Skip to main content

SAST updates

The updates on this page apply to Veracode Static Application Security Testing (SAST). Subscribe to the Static Analysis updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon.

For language support specific to Veracode Pipeline Scan, see Pipeline Scan Supported Languages.

October 28, 2026​

Static Analysis Engine v2026.10​

.NET​

  • Adds support for scanning C# source code.

Java​

  • Adds support for JDK 27.
  • Adds support for LLM-powered applications built with Spring AI.

PL/SQL​

  • Improves parsing of PL/SQL code.

Python​

  • Improves detection of third-party code.
  • Improves detection of CWE-73 flaws, reducing false positives.

RPG​

  • Improves detection of CWE-787 and CWE-823 flaws, reducing false positives.
  • Improves RPG parsing.

Scala​

  • Adds support for Scala 3.9.

T-SQL​

  • Improves parsing of T-SQL code.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages, reducing false positives.

September 23, 2026​

Static Analysis Engine v2026.09​

.NET​

  • Improves detection of CWE-259 and CWE-798 flaws, reducing false positives.

Android​

  • Enhances support for Android 16.

Apple Platforms​

  • Adds support for iOS 27.

Go​

  • Adds support for Go 1.27.

PL/SQL​

  • Improves parsing of PL/SQL code.

Python​

  • Improves detection of CWE-89 flaws in PySpark applications.
  • Improves SQLAlchemy analysis to reduce false positives when detecting CWE-89 flaws.
  • Improves detection of third-party code.

RPG​

  • Improves detection of CWE-200 flaws, reducing false positives.
  • Improves analysis of CALL commands to enhance detection of CWE-252 flaws.

September 16, 2026​

Veracode Static Analysis integration with DryRun Security​

Veracode Static Analysis now integrates with DryRun Security to bring Veracode findings and security context into AI-native developer workflows.

  • Incorporates Veracode Static Analysis findings into DryRun Security analysis and developer workflows.
  • Combines Veracode's deterministic static analysis with DryRun Security's contextual AI analysis to improve accuracy and extend coverage to business logic flaws.
  • Surfaces security context during pull request and code review workflows.
  • Provides Veracode findings as trusted security signals and remediation guidance for AI-assisted development tools.
  • Maintains Veracode Static Analysis as the authoritative source for Veracode findings while DryRun Security provides additional contextual analysis and developer guidance.

Enhanced Python scanner flaw matching​

  • Following the transition to Veracode’s enhanced Python scanner on July 22, 2026, some customers might have experienced a one-time change in flaw matching compared with scans performed using the previous scanner. As a result, certain previously identified flaws might not match their historical findings, and previously applied mitigations might need to be reapplied.
  • This behavior is limited to the transition to the enhanced scanner. After an application establishes its initial scan baseline with the enhanced scanner, subsequent scans use that baseline for consistent flaw matching.

September 3, 2026​

Language support and analysis improvements​

Dart and Flutter​

  • Adds support for Dart 3.13 and Flutter 3.47.

PHP​

  • Adds support for PHP 8.4 and PHP 8.5.

Python​

  • Improves handling of dynamic top-level directory structures and parsing of third-party libraries.

August 26, 2026​

Static Analysis Engine v2026.08​

Android​

  • Enhances support for Android 16.
  • Improves detection of third-party code.

Dart and Flutter​

  • Adds support for detecting hardcoded values in get assignments modeled as getter functions.

Java​

  • Improves Java scan performance when analyzing common template patterns.
  • Improves detection of CWE-78 flaws.

JavaScript​

  • Adds support for Next.js 16.x.
  • Improves detection of CWE-80 flaws involving React useState.

PHP​

  • Improves detection of third-party code.

PL/SQL​

  • Improves scan performance.

Python​

  • Improves detection of hardcoded passwords and credentials associated with CWE-259 and CWE-798.
  • Adds support for the Python google-cloud-bigquery library.

RPG​

  • Improves remediation guidance for flaws associated with CWE-78, CWE-114, CWE-200, CWE-338, CWE-359, CWE-628, CWE-787, and CWE-823.
  • Improves detection of CWE-787 flaws to reduce false positives.
  • Improves RPG parsing.

