Devzy v2.14.0 Release Notes

This release lets you scan a branch you choose, set up the first scan with recommended compliance frameworks, and review security findings from the dashboard. Reports, counts, and pull request comments stay aligned with findings that were confirmed.

New Features

• Any branch: pick the branch when you start a security or compliance scan
• First scan: one repository, the scan types you want, and recommended compliance frameworks
• Security dashboard: critical and high findings, the busiest repositories, and recent results
• Cancel a running scan: stop a security or compliance scan from the scan page or the activity menu. Confirm first, because work already done still counts. The scan shows Cancelling until it stops, and a cancelled run has no verdict or report

Scan a chosen branch

When you start a scan, you can pick the branch. The default branch is selected to start. If the branch list is unavailable, you can type a branch name.

First scan

A new workspace walks through one repository before the first scan.

• Choose security, compliance, or both. Compliance starts on, and security is optional
• Frameworks are asked for only when a compliance scan is selected
• Recommended frameworks are suggested from that repository and can be changed before the scan starts
• The guide ends once that repository has a completed scan

Choose compliance frameworks faster

On a repository's compliance settings you can recommend frameworks from the code, copy a selection from another repository, or apply the saved selection to other repositories.

• Recommend: shows how the repository was read, why each framework was suggested, and whether it was found in the code or suggested from that reading. Recommended items start selected. Nothing already on is turned off
• Copy: shows the other repository's frameworks first, so you can keep or drop each one
• Apply to other repositories: uses the saved selection. A repository that follows the workspace defaults is given its own selection, and the page says so
• Adding or copying saves that framework change and opens the Frameworks list
• Progress is shown while a recommendation runs. If the suggestion step does not finish, you can try again

Security on the dashboard

The dashboard adds a Security view and a count of critical and high findings on completed scans in the selected range.

• Severity and category breakdown
• Repositories with the most findings
• The most recent findings, with a vulnerability identifier when one was recorded
• Fix in editor when the finding includes a fix prompt

Command-line scan depth

A command-line scan can choose Economy, Balanced, or Deep for that run. Scan history records the depth, including for scheduled scans. Free-trial workspaces stay on Economy.

Checked findings on pull requests

Security and compliance comments on a pull request are posted only after the finding has been checked against the code.

Improvements

Reports are easier to read

Reports use a light theme, lead with the verdict and what to do first, and keep findings shorter. Downloaded PDFs open each section, and lists that expand on screen are included in full. A deep security analysis that stops early says how much of it finished.

Counts match the report

Dashboard totals, notifications, and the Secured or Compliant label use the same counts as the report. Findings that were ruled out are left out. A compliance scan that could not confirm its checks is not labeled Compliant.

Serious findings come first

On a large repository, critical and high findings are reviewed before repeated lower-severity hits of the same check. Package advisories are grouped and checked for whether the code can reach them.

Compliance can read repository protection

On GitHub, a compliance scan can read branch protection, required reviewers, and signed commits for the repository's default branch.

Large repositories

Scans of large repositories are given more time to finish, and a compliance scan can cover more of the tree. A scheduled scan that runs for several hours is not started again while it is still going.

Clearer scan progress

While a scan is queued or running, Run scan is disabled and reads Scan in progress. Once the time estimate is used up, the status stays on Finishing up. Failure and progress text stays in plain language. If a report cannot be loaded, the download is a short unavailable page.

Repository names open settings

Repository names on the dashboard and the repository list open that repository's settings.

Reconnecting keeps your plan

Connecting the same source-control account again keeps the existing plan and remaining credits, including after the connection was removed and added back.

Bug Fixes

• Fixed: The depth chosen for a scan being dropped, so history showed no depth
• Fixed: A schedule saved for a date or time that had already passed
• Fixed: Invite and other dialogs cut off on screen
• Fixed: Settings loading showing an internal repository number
• Fixed: Security scans failing on files whose names use characters outside basic English
• Fixed: Apply to other repositories staying unavailable because of unrelated unsaved edits
• Fixed: A compliance check treating a non-GitHub repository as an unprotected branch
• Fixed: Command-line reviews that use Google models stopping after the first step

Infrastructure

• Security updates in bundled libraries
• A scan that cannot access the repository fails once with a clear message instead of retrying