Skip to main content

Upcoming Single-Tenant Version | 3.34

New Features and Enhancements

SAST Engine Upgrade to Version 9.7.2

The SAST engine in Checkmarx One has been upgraded to version 9.7.2. To discover all the new features and updates in the latest version, refer to this page.

Enhanced DAST Triage with Persistent Notes

The Add Notes feature enables users to attach context to vulnerabilities in DAST results, such as mitigation strategies or rationale for severity changes. Notes persist across scans, supporting triage, auditing, and collaboration. This aligns with the existing note-adding functionality in SAST and IaC Security, ensuring platform consistency.

Enhanced Triaging for Secret Detection and Repo Health

The new triaging capabilities in the Repository Health and Secret Detection tabs provide a structured way to manage and prioritize findings. Users can now categorize findings by severity and state, add mandatory comments, and track all actions through a history log.

This ensures a more efficient workflow, allowing security teams to quickly address critical issues while maintaining transparency and accountability. The feature also improves clarity by clearly indicating non-exploitable risks in the UI, helping teams focus on actionable threats.

Feedback App Alerts for SCA Vulnerabilities

You can now configure Feedback Apps to send automatic Alerts to Slack, Teams or Email when a new SCA vulnerability is detected in a package that is used in your projects.

API for Unlimited Filtering of Scans

We have added a new API, POST /scans/byfilters. This enables retrieving detailed information about scans, similar to GET /scans. However, the new API does not have a limit on the number of characters used in filter submission.

External API for Analytics Database

The new external API endpoints provide access to the Checkmarx One Analytics database, enabling customers to integrate their preferred Business Intelligence tools for customizable data analysis and reporting. This API also offers a unified access method for internal Checkmarx One services to consume analytics data.

By replacing multiple real-time data retrieval processes with a single, robust API, it streamlines data access, reduces integration complexity, and minimizes potential points of failure.

For more information, see documentation.

Cloud Insights: Enhancements in Public Exposure Data Logic for Replicated Images

This release introduces enhancements to the Cloud Insights logic for determining the exposure status of replicated images.

Left-Side Menu Updates

In the Checkmarx One left-side menu, Insights has been replaced with ASPM, and Analytics, Risk Management, and Cloud Insights have been grouped under this menu.

SCA Updates

AI Guided Package Remediation

When the SCA scanner identifies a vulnerable package in your project and there is no remediated version available, a button is now shown that enables you to get AI generated suggestions for non-vulnerable replacement packages.

SCA Global Inventory Improvements

We added the following functionality to the Vulnerabilities & Malware tab of the SCA Global Inventory.

  • Added the “Fix Available” column, indicating whether or not a remediated version of the package is available. You can sort and filter for this column.

  • The EPSS score is now shown in a separate column (not under Exploitability). You can now sort and filter for EPSS.

SCA Resolver Version 2.12.11

  • For Nuget, fixed resolution for projects that include private packages.

Download the new version here.

IAM Updates

Keycloak Upgrade

Keycloak was upgraded to version 26.1.

Resolved issues

Ticket number

Description

AST-80321

Epic Links for Jira feedback profiles stopped working.

AST-80593

An error occurred when generating a Projects Report.

AST-80428

A type conversion error occurred when attempting to convert an empty interface.

AST-80773

The access token was briefly exposed when opening the Overview page in a new tab.

AST-81799

Analytics: CSV report from KPI was ignoring a tag filter.

AST-81136

API Compare Scan Endpoint allowed comparison to a running scan.

AST-82885

The source code was missing in the SAST viewer when the file path contained an HTML entity such as #.

AST-82682

An attempt to delete a project failed with the "Failed to fetch project" error.

AST-84312

A SAST scan was skipped with the "no valid sources were found" message for repositories containing symlinks.

AST-84583

The system OAuth client was visible in AIM UI.

AST-84801

The Applications page was not loading with a “Failed to get all Projects” error.

SCA-21893

SPDX 2.2 SBOM Scan was not working.

SCA-21983

Failed to load results from old projects.

AST-82217

SCA Containers were still showing results.

AST-64507

Traditional Chinese characters are masked in project report.

AST-78615

The number of vulnerabilities in Scan History doesn't match the CSV Export grid.

AST-80010

The CSV from SAST results shows an incorrect detection date when the detection date is earlier than the scan date.

AST-80016

Failed to generate a report with the Containers engine.

AST-80697

Application report is showing 0 for all the rows for some users.

AST-81066

Automatic filter reset when viewing vulnerabilities in DAST results.

AST-72972

The ID columns in the “ast_meta_scan_results” and “ast_meta_results” tables for single-tenant deployments were incorrectly set to INT type.

AST-73941

Updating scan results triggered a 502 Bad Gateway error.

AST-74875

A scan was stuck in the Running state.

AST-76119

SAST encountered an error when processing engine ETL results, with the message (pq: deadlock detected).

AST-66143

Deleted groups still appeared on the Projects page.

AST-80423

Wrong behavior on the Applications page for users that have if-in-group permissions.

AST-82542

The /scans API sporadically returned a 502 Bad Gateway error.

AST-77615

An exception occurred during the Policy Manager SCA Engine validation step.

AST-84342

SAST Migration: services crashed due to a Redis error.

AST-84428

Mismatched vulnerabilities count between the Applications view page and the count inside a specific application.

AST-84443

The Results pages for both SAST and SCA were not opening from the application page on the primary branch.

AST-85596

An issue with the Container Security toggle in the Code Repository Integration projects.

SCA-21272

CycloneDx SBOM: Package hashes were always empty.

SCA-21576

Direct dependencies were marked as "snoozed" even though they broke the Policy check.

SCA-21861

The "Identified in Package" filter was not working correctly.

SCA-22002

An error occurred when generating SBOM in SPDX format.

AST-80695

The OAuth Client UI regenerated the secret when pressing Enter in any field.