Other languages​

Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

July 29, 2026​

Pipeline Scan supports artifacts larger than 200 MB​

This update adds support for scanning packaged artifacts larger than 200 MB. No changes to existing integrations are required.

July 22, 2026​

Enhanced Python scanner​

  • Improves vulnerability detection through enhanced taint tracking, cross-file analysis, and pattern recognition. Adds support for applications built with PySpark, Flask, Django, and FastAPI.
  • Future scans might identify additional findings because of the enhanced analysis. These findings represent previously undetected vulnerabilities, not regressions or newly introduced issues.
  • Applies automatically to all Python scans starting July 22, 2026. No configuration changes are required.

July 21, 2026​

Static Analysis Engine v2026.07​

.NET​

  • Enhances support for .NET 10.
  • Improves analysis of applications that include Saturn.dll.

Android​

  • Adds support for Android 17.

Apex​

  • Improves detection of CWE-80 flaws.

Dart and Flutter​

  • Improves detection of third-party Dart packages.

Java​

  • Improves JSP and JSF Expression Language modeling by incorporating more complete data about POJOs, which might identify additional valid findings.
  • Improves scan accuracy for code generated by Project Lombok.
  • Expands third-party library detection to include Fluxnova.

JavaScript​

  • Improves analysis of the spread operator to reduce false positives.
  • Expands support for pnpm modules to improve dependency resolution.
  • Improves detection of CWE-80 flaws in React Native applications.

Python​

  • Improves propagation support for os.path functions.
  • Adds support for httplib when detecting CWE-295 and CWE-297 flaws related to SSL/TLS.

PL/SQL​

  • Improves parsing of PL/SQL code.

Other languages​

Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

June 24, 2026​

Static Analysis Engine v2026.06​

.NET​

  • Improves classification of first-party .NET assemblies to better distinguish application code from third-party dependencies.

Apex​

  • Improves detection of vulnerabilities that involve tainted data flows through public methods.
  • Improves detection of CWE-532 flaws.

Apple Platforms​

  • Improves support for Security APIs.

Dart and Flutter​

  • Adds support for Dart 3.12 and Flutter 3.44.

Kotlin​

  • Adds support for Kotlin 2.4.

Java​

  • Improves third-party detection.
  • Improves detection and classification of ForgeRock third-party dependencies in Maven-based projects.
  • Improves detection of CWE-918 flaws.

JavaScript​

  • Improves detection of CWE-73 flaws.
  • Improves third-party detection.

Python​

  • Improves third-party detection.

RPG​

  • Improves RPG parsing.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

May 27, 2026​

Static Analysis Engine v2026.05​

.NET​

  • Updates the .NET third-party dependency database with the latest NuGet package data.
  • Improves detection of the PdfPig third-party library.

Apple Platforms​

  • Adds support for the CloudKit framework.
  • Adds support for Apple Security framework APIs.
  • Improves detection of third-party libraries.

COBOL​

  • Improves COBOL scan logging for better visibility during analysis.

Java​

  • Enhances support for JDK 25.
  • Improves Java source code scanning for JSP files.
  • Improves detection of the Snowflake JDBC Driver third-party library.

Python​

  • Improves scan detection for the anticrlf cleanser function.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

April 22, 2026​

Static Analysis Engine v2026.04​

Apple platforms​

  • Adds support for applications built with Xcode 26.4.

COBOL​

  • Improves COBOL parsing.

Dart and Flutter​

  • Added support for Dart 3.11 and Flutter 3.41.

Java​

  • Adds support for JDK 26.
  • Adds support for scanning Java source code.
  • Adds support for viewing Java source code on the platform.
  • Improves detection of third-party libraries
  • Adds support for excluding Java .jar files from static analysis by using veracode.json.
  • Expands hardcoded secrets detection to include application configuration files with -local and -prod naming patterns.

JavaScript​

  • Adds support for React 19

Kotlin​

  • Adds support for Kotlin 2.3.

Python​

  • Adds support for Psycopg 3 in Python applications.

Ruby on Rails​

  • Improves detection of CWE-352.

RPG​

  • Enhanced scan accuracy for RPG source files with .MBR extension.

