SCA updates RSS feed

Updates that apply to specific Veracode regions include a region icon.

August 20, 2026​

SCA agent release v3.8.120​

This update resolves minor issues that affected vulnerable method scans for JavaScript-based applications.

August 17, 2026​

SCA agent release v3.8.119​

This update improves the SCA agent's support for autopackaging .NET projects. Installing this update will not affect existing SCA agent-based scans.

July 24, 2026​

SCA agent release v3.8.118​

This update improves scan compatibility and reliability for Maven projects on Windows.

This update also improves error handling for Python-based scans when generating JSON reports. The SCA agent now handles errors more effectively, allowing reports to be generated successfully.

June 11, 2026​

SCA agent release v3.8.116​

We have enhanced support for .NET packaging workflows to improve scan compatibility and reliability. This update ensures consistent processing of .NET applications across supported packaging scenarios.

We have also updated dependency processing for NPM projects to reduce timeout conditions that can cause incomplete scan results. This update improves scan reliability for projects with large or complex dependency graphs.

April 23, 2026​

SCA agent release v3.8.115​

This update adds enhancements to the agent to support autopackaging, along with fixes and improvements for OpenWrt packaging. Installing this update will not affect existing SCA agent-based scans.

April 8, 2026​

SCA agent release v3.8.114​

This update adds support for autopackaging. Installing this update will not affect existing SCA agent-based scans.

March 31, 2026​

New SCA agent scan option to link results to an application profile ​

SCA agent release v3.8.113 adds the --appname flag to the SCA agent scan command for Commercial region users. The --appname flag links scan results to an application profile for improved visibility and management. It requires authentication with Veracode using OAuth or HMAC. For more information, see SCA agent commands.

Improved SCA agent scan output​

This update adds the --show-cli flag to the SCA agent scan command. Used with the --json flag, this option saves JSON output to a file and displays a human-readable CLI summary in the console. This option captures structured scan data for automation and maintains visibility of scan results in your terminal. The --show-cli flag requires the --json flag and returns an error if used without it. For more information, see SCA agent commands.

March 23, 2026​

Assign policies to SCA Agent-based Scan workspaces ​

Use the Unified Policy feature to assign policies to SCA workspaces in the US Federal region for SCA agent-based scans. Similar to existing workspace rules, you use policies to create issues and break builds based on defined criteria. For more information, learn about policy rules, assigning policies to SCA workspaces, and setting a default policy for SCA workspaces.

March 4, 2026​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements do not impact SCA agent-based scanning.

December 12, 2025​

Improved open source vulnerability data synchronization​

Veracode has enhanced the synchronization of open source vulnerability intelligence to ensure security scans reflect the most current risk information available. As part of this improvement, you may notice newly reported CVEs appearing in scan results even when there have been no changes to your application or dependencies. This outcome reflects up-to-date vulnerability data, and not any change in scan behaviour.

December 3, 2025​

SCA agent update​

Veracode has released minor updates to the SCA agent to improve support for autopackaging C/C++ projects, Node-based projects, and Make-based packaging workflows. These updates do not impact SCA agent-based scanning.

November 13, 2025​

Option to break builds only when a fix is available in SCA agent-based scans ​

Commercial region users can now configure the Vulnerability Severity rule in their policy to control when issues are created or when builds are broken based on the availability of an upgrade path to fix a vulnerable open-source component. For more information, see Security Policy Restraints.

SCA agent release v3.8.109​

Veracode SCA agent v3.8.109 resolves minor issues that affect SCA-agent SBOM scan capabilities.

July 30, 2025​

SCA agent update​

Veracode releases minor updates to the SCA agent to improve support for autopackaging C++/CX projects. These updates do not impact SCA agent-based scanning. Veracode also addresses the following issues:

• Resolves packaging issues for C++/CLI and C++/CX projects.
• Resolves several MSBuild errors that occur in C/C++ projects.

July 22, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements do not impact SCA agent-based scanning.

July 14, 2025​

Added support for Python 3.12 in SCA agent-based scans​

Veracode updated SCA agent-based scans to support Python 3.12 environments.

