Skip to content

Codescoring On-premise Changelog

[2024.38.0] - 2024-09-18

  • Fixed CSV export in the Dependencies section

[2024.37.0] - 2024-09-12

  • Added team table to the project page
  • Added ability to export to CSV in the Components section
  • Accelerated SCA analysis in cases where the same package occurs multiple times within a manifest
  • Fixed an error when generating a project report if there are incorrect PURLs in SBOM.

[2024.35.0] - 2024-08-29

  • Added a new condition for policies - Dependency Vulnerabilities Count
  • Added OSA metrics to the dashboard
  • Added the number of blocking Policy Alerts to the dashboard
  • Added the ability to run a project scan in the UI in parallel with the scan in Johnny
  • Added a column with the number of Policy Alerts in the Settings -> Policies subsection
  • Added a filter by the date of the last request in the Components -> Container Images subsection
  • Implemented background generation of downloaded files and accelerated their download
  • Implemented pagination when interacting with LDAP
  • Accelerated work of the Dependencies section
  • Supplemented the list of repository types so that all repositories, including unsupported ones, are displayed in the Repository Managers section

[2024.32.0] - 2024-08-09

  • Added support for Bearer authorization for Container Registries
  • Added implementation of searching for LDAP groups through user attribute records
  • Added repository type output in the Repository Managers section in cases where it is not supported
  • Improved tools for diagnosing LDAP integration
  • Fixed comparison of system package versions when calculating policies
  • Speeded up the work of the Components -> Packages, Components -> Requests and Repository Managers sections
  • Improved OSA requests cleanup

[2024.29.1] - 2024-07-17

  • Added an ability to specify a license for CLI projects when creating via the API
  • Fixed an error while displaying Matched Criteria in the Policy Alerts section
  • Fixed the color of the warning level on the blocked component page

[2024.28.0] - 2024-07-09

  • Implemented a new mechanism of policy conditions with the formation of logical expressions
  • Optimized memory consumption when generating PDF reports
  • Searching LDAP user attributes is now case insensitive
  • Fixed sorting in the vulnerability table on the Container Image viewing page
  • Fixed calculation of block status in OSA for selected components in a policy

[2024.25.0] - 2024-06-18

  • Added setting for matching LDAP group and user access level
  • Added the ability to ignore Policy Alerts by PURL
  • Added checking the availability of the Container Registry before starting an image scan in the interface
  • Added description of OSA API methods in Swagger
  • Improved installation stability in older browsers
  • Accelerated loading of the Components -> OSA Packages section
  • Fixed display of graphs and pagination of the commit table on the TQI tab of the project page
  • Fixed the request date filter in the Components -> Packages section
  • Fixed changing of an obsolete token for VCS
  • Removed deprecated API method /api/dashboard/security/top5_vulnerable_projects/

[2024.24.0] - 2024-06-11

  • Optimized memory usage when loading vulnerability descriptions

[2024.22.2] - 2024-05-28

  • Added the ability to run installation with the readOnlyRootFilesystem option in Kubernetes
  • Improved search speed in the Dependencies, Policy Alerts and Components sections
  • Improved sorting by the Dependency/Package field in the Policy Alerts section
  • Added cleaning of temporary files after forced completion of image scanning
  • Fixed missing Distribution by technology graph in CLI projects after the first scan
  • Fixed an error in generating a PDF report if there were links in PURL

[2024.22.1] - 2024-05-27

  • Changed the status in OSA plugins when receiving an unknown Repository Manager

[2024.22.0] - 2024-05-27

  • Fixed a bug when displaying the Settings -> Workmode section

[2024.21.0] - 2024-05-24

  • Added the ability to connect repository managers through the interface
  • Added OSA package filter for repository managers and individual repositories
  • Added policy settings for specific repositories
  • Improved LDAP group mapping

[2024.17.2] - 2024-04-27

  • Added the package release date to the page in the Components -> Packages section
  • A hint has been displayed for the Plugin mode column in the Components -> Requests section
  • Fixed an error in opening the Policy Ignore editing page with a specified Container Image
  • Fixed generation of links to commits in Gitlab

