Veracode CLI – starsze wersje do pobrania

The veracode fix sca command now supports asynchronous Fire-and-Forget (FnF) mode, which submits remediation requests for background processing without waiting for fixes to be generated and pull requests to be created.

This update includes the following improvements:
- The veracode scan command improves container image scanning by resolving a deadlock that caused scans to fail or become unresponsive.
- The veracode package command excludes artifacts from Gradle dependency folders.
- The veracode package discover command detects toolchains for JavaScript projects that use npm or Yarn.

This update includes the following improvements:
- The veracode package command supports Java source code packaging using the --java-source flag and the VERACODE_PACKAGE_JAVA_SOURCE=true environment variable.
- The veracode package discover command provides toolchain detection for Java projects that use the Gradle package manager.

Note
Recently, Veracode container scans began failing due to a breaking change from one of our upstream data suppliers. This breaking change affected all versions of the Veracode CLI, including 2.43.0 and earlier.
Veracode has expedited a new Container & IaC release to address the issue and recommends all customers upgrade to the latest release immediately.
This breaking change only affected Container & IaC scanning. Other functions of the Veracode CLI, including Static scanning and Veracode Fix, were not affected.
This update includes the following improvements:
- The veracode scan command:
- Allows you to apply a custom policy defined in the Veracode Platform.
- Enables you to view policy evaluation for individual findings along with the overall policy result.
- Introduces changes to the scan results schema.
- Increases vulnerability coverage to improve scan performance.
- Creates a separate asset for each repository in the ADO workflow, making it easier to track and view individual scan results.
- Introduces the veracode package discover command to detect the toolchains required to successfully create scannable artifacts.
- The veracode package command:
- Produces no artifacts if the Python virtual environment is at the repository root. If it’s in a subdirectory or is a conda-meta environment, that directory is excluded from packaging.
- Expects the python-no-pm artifact to be created from the root of the repository.
- For .NET, passes TargetFrameworkVersion to the msbuild publish command only when multiple target framework versions are specified.
- Preserves the source file name extension of preprocessed output files.
- Improves logging of solution configuration and platform selection.
- Eliminates an issue detecting the version of CL.exe from a legacy toolset when using a newer build environment.
- Corrects an issue building projects with names containing ( or ) characters.
- Prevents packaging failures when the input directory contains both supported and unsupported solutions.
- Adds support for preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler, via the SRCLR_MAKE_WINDOWS environment variable.