Checkmarx SCA Release Notes August 2025

Notice

These release notes relate to the SCA standalone product. Users who consume SCA through Checkmarx One should refer to the Checkmarx One release notes to see which SCA features have been released in Checkmarx One.

Warning

The IgnoreVulnerability and UnignoreVulnerability APIs, which had been used for triaging SCA vulnerabilities, will be deprecated soon. They have been replaced by the new Management of Risk API, which supports applying any Checkmarx One state and adding comments. We recommend migrating to the new API soon.

SCA Updates

SBOM Supported Formats

We added support for SPDX version 2.3.

SBOM reports generated by SCA in SPDX format now use version 2.3. When submitting SBOM files to be scanned, we now support both version 2.2 and 2.3.

SCA Resolver

Download the latest version here.

Version 2.12.34 (August 13, 2025)

Improved handling of node_modules exclusion rules.

In this section: