CLI updates RSS feed

Updates that apply to specific Veracode regions show a region icon.

For updates specific to Veracode Fix, such as language and CWE support, see Fix updates.

September 23, 2026​

Veracode CLI v2.52.1​

The veracode fix sca command has performance improvements for JavaScript projects.

August 31, 2026​

Veracode CLI v2.52.0​

This update includes the following improvements:

• The veracode scan command improves container image scanning by resolving a deadlock that caused scans to fail or become unresponsive.
• The veracode package command excludes artifacts from Gradle dependency folders.
• The veracode package discover command detects toolchains for JavaScript projects that use npm or Yarn.
• The veracode fix sca command generates fixes for vulnerable dependencies identified in Software Composition Analysis (SCA) scans. This is a Limited Availability (LA) feature available only to specific Veracode customers. For more information, see veracode fix sca.

July 31, 2026​

Veracode CLI v2.51.2​

This update includes the following improvements:

• The veracode scan command has improved policy enforcement to ensure vulnerability severity thresholds are consistently applied.
• The veracode fix command includes enhanced batch fix processing and fix application capabilities, enabling the remediation of a large number of vulnerabilities in a single batch operation.

July 17, 2026​

Veracode CLI v2.51.1​

This update includes the following improvements to the veracode package command:

• Improved packaging support for JavaScript, .NET, and Java (Gradle)
• Removed unnecessary warnings in Go packaging

July 3, 2026​

Veracode CLI v2.51.0​

This update includes the following improvements:

• The veracode scan command:
  • Introduces schema enhancements for container and IaC scan results.
  • Deletes all temporary files after container scans complete to reduce disk usage.
• The veracode dynamic scan command now supports target UUIDs for triggering scans. You can continue to use webhook UUIDs.
• Veracode collects anonymized, aggregated usage data to improve product quality.
• The veracode package command:
  • Enhances SQL dialect packaging.
  • Improves .NET packaging to increase scan coverage.
  • Adds the --exclude flag, which prevents specified Java packages or JAR files from being scanned.
  • Enhances packaging support for veracode.json.

June 2, 2026​

Veracode CLI v2.50.0​

This update includes the following improvements:

• The veracode policy command now automatically determines and generates appropriate output artifacts based on the policy created. No changes are required to existing workflows.

• The veracode package command includes the following improvements:

  • For .Net, the command's output logs refers to user’s original projects rather than temporary build directories, making failures and warnings easier to understand.
  • The command has OpenWrt improvements and fixes.

April 21, 2026​

Veracode CLI v2.49.0​

This update includes the following improvements to the veracode package command:

• Introduces exit codes 5, 6, and 7 to better automate CI/CD pipelines, improve error handling, and quickly identify packaging or build issues. For details, see CLI exit codes.
• Provides enhanced SQL packaging detection in the Static Packager to better identify supported and unsupported SQL dialects during packaging.

April 13, 2026​

Veracode CLI v2.48.0​

This update includes the following improvements:

• The veracode scan command delivers enhanced user experience in the Veracode Platform.
  Important

  If you use the old CLI versions, you will see incomplete data in the Veracode Platform.

• The veracode package command:
  • Introduces the --skip-packagers flag to exclude specific artifacts, such as unsupported SQL, from packaging results without affecting artifacts in other languages.
  • Adds support for requirements-dev.txt in Python packaging workflows to enable the inclusion of development dependencies in the packaging process.
  • Resolves build failures in .NET projects where submodules contain Node.js artifacts.
  • Improves control over the scan by ensuring skip-packager settings work as expected to package only the relevant components.
• The veracode repository add command improves the accuracy and performance of the repository add command on GitLab by running faster, preventing timeouts or hangs, and ensuring consistent results for large repositories.
• The veracode package discover command introduces exit codes.

March 13, 2026​

Veracode CLI v2.47.0​

This update includes the following improvements:

• The veracode scan returns more precise findings by reducing false positives.
• The veracode package command:
  • Supports the Poetry package management tool in Python for autopackaging.
  • Improves the handling of permission-restricted directories by logging user-friendly warnings.
  • Resolves issues when packaging preprocessed C/C++ using Make in OpenWrt.

February 18, 2026​

Veracode CLI v2.46.0​

This update includes the following improvements:

• The veracode package command supports Java source code packaging using the --java-source flag and the VERACODE_PACKAGE_JAVA_SOURCE=true environment variable.
• The veracode package discover command provides toolchain detection for Java projects that use the Gradle package manager.

