From 9630c57f804e3e9d6fa8f9712ae60dc2b32b2578 Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Tue, 3 Nov 2026 11:53:25 +0000 Subject: [PATCH 1/4] Release Notes October 2026 --- docs/release-notes/cloud/cloud-2026-10.md | 130 ++++++++++++++++++++++ docs/release-notes/index.md | 1 + mkdocs.yml | 1 + 3 files changed, 132 insertions(+) create mode 100644 docs/release-notes/cloud/cloud-2026-10.md diff --git a/docs/release-notes/cloud/cloud-2026-10.md b/docs/release-notes/cloud/cloud-2026-10.md new file mode 100644 index 0000000000..eabf601b20 --- /dev/null +++ b/docs/release-notes/cloud/cloud-2026-10.md @@ -0,0 +1,130 @@ +--- +rss_title: Codacy release notes RSS feed +rss_href: /feed_rss_created.xml +description: Release notes for Codacy Cloud October 2026. +Codacy_tools_version_old: https://github.com/Codacy/tools/releases/tag/9.3.144 +Codacy_tools_version_new: https://github.com/Codacy/tools/releases/tag/9.3.168 +--- + +# Cloud October 2026 + +These release notes are for the Codacy Cloud updates during October 2026. + +📢 [Visit the Codacy roadmap](https://roadmap.codacy.com) and let us know your feedback on both new and planned product updates! + +### Features + +- **Remediation Report (MTTR & SLAs):** The Security and risk management Overview tab is now called Reports and includes a new Remediation report. For each severity, it shows the mean time to remediate against your SLA over the last 90 days, a weekly trend, the share of findings closed on time, and today's open backlog grouped by how late it is. You can filter by segments, repositories and scan types, and the data is also available in the Public API v3. + +- **DAST Target Limits per Organization:** The App scanning target limit is now set per organization. The default is still 6 active targets, and Codacy can raise it on request. The App scanning page shows your limit, adds a "Talk to us" link when you reach it, and now loads all targets, including when there are more than 100. + +- **Dependency Chain on Quality Issues:** Quality issues for vulnerable dependencies now show the full transitive dependency chain and the fixed version, the same way security findings do. + +### Improvements + +- **Bitbucket Sign-in Permissions Prompt:** Atlassian shows its permissions page every time a Bitbucket user signs in to Codacy. This is Atlassian behaviour, and we're following it up with Atlassian. In the meantime, Codacy now tells users this prompt is expected, including in the session-expired modal, and the docs explain it. + +- **Merged Pull Requests Metric Restored:** Fixed the merged pull requests widgets and the pull request count in coding standards, which had stopped updating. The missing data from September 2026 was backfilled for affected organizations. + +- **AI Reviewer Permissions Fix:** Users with write access on the Git provider can now trigger an AI review, even when repository management is limited to admins. + +- **Manual Review While Logged Out:** Clicking the manual review button on GitHub while logged out of Codacy now asks you to log in instead of showing an "Unauthorized" page. + +- **Advisory Search and Display:** Findings search now finds advisories that aren't CVEs, such as GHSA IDs, in the app, the Public API and the Cloud CLI. Findings and issues now also show these advisories. + +- **Findings Reset Filters Fix:** The "reset filters" link in the empty Findings state now works. + +- **AI Risk Hub GitLab Links:** Links to code in the AI Risk Hub now include GitLab subgroup paths. + +- **AI Risk Level Widget Cleanup:** AI Inventory no longer appears greyed out in the AI Risk Level widget checklist. + +- **Dependencies Search Fix:** Fixed searching in the Dependencies tab making the page unresponsive. + +- **Coverage Dashboard Fix:** Ignoring covered files no longer produces a negative "Without coverage" file count on the repository dashboard. + +- **Repository Count Fix:** Fixed inflated repository counts in the usage dashboard. + +- **Provider Settings for Bitbucket and GitLab:** Bitbucket and GitLab organizations can save provider settings again. The Public API v3 spec now describes correctly which providers support each setting. + +- **Duplication Tab Fix:** Expanding a clone occurrence in a file's Duplication tab now loads its content. + +- **Large Diffs No Longer Block Analysis:** Pull requests and commits with very large diffs no longer fail or stay in analysis indefinitely. We also fixed a diff that the diff parser couldn't read. + +- **Container Scanning Reliability:** Container scans no longer get stuck after service restarts. + +- **Certificate Trust Updates:** The Analysis CLI stable image, its GitHub Action and the runtimes installed by the Codacy CLI no longer trust the compromised eMudhra intermediate certificates. + +- **Security Hardening:** Removed JVM-wide trust-all TLS settings from