Devzy v2.7.0 Release Notes

This release brings three significant steps forward: teams can now manage multiple GitHub organizations from a single account, compliance coverage reaches the full OWASP LLM Top 10, and the AI review conversation model becomes significantly more context-aware. Alongside these, a broad set of review quality and feedback-loop improvements compounds the value of every review over time.

New Features

Multi-Organization Support

Users who belong to more than one GitHub organization can now switch between them without signing out.

• A new organization switcher in the app header lists all your connected organizations and lets you set a default
• Sessions are scoped per organization so admin status and repository access stay correctly isolated
• Accepting an invitation via email now correctly routes through your organization's sign-in provider (GitHub or GitLab)
• Session recovery handles the edge case where a previously active organization has been uninstalled

Full OWASP LLM Top 10 Compliance Coverage

Compliance scanning now covers all ten OWASP LLM Top 10 risk categories (LLM01–LLM10) with layer-accurate detection rules.

• Both per-PR and full-repository scan modes include the complete catalog
• Repository-wide scans run LLM validation on detected candidates with bounded context windows to stay reliable on large files; candidates that cannot be fully validated within the window are flagged as unverified rather than silently dropped
• The compliance UI shows saved framework preferences on reload and the progress view is more accurate for long-running scans
• Selecting a compliance framework now requires at least one framework to be chosen before enabling, preventing misconfigured states

Smarter Review Conversations

The review bot now understands the difference between replies directed at it and replies between human reviewers.

• An addressing classifier determines whether a pull request thread reply is directed at the bot or is a human-only exchange, and only responds when appropriate
• Conversational replies in bot-led threads are routed correctly so follow-up context is preserved
• Review reply handling is more consistent across thread types and edge-case comment structures

Changeset-Scoped Review Stage

A new whole-PR review pass surfaces defects that per-file analysis cannot find on its own.

• Catches bugs that only exist in the interaction between files changed together in the same pull request
• Runs as a lifecycle stage after per-file review completes, with no additional latency on the hot path
• Kept separate from per-file findings so both signal types remain actionable

Review Learning and Lessons

The review engine now uses a continuously updated lessons cache so past feedback shapes future reviews without additional model calls on the critical path.

• A background job periodically refreshes repository-level lessons derived from accepted and rejected review feedback
• Lessons are injected into the review orchestrator at the start of each review run using the cached snapshot — no LLM call needed during the review itself
• Reaction-based feedback (thumbs up/down on review comments) is now polled on a two-tier schedule and recorded, feeding the lessons pipeline
• Merge-time signals are recorded when a pull request is merged, closing the feedback loop from review to ship

Salesforce Integration

Salesforce Service Cloud support can now be linked to your Devzy workspace, allowing Devzy to access context directly from your customer support tickets.

Cloud Provider Routing in Admin Settings

Administrators can now configure which cloud provider backs each model in the model registry.

• Cloud provider selection is available in the add/edit model form
• Model labels visible to end users remain cloud-agnostic regardless of the underlying routing choice
• Enables routing equivalent models through different infrastructure without changing the user-facing model name

Improvements

Architect Review Quality

The Architect Review now commits to evidence-supported conclusions rather than deferring open questions back to the author.

• The exploration phase is directed to resolve answerable questions before finishing
• Only pre-existing code is cited as a reference implementation; the PR's own diff is no longer used as a precedent for itself
• The rating displayed in the review header is derived directly from the rating stated in the analysis body, so they can no longer disagree

Review Accuracy and Noise Reduction

Several targeted fixes reduce false positives and duplicate signals in review output.

• Diff polarity false positives on replacement diffs are eliminated — additions and removals were being conflated in a class of structured diff
• Reasoning content from the model is now scoped to the current file so it does not bleed into unrelated file reviews
• Duplicate comment generation is reduced for cases where the same finding was surfaced multiple times in a single review run
• The feedback-loop accuracy threshold now includes a 0.5 tier for code quality findings, and the minimum promotion threshold is adjusted to keep more useful signals

Review Summary Usability

• The review summary now lists all open issues with a direct link to each comment, making it easier to navigate from the summary to the specific finding
• Bot-generated review comments are correctly scoped to the current installation, so cleanup operations do not affect comments from other connected installations

Usage Tracking and Credit Management

• Admin users can view current credit balances and grant credits from the admin panel
• When a review cannot be queued due to insufficient credits, a comment is posted on the pull request to communicate the skip
• Usage tracking covers models from a wider set of providers, with improved vendor resolution for mixed-naming conventions

Platform Branding

Updated platform positioning copy reflects the Defender for AI Non-Deterministic Outcomes focus across the landing page hero, footer, and in-product surfaces.

Bug Fixes

• Fixed: Auth session not recovering when the active organization installation was removed while a user was signed in
• Fixed: Email invitations not applying when accepted via OAuth flow for GitLab-connected organizations
• Fixed: Diff polarity false positives causing replacement-style diffs to be misclassified
• Fixed: Architect Review header rating contradicting the rating stated inside the analysis
• Fixed: Review bot responding to human-only thread replies not directed at it
• Fixed: Review summary omitting some open issues and missing links to individual comments
• Fixed: Compliance scan progress not reflecting stale or incomplete scans accurately
• Fixed: Save button placement in settings forms causing accidental saves

Infrastructure

• Updated shared data package across frontend and backend services for compatibility with new schema fields
• Improved model registry administration APIs with full mutation coverage and type safety
• Background job scheduling refined for lessons refresh and reaction polling reliability