Assign policies to SCA agent-based scan workspaces ​

Use the Unified Policy feature to assign policies to workspaces in the European region for SCA agent-based scans. Similar to existing agent rules, policies help you create issues and break builds based on defined criteria. For more information, see applying rules to a policy, assigning policies to agent-based workspaces, and setting default policies.

June 30, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

June 3, 2025​

Generate SBOMs with SCA agent​

Veracode enhanced the SCA agent to support generating SBOM files during SCA agent-based scans.

May 28, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

May 22, 2025​

Fixed SCA agent CLI summary​

Veracode has fixed an issue that caused license vulnerabilities and associated library counts to display inaccurately in the SCA agent CLI summary.

May 19, 2025​

Fixed SCA agent CLI summary​

Veracode has fixed an issue related to the license counts shown in the summary section of the SCA agent’s command line interface.

May 14, 2025​

Fix for SCA Upload scans of Poetry projects​

Veracode has fixed an issue in SCA Upload scans related to parsing pyproject.toml files with dotted keys.

May 12, 2025​

Fix for SCA agent-based scans of Poetry projects​

Veracode has fixed an issue in SCA agent-based scans related to parsing pyproject.toml files with dotted keys.

May 6, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

April 25, 2025​

SCA Upload support for Python's Poetry package manager​

Veracode SCA Upload scans can now support Python projects that use the Poetry package manager. For pre-requisites, see SCA upload and scan language support matrix.

April 21, 2025​

SCA agent-based scans support for Python's Poetry package manager​

Veracode SCA agent-based scans can now support Python projects that use the Poetry package manager. For pre-requisites, see Python SCA agent-based scanning.

April 18, 2025​

Malicious package detection​

Veracode SCA upload and agent-based scans can now detect and report malicious packages in your libraries. You do not need to take any additional steps to enable this feature or download a new version of the SCA agent.

February 28, 2025​

SCA agent enhancement​

Veracode updated the digital certificate for the SCA agent to enhance its security and trustworthiness. This update introduces an additional layer of protection, enabling customers to verify the source and integrity of the agent file before execution. These changes do not affect agent-based scanning functionality.

February 25, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

February 17, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

January 30, 2025​

SCA agent URL change​

The default URLs for the Veracode Platform backend API that SCA uses to manage agent-based scans have changed from https://platform-backend.analysiscenter.veracode.eu to https://sca-api.veracode.eu for European region customers and from https://platform-backend.analysiscenter.veracode.us to https://sca-api.veracode.us for United States Federal region customers. These changes do not impact Commercial region customers. All legacy URLs will remain available for the next 12 months before being retired.

For more details on the configuration settings that use these URLs, see SCA agent configuration values and SCA agent environment variables.

January 9, 2025​

Deep link support for SCA pages​

If you open a link to view results from an SCA agent-based scan while you are not logged in to the Veracode Platform, Veracode now directs you to the login page and then redirects to the page from the original link.

January 7, 2025​

SCA agent enhancement​

Veracode upgraded several libraries used by the SCA agent. These changes will not impact SCA agent-based scanning.

December 18, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

December 16, 2024​

New URL for downloading the SCA agent​

This update changes the default URL for downloading files from https://download.sourceclear.com to https://sca-downloads.veracode.com. Both URLs will be available for the next 12 months. After that time, https://download.sourceclear.com will no longer be available.

December 12, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

November 18, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

October 16, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET, Go, Python, and iOS projects.

October 4, 2024​

SCA agent URL change ​

The default URL for the Veracode Platform backend API that the SCA agent uses to manage scans for Commercial region customers has changed from https://api.sourceclear.io to https://sca-api.veracode.com. Both URLs will continue to work for the next 12 months, at which point the legacy SourceClear URL will be retired.

For more details on the configuration settings that use these URLs, see SCA agent configuration values and SCA agent environment variables.

September 12, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Python, PHP, and iOS projects.

September 4, 2024​

SBOM scanning enhancement​

Veracode has added support for scanning SBOM files as part of SCA upload scans.

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of JavaScript projects.

August 27, 2024​

SBOM scanning enhancement​

Veracode has added support for scanning SBOM files as part of SCA agent-based scans.

August 21, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Java Maven projects.

August 1, 2024​

Fix for agent-based scans of Yarn projects​

Fixed an issue that caused SCA agent-based scans to miss transitive dependencies in Yarn 4 projects.

July 23, 2024​

Improved handling of circular references​

Veracode has improved how SCA upload and agent-based scans handle circular references in NPM projects.

July 16, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

July 15, 2024​

Vulnerability side pane added to new SCA homepage (Beta)​

You can now access vulnerability details in a side pane on the Vulnerabilities tab of the new Beta version of the SCA homepage.

July 3, 2024​

SCA results data export​

The SCA Results Export that you can download from the Export Data page in the Veracode Platform now contains 13 months of data instead of 24 months of data.

June 28, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

June 25, 2024​

Vulnerable method support for Java 21, 22, and 23​

Veracode SCA agent-based scanning now supports vulnerable method analysis for Java versions 21, 22, and 23.

June 24, 2024​

New component metrics added to SCA agent results​

If an SCA agent-based scan detects a component from a GitHub repository, the CLI summary and the JSON file now include metrics about that repository. Metrics include the number of commits, how long the repository has been stagnant, and more.

June 11, 2024​

New Component Activity API​

Veracode has released a new API to help you understand the health of your components. You can submit library coordinates, and if the library comes from a GitHub repository, the API retrieves metrics about that repository. Metrics include the number of commits, how long the repository has been stagnant, and more. The SCA Component Activity API specification is available on SwaggerHub for more details.

May 30, 2024​

Vulnerabilities and Licenses tabs added to new SCA homepage (Beta)​

You can now see all vulnerabilities from scans performed after March 27, 2024 from the Vulnerabilities tab of the new Beta version of the new SCA homepage. This tab also includes exploitability information from EPSS, KEV, and exploit-DB. License risks from scans you ran after March 27, 2024, are available from the Licenses tab.

To access the new Beta version of the new SCA homepage, select Scans & Analysis > Software Composition Analysis, then, turn on New SCA Home (Beta).

May 28, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

May 22, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

May 15, 2024​

Fix for SCA scans of NPM projects​

Veracode has fixed an issue that caused some SCA upload scans and some agent-based scans using the --quick flag to not detect libraries in NPM projects when both the project version in the package.json file was empty and the package-lock.json file used v3 format.

May 8, 2024​

Fix for SCA agent-based scans of NPM projects​

Veracode has fixed an issue that caused some SCA agent-based scans to identify libraries in NPM projects as transitive dependencies when they are both direct and transitive dependencies.

April 30, 2024​

Exploitability data added to JSON file produced by SCA agent​

The JSON file produced by SCA agent-based scans now includes the following exploitability data:

• Exploit Prediction Scoring System (EPSS) from FIRST
• Exploit-DB from OffSec
• Known Exploited Vulnerabilities (KEV) catalog from the Cybersecurity & Infrastructure Security Agency (CISA)

April 29, 2024​

SCA agent enhancement​

This update includes the following improvements for SCA agent-based scans:

• Veracode proxy authentication is more reliable.
• Improved support of projects that use the version 2 format of yarn.lock.

April 24, 2024​

Fixed SCA agent error​

Veracode has fixed an issue that caused some agent-based scans to fail when Maven is not installed locally.

April 23, 2024​

Additions to JSON file produced by SCA agent​

The JSON file produced by SCA agent-based scans now includes the following enhancements:

• Includes the Common Vulnerability Scoring System (CVSS) vector string for each vulnerability
• Associates each vulnerable method with a specific vulnerability

April 17, 2024​

Veracode Vulnerability Database now includes data from Exploit-DB​

The Veracode Vulnerability Database now includes data from Exploit-DB. You can view this data using the SCA Agent Issues APIs and the Findings API. For more information, see Understanding SCA exploitability information.

April 16, 2024​

Fix for SCA agent update advisor​

Veracode has fixed an issue that caused the SCA agent update advisor to not work properly when cloning a repo with https instead of ssh.