the platform and updated the Codacy MCP server to fix known CVEs. + +- **Refreshed Illustrations:** Updated illustrations across the app with the new Frosted Glass style. + + +## Tool versions + +## Updated tools + +- **Stylelint** has a new version: 17.16.0 (updated from 16.26.1) + +## Unchanged tools + +- **AgentLinter**: 0.3.3 +- **aligncheck**: 1.0.0 +- **Ameba**: 1.6.4 +- **Bandit**: 1.9.4 +- **Biome**: 2.5.14 +- **Brakeman**: 4.3.1 +- **Bundler Audit**: 0.9.1 +- **Checkov**: 3.3.19 +- **Checkstyle**: 14.1.0 +- **clang-tidy**: 10.0.1 +- **CodeNarc**: 3.6.0 +- **PHP_CodeSniffer**: 4.0.4 +- **CoffeeLint**: 5.2.11 +- **Cppcheck**: 2.22.0 +- **Credo**: 1.7.19 +- **CSSLint**: 1.0.5 +- **Dart Analyzer**: 3.13.4 +- **deadcode**: 1.0.0 +- **Detekt**: 1.23.8 +- **ESLint**: 8.57.0 +- **ESLint (Legacy)**: 7.32.0 +- **ESLint 9**: 9.39.5 +- **Faux Pas**: 1.7.2 +- **Flawfinder**: 2.0.20 +- **golangci-lint**: 2.13.2 +- **Revive**: 1.16.0 +- **Gosec**: 2.29.0 +- **Hadolint**: 2.15.1 +- **Jackson Linter**: 2.22.2 +- **JSHint**: 2.13.6 +- **Lizard**: 1.24.0 +- **markdownlint**: 0.41.1 +- **Opengrep**: 1.30.0 +- **Oxlint**: 1.85.0 +- **PHP CS Fixer**: 3.95.26 +- **PHPMD**: 2.14.1 +- **PMD**: 6.55.0 +- **PMD 7**: 7.27.0 +- **Prospector**: 1.19.1 +- **PSScriptAnalyzer**: 1.25.0 +- **Pylint**: 1.9.5 +- **Pylint (Python 3)**: 4.0.8 +- **Reek**: 6.5.0 +- **remark-lint**: 10.0.1 +- **Roslyn**: 1.27.0 +- **RuboCop**: 1.91.0 +- **Ruff**: 0.16.8 +- **ScalaStyle**: 1.5.1 +- **ShellCheck**: 0.10.0 +- **SonarC#**: 9.32 +- **SonarVB**: 8.13 +- **Spectral**: 1.22.6 +- **SpotBugs**: 4.10.4 +- **SQLFluff**: 4.3.0 +- **SQLint**: 0.3.0 +- **Staticcheck**: 2026.2.1 +- **SwiftLint**: 0.63.2 +- **Tailor**: 0.12.0 +- **Trivy**: 0.74.0 +- **TSLint**: 6.1.3 +- **TSQLLint**: 1.16.0 \ No newline at end of file diff --git a/docs/release-notes/index.md b/docs/release-notes/index.md index a68ea4fca1..18dee4ceef 100644 --- a/docs/release-notes/index.md +++ b/docs/release-notes/index.md @@ -21,6 +21,7 @@ For product updates that are in progress or planned [visit the Codacy public roa ### 2026 {.release-series} +- [Cloud October 2026](cloud/cloud-2026-10.md) - [Stylelint accessibility patterns renamed – November 2026](cloud/cloud-2026-11-stylelint-a11y-patterns-renamed.md) - [Cloud September 2026](cloud/cloud-2026-09.md) - [Adding Oxlint as new supported tool September, 2026](cloud/cloud-2026-09-adding-oxlint.md) diff --git a/mkdocs.yml b/mkdocs.yml index 34cf36ac9a..6064879aa3 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -826,6 +826,7 @@ nav: - release-notes/index.md - Cloud: - 2026: + - release-notes/cloud/cloud-2026-10.md - release-notes/cloud/cloud-2026-11-stylelint-a11y-patterns-renamed.md - release-notes/cloud/cloud-2026-09.md - release-notes/cloud/cloud-2026-09-adding-oxlint.md From d8da791de1e2ea0ba2ebb2aaf5c5f3f9d2600a8d Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Tue, 3 Nov 2026 14:16:06 +0000 Subject: [PATCH 2/4] refine the list of issues --- docs/release-notes/cloud/cloud-2026-10.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/docs/release-notes/cloud/cloud-2026-10.md b/docs/release-notes/cloud/cloud-2026-10.md index eabf601b20..e374a4aa0c 100644 --- a/docs/release-notes/cloud/cloud-2026-10.md +++ b/docs/release-notes/cloud/cloud-2026-10.md @@ -22,7 +22,7 @@ These release notes are for the Codacy Cloud updates during October 2026. ### Improvements -- **Bitbucket Sign-in Permissions Prompt:** Atlassian shows its permissions page every time a Bitbucket user signs in to Codacy. This is Atlassian behaviour, and we're following it up with Atlassian. In the meantime, Codacy now tells users this prompt is expected, including in the session-expired modal, and the docs explain it. +- **Refreshed Illustrations:** Updated illustrations across the app with the new Frosted Glass style. - **Merged Pull Requests Metric Restored:** Fixed the merged pull requests widgets and the pull request count in coding standards, which had stopped updating. The missing data from September 2026 was backfilled for affected organizations. @@ -44,8 +44,6 @@ These release notes are for the Codacy Cloud updates during October 2026. - **Repository Count Fix:** Fixed inflated repository counts in the usage dashboard. -- **Provider Settings for Bitbucket and GitLab:** Bitbucket and GitLab organizations can save provider settings again. The Public API v3 spec now describes correctly which providers support each setting. - - **Duplication Tab Fix:** Expanding a clone occurrence in a file's Duplication tab now loads its content. - **Large Diffs No Longer Block Analysis:** Pull requests and commits with very large diffs no longer fail or stay in analysis indefinitely. We also fixed a diff that the diff parser couldn't read. @@ -54,10 +52,6 @@ These release notes are for the Codacy Cloud updates during October 2026. - **Certificate Trust Updates:** The Analysis CLI stable image, its GitHub Action and the runtimes installed by the Codacy CLI no longer trust the compromised eMudhra intermediate certificates. -- **Security Hardening:** Removed JVM-wide trust-all TLS settings from the platform and updated the Codacy MCP server to fix known CVEs. - -- **Refreshed Illustrations:** Updated illustrations across the app with the new Frosted Glass style. - ## Tool versions From a2059f6c2c3d0c76e3ab1e5bb49258056b9793b2 Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Tue, 3 Nov 2026 15:08:22 +0000 Subject: [PATCH 3/4] add ai reviewer improvements --- docs/release-notes/cloud/cloud-2026-10.