiq processes findings, manifests, and pull request comparisons reliably.

​

Bug fixes

• Re-enabled repositories now resume scanning more reliably when earlier scans are still active.
• Bitbucket Cloud connections can now be saved even when Bitbucket temporarily limits an optional setup request.

​

Bug fixes

• Dependency policy violations, counts, and filters now stay accurate after incremental scans.

​

Improvements

• Queued scans now make progress more consistently across repositories when scan capacity is limited.

​

Bug fixes

• Improved scan stability when analysis tasks time out by cleaning up unfinished processing more reliably.
• Fixed vulnerability detail pages so location counts resolve correctly and the Activity tab preserves accurate status, resolution, snooze, and transition-comment history.

​

Bug fixes

• Fixed pull request assessments that reuse older scan results with skipped paths so complete evaluations no longer remain pending.

​

Bug fixes

• Fixed code vulnerability analysis so newer local results take precedence over stale or late call-chain evidence.
• Fixed pagination on the Users and Invitations tabs so workspaces with more than 20 entries can browse every member and invitation.
• Fixed scan recovery when source history is unavailable so affected repositories can continue from the current repository state instead of remaining blocked.
• Scanning remains unavailable for archived repositories until Cysmiq confirms they are active.

​

Bug fixes

• Fixed GitHub push and pull request event processing during maintenance or transient failures so affected scans and assessments can resume.

​

New features

• The Cysmiq API now identifies whether a vulnerability comes from the current branch state or Git history and can filter vulnerability lists by that source.

​

Improvements

• Vulnerability detail pages now provide a dedicated Locations tab and preserve the originating scan’s branch or tag when opened from a scan-filtered vulnerability list.

​

Bug fixes

• GitHub status checks no longer include internal scan or policy diagnostics in their public output.
• Fixed pull request assessments for changes that include paths excluded from scanning so complete evaluations no longer remain pending because of those paths.
• Fixed stale table counts that could appear after navigating quickly between large views.

​

New features

• The Scans view now shows live analysis phases, progress through the scan pipeline, item counts, and estimated time remaining when enough comparable scan history is available.

​

Improvements

• Pull request assessment and policy status checks now show clearer outcome summaries across connected version control providers. GitHub checks also include contributing pull request results and links to relevant Cysmiq results.
• Filters load faster in large vulnerability, policy violation, and package views.

​

Bug fixes

• Metadata-only pull request and merge request edits no longer start redundant assessments when the compared commits are unchanged.
• Fixed GitHub pull request assessments when changed-file counts differ between GitHub API responses.
• Fixed source preparation for repositories with branch or tag names that contain Unicode whitespace.
• Various bug fixes improved scan recovery and result processing for large or long-running scans.

​

Improvements

• Improved source preparation reliability for concurrent scans, including cache reuse and safer recovery under storage pressure.

​

Improvements

• Incremental scans can now reuse completed analysis from scans that later failed during an unrelated step, reducing unnecessary full scans.

​

Bug fixes

• Fixed layout and wrapping in repository branch and tag tables.

​

Improvements

• Secret scan controls and progress details now use Provider checks and Context assessments, making the two assessment methods easier to distinguish. See Repository scan jobs.
• Large asset, vulnerability, scan, and policy tables now load faster.
• Improved finding ingestion performance for scans that produce large result sets.

​

Bug fixes

• Various bug fixes improved scan completion and recovery when tasks are delayed or run concurrently.

​

New features

• The Repositories and Scans views now show available repositories by default and provide an Availability filter for switching to orphaned repositories or all repositories.

​

Bug fixes

• Fixed scan post-processing for large vulnerability candidate sets so affected scans can complete successfully.
• Fixed Secret History scanning so only repository content produces findings and missing commit details no longer interrupt result processing.

​

New features

• Repository scan-job settings now let teams choose which analyses run and limit call-chain analysis to selected branches. Code analysis, call chains, and Secret History are automatically skipped for monorepos.

​

Bug fixes

• Various bug fixes improved scan orchestration, pull request assessment recovery, and dependency policy evaluation.

​

Bug fixes

• Fixed SBOM result processing for dependencies with unusually long package identifiers so affected scans can complete.

​

Improvements

• The vulnerability Analysis view can now filter call hierarchies by path, branch or ref, and analysis state, making large result sets easier to review.

​

Bug fixes

• Improved scan and pull request assessment reliability during concurrent processing.

​

Improvements

• The Scans view now shows repositories and organizations separately, links repository names to their Cysmiq detail pages, and keeps full names and identity details available on hover.

​

Bug fixes

• Dependency policy results now remain scoped to the correct repository when applications or environments span multiple repositories. Removed dependency evidence and policy exceptions now update matching violations consistently.
• Various bug fixes improved scan completion, SBOM result processing, and Bitbucket pull request assessments.

​

New features

• VCS status and PR decoration settings can now set the minimum finding severity that blocks security checks and choose which terminal pull request results receive comments.

​

Improvements

• Pull request comments now separate blocking findings, non-blocking warnings, exploitability changes, fixed findings, and policy outcomes, with links to the relevant Cysmiq results.

​

Bug fixes

• Bitbucket Cloud integration setup now identifies Atlassian account API tokens and app passwords and directs users to the required workspace access token.
• Fixed the vulnerability status dialog so its displayed resolution is selected correctly.
• Workspace listings no longer include workspaces scheduled for deletion.
• Improved pull request assessment reliability for large result sets.

​

Improvements

• Improved scan monitoring and pull request assessment performance.

​

Bug fixes

• Fixed analysis result processing so scans only update findings for the repository being analyzed.
• Fixed GitHub pull request comment recovery when an existing comment can no longer be found.
• Various bug fixes improved scan recovery and pull request assessment consistency.

​

New features

• Repository branch views can now start scans for unscanned branches and retry eligible failed scans. Failed scans can also be retried from the Scans view.

​

Bug fixes

• Various bug fixes improved scan queue reliability and pull request assessment consistency.

​

New features

• Code scanning now supports Swift and Dart. Framework-aware coverage includes CryptoSwift and SwiftNIO for Swift, plus common database and WebView packages for Dart.
• Dependency scanning now recognizes Dart Pub projects and CocoaPods dependencies in Swift projects.

​

Improvements

• Secret findings now identify whether Cysmiq used a provider check or a context assessment. Dedicated filters and badges make the assessment method easier to understand during triage. See Secrets scanning.

​

Bug fixes

• Fixed analysis of Scala Play configuration findings so affected scans can complete successfully.
• Various bug fixes improved GitHub and Bitbucket Cloud integration reliability.

​

New features

• Code scanning now supports Rust, including framework-aware rules for libraries such as Diesel, Reqwest, SQLx, Tower HTTP, and Warp.
• Code scanning now supports Scala, including framework-aware rules for Akka HTTP, Anorm, Play, and Slick.
• Dependency scanning now recognizes Scala projects that use sbt manifests and lock files.

​

Bug fixes

• Various bug fixes improved pull request assessment consistency and pull request decoration behavior.

​

New features

• Code scanning now supports Ruby, including Rails-aware analysis, ERB templates, and common Ruby project files.
• Code scanning now supports Kotlin, including framework-aware coverage for Android projects and Apache HTTP Client usage.

​

Improvements

• Improved reliability for large code scans by reducing memory use during call-chain analysis.

​

Bug fixes

• Improved scan completion and recovery when result processing times out.
• Prevented cancelled scans from being queued again during recovery.

​

New features

• Code scanning now supports Elixir, including framework-aware rules for Phoenix and Plug applications.
• The Cysmiq CLI can now list accessible workspaces, repositories, and applications, making it easier for scripts and coding agents to discover the identifiers they need.
• CLI checks, vulnerability lists, and vulnerability summaries can now target an application across its repositories.

​

Action required

• Existing API keys retain their original scopes. Create a key with tenants:read or applications:read when using the new tenant and application commands. See API keys.

​

New features

• The Cysmiq CLI can now install, inspect, update, and remove official Cysmiq skills for Codex, Claude Code, and portable agent layouts.

​

Bug fixes

• Disabled repositories no longer publish new VCS status updates until scanning is re-enabled. See VCS status updates.

​

New features

• Pull requests can now show separate Cysmiq Scan, Cysmiq PR Assessment, and Cysmiq Policies checks, making scan execution, vulnerability assessment, and policy enforcement independently visible. See VCS status checks.

​

Improvements

• The Scans view now separates lifecycle Status from the resulting pull request or provider outcome, including scans associated with multiple current pull requests.