Changelog

Improved

​

Access control detection

Improved

​

Finding validation

• Only findings ZeroPath has verified appear in your open queue, counts, exports and SLA due dates. The rest are retained rather than deleted; you can list them in a custom report and decide for yourself.
• Closing a finding requires a scan of changed code. If the repository has not changed since the last scan, an open finding stays open.
• Patches, pull requests and review comments are created only for findings ZeroPath has confirmed.

New

​

Security Compass

New

​

Private registry connections

• Container images: Docker Hub, GitHub Container Registry, Amazon ECR, Google Artifact Registry, Azure Container Registry, JFrog Artifactory, and any OCI-compliant registry including Harbor, Quay, and GitLab.
• Packages: internal npm and Maven dependencies hosted on Artifactory, Nexus and equivalent registries, so private transitive dependencies resolve rather than appearing as coverage gaps.
• Images can be selected by browsing a connected registry’s repositories and tags from the scan dialog.
• Credentials are verified against the registry before they are stored. AWS and Google credentials are exchanged for a short-lived token on each pull, so the stored key is never used directly, and members can scan with a saved connection without access to the credential itself. A credential rejected later is named in the coverage warning. Configure in Registries.

ImprovedEarly Access

​

Runtime Validation from source

New

​

Wiz runtime context

NewEarly Access

​

Code Governance

Action required

• GitHub merge queues. Existing GitHub Apps must accept the updated merge queue permission before merge group commits receive a check.
• Secret findings. Findings detected before this release return a placeholder in place of the redacted value until the repository is rescanned.
• Scan locations. Editing an organization-wide location set now requires the Create and Edit Included and Excluded Scan Locations permissions. Members and automation without them will be refused.

Added

Scanning

• Findings record the setup an attacker requires for the vulnerability to be reachable, alongside the preconditions already reported.
• Scan on First Commit runs an initial scan when a newly connected repository receives its first substantive commit, rather than waiting for the next schedule. Available on GitHub, GitLab, Bitbucket Cloud and Bitbucket Server.

Supply chain

• SBOM export offers four formats: CycloneDX, SPDX, standalone VEX, and an ML-BOM of the AI components in the codebase.
• The primary CycloneDX export now identifies AI components inline, recording provider, usage, model format and detection source, so a separate ML-BOM is optional.
• ML-BOM export is available per repository from the AI Inventory tab, replacing the organization-wide CSV export.
• Exports carrying vulnerabilities include an EPSS rating alongside CVSS.

Patching

• Up to three alternative patches can be requested for a finding and compared before one is applied. Feedback refines the existing patch rather than regenerating it, and the current patch is retained if a revision does not improve on it.

Integrations

• Jira Data Center and Server 8.14 and later, authenticated with a personal access token, including instances behind a private certificate authority or mounted at a context path. Coverage matches the Cloud integration: descriptions render as Jira wiki markup, and project, issue type, epic, assignee and user and group custom-field selection, PR-bot ticket assignment and ticket templates all operate against Data Center. One Data Center connection per organization; Confluence linking remains Cloud only. See Jira.
• Merge group commits receive a neutral ZeroPath check, so GitHub merge queues advance.

Platform

• Archiving a GitHub repository moves its code, dependency and container findings to accepted risk with a timeline entry and closes the linked Jira and Linear tickets. Unarchiving restores the findings; tickets already closed remain closed. Repositories archived before this release retain their current status.
• Deleting a repository closes the Jira and Linear tickets its findings were synced to, including per monorepo partition, and stops scheduled scanning of its linked container images.
• An organization setting suppresses the generated description and exploit walkthrough on secret findings in the dashboard. Both are withheld from all other surfaces regardless of the setting.
• Dedicated regional deployments, including an EU region, keep scan data in the selected region.
• The Rules page records the author of each rule, distinguishing a user, an API token and Security Compass, with sortable and resizable columns and search across authors.
• Assistant tasks can be stopped from the chat, including tasks started from Slack, and conversation retention is configurable.
• Documentation is available in Portuguese alongside English, covering the guides, CLI and webhook references.

