Skip to content

Codacy release notes#

This section contains the release notes for Codacy Cloud and Codacy Self-hosted.

For product updates that are in progress or planned visit the Codacy public roadmap instead.

Tip

Subscribe to this Codacy release notes RSS feed RSS feed using your favorite news aggregator to receive notifications when there are new Codacy release notes.

Codacy Cloud release notes#

2026#

  • September 2, 2026 Oxlint support: Codacy can now analyze your JavaScript and TypeScript projects with Oxlint, a fast Rust-based linter from the Oxc project, and report results directly in your dashboard.
  • September 2, 2026 Repository (Project) Tokens for API v3: Full rollout of scoped repository tokens — creation, listing, deletion (single & bulk), and expiration is now supported end-to-end across all features of our product.

    Mandatory token expiration & auditability: Repository tokens now enforce a maximum lifetime, surfaced in both the API and the SPA.

    Pull Requests page filters: New search + branch-scope filter bar on the Pull Requests page, backed by API support and a new pull-requests list command in the Cloud CLI.

    Dart support in the Analysis CLI: Added a dartanalyzer adapter, closing a cli-v2 parity gap for Dart projects.
  • August 11, 2026 Folder-Level Metrics: Users can now browse their repositories by folder and view quality metrics — issues, complexity, coverage, and duplication — scoped to each directory. Folder navigation, search, and branch-keyed overviews are all included.

    Affected Functions in Security Findings: Security dependency findings now surface the affected entrypoint functions, so teams can immediately see which code paths are reachable from a vulnerable dependency. The functions are visible in the Findings card, in the cloud CLI findings command, and in the public API.

    Pull Requests Page Filter Bar: A new filter bar on the Pull Requests page lets users search pull requests by title and switch between all target branches or the current branch only.

    PHP CS Fixer is live: Codacy added support for PHP CS Fixer, a popular tool that fixes PHP code to follow standard coding style rules.
  • July 29, 2026 Shellcheck configuration files: You can now manage Shellcheck settings with a .shellcheckrc file in your repository instead of configuring analysis directly through the Codacy UI.
  • July 27, 2026 PHP CS Fixer: Support for PHP-CS-Fixer, a tool that fixes PHP code to follow standard coding style rules; Codacy can now analyze PHP projects for style violations and report them in your dashboard.

    Now Checkov supports configuration files: Checkov analysis can now be configured with a .checkov.yaml or .checkov.yml file in your repository.
  • July 10, 2026 PHP_CodeSniffer upgrade: PHP_CodeSniffer is upgrading to its latest version, which drops support for several unmaintained coding standard packages, including the WordPress-VIP, Magento, and PHPCS Security Audit rule sets.
  • July 10, 2026 Import chain visibility for vulnerable dependencies: We added clearer dependency chain visibility so users can better understand how vulnerable dependencies are introduced into their projects.

    Better visibility for CI/CD setup in container scanning: We made the CI/CD setup option more prominent in container scanning so teams can find and enable it more easily.

    Proxy support for Guardrails: Guardrails now supports proxy configurations, making it easier to use in restricted network environments.
  • June 11, 2026 Draft PR AI Review Control: The PR reviewer no longer runs automatically for draft PRs. Please trigger it manually using the button on the summary if you want a review.

    Deprecation of AI Suggestions: Deprecated AI suggestions in GitHub; please use our PR reviewer instead.

    YAML Support for Environment Files: Codacy now supports .env, .env.production, .env.prod, and .env.staging files for the YAML language. All tools running for YAML will be able to scan these files as well.
  • May 8, 2026 Context-Aware Feedback Loops: The AI Reviewer (GitHub only) now factors in previous comments throughout the life of a Pull Request. By learning from the conversation history, it delivers more relevant feedback and reduces noise with every subsequent review.

    New Pull Request Summary Experience: We have introduced the Pull Request Summary to replace the legacy coverage summary settings (GitHub only). All repositories and organizations previously using the coverage summary have been migrated to this new, unified view.
  • April 15, 2026 AI Security & Privacy Safeguards: The AI reviewer and false positive detection now automatically mask any secrets or credentials accidentally pushed in code, protecting sensitive data before it is processed by AI models.

    Customizable AI Instructions: You can now tune the AI Reviewer's output by adding a review.md file to your repository, to define specific coding conventions and prioritize the types of feedback that matter most to your team.

    Manual AI Review Trigger: The new "Run review" button on the Pull Request Summary page lets you trigger the AI Reviewer exactly when you need it, rather than relying solely on automated triggers.

    AI-Powered Test Coverage Suggestions: The AI Reviewer now identifies gaps in test coverage and suggests missing tests for your changes, with a ready-to-use prompt you can give to your coding agent to generate them.
  • March 2, 2026 AI-enhanced comments (Beta) being deprecated for GitHub: AI-enhanced comments are being replaced by the AI Reviewer on March 17, 2026.

    Coverage summary moving to Pull request review: The Coverage summary setting is being removed; coverage data will soon be included in the Pull request review comment.
  • March 6, 2026 Migration from Semgrep to Opengrep: In response to recent licensing changes affecting Semgrep, we have transitioned to Opengrep, an open-source fork of the Semgrep engine, ensuring uninterrupted access to your existing code patterns and continued support for your workflows.

    Organization Overview Dashboard: A comprehensive dashboard providing a holistic view of your organization's health, including new metrics for code health & security, grade, complexity, duplication, and coverage.

    SRM Findings Text Search: Added the ability to filter findings in the SRM tab using text search, for more efficient navigation and management of results.
  • February 19, 2026 Semgrep to Opengrep: Following licensing changes to Semgrep, Codacy switched to Opengrep as a 1:1 replacement, preserving all existing patterns, issue history, and configuration.
  • January 5, 2026 GolangCI-Lint Integration: We've built a new GolangCI-Lint wrapper. This client-side tool integrates over 100 linters, providing deeper insight into Go code quality.

    VS Code Setup Section: Introduced a dedicated setup section within the VS Code extension to streamline the initial configuration process and improve the onboarding experience.
  • January 13, 2026 GolangCI-Lint (client-side): Run GolangCI-Lint locally on your Go projects and upload the results to Codacy for analysis and reporting.

2025#

2024#

2023#

2022#

2021#

2020#

2019#

2018#

Codacy Self-hosted release notes#

v16#

v15#

v14#

v13#

v12#

v11#

v10#

v9#

v8#

v7#

v6#

v5#

v4#

v3#

v2#

v1#

Was this page helpful?

Your feedback helps us improve the documentation.

Edit this page on GitHub Contact support