[2024.17.1] – 2024-04-23

  • Added the ability to specify the OSA type of the component for which the policy will be applied
  • Added Group mapping section for configuring LDAP groups
  • Added mapping of LDAP groups to internal CodeScoring groups
  • Added links to vulnerabilities and licenses in the Matched criteria field of the Policy Alerts section
  • Added search to the policy condition by the Technology field
  • Added the Matched criteria field to the Policy Alerts table on the project page
  • Returned display of the SBOM loading icon
  • The License and Vulnerability columns in the Policy Alerts tables are now hidden by default
  • Accelerated loading of the Components -> Requests section
  • Improved periodic cleaning of OSA queries from the database
  • Fixed redirect when deleting a user
  • Fixed formation of Dependency Name from PURL

[2024.15.0] - 2024-04-09

  • Added the ability to configure multiple LDAP integrations
  • Added Matched criteria output in the Container images section
  • Added columns and filters Scan schedule, Scan with hashes to the Projects section
  • Added columns and filters Scan schedule, Excluded from analysis to the Settings -> Projects section
  • Added information about the previous user access level to the Audit Log
  • Added support for non-standard ports for SSH when adding VCS
  • Added percentage of similarity between authors in the Authors section
  • Implemented periodic cleaning of OSA queries in the database
  • Returned the dev policy stage to the project settings

[2024.13.0] – 2024-03-27

  • Fixed re-running of periodic tasks in the queue
  • Fixed long wait for response from Index API in case of connection interruption

[2024.12.0] – 2024-03-22

  • Added Components section, which includes lists of OSA components and requests
  • Added the Vulnerabilities field to the CSV project report
  • Added pool_used metric to view busy connections from the pool
  • Optimized launching analysis and unloading SBoM CLI project
  • Fixed ignoring the load full images list flag when creating or updating a Registry
  • Fixed display of the number of active policies in the Dashboard section
  • Fixed missing options for CVSS2 Authentication policy
  • Fixed an error when calculating Policy Alerts of a policy with the CVSS Score condition

[2024.11.0] – 2024-03-18

  • Added information about the package to the Policy alerts and Vulnerabilities sections on the page of the image blocked in OSA
  • Added Group filter in the Vulnerabilities section
  • Renamed the Blocks build policy attribute to Blocker
  • Optimized analysis of CLI projects in situations where the dependencies of the analyzed project are often found in other projects
  • Accelerated loading of information about similar authors
  • Fixed display of connections at the same level in the project dependency graph

[2024.10.0] – 2024-03-06

  • Fixed the disappearance of the HTML upload button for charts
  • Changed the formatting of commit messages in the project commits table
  • Fixed display of metrics on project pages for which analysis was not carried out
  • Fixed availability of downloading the PDF report and SBOM depending on the status of the project analysis

[2024.9.1] – 2024-02-29

  • Fixed case insensitivity when creating users from LDAP

[2024.9.0] – 2024-02-28

  • Added display of analysis status in history for projects and images
  • Added display of commit messages in projects for past periods on the TQI page
  • Expanded SCA metrics on the project page
  • Fixed behavior when loading and scanning images without tags
  • Fixed updating information about Container registry after saving changes
  • Fixed inability to view project commits for the last week
  • Fixed display of metrics on project pages for which analysis was not carried out
  • Fixed integration with LDAP
  • Reduced timeout when checking Registry availability

[2024.8.0] – 2024-02-22

  • Fixed launch of general analysis of clones
  • Fixed display of paths to files inside clones
  • Fixed transitions to lists of clones from the clone map
  • Fixed display of the author when there is no email field
  • Fixed display of hidden columns in tables
  • Fixed display of the block_status variable in the list of the Container Images section
  • Fixed updating the list of images when there are images in the registry without specifying the platform
  • Removed empty value when selecting in filters
  • Removed automatic restart of scheduled scanning in case of a crash

[2024.7.0] – 2024-02-16

  • Added vulnerabilities from the FSTEC BDU
  • Implemented a page to display information about a component blocked in OSA
  • Implemented launch of author analysis for one project
  • Implemented the launch of clone analysis for one project
  • Added a table of commits on the TQI tab of the project page
  • Fixed filter for vulnerabilities in the Policy Alerts section
  • Fixed transition to the policy page from the Dashboard section

