Visual Studio Extension - Changelog

General improvements and bug fixes

General improvements and bug fixes

Added the AI Secure Coding Assistant (ASCA). The ASCA scanner is a lightweight scan engine that runs in the background as you work in Visual Studio. Whenever you edit a file in Visual Studio the ASCA scanner automatically scans that file.

ASCA also enables you to generate a customized snippet to remediate the secure coding issue using Copilot. ASCA prompts Copilot with the remediation data in our system so that Copilot can generate customized code to remediate the risk.

For more info about ASCA in Visual Studio, see here.

General improvements and bug fixes

When selecting a project, branch or scan, you can now start typing text and the results are filtered for that text.

General improvements and bug fixes

Made the plugin display more responsive to accommodate various types of devices.

Synchronized version release number with version shown in marketplace.

General improvements and bug fixes

The CLI that this plugin is based on is now signed with the Checkmarx digital signature, indicating that this is an official Checkmarx product. This enables communication from this plugin to bypass firewalls on Windows computers that previously blocked the unsigned CLI.

Remediated vulnerabilities that we identified in our project.

Uses new CLI version in which vulnerabilities affecting our CLI project have been remediated.

Fixed issue that KICS Auto Scanning had been running even when the feature was disabled.

Fixed issue related to incorrect use of log object.

Updated for CLI version that uses GO version 1.21.1, in order to remediate a vulnerability.

In the SAST results viewer, we added new tabs with additional info about each vulnerability.

Fixed issue that some buttons weren't showing up properly in blue mode.

Fixed issue that when submitting multiple additional params, only the first was being processed.

Fixed issue that when running a scan from the IDE, if the content in your workspace project isn't a Git project we had been treating it as a mismatched project.

Fixed issue that when running a scan from the IDE, if a project didn't have any results (identified risks) we had automatically been treating it as a mismatched project.

You can now initiate scans directly from your Visual Studio IDE (in addition to existing support for this feature in VS Code and JetBrains). This empowers developers to identify vulnerabilities and remediate them as they code.

You can run a new scan on an existing Checkmarx project by simply clicking on the "play" button in the Checkmarx panel. A Checkmarx scan runs on the files in your current workspace.

A sanity check is run to verify that the project and branch in your workspace match the project and branch that were scanned for this project. If a mismatch is detected, then a warning message is shown.

Fixed a bug that was introduced in version 2.0.12

Fixed a bug that was introduced in version 2.0.12

We added a new environment variable, CX_HTTP_PROXY, which can be used to designate a specialized proxy for Checkmarx One. When this is used, it overrides the proxy specified in your general HTTP_PROXY variable.

Added support for earlier versions of Visual Studio 2022. We now support SDK version 17.0 and above.

Updated dependencies

Improved memory usage when uploading zip files.

Fixed tooltip for Additional parameters so that link points to new documentation portal.

All references to AST have been changed to use the new product name "Checkmarx One".

Fixed problem with automatically opening the relevant files when clicking on an attack vector.

We have simplified the integration procedure for IDE plugins. It is no longer required to enter the Base URL or Tenant Name of your Checkmarx One account. Now, you just enter your API Key, and we extract all of the relevant account info from that Key.

In the Checkmarx AST settings, there is now a field for adding additional params. This can be used to manually submit the base url and tenant name (in case there is a problem extracting them from the API Key) or to add global params such as --debug or --proxy. To learn more about CLI params, see Global Flags.

Added links to the relevant Codebashing lessons.

Import Checkmarx One scan results

Show results from all scan types (SAST, SCA, and KICS)

Group results by file, language, severity, and status

Navigate from results directly to the vulnerable code in the editor

Vulnerable code is highlighted in the editor