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/release-notes/cloud/cloud-2026-10.md b/docs/release-notes/cloud/cloud-2026-10.md index e374a4aa0c..d3644cc7f7 100644 --- a/docs/release-notes/cloud/cloud-2026-10.md +++ b/docs/release-notes/cloud/cloud-2026-10.md @@ -20,10 +20,22 @@ These release notes are for the Codacy Cloud updates during October 2026. - **Dependency Chain on Quality Issues:** Quality issues for vulnerable dependencies now show the full transitive dependency chain and the fixed version, the same way security findings do. +- **AI Reviewer Outcome at a Glance:** AI reviews now start with the reviewer's overall assessment of the pull request, so you can see its verdict without reading the whole summary first. + ### Improvements - **Refreshed Illustrations:** Updated illustrations across the app with the new Frosted Glass style. +- **Faster AI Reviews:** The AI Reviewer now runs on a new model and finishes a typical review in seconds instead of minutes. + +- **AI Reviewer Skips Very Large Pull Requests:** The AI Reviewer no longer reviews pull requests whose context is too large to review well, such as whole-branch merges or bulk changes across hundreds of files. + +- **AI Reviewer Reliability:** Fixed some pull requests never getting their first automatic review when several analyses finished at almost the same time. Reviews that would run on far too long are now cut short, so they no longer fail without posting anything, and stuck reviews fail faster. + +- **AI Reviewer File Paths Fix:** Fixed the secret redactor hiding file paths, which caused findings to point to "[REDACTED]" instead of the real file. + +- **Fewer GitHub API Calls from the AI Reviewer:** The AI Reviewer now fetches a pull request's changed files in batches, using far fewer calls from your organization's GitHub API rate limit. + - **Merged Pull Requests Metric Restored:** Fixed the merged pull requests widgets and the pull request count in coding standards, which had stopped updating. The missing data from September 2026 was backfilled for affected organizations. - **AI Reviewer Permissions Fix:** Users with write access on the Git provider can now trigger an AI review, even when repository management is limited to admins. From 19b73584bed3ab5cbe34d97044238fc73fd56ee8 Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Tue, 3 Nov 2026 16:31:57 +0000 Subject: [PATCH 4/4] re-order features list --- docs/release-notes/cloud/cloud-2026-10.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/cloud/cloud-2026-10.md b/docs/release-notes/cloud/cloud-2026-10.md index d3644cc7f7..72c8c5ff43 100644 --- a/docs/release-notes/cloud/cloud-2026-10.md +++ b/docs/release-notes/cloud/cloud-2026-10.md @@ -14,13 +14,14 @@ These release notes are for the Codacy Cloud updates during October 2026. ### Features +- **AI Reviewer Outcome at a Glance:** AI reviews now start with the reviewer's overall assessment of the pull request, so you can see its verdict without reading the whole summary first. + - **Remediation Report (MTTR & SLAs):** The Security and risk management Overview tab is now called Reports and includes a new Remediation report. For each severity, it shows the mean time to remediate against your SLA over the last 90 days, a weekly trend, the share of findings closed on time, and today's open backlog grouped by how late it is. You can filter by segments, repositories and scan types, and the data is also available in the Public API v3. - **DAST Target Limits per Organization:** The App scanning target limit is now set per organization. The default is still 6 active targets, and Codacy can raise it on request. The App scanning page shows your limit, adds a "Talk to us" link when you reach it, and now loads all targets, including when there are more than 100. - **Dependency Chain on Quality Issues:** Quality issues for vulnerable dependencies now show the full transitive dependency chain and the fixed version, the same way security findings do. -- **AI Reviewer Outcome at a Glance:** AI reviews now start with the reviewer's overall assessment of the pull request, so you can see its verdict without reading the whole summary first. ### Improvements