Improved

Scanning

• Infrastructure and secrets findings are evaluated against the surrounding repository before they are reported, now on lightweight scans in addition to full scans and pull requests, and are marked Confirmed only after that evaluation.
• Re-investigation runs against the branch’s current code, relocating the finding when lines have moved, and takes the application’s threat model and runtime evidence into account.
• Investigation effort is distributed evenly across large repositories.
• Pull request scans assess only what the pull request introduces. Code already present on the target branch, including code relocated by a refactor, is excluded.
• Cross-Repository Discovery covers .NET and Python services, resolves repositories that declare multiple modules or packages, and reports vulnerabilities that cross service boundaries. Enabled per organization.
• A resolved finding reopens only when a scan re-examines the code and detects it again.
• A rescan limited to changed files closes a finding as soon as it detects the fix.
• Each detection category reports independently, so secrets, infrastructure and CI/CD workflow findings are unaffected by an error elsewhere in the scan.
• A pull request check clears on the next scan once the findings behind it are resolved.
• Deleting a custom rule retains its findings, along with their status and triage history.
• The patch panel reports a patch when one exists, and states clearly when none was generated.

Supply chain

• Dependency resolution reflects the versions actually shipped, removing advisories raised against versions that were never deployed: workspace packages use the version pinned by the repository lockfile, each dependency resolves to a single version, npm projects without a lockfile resolve their ranges first, and each manifest resolves independently of manifests for other languages beside it.
• Maven projects resolve versions through parent POM and imported BOM chains without a build, Scala projects that define versions through variables resolve, and Rust workspaces resolve the full dependency tree.
• Package visibility is determined from the resolved host in the lockfile, so packages installed from GitHub or GitLab are classified as public.
• Assessed dependency advisories report their determined severity and verdict.
• The Posture and Risk tabs report consistent counts, including Fixable now, for organizations containing monorepos.
• New CVE notifications cover findings from the point they are enabled, and each alert is delivered once the findings it references are linked.

Integrations

• Merged GitLab merge requests record their scans, trigger the merged-with-open-issues notification, and run post-merge fix verification. GitLab users should confirm these notifications are arriving.
• Jira webhook registrations are maintained automatically: one pointing at a superseded host or secret is replaced, and one disabled within Jira is recreated. Organizations whose Jira synchronization has been inactive should see it resume.
• Azure DevOps pull request scans start on the first webhook delivery, and inline comments render flat.
• GitHub Enterprise Server repositories are cloned from the registered appliance origin.
• Empty GitLab and Bitbucket repositories import successfully, newly added GitHub and GitHub Enterprise Server repositories appear without a manual refresh, and reconnecting a GitLab installation preserves existing history.

Platform

• Secret values are masked on every surface, including the dashboard. This reverses the position stated in June, where the dashboard continued to display them for rotation. The detector, file, line, code link and rotation guide remain available.
• Closing a Jira or Linear ticket closes the findings behind it with the reason recorded on the ticket and resolves the corresponding pull request review threads. Standalone Supply Chain and container findings are now included, and status changes on container findings propagate to their tickets.
• Scan completion notifications and Jira and Linear tickets are retried until delivered, every eligible finding receives a ticket, and a scan delivers each notification once.
• The PR bot responds to @ZeroPath on GitHub, GitLab and Azure DevOps; the previous handle continues to work.
• Slack notifications for new findings include severity, status, affected file, pull request and the last author to modify the line.
• Scan Triage Autopilot posts a single threaded summary per scan. Existing installations adopt this unless the prompt has been customized.
• Resetting a repository’s scanner settings returns it to the tag or organization configuration rather than product defaults, and retains the rules, contexts and custom sources and sinks assigned to it. Scan schedules and dependency-scanning configuration for that level are cleared.
• Starting scans across multiple repositories skips those already running or without scannable content, proceeds with the remainder, and reports the number skipped.
• Reopening a finding affects only findings that were resolved, and preserves an accepted risk or false positive decision.
• The repositories list reports why a scan could not reach the repository: DNS resolution, an untrusted certificate, an unreachable host, or a timeout, each with the corresponding remedy.
• SLA policies save on organizations with large finding backlogs.

API

Breaking changes

• POST /api/v1/sca/vulnerabilities/search returns hasMore in place of a total. Paginate with hasMore and retrieve counts from POST /api/v1/sca/vulnerabilities/count.
• deletedCount is renamed resetCount on POST /api/v1/repositories/reset-scanner-settings.
• defaultBranch and gitlabInstallationId are now nullable. Clients assuming a string value will fail.
• On secret findings, redactedSecret is masked for all callers, and the generated description, attack steps and preconditions are withheld.

