Checkmarx SCA Release Notes August 2026

SCA archive unpacking now supports tgz, rpm, and whl files, expanding on the existing capability to detect and analyze package manifests found inside archive and package files. This applies to both Checkmarx SCA cloud scans and the SCA Resolver CLI, using the same unpacking pipeline already applied to other supported archive types.

With this expanded coverage, teams working in Linux, Red Hat, and Python ecosystems get accurate dependency and risk visibility for software distributed as pre-packaged archives, without any change to existing scan configuration.

The CycloneDX SBOM generated by Checkmarx SCA is now compliant with version 1.7 of the CycloneDX specification. As part of this upgrade, each component in the SBOM now includes evidence of its provenance and detection method: the file path in your project that produced it, and whether it was identified through manifest analysis or hash comparison, with both shown separately when a component was identified through more than one method.

This is available in the CycloneDX SBOM downloaded from Checkmarx SCA, whether generated through the UI, API, or CI integration.

By aligning with the latest CycloneDX standard, the SBOM is more useful for enterprise audit, provenance, and compliance workflows.

SCA now extends its C/C++ open source detection to include packages sourced from vcpkg, in addition to the existing Conan-based detection.

Since C/C++ projects don't have a standardized manifest or lockfile format, SCA identifies open source packages using fingerprint analysis; this analysis now runs against a combined Conan and vcpkg fingerprint database. Detected vcpkg packages appear in scan results with their name, version, and source registry, along with any associated risk data from the Checkmarx security knowledge base.

This gives teams that manage C/C++ dependencies through vcpkg the same visibility into open source risk that Conan users already have, closing a previous blind spot in C/C++ scanning.