Skip to content

Cloud October 2026#

These release notes are for the Codacy Cloud updates during October 2026.

📢 Visit the Codacy roadmap and let us know your feedback on both new and planned product updates!

Features#

  • AI Reviewer Outcome at a Glance: AI reviews now start with the reviewer's overall assessment of the pull request, so you can see its verdict without reading the whole summary first.

  • Remediation Report (MTTR & SLAs): The Security and risk management Overview tab is now called Reports and includes a new Remediation report. For each severity, it shows the mean time to remediate against your SLA over the last 90 days, a weekly trend, the share of findings closed on time, and today's open backlog grouped by how late it is. You can filter by segments, repositories and scan types, and the data is also available in the Public API v3.

  • DAST Target Limits per Organization: The App scanning target limit is now set per organization. The default is still 6 active targets, and Codacy can raise it on request. The App scanning page shows your limit, adds a "Talk to us" link when you reach it, and now loads all targets, including when there are more than 100.

  • Dependency Chain on Quality Issues: Quality issues for vulnerable dependencies now show the full transitive dependency chain and the fixed version, the same way security findings do.

Improvements#

  • Refreshed Illustrations: Updated illustrations across the app with the new Frosted Glass style.

  • Faster AI Reviews: The AI Reviewer now runs on a new model and finishes a typical review in seconds instead of minutes.

  • AI Reviewer Skips Very Large Pull Requests: The AI Reviewer no longer reviews pull requests whose context is too large to review well, such as whole-branch merges or bulk changes across hundreds of files.

  • AI Reviewer Reliability: Fixed some pull requests never getting their first automatic review when several analyses finished at almost the same time. Reviews that would run on far too long are now cut short, so they no longer fail without posting anything, and stuck reviews fail faster.

  • AI Reviewer File Paths Fix: Fixed the secret redactor hiding file paths, which caused findings to point to "[REDACTED]" instead of the real file.

  • Fewer GitHub API Calls from the AI Reviewer: The AI Reviewer now fetches a pull request's changed files in batches, using far fewer calls from your organization's GitHub API rate limit.

  • Merged Pull Requests Metric Restored: Fixed the merged pull requests widgets and the pull request count in coding standards, which had stopped updating. The missing data from September 2026 was backfilled for affected organizations.

  • AI Reviewer Permissions Fix: Users with write access on the Git provider can now trigger an AI review, even when repository management is limited to admins.

  • Manual Review While Logged Out: Clicking the manual review button on GitHub while logged out of Codacy now asks you to log in instead of showing an "Unauthorized" page.

  • Advisory Search and Display: Findings search now finds advisories that aren't CVEs, such as GHSA IDs, in the app, the Public API and the Cloud CLI. Findings and issues now also show these advisories.

  • Findings Reset Filters Fix: The "reset filters" link in the empty Findings state now works.

  • AI Risk Hub GitLab Links: Links to code in the AI Risk Hub now include GitLab subgroup paths.

  • AI Risk Level Widget Cleanup: AI Inventory no longer appears greyed out in the AI Risk Level widget checklist.

  • Dependencies Search Fix: Fixed searching in the Dependencies tab making the page unresponsive.

  • Coverage Dashboard Fix: Ignoring covered files no longer produces a negative "Without coverage" file count on the repository dashboard.

  • Repository Count Fix: Fixed inflated repository counts in the usage dashboard.

  • Duplication Tab Fix: Expanding a clone occurrence in a file's Duplication tab now loads its content.

  • Large Diffs No Longer Block Analysis: Pull requests and commits with very large diffs no longer fail or stay in analysis indefinitely. We also fixed a diff that the diff parser couldn't read.

  • Container Scanning Reliability: Container scans no longer get stuck after service restarts.

  • Certificate Trust Updates: The Analysis CLI stable image, its GitHub Action and the runtimes installed by the Codacy CLI no longer trust the compromised eMudhra intermediate certificates.

Tool versions#

Updated tools#

  • Stylelint has a new version: 17.16.0 (updated from 16.26.1)

Unchanged tools#

  • AgentLinter: 0.3.3
  • aligncheck: 1.0.0
  • Ameba: 1.6.4
  • Bandit: 1.9.4
  • Biome: 2.5.14
  • Brakeman: 4.3.1
  • Bundler Audit: 0.9.1
  • Checkov: 3.3.19
  • Checkstyle: 14.1.0
  • clang-tidy: 10.0.1
  • CodeNarc: 3.6.0
  • PHP_CodeSniffer: 4.0.4
  • CoffeeLint: 5.2.11
  • Cppcheck: 2.22.0
  • Credo: 1.7.19
  • CSSLint: 1.0.5
  • Dart Analyzer: 3.13.4
  • deadcode: 1.0.0
  • Detekt: 1.23.8
  • ESLint: 8.57.0
  • ESLint (Legacy): 7.32.0
  • ESLint 9: 9.39.5
  • Faux Pas: 1.7.2
  • Flawfinder: 2.0.20
  • golangci-lint: 2.13.2
  • Revive: 1.16.0
  • Gosec: 2.29.0
  • Hadolint: 2.15.1
  • Jackson Linter: 2.22.2
  • JSHint: 2.13.6
  • Lizard: 1.24.0
  • markdownlint: 0.41.1
  • Opengrep: 1.30.0
  • Oxlint: 1.85.0
  • PHP CS Fixer: 3.95.26
  • PHPMD: 2.14.1
  • PMD: 6.55.0
  • PMD 7: 7.27.0
  • Prospector: 1.19.1
  • PSScriptAnalyzer: 1.25.0
  • Pylint: 1.9.5
  • Pylint (Python 3): 4.0.8
  • Reek: 6.5.0
  • remark-lint: 10.0.1
  • Roslyn: 1.27.0
  • RuboCop: 1.91.0
  • Ruff: 0.16.8
  • ScalaStyle: 1.5.1
  • ShellCheck: 0.10.0
  • SonarC#: 9.32
  • SonarVB: 8.13
  • Spectral: 1.22.6
  • SpotBugs: 4.10.4
  • SQLFluff: 4.3.0
  • SQLint: 0.3.0
  • Staticcheck: 2026.2.1
  • SwiftLint: 0.63.2
  • Tailor: 0.12.0
  • Trivy: 0.74.0
  • TSLint: 6.1.3
  • TSQLLint: 1.16.0

Was this page helpful?

Your feedback helps us improve the documentation.

Edit this page on GitHub Contact support