NewEarly Access

​

Container Scanning

New

​

AI Inventory

New

​

Application Threat Modeling

New

​

Exploit intelligence for dependencies

New

​

Dependency coverage you can verify

New

​

SLA policies

New

​

GitHub Enterprise Server and Azure DevOps

New

​

Coding-agent integrations

ImprovedEarly Access

​

Runtime Validation

New

​

ObjectScript language support

​

Code Analysis

• Static call-graph resolution added for 18 languages: data-flow analysis runs faster and results stay consistent between scans.
• Very large C and Ruby codebases now scan reliably.
• Custom natural-language rules apply on pull request scans and incremental rescans, so every scan enforces the same policies.
• Cross-Repository Discovery (opt-in) builds a relationship graph across your repositories and attaches cross-repository evidence to findings.
• Scans skip vendored, minified, and generated code, keeping findings focused on what your team wrote.

​

AI AppSec Assistant

• Chat with the Assistant directly from the issue preview pane; the conversation carries over to the full issue view.
• Admins can review Assistant activity across the whole organization, and every Assistant action lands in the audit log.

​

Platform

• Secret values stay redacted in exports, tickets, PR comments, and API responses; the dashboard still shows them so you can rotate the credential.
• Each repository gains a Feedback tab collecting triage decisions and the reasons behind them.
• Filter issues by application, search by issue ID, and add shared notes to issues.
• Start scans across every repository at once, with per-repository exclusions.
• New scanner settings: remove the bypass button from failing PR checks, and an opt-in High Performance Mode for deeper analysis.
• Draft pull requests wait until marked ready for review, and linked Jira tickets appear in PR scan comments.
• Pull request checks re-evaluate when findings are triaged, so a dismissed false positive unblocks a failing check.
• The PR bot replies in the thread when a command completes, and inline comments include tips for triaging by reply.
• Set default tags, scope rules by tag, and manage team repository access by tag.
• Team access follows tag membership as repositories join or leave tags, including tags synced from GitHub custom properties.
• Patch generation shows live progress and can be re-run on demand, even for issues previously marked unpatchable.
• Export any custom report view as a PDF.

​

API

• Transitive dependency resolution adds Maven, Gradle, Python (pip), .NET, and Rust (Cargo), alongside the existing sbt (Scala) support.
• Filter SCA vulnerabilities and alerts by Wiz Exposure to focus on dependencies reachable by internet-facing or otherwise exposed applications.
• Threat model and application context factor into reachability analysis and transitive dependency triage, so customer-defined trust zones and out-of-scope areas shape SCA decisions.
• Real-time notifications for new SCA issues are sent through configured Slack and webhook channels.
• New SCA_NEW_ISSUE event trigger for the AI AppSec Assistant.
• SCA Warnings page adds a searchable repository filter and displays monorepo partition names in the repository column.

• Improved secrets false-positive rate.

• Improved IaC false-positive rate.

• Runtime Validation (early access): dynamically validate eligible SAST findings against your deployed, running application to confirm whether they are exploitable at runtime. ZeroPath exercises each finding against the running application and returns a Confirmed, Disconfirmed, or Untestable verdict with runtime evidence — available from a per-repository Runtime Validation tab, as full-application or selected-issue runs, and inline on each issue, with matching API and MCP surfaces.

• Azure DevOps added as a supported platform for PR scanning.
• Severity-level checkboxes (Critical, High, Medium, Low, Info) for scan filtering.
• PR scans can be grouped by pull request, collapsing rescans into a single row with a count badge.
• Scan statuses auto-refresh every 5 seconds while in-progress scans are visible.
• Default team permissions let organization admins configure a baseline permission template and apply it across all teams, including teams auto-created via GitHub team sync.
• Investigation results display a color-coded verdict label (Confirmed, Not Exploitable, or Unknown) in the issue detail view.
• Single-partition monorepos can be converted to a normal repository as an alternative to deletion.
• Repository context supports an optional title field (up to 120 characters) as a short label shown in the contexts list.
• PR bot comments include account-linking instructions when the commenting user doesn’t have a linked ZeroPath account.
• More informative scan error messages.

• Superseded PR scans are cancelled across GitHub, GitLab, and Bitbucket.
• Large PR status comments link to the full scan results in the dashboard.