T-SQL​

  • Improves parsing of T-SQL code.

March 23, 2026​

Static Analysis Engine v2026.03​

.NET​

  • Improves detection of third-party libraries.

Apex​

  • Improves detection of CWE‑201 and CWE‑798, reducing false positives.
  • Skips @isTest methods during scans to reduce noise and improve result quality.

Apple platforms​

  • Improves scan performance for iOS projects.

COBOL​

  • Improves COBOL parsing.

Go​

  • Adds support for Fast HTTP.

Java​

  • Improves detection of third-party libraries from Maven repositories.
  • Improves detection of CWE-80.
  • Improves detection of CWE‑117 and CWE‑918, reducing false positives.

JavaScript​

  • Adds support for Angular 20.
  • Adds support for Next.js 15.x.

PL/SQL​

  • Improves PL/SQL code parsing.

Python​

  • Improves detection of CWE-73.
  • Adds taint sinks for the following functions:
    • send_from_directory
    • send_file

February 23, 2026​

Static Analysis Engine v2026.02​

.NET​

  • Expands .NET taint sink coverage for CWE‑80: Cross-Site Scripting to detect:
    • System.Web.UI.Page.Title
    • System.Web.UI.HtmlControls.HtmlHead.Title

Apple Platforms​

  • Adds taint propagation support for framework APIs.

Go​

  • Adds support for Go 1.26.

Java​

  • Improves cleanser detection for CWE-73.
  • Adds support for excluding specific Java classes from Static Analysis through the veracode.json configuration file.

JavaScript​

  • Improves scan performance.

Python​

  • Adds support for PyYAML.

January 28, 2026​

Static Analysis Engine v2026.01​

.NET​

  • Improves scan performance and result quality.

Android​

  • Improves detection of CWE-926 flaws to reduce false positives.

Apex​

  • Adds support for Apex 64 and Apex 65.
  • Improves detection of CWE-259, CWE-532, CWE-693, and CWE-798 flaws.

Apple Platforms​

  • Improves mobile behavioral detection for iOS 26.

C/C++​

  • Improves detection of third-party code.

Java​

  • Adds support for Spring Boot 4, Spring Core 7, and Spring Security 7.
  • Improves detection of CWE-104.

JavaScript​

  • Adds support for the Svelte framework.

Kotlin​

  • Improves detection of CWE-798 flaws to reduce false positives.

Ruby on Rails​

  • Adds support for Ruby 4.0 and Rails 8.1.

T-SQL​

  • Improves parsing of T‑SQL code.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

December 17, 2025​

Static Analysis Engine v2025.12​

.NET​

  • Adds support for .NET 10.
  • Improves detection of CWE-321 for ENCRYPTION_SALT_KEY and ENCRYPTION_IV_KEY.
  • Improves detection of CWE-78 flaws.

Android​

  • Improves third-party library detection for React.
  • Improves third-party library detection for Seismic.

COBOL​

  • Improves COBOL code parsing.

Dart and Flutter​

  • Adds support for Dart 3.10 and Flutter 3.38.

Go​

  • Adds support for the Go Fiber web framework.

iOS​

  • Adds taint propagation support for the Swift standard library.

Java​

  • Improves detection of CWE-918.
  • Improves cleanser detection for CWE-73.

JavaScript​

  • Improves detection of CWE-80 flaws to reduce false positives.

T-SQL​

  • Improves T-SQL code parsing.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

November 20, 2025​

Static Analysis Engine v2025.11​

C/C++​

  • Improves detection of third-party code.

COBOL​

  • Improves flaw detection in conditional variable initialization to reduce false positives.
  • Improves COBOL code parsing.

Java​

  • Enhances identification of first-party code in WEB-INF/classes with non-standard or mismatched package names.
  • Improves detection of third-party libraries from Maven repositories.

PL/SQL​

  • Improves PL/SQL code parsing.

Python​

  • Adds support for AWS Glue.
  • Improves detection of hardcoded passwords and credentials (CWE-259 and CWE-798).
  • Increases scan performance.
  • Enhances cleanser detection for CWE-117.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all supported languages to reduce false positives.