February 2, 2026​

Veracode CLI v2.45.0​

This update includes the following improvements:

• All Veracode CLI commands can consistently read access tokens from the disk.
• The veracode scan command:
  • Categorizes secret-type findings as Critical in the scan results.
  • Prioritizes vulnerability results from the NVD database, if available.

December 24, 2025​

Veracode CLI v2.44.0​

Note
Recently, Veracode container scans began failing due to a breaking change from one of our upstream data suppliers. This breaking change affected all versions of the Veracode CLI, including 2.43.0 and earlier.

Veracode has expedited a new Container & IaC release to address the issue and recommends all customers upgrade to the latest release immediately.

This breaking change only affected Container & IaC scanning. Other functions of the Veracode CLI, including Static scanning and Veracode Fix, were not affected.

This update includes the following improvements:

• The veracode scan command:
  • Allows you to apply a custom policy defined in the Veracode Platform.
  • Enables you to view policy evaluation for individual findings along with the overall policy result.
  • Introduces changes to the scan results schema.
  • Increases vulnerability coverage to improve scan performance.
  • Creates a separate asset for each repository in the ADO workflow, making it easier to track and view individual scan results.
• Introduces the veracode package discover command to detect the toolchains required to successfully create scannable artifacts.
• The veracode package command:
  • Produces no artifacts if the Python virtual environment is at the repository root. If it’s in a subdirectory or is a conda-meta environment, that directory is excluded from packaging.
  • Expects the python-no-pm artifact to be created from the root of the repository.
  • For .NET, passes TargetFrameworkVersion to the msbuild publish command only when multiple target framework versions are specified.
  • Preserves the source file name extension of preprocessed output files.
  • Improves logging of solution configuration and platform selection.
  • Eliminates an issue detecting the version of CL.exe from a legacy toolset when using a newer build environment.
  • Corrects an issue building projects with names containing ( or ) characters.
  • Prevents packaging failures when the input directory contains both supported and unsupported solutions.
  • Adds support for preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler, via the SRCLR_MAKE_WINDOWS environment variable.

October 30, 2025​

Veracode CLI v2.43.0​

This update includes the following improvements:

• The veracode scan command has security related updates.
• The veracode package command:
  • Supports generic packager for Apex.
  • Includes fixes to stop the creation of a Golang zip artifact when only the go.mod file is present.
  • Adds the new VERACODE_PACKAGE_GOLANG_GENERATE environment variable, which enables client-side CGO code generation when packaging Go applications.
• The veracode static command includes fixes for the usability of --filtered-json-output-file to work like --results-file.
• The veracode fix CLI includes minor updates.

Aug 1, 2025​

Veracode CLI v2.42.0​

This update includes the following improvements:

• Improves error messaging when a user cannot be authenticated.
• The veracode static scan command:
  • Displays the Static Engine version in the scan summary.
  • Provides enhanced logging.
• The veracode package command:
  • Resolves packaging errors for C++/CLI and C++/CX projects that produce static libraries.
  • Resolves MSBuild errors for C/C++ projects that contain a . in the name.
  • Improves detection of Makefiles generated by Autoconf to reduce autopackaging errors.
  • Provides packaging support for the MSBuild .NET framework.
• The veracode scan command:
  • Adds platform integration support for scenarios where the scan path is specified as relative. For example, ./.

July 1, 2025​

Veracode CLI v2.41.0​

This update includes the following improvements:

• The veracode package command has the following updates and improved capabilities:

  • Adds the ability to include the directory path in the artifact name to make flaws easier to locate.
  • Skips creating a JS artifact if the artifact contains only these extensions: json, map, yaml, yml, lock, css.
  • Fixes Maven build failure caused by the directory tag in pom.xml. Scannable artifacts are now created only in the target directory.
  • Adds support for preprocessor header files used to build PCH.
  • Packages C++/CLI and C++/CX projects as binaries when packaging preprocessed source.
  • Adds the option to process all Makefiles in a directory tree.

• The veracode scan command includes the following improvements:

  • Enables customers to specify a custom location from which vulnerability databases can be downloaded.
  • Provides supports for parsing Dockerfile heredoc syntaxes.

• The veracode repository report command fixes the issue of duplicate email address being counted twice.

• The veracode sca command that includes SBOM generation is now supported via SCA agent-based scans. Results can be published in CycloneDX 1.6 and SPDX 2.3 formats.

• Introduces auth login command to seamlessly onboard new users via oAuth2.

May 16, 2025​

Veracode CLI v2.40.0​

This update includes the following improvements:

• The veracode package command includes:

  • Improved messaging for build issues during packaging.
  • Support for Go v1.24.

