Veracode Static Analysis: What's New Lately
- SAST
Static Analysis (SAST) has had a busy three months — and it's all good news for teams relying on it. Three engine releases, a retooled Python scanner, bigger Pipeline Scan support, and richer findings data in Analytics all shipped between May and July 2026. Each update means broader coverage, sharper detection, and less noise to wade through. Here's the full rundown, organized by month.
May 2026 — Static Analysis Engine v2026.05
Released May 27, 2026
The May release broadened language and framework support while sharpening third-party detection across several ecosystems. Better third-party classification means fewer findings traced back to code teams don't own — less noise, more signal.
- .NET — The third-party dependency database picked up the latest NuGet package data, and detection improved for the PdfPig library.
- Android — Improved detection for the Dynatrace, Apptentive, and Onfido libraries, cutting down on misattributed findings in mobile projects.
- Apple Platforms — Added support for the CloudKit framework and Security APIs, plus improved third-party library detection. iOS and macOS apps now get broader coverage out of the box.
- COBOL — Enhanced scan logging gives teams better visibility into what the analyzer is doing during COBOL scans, making troubleshooting faster.
- Java — Enhanced support for JDK 25 (the latest long-term support release), improved Java source code scanning for JSP files, and better detection of the Snowflake JDBC Driver as a third-party library.
- Python — Improved scan detection for the anticrlf cleanser function (a data-sanitization helper), meaning fewer false negatives on input-sanitization checks.
- All languages — Improved detection of CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials) flaws across all languages, reducing false positives so teams spend less time chasing noise.
June 2026 — Static Analysis Engine v2026.06
Released June 24, 2026
June's engine update focused on smarter classification, new framework versions, and tighter CWE detection. CWEs (Common Weakness Enumerations) are standardized identifiers for software security weaknesses — better detection of specific CWEs means catching real vulnerabilities with fewer false alarms.
- .NET — Improved classification of first-party .NET assemblies, helping the engine better distinguish application code from third-party dependencies. The result: findings attributed more accurately to the code teams actually write.
- Apex — Improved detection of vulnerabilities involving tainted data flows through public methods, plus better CWE-532 (Insertion of Sensitive Information into Log File) detection. Salesforce developers get sharper, more relevant findings.
- Apple Platforms — Improved support for Security APIs.
- Dart and Flutter — Added support for Dart 3.12 and Flutter 3.44, keeping coverage current for teams building cross-platform mobile and web apps.
- Kotlin — Added support for Kotlin 2.4.
- Java — Improved third-party detection, better detection and classification of ForgeRock dependencies in Maven-based projects, and improved CWE-918 (Server-Side Request Forgery) detection.
- JavaScript — Improved CWE-73 (External Control of File Name or Path) flaw detection and better third-party detection.
- Python — Improved third-party detection.
- RPG — Improved RPG parsing for teams working with IBM i legacy code.
- All languages — Continued improvements to CWE-259 and CWE-798 detection to further reduce false positives.
July 2026 — Static Analysis Engine v2026.07
Released July 21, 2026
The July engine release brought support for .NET 10, deeper Python and JavaScript analysis, and broader framework coverage.
- .NET — Enhanced support for .NET 10, plus improved analysis of applications that include Saturn.dll.
- Java — Improved JSP and JSF Expression Language modeling with more complete POJO data (which may surface additional valid findings), better scan accuracy for code generated by Project Lombok (a popular Java boilerplate-reduction tool), and expanded third-party library detection to include Fluxnova.
- JavaScript — Improved spread-operator analysis to reduce false positives, expanded pnpm module support for better dependency resolution, and improved CWE-80 (Improper Neutralization of Script-Related HTML Tags — a cross-site scripting category) detection in React Native applications.
- Python — Improved propagation support for os.path functions, plus added support for httplib when detecting CWE-295 and CWE-297 flaws related to SSL/TLS certificate validation.
- PL/SQL — Improved parsing of PL/SQL code.
- All languages — Further refinements to CWE-259 and CWE-798 detection to keep driving down false positives.
Enhanced Python Scanner
Released July 22, 2026
A standalone enhancement to the Python scanner that goes beyond the monthly engine cycle. It improves vulnerability detection through enhanced taint tracking (tracing how untrusted data flows through an application), cross-file analysis, and pattern recognition — and adds support for applications built with PySpark, Flask, Django, and FastAPI.
This applies automatically to all Python scans starting July 22, 2026, with no configuration changes required. Teams may see additional findings surface; these represent previously undetected vulnerabilities, not regressions or newly introduced issues. Catching previously hidden flaws is a win — it means the scanner is doing its job better.
Pipeline Scan Supports Larger Artifacts
Released July 29, 2026
Pipeline Scan now supports scanning packaged artifacts larger than 200 MB. No changes to existing integrations are required. For teams working with large monolithic applications or bundled binaries, this removes a sizing constraint that previously forced workarounds — scans just work now, regardless of artifact size.
Richer Static Analysis Findings in Veracode Analytics
Released July 29, 2026
Veracode Analytics now provides more detail about findings related to Static Analysis scans — including the function name, class path, and most recent line number where Veracode discovers the finding. This data makes it possible to recreate a view similar to the Triage Flaw view in the Veracode Platform, but across multiple application profiles at once. For security teams managing large portfolios, that means faster triage and less context-switching between apps.
The Quarter at a Glance
| Date | Update | Highlight |
|---|---|---|
| May 27 | Engine v2026.05 | JDK 25, CloudKit, Security APIs, CWE-259/798 false-positive reduction |
| June 24 | Engine v2026.06 | Dart 3.12, Flutter 3.44, Kotlin 2.4, CWE-918/532/73 detection |
| July 21 | Engine v2026.07 | .NET 10, pnpm support, React Native CWE-80, SSL/TLS CWE-295/297 |
| July 22 | Enhanced Python scanner | Taint tracking + PySpark, Flask, Django, FastAPI support |
| July 29 | Pipeline Scan | Artifacts larger than 200 MB now supported |
| July 29 | Analytics | Function name, class path, and line number in findings data |
What This Means for SAST Customers
Three months of engine updates add up to real, tangible coverage gains. Here's the practical takeaway:
- Newer frameworks, covered. Support for .NET 10, JDK 25, Dart 3.12, Flutter 3.44, and Kotlin 2.4 keeps scans current as teams adopt the latest toolchains. No more blind spots just because a team upgraded.
- Cleaner findings. Broader third-party detection across .NET, Java, JavaScript, Python, Android, and Apple platforms means fewer findings misattributed to first-party code. And sustained false-positive reduction for CWE-259 and CWE-798 across all languages helps developers trust what the scanner reports.
- Deeper Python analysis. The enhanced Python scanner brings taint tracking and cross-file analysis to modern web frameworks like Flask, Django, and FastAPI — surfacing vulnerabilities that previously went undetected.
- No more size ceiling. Pipeline Scan handling artifacts over 200 MB removes a real bottleneck for teams with large applications.
- Faster portfolio-wide triage. Richer findings data in Analytics — function name, class path, line number — lets security teams triage across an entire portfolio without bouncing between profiles.
All updates apply automatically to existing scans — no configuration changes required. Teams start benefiting from the latest engine the next time a scan runs. That's the beauty of a managed SAST engine: improvements ship continuously, and coverage keeps getting better without anyone lifting a finger.
For the complete release history, visit the
Static Analysis release notes on the Veracode Docs site. Questions or feedback? Drop a reply in the community — the product teams are listening.
.png){kind=logo}
