On-premise updates

​

Improvements

• Reduced database growth after successful pull request assessments by cleaning up consumed processing data.

​

Bug fixes

• Dependency policy violations, counts, and filters now stay accurate after incremental scans.
• Re-enabled repositories now resume scanning more reliably when earlier scans are still active.
• Bitbucket Cloud connections can now be saved even when Bitbucket temporarily limits an optional setup request.

​

Improvements

• Queued scans now make progress more consistently across repositories when scan capacity is limited.
• Reduced database growth from vulnerability activity tracking while preserving status, resolution, snooze, and transition-comment history.

​

Bug fixes

• Improved scan stability when analysis tasks time out by cleaning up unfinished processing more reliably.
• Fixed vulnerability detail pages so location counts resolve correctly and the Activity tab preserves accurate status, resolution, snooze, and transition-comment history.

​

Configuration

• Repository Max Concurrency Share can now limit the fraction of finite scan capacity used by one repository. The default is 0.65.

​

Bug fixes

• Fixed pull request assessments that reuse older scan results with skipped paths so complete evaluations no longer remain pending.

​

Configuration

• Embedded MySQL deployments can now configure the InnoDB log buffer size. The default is 16M.

​

Bug fixes

• Fixed scan recovery when source history is unavailable so affected repositories can continue from the current repository state instead of remaining blocked.
• Scanning remains unavailable for archived repositories until Cysmiq confirms they are active.

​

New features

• The Cysmiq API now identifies whether a vulnerability comes from the current branch state or Git history and can filter vulnerability lists by that source.

​

Improvements

• Vulnerability detail pages now provide a dedicated Locations tab and preserve the originating scan’s branch or tag when opened from a scan-filtered vulnerability list.

​

Bug fixes

• GitHub status checks no longer include internal scan or policy diagnostics in their public output.
• Fixed pull request assessments for changes that include paths excluded from scanning so complete evaluations no longer remain pending because of those paths.
• Fixed stale table counts that could appear after navigating quickly between large views.
• Fixed GitHub push and pull request event processing during maintenance or transient failures so affected scans and assessments can resume.
• Fixed code vulnerability analysis so newer local results take precedence over stale or late call-chain evidence.
• Fixed pagination on the Users and Invitations tabs so workspaces with more than 20 entries can browse every member and invitation.

​

New features

• The Scans view now shows live analysis phases, progress through the scan pipeline, item counts, and estimated time remaining when enough comparable scan history is available.

​

Improvements

• Pull request assessment and policy status checks now show clearer outcome summaries across connected version control providers. GitHub checks also include contributing pull request results and links to relevant Cysmiq results.
• Filters load faster in large vulnerability, policy violation, and package views.

​

Bug fixes

• Metadata-only pull request and merge request edits no longer start redundant assessments when the compared commits are unchanged.
• Fixed GitHub pull request assessments when changed-file counts differ between GitHub API responses.
• Fixed source preparation for repositories with branch or tag names that contain Unicode whitespace.
• Various bug fixes improved scan recovery and result processing for large or long-running scans.

​

Improvements

• Improved source preparation reliability for concurrent scans, including cache reuse and safer recovery under storage pressure.

​

New features

• The Repositories and Scans views now show available repositories by default and provide an Availability filter for switching to orphaned repositories or all repositories.

​

Improvements

• Secret scan controls and progress details now use Provider checks and Context assessments, making the two assessment methods easier to distinguish. See Repository scan jobs.
• Large asset, vulnerability, scan, and policy tables now load faster.
• Improved finding ingestion performance for scans that produce large result sets.
• Incremental scans can now reuse completed analysis from scans that later failed during an unrelated step, reducing unnecessary full scans.

​

Bug fixes

• Fixed scan post-processing for large vulnerability candidate sets so affected scans can complete successfully.
• Fixed Secret History scanning so only repository content produces findings and missing commit details no longer interrupt result processing.
• Various bug fixes improved scan completion and recovery when tasks are delayed or run concurrently.
• Fixed layout and wrapping in repository branch and tag tables.

​

Improvements

• Analysis workloads can now start replicas in parallel, reducing wait time when self-hosted deployments start or scale.

​

Configuration

• Embedded RabbitMQ deployments can now configure the consumer timeout. The default is 10800000 milliseconds (3 hours).