• The veracode scan command includes updated dependencies for improved security.

April 14, 2025​

Veracode CLI v2.39.0​

This update includes the following improvements:

• The veracode package command includes:

  • New configuration options for specifying platform and build configuration for C/C++ on Linux and Windows.
  • Improved packaging support for Golang and Ruby projects.
  • The SRCCLR_DOWNLOAD_URL environment variable now defaults to https://sca-downloads.veracode.com. The previous URL, https://download.sourceclear.com, is now deprecated. We recommend updating all instances in your environment.
  • Autopackager debug logs now include Maven project exit codes.
  • A new, optional --strict flag: when enabled, the CLI returns exit code 4 for any build failures during packaging.
  • Preprocessed source code scanning is now the default method for C/C++ projects on Windows. This change offers broader support and faster scan times.
  • Support for scanning preprocessed C/C++ source code is now available on Linux, replacing the existing Linux autopackaging solution.

• The veracode scan command includes:

  • Improved detection of misconfigured environments
  • A new schema that improves the organization and presentation of scan results

March 13, 2025​

Veracode CLI v2.38.2​

This update includes the following improvements:

• The veracode static scan command no longer includes the --verbose flag, by default.

• The veracode package command includes:

  • Improved logging and warning messages.
  • Support for identifying the Go version specified in the go.mod file.
  • Support for .NET 9.
  • Improved support for atypical .NET projects, such as mixed SDK-style.
  • Builds that use Microsoft C++ (MSVC) compilers now succeed, even if there are warning messages.

• The veracode repository add command now supports larger data types (Int64).

February 21, 2025​

Veracode CLI v2.38.0​

This update includes the following improvements:

• Added the --verbose flag to the veracode package command. The --debug flag is now deprecated, but still available for compatibility. Use --verbose instead.
• The veracode static scan command now retries failed scans up to five times when server errors or too many requests occur.

January 13, 2025​

Veracode CLI v2.37.0​

This update includes the following improvements:

• You can now install the CLI on Windows using a signed Microsoft Standard Installer (MSI) file.

• The CLI now prompts you when a new version of the CLI is available.

• The CLI now displays a progress indicator when commands are running.

• The veracode package command includes:

  • Autopackaging for .NET MAUI framework, .NET Blazor WebAssembly, Azure functions in .NET projects, and .publishproj file types in .NET frameworks.
  • Improved logging.

• The veracode scan command no longer generates extraneous files in the working directory.

November 20, 2024​

Veracode CLI v2.36.0​

This update includes the following improvements:

• The veracode package command includes:

  • Improved logging.
  • The autopackager attempts to generate artifacts for .NET projects even if it encounters warnings.
  • The autopackager now ignores gems when packaging Ruby projects.

• The veracode scan command now takes less time to generate output.

October 24, 2024​

Veracode CLI v2.35.0​

This update includes the following improvements to the veracode package command:

• If your Python, JavaScript, or PHP projects do not use a package manager, this command now generates artifacts that include all code files that might be omitted by a package manager. The artifact filename contains no-pm.
• Minor performance improvements.

October 15, 2024​

Veracode CLI v2.34.0​

This update includes the following improvements:

• New veracode cache command clears the cache for all commands.

• The veracode scan command includes:

  • To improve secrets detection, adds support for custom keywords and regex patterns, based on the policy for your organization.
  • If policy passed is false, the CLI now exits with code 3.
  • Support for defining a temp directory.

September 25, 2024​

Veracode CLI v2.33.0​

This update includes support for installing previous versions of the CLI using Homebrew.

September 16, 2024​

Veracode CLI v2.32.0​

This update includes the following improvements:

• The veracode package command includes:

  • Support for PL/SQL and T-SQL.
  • Improved packaging for Python and PHP.
  • Improved error handling.
  • Improved packaging for iOS to support the latest release of gen-ir.
  • Improved packaging for .NET to include EXE files.
  • Improved JavaScript packaging on Windows.

• The veracode scan command adds a --verbose flag to show debug logs.

September 09, 2024​

Veracode CLI v2.31.0​

This update includes the following improvements:

• The veracode package command has improved packaging for JavaScript.
• The veracode package command now excludes nested Go modules when packaging Go projects.
• The veracode scan command has improved logging for .NET projects.
• The veracode scan command can now scan SBOMs from an SCA agent-based scan or upload scan.
• Added the proxyUrl parameter to a CLI installation script for PowerShell. You can use the parameter to configure proxy servers during the installation.