• Linear auto-ticketing supports automatic assignee resolution with three modes: automatic (matches git blame contributors to Linear users), fixed assignee, or disabled.
• Wiz integration data is accessible through the AI Assistant and MCP server via four read-only query tools for settings, projects, cloud assets, and network exposures.
• Improved Jira status synchronization.

• On-Demand Code Scans (beta) let you submit diffs, files, file sets, or snippets to ZeroPath for asynchronous security review without starting a full repository scan. Linked repository context is used automatically when the submitted Git remote resolves to a known repository.

• New V2 integration endpoints for querying Wiz CSPM settings, projects, assets, and exposures.
• Scans API supports severity-level filtering and PR scan grouping, with expanded issue status counts in responses.
• Playbook templates support boolean, number, and select dropdown parameter types in addition to text.
• New default team permissions endpoints for defining and applying permission templates across teams.
• Breaking: The functionSummary field has been removed from vulnerability API response schemas. API consumers relying on this field should update their integrations.

• Agent Playbooks let you install pre-built, parameterized workflows that self-configure triggers, schedules, and memory. Automate triage routines, compliance checks, alert routing, and other multi-step security tasks without manual setup.
• New event trigger types: PR Merged with Issues, Vulnerability Patched, Vulnerability Reopened, Long Running Scan, Report Complete, Scan Started, PR Scan Started, Scan Scheduled, and Audit Log Event. Multiple triggers per event type with repo/tag scoping.
• Agent permissions (View, Manage, Run) added to team settings.

• Expanded detection for OWASP LLM Top 10 issues including prompt injection, insecure output handling, system prompt leakage, and excessive agency.
• Custom source and sink declarations participate in the full SAST scanning pipeline alongside built-in detections.
• CVSS 3.1 scores are generated alongside CVSS 4.0 for all findings, with automatic backfill for older findings. Security impact labels (e.g., “Account Takeover”) are displayed in issue headers.
• Each finding can carry multiple CWE identifiers.
• Differential scan planning classifies changed files into code vs. dependency categories and selects the minimal scan strategy. Dependency manifest changes trigger fresh SCA even when no code files changed.
• PR bot falls back to AI-powered natural language replies when @-mentions don’t match structured commands.
• When findings drop off in a rescan, ZeroPath natively resolves the corresponding PR review threads on GitHub, GitLab, and Bitbucket, preserving the original comment text.

• Maven parent POM dependencies are extracted from <dependencyManagement> sections in multi-module projects.
• Improved npm transitive dependency fix suggestion accuracy.
• CVE Alerts table includes an “Affected repositories” column showing which repositories contain the vulnerable package, with an expandable detail view for multi-repo alerts.
• Improved SCA advisory matching for cross-package advisories.
• Advisory search accepts titles and CVE identifiers in addition to GHSA identifiers. Issue headers show clickable links to both the advisory source and the associated CVE.
• Broader ecosystem version comparison: Hex, Pub, and SwiftURL use semver; CRAN and Hackage use Maven-style comparison.
• SCA vulnerability alerts can be routed to per-org webhook endpoints, enabling direct integration with Microsoft Teams, Slack, and other notification systems.
• SBOM exports support the latest CycloneDX and SPDX specification versions.

• AI-powered validation runs across all secrets detection engines with three validation states: Confirmed, Disconfirmed, and Unknown.

• Issue comments let developers and security teams document triage decisions, capture fix reasoning, and maintain an audit trail directly on findings. Comments are visible in the issue timeline and sync when status changes arrive from Jira and Linear.
• Mark issues as “Resolved” directly from the issue action menu, with optional context explaining the resolution. Bulk “Resolved” action is available when selecting multiple issues.
• Issue triage actions (false positive, accepted risk, true positive, resolved) apply with a single click.
• Resolving an issue clears any silenced state on that issue.
• Per-issue AI chat assistant embedded in the issue detail view for questions about exploitation, fixes, and reachability.
• Provide additional context when requesting a retriage of a finding from the dashboard, MCP server, or API — context is passed to the scanner to guide the re-evaluation.
• Custom rules and repository context with “Select All” scope apply to repositories added in the future.
• Rules and context list views display “All Repositories” for org-wide items.
• Organizations can require developers to provide context when marking a finding as a false positive, configurable per-team.
• New Custom Sources & Sinks management page with dedicated tabs for custom sources, custom sinks, and a library of curated source and sink packs that can be enabled with one click.
• Rule Packs tab added to the Rules page for browsing and enabling pre-built rule bundles covering privacy, compliance, and policy checks.
• Issue export dialog adds format selection (CSV, CASA CSV, SARIF), filter overrides for severity, category, and status, live export preview count, and optional SARIF toggles for preconditions and exploit walkthrough context.
• Custom source and sink badges appear on source and sink nodes in the data flow visualization, with clickable links to view or edit the declaration.
• Branch-scoped full scan deduplication ensures each branch maintains an independent issue lifecycle. Branch filter dropdowns added to the Issues and Scans tabs.
• Per-branch scan scheduling with support for multiple schedules per repository.
• Scan explorer adds repository and scan navigation dropdowns and SCA manifest file nodes.
• Scanner setting toggles show whether values are inherited from org/tag defaults or explicitly set at the repo level.
• Scan explorer shows a “Standalone Findings” node for findings not linked to a specific source.
• Deprovisioned members are marked with an “Inactive” badge on the members settings page, with role editing and removal disabled.
• Differential scanning is enabled by default. Manual scans are prioritized over scheduled scans in the processing queue.
• Shai Hulud Impact report type added. Custom report filters include Repository Name, Branch, and Tag fields.