April 11, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of iOS and .NET projects and fixed a bug caused by libraries with no versions in Go projects.

April 3, 2024​

API to scan SBOMs​

Veracode has released a REST API for scanning SBOMs. You can use this API to upload and scan an SBOM to identify vulnerabilities associated with the libraries listed in the SBOM. The API can produce a new SBOM that includes results from the scan in CycloneDX or SPDX format. For more information, see SBOM Scan REST API.

April 2, 2024​

Reporting changes for ‘conditional pass’ SCA findings​

Even though policy status can have three possible values—pass, fail, and conditional pass—several reports and APIs with finding-level policy status fields are limited to only two possible values, such as true and false. Veracode has changed how it populates these fields for SCA upload scans to be more consistent with Static Analysis scans.

These changes only affect findings with a conditional pass status. There is no impact on how Veracode calculates the application-level policy status or how the user interface displays the finding-level policy status. For more details, review the post in the Product Announcement group in the Veracode Community.

April 1, 2024​

include_metrics parameter for getWorkspaces API set to FALSE by default​

The default value for the include_metrics parameter has changed from TRUE to FALSE for the getWorkspaces API. When the parameter is FALSE, the API responds more quickly but provides data only for the following fields: id, name, projects_count, and site_id. If you set the parameter to TRUE, the API also provides data for the following fields: last_scan_date, library_issues_count, vulnerability_issues_count, and total_issues_count.

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 28, 2024​

New SCA homepage (Beta)​

A Beta version of the new SCA homepage is now available in the Veracode Platform. To access the new homepage, select Scans & Analysis > Software Composition Analysis. Then, turn on New SCA Home (Beta). This page is built on a new infrastructure that Veracode will use to provide unified results from SCA upload scans and SCA agent-based scans. To see all applications and workspaces that you scanned after March 27, 2024, select the Portfolio tab. To see all discovered components from scans you ran after March 27, 2024, select the Components tab.

March 27, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 21, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 15, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Ruby and iOS projects.

March 5, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of iOS projects.

February 29, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET, Go, Java Gradle, and Scala SBT projects.

February 27, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET projects.

February 8, 2024​

Vulnerable methods for Go​

Veracode SCA agent-based scanning now supports detecting vulnerable methods in Go projects that use Go modules as the package manager.

Gradle scanning enhancement​

Veracode SCA agent-based scanning now supports scanning Gradle projects without access to the plugin on maven.apache.org. See Run an agent-based scan for Gradle for more details.

New include_metrics parameter for getWorkspaces API​

Veracode has added the include_metrics parameter to the getWorkspaces API. When the parameter is TRUE, there are no changes to the issue count and other metrics that the API includes in the payload. When the parameter is FALSE, the API responds more quickly but provides data only for the following fields: id, name, projects_count, and site_id.

Through March 31st, 2024, the default value for the include_metrics parameter is TRUE. On April 1st, the default will change to FALSE. If you have automation that relies on having issue counts and other metrics, Veracode recommends you adjust the parameter in your API call before April 1st.

January 23, 2024​

Maven scanning enhancement​

Veracode SCA agent-based scanning now supports scanning Maven projects without access to the plugin on maven.apache.org. See Run an agent-based scan for Maven for more details.

Fix for Python scans​

Veracode fixed an issue that caused an error in SCA agent-based scans of Python projects when using a newer version of pipenv.

January 5, 2024​

SCA API enhancements​

Veracode has fixed an issue that caused the SCA Agent Issues APIs to exclude fixed issues from the payload when the vuln_methods parameter was set to true. This fix applies to scans performed after January 5th, 2024.

Additionally, the getProjectIssues endpoint now supports all of the same parameters as the getWorkspaceIssues endpoint.

January 4, 2024​

Veracode Vulnerability Database now includes exploit information​

The Veracode Vulnerability Database now includes data from both the Exploit Prediction Scoring System (EPSS) and the Cybersecurity & Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) catalog. To access this data, you must sign in to the Veracode Platform. For more information, see Understanding SCA exploitability information.

Previous updates​

2023 updates​

2022 updates​

2021 updates​

2020 updates​