October 22, 2025​

Static Analysis Engine v2025.10​

.NET​

  • Adds support for Semantic Kernel (SK) KernelContent and Taint Injection.
  • Improves detection of third-party code.
  • Improves detection of CWE-352 flaws.

Android​

  • Skips ProGuard-obfuscated classes to improve scan performance.
  • Optimizes Android scans to reduce analysis time.

C/C++​

  • Improves detection of CWE-73 flaws.

COBOL​

  • Enhances COBOL parsing to automatically detect copybooks.

Java​

  • Improves detection of CWE-611 flaws.
  • Enhances identification of third-party code.

Python​

  • Adds support for PySpark.
  • Adds support for DynamoDB.
  • Adds support for FastAPI.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all supported languages to reduce false positives.

September 25, 2025​

Static Analysis Engine v2025.09​

.NET​

  • Adds support for Semantic Kernel (SK) InvocationFilter and Filter.

Dart and Flutter​

  • Adds support for Dart 3.9 and Flutter 3.35.

iOS​

  • Updates Gen IR: the --capture flag now includes diagnostic data in .xcarchive files to help with troubleshooting.

Java​

  • Adds support for JDK 25 (LTS).
  • Improves detection and reporting of insecure implementations involving encrypted values.

PL/SQL​

  • Improves parsing of PL/SQL code.

Python​

  • Enhances detection of CWE-89 in AWS Lambda environments.

Other languages​

  • Removes support for selecting third-party modules to improve scan accuracy and performance.
  • Enhances flaw detection for CWE-259 and CWE-798 to reduce false positives across supported languages.

September 15, 2025​

Updated language and framework support​

iOS​

  • Adds initial support for iOS 26.

August 27, 2025​

Static Analysis Engine v2025.08​

.NET​

  • Adds support for .NET Semantic Kernel (SK) to detect hardcoded credentials (CWE-798) and configuration control issues (CWE-15).
  • Adds support for Azure Functions v4 on .NET 9 in isolated process mode.

Dart and Flutter​

  • Adds support for Dart 3.8 and Flutter 3.32.

Go​

  • Adds support for Go 1.25.

Java​

  • Adds support for Micronaut 4.x.
  • Improves support for Quarkus.
  • Enhances third-party library detection for Maven repositories.
  • Improves CWE-918 detection to reduce false positives.

JavaScript​

  • Adds support for Node.js 22.x.

Scala​

  • Adds support for Scala 3.7.

T-SQL​

  • Improves T-SQL code parsing.

Other languages​

  • Enhances flaw detection for CWE-259 and CWE-798 across supported languages to reduce false positives.

August 4, 2025​

Pipeline Scan output now displays the finding exploit level​

The results.json output file from a Pipeline Scan now includes the finding exploit level. When you run a Pipeline Scan in the Veracode CLI or with the APIs, the exploit level is a numeric value from -2 to 2, where -2 is Very Unlikely and 2 is Very Likely.

July 24, 2025​

Updated language and framework support​

.NET​

  • Adds support for detecting CWE-285 flaws in ASP.NET Core MVC controllers.

Android​

  • Introduces initial support for Android 16.

Apex​

  • Adds support for Apex 63.
  • Improves detection of SOSL FIND queries. This update might increase findings for CWE-274 and CWE-284, and reduce findings for CWE-943.

Go​

  • Adds support for Go version 1.24.5.

COBOL​

  • Improves COBOL code parsing.

Java​

  • Improves detection of third-party libraries from Maven repositories.
  • Improves detection of org.owasp.esapi.Logger for better coverage of logging-related flaws.

JavaScript​

  • Improves detection of CWE-80 flaws in Node.js applications.
  • Improves detection of CWE-321 flaws in CryptoJS AES encryption and decryption calls.

PHP​

  • Reduces analysis times for WordPress applications. WordPress is not a supported framework, and result quality may be limited.

PL/SQL​

  • Improves PL/SQL code parsing.

T-SQL​

  • Improves T-SQL code parsing.

June 26, 2025​

Updated language and framework support​

.NET​

  • Enhanced flaw detection for CWE-201 to reduce false positives.

C/C++​

  • Improved error handling during code parsing.