​

New features

• Repository scan-job settings now let teams choose which analyses run and limit call-chain analysis to selected branches. Code analysis, call chains, and Secret History are automatically skipped for monorepos.

​

Bug fixes

• Various bug fixes improved scan orchestration, pull request assessment recovery, and dependency policy evaluation.

​

Bug fixes

• Fixed SBOM result processing for dependencies with unusually long package identifiers so affected scans can complete.

​

New features

• VCS status and PR decoration settings can now set the minimum finding severity that blocks security checks and choose which terminal pull request results receive comments.

​

Improvements

• Improved scan monitoring and pull request assessment performance.
• Pull request comments now separate blocking findings, non-blocking warnings, exploitability changes, fixed findings, and policy outcomes, with links to the relevant Cysmiq results.
• The Scans view now shows repositories and organizations separately, links repository names to their Cysmiq detail pages, and keeps full names and identity details available on hover.
• The vulnerability Analysis view can now filter call hierarchies by path, branch or ref, and analysis state, making large result sets easier to review.

​

Bug fixes

• Various bug fixes improved scan recovery and pull request assessment consistency.
• Bitbucket Cloud integration setup now identifies Atlassian account API tokens and app passwords and directs users to the required workspace access token.
• Fixed the vulnerability status dialog so its displayed resolution is selected correctly.
• Workspace listings no longer include workspaces scheduled for deletion.
• Improved pull request assessment reliability for large result sets.
• Dependency policy results now remain scoped to the correct repository when applications or environments span multiple repositories. Removed dependency evidence and policy exceptions now update matching violations consistently.
• Various bug fixes improved scan completion, SBOM result processing, and Bitbucket pull request assessments.
• Improved scan and pull request assessment reliability during concurrent processing.

​

Bug fixes

• Fixed analysis result processing so scans only update findings for the repository being analyzed.
• Fixed GitHub pull request comment recovery when an existing comment can no longer be found.

​

New features

• Code scanning now supports Swift and Dart. Framework-aware coverage includes CryptoSwift and SwiftNIO for Swift, plus common database and WebView packages for Dart.
• Dependency scanning now recognizes Dart Pub projects and CocoaPods dependencies in Swift projects.
• Repository branch views can now start scans for unscanned branches and retry eligible failed scans. Failed scans can also be retried from the Scans view.

​

Bug fixes

• Various bug fixes improved scan queue reliability and pull request assessment consistency.

​

New features

• Code scanning now supports Rust, including framework-aware rules for libraries such as Diesel, Reqwest, SQLx, Tower HTTP, and Warp.
• Code scanning now supports Scala, including framework-aware rules for Akka HTTP, Anorm, Play, and Slick.
• Dependency scanning now recognizes Scala projects that use sbt manifests and lock files.

​

Improvements

• Secret findings now identify whether Cysmiq used a provider check or a context assessment. Dedicated filters and badges make the assessment method easier to understand during triage. See Secrets scanning.

​

Bug fixes

• Fixed analysis of Scala Play configuration findings so affected scans can complete successfully.
• Various bug fixes improved GitHub and Bitbucket Cloud integration reliability.

​

Improvements

• Reduced background-job metadata retention to limit storage growth in self-hosted deployments.

​

Bug fixes

• Various bug fixes improved pull request assessment consistency and pull request decoration behavior.

​

New features

• Code scanning now supports Elixir, including framework-aware rules for Phoenix and Plug applications.
• Code scanning now supports Ruby, including Rails-aware analysis, ERB templates, and common Ruby project files.
• Code scanning now supports Kotlin, including framework-aware coverage for Android projects and Apache HTTP Client usage.
• Pull requests can now show separate Cysmiq Scan, Cysmiq PR Assessment, and Cysmiq Policies checks, making scan execution, vulnerability assessment, and policy enforcement independently visible. See VCS status checks.

​

Improvements

• The Scans view now separates lifecycle Status from the resulting pull request or provider outcome, including scans associated with multiple current pull requests.
• Improved reliability for large code scans by reducing memory use during call-chain analysis.

​

Bug fixes

• Improved scan completion and recovery when result processing times out.
• Prevented cancelled scans from being queued again during recovery.
• Disabled repositories no longer publish new VCS status updates until scanning is re-enabled. See VCS status updates.