[2024.5.0] – 2024-02-02

  • Updated system UI
  • Added new SCA metrics on the project page
  • Added policy condition to match PURL regular expression
  • Added policy condition for searching a text string in PURL
  • Added a check for hidden characters when entering the activation key
  • Fixed filter by technology in the Projects section
  • Fixed display of technologies for CLI projects in the Projects section
  • Optimized policy recalculation mechanism
  • Clarified error messages about connecting to GitLab
  • Changed the orientation of the Vulnerabilities section in the PDF project report

[2024.2.0] – 2024-01-12

  • Added information about the architecture of scanned images
  • Added Group filter on the projects page
  • Added support for CycloneDX 1.5 specification when importing SBOM
  • Added new blocking statuses for OSA components
  • Improved OSA performance
  • Accelerated loading of Complexity map in the Projects section
  • Removed scans stuck in in progress status
  • Fixed report export to PDF when actively scanning a project and for CLI projects

[2023.49.0] – 2023-12-08

  • Added the ability to export a PDF report with the results of scanning a project
  • Added support for Rust dependency analysis via Cargo manifests
  • Added the ability to clone a repository via SSH
  • Added new VCS type "Other Git"
  • Added display of the number of vulnerabilities found in the list of the Projects section
  • Added search for nested vulnerabilities (those with entries in different feeds) in the Vulnerabilities section
  • Added setting for displaying project ID in the Settings -> Projects section
  • Added null values to Prometheus OSA API metrics
  • Automatic analysis after cloning a VCS project has become optional
  • Fixed an error when sorting the table by the CVSS3 Attack Complexity field in the Vulnerabilities section
  • Fixed incorrect operation of OSA with packages that have uppercase in the version

[2023.48.0] – 2023-11-22

  • Reduced the size of supplied Docker images CodeScoring
  • Added the Matched criteria parameter with the reason for the triggered policy to the Policy alerts section
  • Added a new type of Container registries "Other"
  • Added the right for users with User access level to create CLI projects via the API
  • Added Prometheus metrics on scan status and component blocking status in OSA
  • Added password and token hiding in Jira connection settings
  • Removed duplicate vulnerabilities in SBOM that have different affected versions
  • Removed obsolete endpoint API /integration_api/v1/
  • Analysis work with a large number of Policy ignores has been accelerated
  • Fixed UnsafeOption error when working with Azure and Bitbucket
  • Fixed display of available values for the Container images filter in the Policy alerts section
  • Fixed search by dependency in the Policy alerts section
  • Fixed display of the CWE filter in the Vulnerabilities section

[2023.44.0] – 2023-10-31

  • Added saving filters between tabs in the Policy alerts section
  • Fixed display of resolved Policy alerts on the project page

[2023.43.0] - 2023-10-27

  • Added support for scanning proxy Docker repositories based on Sonatype Nexus and JFrog Artifactory
  • Added Digest and tags on the container image page
  • Added background update of vulnerabilities and background operation of policies for components from container images
  • Added metrics of number and time of requests for CodeScoring OSA
  • The installation queue metrics have been supplemented - now you can separately view the types of analyzes in the queue
  • Added a new policy condition – age of vulnerability
  • Added the ability not to automatically download the list of images when adding a Container Registry
  • Fixed opening the Policy Ignore view page
  • Fixed display of git error 128 when working with VCS

[2023.41.0] - 2023-10-09

  • Running CodeScoring no longer requires superuser rights inside the container. Instructions for migrating from root containers to rootless are available from the vendor

[2023.40.0] - 2023-10-04

  • Added the ability to scan images from hosted Docker repositories based on Sonatype Nexus and JFrog Artifactory
  • Added the ability to block downloading images from Sonatype Nexus Repository if they do not comply with security policies

[2023.38.0] - 2023-09-20

  • Added the ability to specify special characters in the password for connecting to the database
  • Fixed an issue with displaying ignored alerts in the Policy Ignores section
  • Fixed display of Source files and Parents fields on the dependency page
  • Instant removal of an alert from the Active list after creating an ignore rule has been restored
  • Added update scheme to the current version of the product.