• When a developer pushes a fix for a flagged finding in a PR, ZeroPath automatically resolves the review comment thread and updates the finding status in the dashboard.
• PR rescans can be triggered directly from GitHub by re-running the ZeroPath check from the checks page.
• Disconnecting a VCS integration cancels queued scans for affected repositories.

• PR comments support custom footer links and an auto-generated vulnerability summary. Teams can add links to internal wikis and documentation directly in the PR comment, and each finding includes a plain-language explanation of why it matters.
• Jira auto-ticketing supports grouping issues under an epic, with epic selection available for all issue types.
• Improved Jira issue export reliability across issue types.
• Slack channel picker supports search and alphabetical sorting in notification groups.
• When an issue is closed in Jira or Linear, ZeroPath captures the closure reason and stores it as context on the finding.

• The ZeroPath MCP server returns patch and remediation metadata alongside vulnerability details, so AI agents in Cursor, VS Code, and other tools can access fix suggestions directly.

• New AI Assistant API with full management of conversations, jobs, schedules, triggers, and memory. Real-time SSE streaming for job output.
• New semantic search endpoints for vulnerabilities and application endpoints using natural language queries.
• New endpoints for scan start/cancel, scan schedule management with branch targeting, repository add-by-URL and delete, and organization member management.
• New Custom Sources, Custom Sinks, Custom Source Packs, Custom Sink Packs, and Rule Packs endpoints for programmatic management of security declarations and rule bundles.
• Issue data flow details include custom source and custom sink declaration names and descriptions when a finding matches a user-defined declaration.
• Issues and SCA API responses include remediation and patch metadata (validation status, PR link, proposed diff) when a fix exists.
• Rules API supports allRepositories as a first-class field for scoping rules org-wide, mutually exclusive with repositoryIds.
• organizationId is optional on most V2 endpoints — auto-resolved from the API token.
• VULNERABILITY_STATUS_CHANGED notification fires on all triage actions (archive, unarchive, true positive, false positive, resolve, unresolve) from the dashboard, API, and AI agent.

• New early-access AI AppSec Assistant with a dedicated dashboard featuring Overview, Activity, Chat, Schedules, Triggers, Memory, and Settings tabs. Includes Jira, Confluence, and Linear integrations, custom MCP server installation, and Slack thread control (cancel, replace, amend).

• On-demand investigation allows deeper AI re-evaluation of findings, available from the issue detail view, in bulk, and via the API and MCP server.
• Each confirmed finding includes step-by-step exploitation steps and a mandatory data flow path for exploitable vulnerabilities.
• Exploitability preconditions surface deployment-context factors (WAFs, network exposure, auth middleware) that may affect whether a finding is exploitable, with expandable per-precondition evidence in the issue detail view.
• New “Informational” status for findings where exploitability cannot be determined.
• Deep codebase analysis follows extended call chains and complex cross-file data flows for more thorough vulnerability detection.
• Smart rescans match issues to changed line ranges per file.
• Fix verification: reference ZeroPath issues in PR descriptions using ZP-ID: syntax or dashboard URLs to have ZeroPath check whether they are resolved by the PR and report results in a PR comment and a dedicated check status. Supported on GitHub, GitLab, and Bitbucket.
• @bot retriage on PRs with fix verification references re-runs fix verification instead of the standard investigation flow.
• AL (Business Central) added to supported languages.

