Skip to main content

TeamCity Plugin - Changelog

The following table lists of improvements and bug fixes have been implemented for the TeamCity plugin with the relevant version release.

Checkmarx One Version

Release Date

CLI Version


Bug Fixes


October 30, 2023


  • Updated for CLI version that uses GO version 1.21.1, in order to remediate a vulnerability.

  • Added an environment variable, "CX_IGNORE_PROXY", for ignoring proxies. Mark the variable as true to ensure that all Checkmarx One CLI commands run directly from the local machine.

  • Added Podfile and Podfile.lock to the list of included files (when creating the zip archive for scanning).


July 29, 2023


  • Added information about violated policies to the scan summary output.

    For policies that are configured to "break build", when the policy is violated the scan will fail. (The --ignore-policy flag can be applied using Additional Parameters to prevent policies from causing the scan to fail).


Apr 19, 2023


  • We added a new environment variable, CX_HTTP_PROXY, which can be used to designate a specialized proxy for Checkmarx One. When this is used, it overrides the proxy specified in your general HTTP_PROXY variable.


    We still support use of the HTTP_PROXY variable if you choose to use the same proxy for Checkmarx One as for your other applications.


Apr 3, 2023


  • You can now designate a scan as a "Private Package" and assign a package version to it using the Additional parameters options. Once a private package has been scanned, info about the risks affecting that package will be identified by SCA when that package version is used in any of your projects. You can download an article about private packages here.

  • We added the --exploitable-path flag to the Additonal parameters options. This enables you to designate whether or not Exploitable Path will run on this particular scan. When used, this overrides the designation made in the project settings.

    We also added a flag --sca-last-sast-scan-time, which enables you to specify the number of days that SAST scan results are considered valid for use in Exploitable Path (i.e., if there is no current SAST scan, how many days prior to the current SCA scan will Checkmarx One look for a SAST scan to use for analyzing Exploitable Path.)


    The --sca-last-sast-scan-time flag is not yet fully supported and may not function as designed.

  • Improved memory usage when uploading zip files.

  • Added file extensions go.mod, go.sum, *.dart, and *.plist to the list of included files (when creating the zip archive for scanning).

  • Fixed issue that spaces in additional params values had been causing errors.


Feb 23, 2023


  • All references to AST have been changed to use the new product name "Checkmarx One".

  • Added option to generate reports in PDF format by setting --report-format to pdf. For PDF format reports, you can add the following additional flags:

    • Add the --report-pdf-email flag to specify email recipients.

    • Add the --report-pdf-options flag to specify which sections to include in the report. Options are: Iac-Security, Sast,Sca, ScanSummary, ExecutiveSummary, ScanResults.


Dec 7, 2022


  • The KICS scanner is now referred to in Checkmarx One as "IaC Security". All mentions of the scanner and the vulnerabilities identified by it, now refer to IaC Security.

  • The API Security scanner is now supported for use via the CLI. When running the scan create command, you can now add api_security to the list of scanners under --scan-types.


Nov 10, 2022


  • A report is now generated when a build fails because of a threshold set in the Checkmarx One plugin.


Sep 15, 2022


General improvements and bug fixes.


Sep 2, 2022


General improvements and bug fixes.


Jul 5, 2022


  • You can now add filters to the scan create command (to exclude files/folders from the scan) separately for each specific scanner. The flags for the new filters are: --sast-filter <string>, --kics-filter <string>, --sca-filter <string>. See scan create.


    The existing flag --file-filter , which sets filters for the entire scan (for all scanners) is still in use.

  • You can now add an ssh key to a scan, using the flag --ssh-key <string> with the path to the ssh private key.

  • Changed the flag to async so that the workflow continues without failure for async scans.

  • Added all permissions for github token being used in action.


Apr 13, 2022


General improvements and bug fixes.


Mar 2, 2022


Added new --sca-resolver-params flag to the scan create command. See documentation here.


Feb 11, 2022


  • In the scan create command, we renamed the format flag as scan-info-format.

  • Renamed the results command as results show command.


Feb 8, 2022


  • In the scan create command, we renamed the format flag as scan-info-form.

  • Fixed problems with the proxy connection


Jan 26, 2022


  • Added SummaryJSON reports.

  • Added the --scan-timeout <int> flag to the scan create command, enabling users to specify a time limit after which the scan will fail and terminate. See documentation here.

  • Updated UI elements to reflect the new Checkmarx branding (e.g., logo).


Jan 11, 2022


  • Added ability to break builds by specifying a threshold for acceptable vulnerabilities.

  • Added support for exporting scan results directly to SonarQube or SonarCloud console. See documentation here.


Nov 3, 2021


  • Updated CLI to version 2.0.4

  • Added branch parameter (required)


Initial release of the plugin. Enables you to trigger SAST, SCA, and KICS scans directly from a TeamCity project.

  • Automatically trigger CxSAST, CxSCA and KICS scans from TeamCity projects

  • Supports use of CLI arguments to customize scan configuration

  • Automatically updates to the latest plugin version

  • Interface for viewing scan results summary and trends in the TeamCity environment

  • Direct links from within TeamCity to detailed Checkmarx One scan results and reports