COBOL​

  • Improved flaw analysis for CWE-489 to reduce false positives.

iOS​

  • Improved flaw detection for CWE-201 to reduce false positives.

Java​

  • Identifies use of FileUtils.File from Apache Commons IO as a potential security risk (CWE-73).
  • Improved flaw detection for CWE-80 to reduce false positives.
  • Improved cleanser detection for CWE-113.

Kotlin​

  • Added support for the Ktor framework.

T-SQL​

  • Improved flaw detection for CWE-89.

Other languages​

  • Enhanced flaw detection for CWE-259 and CWE-798 to reduce false positives across supported languages.

June 19, 2025​

Added Java risky functions for CWE-918 detection​

Risky Java functions associated with CWE-918: Server-Side Request Forgery (SSRF) are now flagged. The following functions are now included:

  • URL.openConnection()
  • URL.openConnection(Proxy)
  • URL.openStream()
  • URL.getContent()

These changes might increase CWE-918 findings in your applications and affect other taint-based categories, such as CWE-80, CWE-201, and CWE-209.

May 22, 2025​

Updated language and framework support​

.NET​

  • Enhanced support for .NET 9

Android​

  • Enhanced support for Android 15

Apex​

  • Improved CWE-943 flaw detection for static final fields to reduce false positives

C/C++​

  • Improved parsing of C/C++ code
  • Added support for the GCC 14.2.0 compiler
  • Improved preprocessor line directive mapping to customer source files
  • Enhanced detection of third-party code

COBOL​

  • Added support for HP TNS Timed Input and Output constructs
  • Added support for HP TNS EXTENDED-STORAGE sections

Java​

  • Improved detection of third-party code
  • Improved parsing of Java code

JavaScript​

  • Improved Cross-Site Scripting (XSS) flaw detection

Kotlin​

  • Added support for Kotlin 2.1

PHP​

  • Improved file path identification to support case-sensitive file systems. This change triggers a one-time update to flaw matching and assigns new flaw IDs to PHP files with uppercase letters in their filenames.

Python​

  • Improved detection of CWE-259 flaws

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives

April 24, 2025​

Updated language and framework support​

.NET​

  • Improved CWE-117 flaw detection to reduce false positives
  • Enhanced detection of SQL injection vulnerabilities

Android​

  • Improved detection of third-party libraries

Apex​

  • Improved scan performance

Go​

  • Enhanced analysis of slices and maps packages

iOS​

  • Improved CWE-201 flaw detection to reduce false positives

Java​

  • Added support for JDK 24
  • Improved cleanser detection for CWE-117

JavaScript and TypeScript​

  • Added support for Angular 19

  • Enhanced support for Angular 18

  • Added support for Azure Functions v4

  • Improved CWE-918 flaw detection

Kotlin​

  • Enhanced support for Kotlin 2.0

PL/SQL​

  • Improved scan performance

T-SQL​

  • Improved parsing of T-SQL code

VB6​

  • Improved scan performance

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives

March 27, 2025​

Updated language and framework support​

.NET​

  • Enhanced support for .NET 9
  • Improved detection of CWE-89 flaws

Apex​

  • Added support for Apex 61 and 62

COBOL​

  • Improved parsing of COBOL code

Dart and Flutter​

  • Added support for Dart 3.7 and Flutter 3.29

Go​

  • Added support for Go 1.24

Java​

  • Improved detection of CWE-942 flaws
  • Enhanced detection of third-party code

JavaScript and TypeScript​

  • Enhanced detection of third-party code

Python​

  • Improved detection of hardcoded passwords and credentials (CWE-259 and CWE-798)

PL/SQL​

  • Improved parsing of PL/SQL code

T-SQL​

  • Improved parsing of T-SQL code

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages, reducing false positives

February 27, 2025​

Updated language and framework support​

C/C++​

  • Improved flaw detection for exported functions.

iOS​

  • Improved detection accuracy for taint-based flaws.

JavaScript​

  • Enhanced support for Angular 18.

PL/SQL​

  • Enhanced flaw detection for out-of-scope code, reducing false positives.
  • Improved detection of flaws in variables initialized with a taint source, which might increase the number of reported flaws.
  • Enhanced SQL injection detection.

