Version 3.7

NEW

Nightly versions

Jenkins

We now create nightly pre-release versions of this extension whenever we merge new code. Users have the option to update to the latest pre-release version or to update only when a new release version is published.

NEW

Ignore proxies

Jenkins

Added an environment variable, "CX_IGNORE_PROXY", for ignoring proxies. Mark the variable as true to ensure that all Checkmarx One CLI commands run directly from the local machine.

NEW

Podfile

Jenkins

Added Podfile and Podfile.lock to the list of included files (when creating the zip archive for scanning).

NEW

SBOM reports

Jenkins

Added the ability to generate SBOM reports. SBOMs can be generated using CycloneDX or SPDX format. SPDX reports are output in JSON format, and CycloneDX can be output as JSON or xml. This can be done using the scan create or results show command.

NEW

Proxy designation

Jenkins

We added a new environment variable, CX_HTTP_PROXY, which can be used to designate a specialized proxy for Checkmarx One. When this is used, it overrides the proxy specified in your general HTTP_PROXY variable.

UPDATED

Results summary

Azure DevOps

Improved the "Results Summary" shown in the CLI output. The summary now shows vulnerabilities by severity level for each scanner separately, in addition to the overall totals.

UPDATED

Output log

Jenkins

The output log is now stored to a variable cxcli, enabling users to access this data further along in their pipeline.

UPDATED

CLI code

Jenkins

Updated CLI code to GO version 1.21.1 in order to remediate a vulnerability.

UPDATED

Results limit

Jenkins

We now return an unlimited number of results in the results summary (had been limited to 10k).

UPDATED

Policy violation

Jenkins

Added information about violated policies to the scan summary output.

For policies that are configured to "break build", when the policy is violated the scan will fail. (The --ignore-policy flag can be applied using --additional-params to prevent policies from causing the scan to fail).

UPDATED

Projects limit

Jenkins

Increased the default limit for projects returned using the project list command to 10,000. (This enables Checkmarx One to effectively verify whether a project with the specified name already exists when a scan is initiated via CLI/plugin.)

FIXED

Vulnerability remediation

Azure DevOps, Jenkins

Remediated vulnerabilities that we identified in our project.

FIXED

Vulnerability remediation

Azure DevOps, Jenkins

Uses CLI version in which vulnerabilities affecting that project have been remediated.

FIXED

Sarif output

GitHub Actions

Fixed issue that sarif output had been failing when there were no SAST results.

FIXED

Scan ID

Jenkins

Fixed issue obtaining scan ID from logs.

FIXED

Groups

Jenkins

Fixed issue that submitting --groups was interfering with project configuration (e.g., removing designation of primary branch).

NEW

AI Guided Remediation for SAST

VS Code

We added AI Guided Remediation for SAST vulnerabilities (in addition to existing support for IaC Security vulnerabilities). We send the Checkmarx scan results file to OpenAI together with code snippets around each node of the Attack Vector for the specified vulnerability. We also submit a pre-configured series of instructions to OpenAI, which generates a response that includes the following sections: Confidence, Explanation and Proposed Remediation sections. You can follow up with additional questions. For more information see AI Guided Remediation

Visual Studio Code - Marketplace

Visual Studio Code Plugin - Changelog

Checkmarx One Visual Studio Code Extension (Plugin)

Visual Studio - Marketplace

Visual Studio Plugin - Changelog

Checkmarx One Visual Studio Extension (Plugin)

JetBrains - Marketplace

JetBrains Plugin - Changelog

Checkmarx One JetBrains Plugin

Eclipse - Marketplace

Eclipse Plugin - Changelog

Checkmarx One Eclipse Plugin