August 28, 2024​

Veracode CLI v2.30.1​

You can now install and access the CLI using Homebrew.

August 27, 2024​

Veracode CLI v2.30.0​

This update includes the following improvements to the veracode package, veracode sbom and veracode scan commands:

• Improved language support for Java Maven workflow.
• Improved error handling to show fatal errors in all modes. For debug mode, added guidance to contact Veracode Technical Support.

August 1, 2024​

Veracode CLI v2.29.0​

This update includes the following improvements to the veracode package, veracode sbom and veracode scan commands:

• Streamlined the log output by removing overly detailed logs that were cluttering the console. This change improves readability and helps users focus on the most relevant information during the execution of commands. Detailed logs are still available using the --debug flag.
• Windows C/C++ packaging improvements, including parallel project builds, skipping non-C/C++ projects, and enhanced logging for failed builds.
• Improved error messaging.
• Updated the Syft JSON schema from version 13.0.0 to 16.0.4.
• Updated the CycloneDX XML schema from version 1.5 to 1.6.
• URL encoder is applied.

July 25, 2024​

Veracode CLI v2.28.0​

This update includes the following improvements:

• The veracode static scan command has improved error messages that indicate whether API credentials are missing or invalid.
• The veracode configure command now correctly uses directory paths that contain environment variables.
• General performance improvements.

July 2, 2024​

Veracode CLI v2.27.1​

This update includes the following improvements to the veracode package command:

• Support for C/C++ Windows, C/C++ Linux, COBOL, and Perl.
• Support for multiple target frameworks defined in the *.csproj, Directory.Packages.props, and Directory.Build.props files in .NET projects.
• Improved language support for .NET.

June 28, 2024​

Veracode CLI v2.26.0​

This update includes the following improvements to the veracode package command:

• Support for .NET Framework 4.6-4.8.
• Support for restoring .NET projects with <TargetFramework>.
• Improved language support for Flutter, Android, PHP, and .NET.
• More meaningful --debug messages if the command is not able to locate required build or packaging tools.

June 18, 2024​

Veracode CLI v2.25.0​

This update includes the following improvements

• The veracode package and veracode scan commands are now supported on alpine-based environments.
• Improved Java, Javascript, and Python language support for the veracode package command.

June 12, 2024​

Veracode CLI v2.24.0​

The veracode static command now provides improved command output.

June 6, 2024​

Veracode CLI v2.23.0​

The veracode static command output now only displays scannable modules once.

June 5, 2024​

Veracode CLI v2.22.0​

This update adds the veracode dynamic command. You use this command to run a DAST Essentials dynamic analysis, check the status of the analysis, and output the results.

May 28, 2024​

Veracode CLI v2.21.0​

The veracode package command now supports Android, React Native, Dart, and Flutter.

May 6, 2024​

Veracode CLI v2.18.0​

This update includes the following improvements to the veracode package command:

• Support for streaming log messages.
• Improved language support for .NET and Python.

April 15, 2024​

Veracode CLI v2.16.0​

This update includes the following improvements:

• The veracode package command now supports iOS, in addition to existing support for Java, JavaScript, .NET, Python, PHP, Scala, Kotlin, Go, and Ruby on Rails. You use this command to autopackage your applications for Static Analysis and Software Composition Analysis (SCA) upload scans.
• The packaged artifacts use a Veracode approved filename format.
• Improved error messaging.
• The veracode package command output now displays the installed CLI version.

March 29, 2024​

Fix flaws in multiple files in a directory​

The veracode fix command now provides suggested fixes for a directory of source files, in addition to a single source file. You can fix flaws in multiple files as a batch, without having to rescan your code each time you apply a fix.

March 27, 2024​

Veracode CLI v2.14.0​

The veracode package command now supports application packaging for the following languages:

• .NET
• Go
• Kotlin
• PHP
• Ruby on Rails
• Scala

February 5, 2024​

New commands for reporting on repository contributors​

The Veracode CLI now includes the following commands:

• veracode repository add: create an Excel file that lists all accessible repositories from which to import contributing developers.
• veracode repository report: create a report that lists all contributing developers for each repository.

January 18, 2024​

The Veracode CLI now supports autopackaging for Veracode Static Analysis​

The Veracode CLI now supports Static Analysis autopackaging for Java, JavaScript, and Python. The package command removes manual packaging steps to streamline your application security tests.

January 9, 2024​

Install the CLI on Windows with a PowerShell script​

You can now install the Veracode CLI on Windows with a PowerShell script.

Previous updates​

2023 updates​

2022 updates​