Ruby on Rails​

  • Added support for Rails 3.4 and Rails 8.

Other languages​

  • Improved detection for CWE-259 and CWE-798 flaws, reducing false positives across all languages.
  • Enhanced flaw descriptions and remediation details for CWE-284 and CWE-115.
  • Updated CWE Top 25 to the 2024 version, impacting all policies with Auto-Update CWE Top 25 as a requirement.

January 27, 2025​

Updated language and framework support​

.NET​

  • Improved CWE-1174 flaw detection resulting in a reduction in false positives

Dart and Flutter​

  • Dart 3.6 and Flutter 3.27 support

Java​

  • Improved third-party code detection
  • Improved cleanser detection for CWE-117

JavaScript and TypeScript​

  • Improved CWE-80 flaw detection
  • Improved third-party code detection

PHP​

  • Enhanced overall flaw detection for PHP, which may lead to an increase in the number of reported flaws

PL/SQL​

  • Improved parsing for PL/SQL

T-SQL​

  • Improved SQL injection detection
  • Improved parsing for T-SQL

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

December 17, 2024​

Updated language and framework support​

.NET​

  • .NET 8 MAUI support

Go​

  • Cobra support

iOS​

  • Enhanced support for iOS 18
  • Improved mobile behavioral detection for iOS 18
  • Improved Foundation framework support for iOS 18
  • Improved HealthKit framework support for iOS 18
  • Improved Swift Memory Management support for iOS 18

Java​

  • Improved third-party code detection

JavaScript​

  • Added NestJS 10.3.x support

November 21, 2024​

Updated language and framework support​

.NET​

  • Initial support for .NET 9

Go​

  • Go 1.23 support

iOS​

  • Improved Contacts framework support

T-SQL​

  • Improved scan performance

October 31, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection

Java​

  • Added JDK 23 support
  • Improved Spring Security 5 and 6 support
  • Improved CWE-352 flaw detection
  • Improved CWE-80 flaw detection resulting in a reduction in false positives
  • Improved third-party detection

JavaScript​

  • Improved CWE-80 and CWE-601 flaw detection resulting in a reduction in false positives
  • Improved third-party detection

September 26, 2024​

Updated language and framework support​

.NET​

  • Improved cleanser detection for CWE-113

Android​

  • Initial support for Android 15

Go​

  • Enhanced Go AWS Lambda package support

iOS​

  • Enhanced support for iOS 17
  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives

Java​

  • Improved handling of detected third-party class files in Uber JAR applications and third-party JAR files in WAR, EAR, and Spring Boot applications. As a result, analysis is more concise and accurate, resulting in both improved scan performance and more accurate findings
  • Improved CWE-73 and 327 flaw detection
  • Improved third-party detection

PHP​

  • Added Laravel Blade and Views support

PL/SQL​

  • Improved SQL parsing support

Ruby on Rails​

  • Rails 7.2 support

T-SQL​

  • Improved SQL parsing support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

September 16, 2024​

Updated language and framework support​

iOS​

  • Initial support for iOS 18

Scan results for any iOS applications built with Xcode versions older than Xcode 15.3 may be degraded. Veracode recommends that iOS applications be built with Xcode 15.3 or later for best results

September 13, 2024​

Updated language and framework support​

iOS​

Veracode has released version 0.5.0 of Gen IR, the iOS packaging tool, to GitHub and Homebrew. It includes the following new features and improvements:

  • Added PIFSupport library that integrates the Project Interchange Format (PIF) into Gen IR. This new library allows Veracode to better interact with project models from Xcode and SPM, offering a more structured and publicly documented alternative to PBXProject. With this change, Veracode can now discover and decode the PIF cache, which allows Gen IR to better parse and reason about complex project structures and dependencies between targets in a project. Benefits of this change include:

    • Simplified project parsing: PIF’s structure is easier to consume and more robust.
    • Enhanced compatibility: improved handling of dependencies and other existing issues.
    • Future-proofing: aligns with modern development tools and workflows in Xcode and SwiftPM.

  • Support for projects built or generated with Xcode 16.

