Veracode's GitHub Workflow Integration just got a major upgrade with version 2.0.0!

Did you know that you can now set up the entire Veracode GitHub Integration directly from the Veracode platform — no more GitHub Marketplace installations, and no more manual steps like importing repositories?

That's just the beginning. Here's what else is new:

🔧 Manage credentials in-platform — Update your Veracode integration credentials without ever leaving the platform.

🗓️ Scheduled scans for Static, SCA, and IaC — Set up scans to trigger on your preferred schedule across installed organizations (just like you can with ADO). This extends the value of repository scanning and gives AppSec teams a structured, scheduled security posture — including improved visibility into dormant repos with little or no development activity.

🔄 Already installed via GitHub Marketplace? No problem. You can start using the platform to install Veracode on other organizations, update credentials, and schedule scans. The Marketplace installation path isn't going away — it continues to work as-is.

🆕 New language support — Apex, VB6, and Perl are now supported.

This release is all about our Zero Drift vision — eliminating the manual steps and onboarding friction that customers experienced with the original GitHub Workflow Integration. 

Want to learn more or get started? Let's talk! 🚀

Next week's August Static Analysis Release includes the following:

Updated language and framework support

Android

• Enhanced support for Android 16.
• Improved third-party detection.

Dart and Flutter

• Adds support for hardcoded value detection in get assignments modeled as getter functions.

Java

• Improves Java scan performance when analyzing common template patterns.
• Improved detection of CWE-78 flaws.

JavaScript

• Adds support for Next.js 16.x

PHP

• Enhanced detection of third-party code.

PL/SQL

• Improved scan performance.

Python

• Improves detection of hardcoded passwords and credentials (CWE-259 and CWE-798).
• Adds support for the Python google-cloud-bigquery library.

RPG

• Improves remediation guidance for flaws associated with CWE-78, CWE-114, CWE-200, CWE-338, CWE-359, CWE-628, CWE-787, and CWE-823.
• Improved detection of CWE-787 flaws to reduce false positives.
• Improved RPG parsing.

Other languages

• Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

A fresh batch of platform updates just landed across the Veracode portfolio. Here's what's shipped since August 5th — from smarter scan notifications to sharper DAST targeting and a more capable packaging runner for GitHub and GitLab integrations.

EASM: Real-Time Scan Event Notifications

Released August 5, 2026

External Attack Surface Management (EASM) now sends real-time, in-app notifications the moment a scan completes, fails, or gets cancelled. No more manually refreshing scan status — security teams get an immediate signal, keeping threat surface monitoring responsive and shrinking the gap between detection and action.

Notifications show up directly in the EASM interface, so teams can track scan outcomes without ever leaving the workflow.

• Learn more: EASM documentation
• Release notes: EASM release notes

DAST: Business Unit Targeting and Scan Engine Enhancements

Released August 6, 2026

Dynamic Analysis (DAST) now lets teams assign a business unit when creating a web application or API specification target — or straight from the DAST configuration page. That makes it simple to organize and filter scan targets by business unit, a real win for organizations that need to align application security reporting with internal team and ownership structures.

The DAST scan engine also got sharper, with improved detection for CAA record checks on SSL certificates for CWE-862 — applied across both Dynamic Analysis and DAST. Better detection means more accurate identification of certificate-related misconfigurations, so teams can close gaps before they're exploited.

• Documentation: Scan web applications (DAST) | Scan APIs
• Release notes: Web Application Scanning release notes

GitHub Workflow Integration: Check Runs Bug Fix (v2.1.2)

Released August 6, 2026

A minor release of the GitHub Workflow Integration (v2.1.2) fixes a bug where GitHub APIs weren't updating and reflecting the correct check runs status. With the fix in place, check run results now display accurately in GitHub — so developers and security teams can trust the status shown right in pull requests and commit views.

Runner Image scm-packaging-5.0.0: Expanded Packaging for GitHub and GitLab

A new default runner image — scm-packaging-5.0.0 — is now available for GitHub and GitLab repository integrations, replacing scm-packaging-3.0.0

. The updated image brings a broad refresh of underlying components, expanding support for a wider range of project types and increasing overall project coverage across repo workflows.

Updated components include:

• Alpine v3.24.0
• Ubuntu v26.04
• .NET v10
• PipEnv v2026.6.2
• libicu v78
• Node.js v22.22.1
• Python v3.14.4

GitHub Workflow Integration (v2.1.1) also introduces a new uninstallation workflow. Administrators can now uninstall the Veracode app from GitHub organizations directly through the Veracode Platform — streamlining lifecycle management without toggling settings in GitHub itself.

GitLab gets the same scm-packaging-5.0.0 support, enhancing packaging capabilities in repo workflows and broadening the range of project types covered.

• Packaging details: GitHub Workflow packaging requirements

That's the full set of updates since August 5th. For a complete history of platform changes, visit the Veracode release notes.

What does this mean?

Beginning December 1, 2026, Jira Server and Jira Data Center 9.x versions will no longer be supported by the Veracode Integration for Jira. Customers running Jira 9.x should plan their upgrade path now to avoid disruption to support and compatibility.

Required action

To continue using a supported version of the Veracode Integration for Jira, upgrade to Jira 10 or later before November 30, 2026.

Additional information

After the support end date:

1. Veracode will no longer test or validate the integration against Jira 9.x.

2. Issues encountered on Jira 9.x may not be investigated or fixed.

3. New integration enhancements and compatibility updates will be targeted toward supported Jira versions.

For the latest supported version information, see the Veracode documentation: https://docs.veracode.com/r/c_jira_about#supported-versions

If you have any questions about this change or need assistance planning your upgrade, please contact Veracode Support.

Today Veracode launched the Veracode Marketplace — a curated ecosystem of security integrations built for the AI-powered software development era. Every partner is vetted for technical depth and workflow fit, every integration is anchored to Veracode findings for a unified audit trail, and every purchase runs through a single contract.

DryRun Security joins as the inaugural partner, bringing AI-native code analysis that reasons across intent, behavior, and application context. The marketplace is available to all customers today, with additional partners joining throughout 2026.

Learn more here: https://www.veracode.com/partners/marketplace/