VS Code Extension - Changelog

General improvements and bug fixes

You can now view results from the Secret Detection scanner (part of SCS) in VS Code. When you click on a result, the result details are shown in three tabs: General, Description and Remediation Examples.

We now use pagination when loading projects and branches in order to cut the loading time. We now load only 20 items at a time.

Fixed issue that ASCA scanner had been marking results (with a squiggly underline) from the beginning of the line even when the code was indented.

We now show a warning when the selected Checkmarx One project doesn't match the local project in your workspace.

Improved ability to load results for projects with a large number of results (above 40k).

Added the ability to create a new branch in the Checkmarx project when you run a scan from the IDE.

Fixed issue that the "run scan" button wasn't reactivated after a scan failed.

General improvements and bug fixes

General improvements and bug fixes

General improvements and bug fixes

General improvements and bug fixes

Fixed issue that KICS scans were failing due to syntax problems in the additional parameters.

General improvements and bug fixes

The name of the Vorpal scanner was changed to AI Secure Coding Assistant (ASCA).

Added support for running the Vorpal scanner on Linux and MacOS ARM machines (in addition to existing support for Windows).

We now correctly label the issues identified by the Vorpal scanner as "best practice" issues and not vulnerabilities.

Added the AI Secure Coding Assistant (ASCA). The ASCA scanner is a lightweight scan engine that runs in the background as you work in VS Code. Whenever you edit a file in VS Code the ASCA scanner automatically scans that file.

Changed the name of KICS Auto Scanning to KICS Real-time scanning.

Fixed issue that the Output tab would open every time the user opens a new window.

General improvements and bug fixes

Fixed issue running IDE scans on projects with special characters (such as ":").

Changed the name of the extension from Checkmarx to Checkmarx One.

Resolved issue that it wasn't possible to run a scan on a Project for which no vulnerabilities were found in the previous scan.

Improved the error message when a user without proper permissions tries to initiate a scan.

General improvements and bug fixes.

General improvements and bug fixes.

The CLI that this plugin is based on is now signed with the Checkmarx digital signature, indicating that this is an official Checkmarx product. This enables communication from this plugin to bypass firewalls on Windows computers that previously blocked the unsigned CLI.

Fixed broken documentation link in marketplace.

Fixed issue that vulnerability descriptions weren't being shown for results from container scans.

Improved display of scan date in the Checkmarx One Results panel.

Fixed a problem that was introduced in the previous release.

Changed the name of the AI Guided Remediation feature to AI Security Champion.

Moved the Codebashing links into the Description tab.

Remediated vulnerabilities that we identified in our project.

Uses new CLI version in which vulnerabilities affecting that project have been remediated.

In the AI Security Champion tab, we improved the formatting of the response, and fixed the description of the "Confidence" score to accurately explain that it represents the likelihood of the vulnerability being exploited.

We added AI Guided Remediation for SAST vulnerabilities (in addition to existing support for IaC Security vulnerabilities). We send the Checkmarx scan results file to OpenAI together with code snippets around each node of the Attack Vector for the specified vulnerability. We also submit a pre-configured series of instructions to OpenAI, which generates a response that includes the following sections: Confidence, Explanation and Proposed Remediation sections. You can follow up with additional questions. For more information see AI Guided Remediation

Fixed issue that KICS Auto Scanning had been running even when the feature was disabled.

Fixed issue related to incorrect use of log object.

Updated for CLI version that uses GO version 1.21.1, in order to remediate a vulnerability.

Fixed issue related to showing masked secrets in the AI Guided Remediation tab.

Added Podfile and Podfile.lock to the list of included files (when creating the zip archive for scanning).

Fixed issue that had been causing KICS Realtime scans to fail.

Fixed issue that HTML output wasn't being shown properly for results that contain HTML content.

Stopped showing the Policy Violation header in the console results for projects that don't have any associated polities.

We added ”AI Guided Remediation” feature, which harnesses the power of Open AI's GPT to help you to understand the vulnerabilities in your code, and resolve them quickly and easily. This feature is currently supported only for IaC Security vulnerabilities.

When you initiate an AI chat, we automatically provide the context to GPT so that you can start a conversation about the precise vulnerability instance that you are assessing.

Added a new Documentation & Feedback section to the Checkmarx panel, providing quick links to view our documentation and submit requests for improvements.

Fixed issue that risk management (triaging results) hadn't been working for IaC Security risks.