If you need to downgrade to the previous version, use a new Homebrew formula:

To upgrade your installed Gen IR to the new version, run brew update && brew upgrade

August 26, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-316 flaw detection, resulting in a reduction in false positives

Apex​

  • Enhanced Apex 60 support
  • Improved CWE-274 detection

Dart and Flutter​

  • Dart 3.5 and Flutter 3.24 support

Go​

  • Go AWS Lambda package support

iOS​

  • Improved CWE-297 detection in Swift applications
  • Improved CWE-323 support for iOS 17 APIs
  • Improved third-party detection for NuGet repositories

Java​

  • Improved third-party detection for Maven repositories
  • Improved CWE-259 and 798 flaw detection for Spring Boot applications, resulting in a reduction in false positives
  • Improved SQL injection detection

JavaScript​

  • Angular 17 support

Kotlin​

  • Kotlin 2.0 support

Scala​

  • Enhanced Scala 3.4 support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

Sept. 20, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports Apex.

Aug. 8, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports COBOL.

July 31, 2024​

Improved prescan performance​

The Static Analysis prescan processor is updated to improve performance. This update has no impact on your scan results and requires no user action.

July 25, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-327 flaw detection

APEX​

  • Added CWE-274 support for Apex

C/C++​

  • Improved third-party detection for C/C++

iOS​

  • Improved CWE-252 and 321 support for iOS 17 APIs

Java​

  • Skip annotation if every data path has a corresponding cleanser

Python​

  • Improved flaw detection for Python Lambda

T-SQL​

  • Improved parsing for T-SQL

July 2, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports iOS.

June 27, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-117 and 1174 flaw detection for .NET resulting in a reduction in false positives

Apex​

  • Improved parsing for Apex

C/C++​

  • Added Visual Studio 2022 MSVC 14.4x compiler support
  • Improved scan performance for C/C++ Linux

COBOL​

  • Improved parsing for COBOL
  • Improved CWE-248 flaw detection for COBOL resulting in a reduction in false positives

Dart and Flutter​

  • Dart 3.4 and Flutter 3.22 support

iOS​

  • Improved CWE-201 support for iOS 17 APIs
  • Improved third-party detection for iOS resulting in a reduction in false positives

Java​

  • Improved line number detection for flaws

JavaScript​

  • Added Next.js 14.x support
  • Improved parsing for TypeScript

Ruby on Rails​

  • Ruby 3.3 and Rails 7.1 support

Other languages​

  • Improved CWE-201 support for iOS 17 APIs
  • Improved CWE-331 support for Android
  • Improved CWE-259 and 798 flaw detection for all languages resulting in a reduction in false positives
  • Removed CGI-only restriction for Perl
  • Improved CWE-80 flaw detection for PHP
  • Improved parsing for T-SQL
  • Improved CWE-259 flaw detection for Python resulting in a reduction in false positives

May 23, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-73, 259, and 798 detection
  • Improved third-party detection
  • Improved SQL injection detection

APEX​

  • Apex 57, 58, 59, and 60 support

COBOL​

  • Stratus VOS COBOL support

Java​

  • Enhanced JDK 21 and 22 support
  • Improved cleanser detection for CWE-78
  • Improved CWE-259, 798, and 916 flaw detection resulting in a reduction in false positives
  • Improved third-party detection for Maven repositories

Scala​

  • Scala 3.4 support

Other languages​

  • Improved CWE-259 and 798 detection for all languages
  • Improved CWE-89 detection for T-SQL
  • Improved CWE-259, 319, and mobile behavioral scan support for iOS 17 APIs
  • Improved parsing for T-SQL
  • Improved CWE-80 flaw detection for TypeScript resulting in a reduction in false positives
  • Improved SQL injection detection for Python

April 25, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection

COBOL​

  • You must now submit all COBOL files as separate files in a single archive. Veracode no longer supports uploading individual COBOL files outside of an archive.