[2023.35.0] - 2023-08-31

  • Added history of SCA scans in the project
  • On the project page, information for the SCA and TQI modules is now displayed in separate tabs
  • Added display of parts of CVSS vectors in the list of vulnerabilities
  • Added a new policy condition "Vulnerability has fixed version"
  • Added the CWE field to the CSV vulnerability table export
  • Added CodeScoring banner and version logging to the console when launching a Docker container with installation
  • Added metrics for the number of running analyzes for Prometheus
  • Removed deprecated endpoint /api/policy_alerts/ignored/
  • Removed deprecated endpoint /api/policy_alerts/resolved/
  • Removed deprecated endpoint /api/policy_alerts/
  • Fixed display of technologies on the Policy ignores list
  • Fixed purl and CVSS policy for rpm
  • Removed license text from generated SBoMs for the project

[2023.31.0] - 2023-08-04

  • Speeded up CodeScoring OSA

[2023.30.0] - 2023-07-27

  • Added fixed version in the Affected dependencies table on the vulnerability page
  • Added queue status metrics for Prometheus
  • Moved the installation version from the footer to the side menu
  • Fixed inconsistency between Swagger schema and API
  • Removed the ability to click the Upload SBOM button without an attached file

[2023.26.0] - 2023-06-30

  • Added support for system packages for the OSA plugin in NXRM
  • Added new policy conditions - on the presence of a vulnerability exploit and parts of the CVSS vector
  • Added output of policy name, stage and level to the Policy alerts list on the project page
  • Added a filter by project type in the list of projects
  • Marked the /api/dependencies/csv/ method as deprecated. Now you need to use /api/dependencies/by_project/csv/
  • Fixed an error when adding a project without first creating a VCS
  • Fixed display of information about stages on the policy description card for the User access level

[2023.24.0] - 2023-06-13

  • Added a filter for searching by policy name in the Policies section
  • Fixed dependency export with an empty filter

[2023.22.0] - 2023-06-01

  • Fixed loading SBOM in CycloneDX format obtained from Microsoft.SBOMTool
  • Fixed processing of fractional vulnerability ratings when generating SBOM

[2023.21.3] - 2023-05-30

  • Fixed loading SBOM in CycloneDX format obtained using third-party tools
  • Improved loading of Code Clones pages

[2023.21.2] - 2023-05-23

  • Added the ability to upload and download SBOM for a project in CycloneDX format
  • Added the ability to perform analysis on a CLI project through the interface
  • Added manual update of project code in settings
  • Added the ability to connect several VCS with the same address, but different tokens
  • Added basic auth support for integration with Jira
  • Fixed display of the list of licenses on the chart
  • Fixed the appearance of duplicate alerts under heavy load

[2023.15.0] - 2023-04-14

  • Added a new type of projects without reference to a repository - CLI
  • Added Policy alerts grouping to digests for notifications via email
  • Added search by policy name and dependency name in Policy alerts
  • Added recommendations for eliminating vulnerabilities (fixed version)
  • Added support for parsing packages in deb/apk/rpm formats
  • Added a prompt to refresh the page if the client version is different from the server version
  • Added minor improvements to the UI

[2023.11.0] - 2023-03-16

  • Fixed long loading of the Distribution by license graph on the Dashboard
  • Added Note field to Policy ignore
  • Added Description field to Policy
  • Added a new Auditor access level
  • Added session lifetime setting via environment variable
  • Added links to the dependency graph

[2023.6.0] - 2023-02-10

  • Added project dependency graphs (link is on the project page)
  • Added option to disable hash collection during SCA on installation
  • Added Index API response cache for OSA (by default from 1 hour to 1.5 hours, configured through environment variables)
  • Added information about restrictions on using OSSIndex
  • Launch of mass SCA is now logged in Audit log
  • Swagger no longer requires internet
  • Changed the path to the statics from the backend (you need to fix docker-compose.yaml)
  • Fixed a bug due to which in packages of the same name (with different versions) located in different manifests, information about the file in which the package was found was incorrectly displayed

[2022.49.1] - 2022-12-07

  • Fixed the work of the project page

[2022.49.0] - 2022-12-07

  • Added login events to Audit log
  • Added processing of the unresolved node
  • Added a new condition in policies for missing component version
  • Changed installation API
  • Fixed analysis when there is no env in the dependency graph

[2022.48.2] - 2022-12-04

  • Added support for modern yarn
  • Changed the mechanism for classifying dependencies as direct
  • Added unresolved section for dependencies that are in the lock file, but do not have a parent component