• SCA findings link to the manifest file and line number where the dependency is declared.
• Compiled asset scanning detects packages embedded in JARs, WARs, Python wheels, and other binary artifacts.
• Multi-hop transitive dependency resolution walks up to 5 hops to find the nearest upgradable direct dependency.
• Remediation instructions are provided for unpatchable findings when no safe version exists.
• SBT (Scala) transitive dependency support with lockfile parsing and automatic sandbox fallback when no lockfile is present.
• SBT auto-remediation creates version bump PRs for vulnerable dependencies in build.sbt files.
• Haskell (Hackage) and R (CRAN) ecosystems added.
• New filters for ecosystem, package reachability, source type (manifest vs. compiled), and info severity level.
• Gradle version catalog support with line-level tracking in build files; PEP 621 pyproject.toml and Poetry 1.2+ group dependencies are parsed.
• SCA findings include exploitability preconditions.
• SBOMs can be generated directly without first running an SCA scan.

• Multi-engine secrets detection with automatic cross-engine deduplication for broader coverage.

• GitHub Actions workflow security scanning for CI/CD pipeline misconfigurations.
• IaC findings include exploitability preconditions and supporting evidence.

• Custom Reports dashboard with interactive charts (severity distribution, MTTR, top vulnerability classes, issue trends), a chip-based filter bar with 14 filterable fields, six preset report templates, and the ability to save and share filter configurations.
• New Assets tab in Reports provides a dedicated view of organization assets alongside the existing Views, Generate, and History tabs.
• Custom Report permissions (View, Create, Delete) added to team settings.

• Separate PR summary comment controls for scans that find issues and clean scans, both enabled by default.
• PR summary comments display exact issue counts and limit inline display to the top 10 findings, with a link to the full dashboard.
• Detailed vulnerability info toggle added to PR scan settings for controlling the level of detail shown in PR comments.
• Bot commands for PR comments: @bot rescan triggers a PR rescan and @bot retriage triggers deeper AI re-investigation of findings. Bot responses update in-place to keep PR comment threads clean.
• @ZeroPath is accepted as a universal bot alias in PR comments, in addition to the configured bot username and @zeropath-ai.
• Marking an issue as false positive or resolved automatically resolves the corresponding inline PR comment threads on GitHub, GitLab, and Bitbucket.
• Dashboard overview statistics redesigned with four key metrics: Total Open, Total Resolved, Avg PR Scan Time, and Mean Time To Resolve, with trend indicators.
• Integrations settings page redesigned with a master-detail sidebar layout.
• History cutoff setting allows a clean baseline by ignoring scan history before a configured date, including during dependency analysis and deduplication.
• Custom rules only mode is available at the repository level in addition to organization and tag levels.
• Improved SCA fix PR merge reliability.
• Monorepo patch PRs update all linked vulnerabilities on merge.
• Team repository selector supports search and pagination.
• Unmatched contributors can be searched and linked individually.
• Report history auto-refreshes while reports are processing.
• Automatic GitHub repository sync for rename, transfer, archive, and delete events.

• Jira and Linear support bulk export of multiple findings at once.
• Linear custom templates with title, description, labels, and priority fields for auto-ticketing.
• Linear integration can be connected at the organization level.
• GitLab pipeline webhooks support pipelines outside of merge requests.

• MCP server adds code inspection tools and investigation tools, including a scans.rescanPR tool for triggering PR rescans.

• New V2 API endpoints for semantic search across vulnerabilities and detected endpoints, SCA vulnerability listing, report generation, and custom report management (CRUD and filter schema discovery).
• New V2 Agent API with endpoints for patch management, PR creation, repository access for agent workflows, event triggers (including inbound webhooks), and global agent instructions.
• Custom report statistics endpoint returns aggregated metrics including severity distribution, top vulnerability classes, MTTR, and new/resolved trends.
• New Code Inspection API endpoints for searching, reading, and listing files in connected repositories.
• On-demand investigations: POST /api/v2/issues/requestInvestigation with issueIds and optional context.
• POST /scans/rescanPR endpoint to trigger a rescan of a previously scanned PR.
• New INFORMATIONAL issue status and CICD detection type added across v1 and v2 APIs.
• VULNERABILITY_PATCHED webhook fires per-vulnerability for multi-fix PRs.