C/C++​

  • GCC 12 and 13 (RHEL 9) support
  • openSUSE Leap version 15 support
  • Improved CWE-121 and 454 detection

Dart and Flutter​

  • Dart 3.3 and Flutter 3.19 support

Java​

  • JDK 22 support
  • Improved CWE-259 and 798 flaw detection for Spring Boot applications, resulting in a reduction in false positives
  • Improved Generic modeling, which impacts all CWEs

JavaScript​

  • JavaScript cleansers for CWE-80, 93, 113, and 117
  • Improved CWE-73 detection, resulting in a reduction in false positives

PHP​

  • PHP 8.2 and 8.3 support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages
  • Improved CWE-416 detection in iOS
  • Improved third-party detection in Android

March 28, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-1174 flaw detection resulting in a reduction in false positives

Android​

  • Enhanced Android 14 support

Apex​

  • Improved CWE-80 flaw detection resulting in a reduction in false positives

C/C++​

  • Improved CWE-190 flaw detection resulting in a reduction in false positives
  • CentOS/RHEL 9 (x64) support

COBOL​

  • Improved parsing for COBOL

Go​

  • Go 1.22 support

Java​

  • Improved CWE-259 flaw detection for Java
  • Improved processing of shaded JAR files

JavaScript​

  • Improved processing of large JS files

Kotlin​

  • Improved source file name parsing for Kotlin results

PL/SQL​

  • Improved scan times for PL/SQL

Python​

  • Improved CWE-80 handling for Python resulting in a reduction in false positives

React Native​

  • Improved React Native handling of IPA files

T-SQL​

  • Improved CWE-89 detection for T-SQL resulting in a reduction in false positives

March 12, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports Ruby on Rails.

February 22, 2024​

Updated language and framework support​

.NET​

  • Enhanced .NET 8 support
  • Improved support for CultureInfo.InvariantCulture
  • Improved CWE-78 flaw detection
  • Improved CWE-117 flaw detection resulting in a reduction in false positives

C/C++​

  • Improved CWE-121 flaw detection resulting in a reduction in false positives
  • Improved CWE-125, 129, 134, 170, 190, 191, 195, and 196 flaw detection
  • Improved CWE-477 flaw detection

COBOL​

  • Improved flaw analysis for CWE-78, 89, 114, 201, 209, 242, 248, 252, 489, and 798
  • Improved parsing for COBOL
  • Improved scan performance for COBOL
  • Improved scan size calculations

Java​

  • Improved CWE-80 fix detection with modern Spring Framework versions
  • Improved generic modeling and modeling of Spring Framework applications, which impacts all CWEs
  • Improved CWE-916 detection
  • Improved Java third-party detection

JavaScript and TypeScript​

  • Improved analysis for numeric and boolean datatypes, which impacts all CWEs
  • Improved type detection to prevent false positives for CWE-601 and all other CWEs
  • Detect and ignore webpack-generated files that are concatenated or minified
  • Improved support for fs/promises, which impacts all CWEs

Other languages​

  • Improved CWE-259 and 798 flaw detection resulting in a reduction in false positives for all languages
  • Improved analysis of conditionals for all languages
  • Improved CWE-89 flaw detection for Classic ASP
  • Improve support for error_log, which impacts CWE-73, 88, 93 and 117 for PHP

January 25, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection
  • Enhanced .NET 8 support
  • Improved CWE-80, 89, 404, 501, and 1174 detection

Java​

  • Improved flaw detection
  • Improved third-party detection
  • Improved CWE-117, 327, and 749 detection
  • Added ‘jsi’ filetype support

C/C++​

  • Improved flaw detection
  • Added openSUSE (x86) version 12 support
  • Improved CWE-121 and 190 detection

Dart​

  • Improved flaw detection
  • Improved third-party detection
  • Improved CWE-331 detection

Other languages​

  • Improved Android third-party detection
  • Improved JavaScript flaw detection
  • Updated JavaScript third-party detection
  • Improved CWE-99 and 918 detection for Python
  • Improved CWE-259, 798 detection for PHP
  • Improved CWE-252, 259, 311, 522, 614, and 798 detection in iOS
  • Improved CWE-321 detection for all languages
  • Added CWE-639 support for COBOL

January 18, 2024​

The Veracode CLI now supports autopackaging for Veracode Static Analysis​

The Veracode CLI now supports Static Analysis autopackaging for Java, JavaScript, and Python. The package command removes manual packaging steps to streamline your application security tests.

Previous updates​

For updates from 2020 through 2023, see the updates archive.