For SCA Realtime scans that return incomplete results, we now show a Dependency resolution errors section which gives info about manifest files that weren't resolved and the reason for the error (e.g., relevant package managers not installed locally).

We now create nightly pre-release versions of this extension whenever we merge new code. Users have the option to update automatically to the latest pre-release version or to update only when a new release version is published.

If you would like to start receiving automatic updates whenever a new pre-release (or release) version is created, go to the Checkmarx extension page and click on Switch to Pre-Release Version. Otherwise, you will continue to get updates only when a new release version is created.

We now show the complete Changelog for this extension in Marketplace as well as on the Checkmarx Extension page that is shown in the IDE.

Added error handling for SCA Realtime scanner.

Fixed problem that was introduced in version 2.0.15 relating to showing SCA Realtime results.

Fixed problem that was introduced in version 2.0.15 relating to Create Scan button.

Improved visibility of the Create Scan button by moving it to the header bar of the Checkmarx pane.

Fixed issue that the Create Scan button had been disabled after unexpected shutdown.

Fixed issue that SCA Realtime wasn't yielding results for users that didn't enter account credentials.

Fixed issue that filters hadn't been functioning properly.

Added the SCA Realtime scanner tool, which enables all VS Code users to run an SCA scan on the project in their workspace and view results in the VS Code console.

The KICS scanner is now referred to in Checkmarx One as "IaC Security". All mentions of the scanner and the vulnerabilities identified by it, now refer to IaC Security.

Scan results now differentiate between regular SCA vulnerabilities and Supply Chain Security (SCS) risks.

We added a new grouping category. For SCA vulnerabilities you can now differentiate between Direct Dependencies and Transitive Dependencies in the results tree.

The "Code samples" tab was renamed "Remediation Examples".

You can now initiate scans directly from your IDE. This empowers developers to identify vulnerabilities and remediate them as they code. This feature is currently supported for VS Code and JetBrains. This feature needs to be enabled for your organization's account by a Checkmarx admin user under Account Settings.

You can run a new scan on an existing Checkmarx project by simply clicking on the "play" button in the Checkmarx panel. A Checkmarx scan runs on the files in your current workspace.

We have simplified the integration procedure for IDE plugins. It is no longer required to enter the Base URL or Tenant Name of your Checkmarx One account. Now, you just enter your API Key, and we extract all of the relevant account info from that Key.

In the Checkmarx AST settings, there is now a field for adding additional params. This can be used to manually submit the base url and tenant name (in case there is a problem extracting them from the API Key) or to add global params such as --debug or --proxy. To learn more about CLI params, see Checkmarx One CLI Commands.

Fixed results panel for KICS results. The code samples tab is no longer shown.

In the SAST results viewer, we added new tabs with additional info about each vulnerability.

A notification is now shown in the Output section when KICS Auto-Scanning identifies an IaC vulnerability for which Checkmarx offers a suggested "quick-fix".

In the SCA results viewer, we added an automatic remediation button, which enables users to automatically replace a vulnerable package version with a non-vulnerable version of that package.

It is now possible to add a comment to a vulnerability without changing the state or severity of the vulnerability.

All documentation links now point to the new Checkmarx documentation portal at https://checkmarx.com/resource/documentation.

General improvements and bug fixes

Added a new tool to the VS Code plugin that initiates KICS scans directly from their VS Code console. This is a free tool provided by Checkmarx for all VS Code users, and does not require the user to submit credentials for a Checkmarx One account. For more info, see Visual Studio Code - KICS Auto Scanning.

Added hover tooltip for codebashing links.

Once a project and branch are selected, the latest scan of that branch is automatically loaded.

Once the project and branch are selected, the latest scan is automatically loaded.

Added support for users that don’t have git installed.

Fixed issue loading result with Urgent state.

Added links to the relevant Codebashing lessons.

Enabled selecting multiple groups in order to create nested display

Added ability to triage results directly from the IDE console

Added a brief description for SAST vulnerabilities

Updated UI elements to reflect the new Checkmarx branding (e.g., logo)

Added filter results by “state”

General UI improvements

Updated CLI to version 2.0.4

Shows logs of Checkmarx One results in “Output” tab

Added a “Clear” button to “Projects” tab, enabling clearing the current selection and results.

Added integration tests and UI tests

Fixed display of line and column in the “Details” section to match the line and column shown in the editor

Import Checkmarx One scan results

Show results from all scan types (SAST, SCA, and KICS)

Group results by file, language, severity, and status

Navigate from results directly to the vulnerable code in the editor

Vulnerable code is highlighted in the editor