This release includes the following enhancements:
Release date: October 28, 2026
Expanded MCP Support for AI-Driven Development
This release expands MCP support and enhances AI coding agent workflows, allowing agents to access additional Jtest data and capabilities while improving the efficiency of data retrieval and processing.
- New MCP tools have been added that retrieve metrics from XML reports and provide access to metric documentation, making it easier to identify and interpret relevant metrics. See Configuring the MCP Server Extension for AI Agents.
- Violation data provided through the MCP tools now includes Flow Analysis details, giving AI agents more context to analyze and fix violations.
- Parallel MCP calls are now supported, allowing multiple tool requests to be processed simultaneously for improved efficiency.
- MCP tools now support pagination for large outputs, enabling efficient access to data in smaller chunks.
- Agent skills have been enhanced with improved handling of equivalent violations, support for Flow Analysis paths, and other updates to improve result accuracy.
Static Analysis Enhancements
- New rules have been added to support CWE 4.20, and CWE mappings have been updated.
- A number of rules have been added and updated to improve support for Java 25.
For details, see New and Updated Static Analysis Rules.
Test Configuration Editor Updates
Test Configuration Editor is now a separate, optional component. See Breaking Changes for details.
- Test Configuration Editor can now be launched from the CLI to view or edit a specified test configuration or the user rule map. See Using Test Configuration Editor.
JUnit 6 Support
Support for JUnit 6 has been added for unit testing workflows.
Coverage and Test Impact Analysis Enhancements
- The Jest coverage results now include information about non-coverable classes and files, indicating that they were included in the analysis but contain no coverable code.
- Test Impact Analysis now supports method-level precision based on coverage images generated from application binaries. Previously, this level of precision was available only for images generated based on source code.
Report Enhancements
- A Test Creation section has been added to HTML reports, providing a summary of the unit tests created via the CLI.
- Reports now include information about the number of violations per severity in each project.
- The visualization of executed test details and coverage has been enhanced.
For details, see Viewing Reports.
New and Updated Test Configurations
The Security Compliance Pack has been extended by adding support for the following test configuration:
- CWE 4.20
The following test configurations have been updated:
- CWE Top 25 2025
- CWE Top 25 + On the Cusp 2025
- OWASP Top 10-2025
- UL 2900
The following test configuration has been removed:
- CWE 4.19.1
New and Updated Static Analysis Rules
The following rules have been added:
Rule ID | Header |
|---|---|
| CODSTA.ORG.CDG | Constructors should be grouped together in a type declaration |
| CODSTA.POD.SHPL | Sealed classes and interfaces should explicitly declare their permitted subclasses |
| CODSTA.READ.LBL | Lambda bodies should not exceed the maximum allowed length |
| CODSTA.READ.UCPU | Unused catch parameters should be unnamed |
| CODSTA.READ.ULPU | Unused lambda parameters should be unnamed |
| CODSTA.READ.WSBU | Use a "when" guarded case label instead of a single "if" statement inside a pattern case block |
| MOBILE.ANDROID.UBSP | Send broadcasts with an explicit receiver permission or an explicit intent |
| MOBILE.ANDROID.URRP | Register broadcast receivers with an explicit broadcast permission |
| PB.MNCS | A "case null" label should be included in "switch" statements or expressions that use patterns or string labels |
| SECURITY.DRC.SUL | Do not synchronize on shared or externally-controllable monitors |
| SECURITY.IBA.TCC | Do not disclose whether a username exists in authentication flows |
| SECURITY.WSC.SSMS | Avoid shadowing Spring Security URL request matchers |
| SECURITY.WSC.UBA | Bind BiometricPrompt.authenticate() to a KeyStore-backed CryptoObject to prevent authentication bypass |
| SECURITY.WSC.WVDBG | Do not enable WebView content debugging in production |
The following rules have been updated:
Rule ID | Updates |
|---|---|
| SECURITY.UEC.STTL | Java 25 support and improvements |
| SECURITY.UEC.WCMT | Java 25 support and improvements |
| STRUTS.PLUGIN | Java 25 support and improvements |
| CODSTA.EPC.AGBPT | Java 25 support and improvements |
| CODSTA.BP.AMRO | Java 25 support and improvements |
| CODSTA.READ.ANL | Java 25 support and improvements |
| EJB.EJB3.ULI | Java 25 support and improvements |
| GLOBAL.ASI | Java 25 support and improvements |
| HIBERNATE.SLM | Java 25 support and improvements |
| JAVADOC.ECTM | Java 25 support and improvements |
| JAVADOC.MVJDT | Java 25 support and improvements |
| JDBC.UPSC | Java 25 support and improvements |
| JUNIT.TCWNT | Java 25 support and improvements |
| NAMING.UUVN | Java 25 support and improvements |
| OOP.CQS | Java 25 support and improvements |
| OPT.ACDO | Java 25 support and improvements |
| OPT.UNC | Java 25 support and improvements |
| PB.TYPO.EB | Java 25 support and improvements |
| PB.LOGIC.ESO | Java 25 support and improvements |
| PB.API.HNCN | Java 25 support and improvements |
| PB.NUM.IMOF | Java 25 support and improvements |
| PB.NUM.PMRWLED | Java 25 support and improvements |
| PB.PDS | Java 25 support and improvements |
| SECURITY.EAB.CMP | Java 25 support and improvements |
| SECURITY.WSC.HV | Java 25 support and improvements |
| SECURITY.WSC.IDP | Java 25 support and improvements |
| SECURITY.WSC.MCMDU | Java 25 support and improvements |
| SECURITY.WSC.STREP | Java 25 support and improvements |
| SECURITY.WSC.VJFS | Java 25 support and improvements |
| TRS.CSFS | Java 25 support and improvements |
| TRS.UWIL | Java 25 support and improvements |
| UC.AURV | Java 25 support and improvements |
Support for IDEs
The following IDEs are now supported:
- Eclipse 4.40 (2026-06)
- Eclipse 4.41 (2026-09)
- IntelliJ 2026.2
VS Code Extension Enhancements
- Test Configuration Editor can now be launched from the VSCode plugin to view or edit a test configuration.
AI coding agents in VS Code can now take advantage of the expanded MCP capabilities described in Expanded MCP Support for AI-Driven Development, including enhanced access to analysis data and support for more efficient tool execution.
Breaking Changes
- Test Configuration Editor is no longer delivered with Jtest. It is now an optional component and must be downloaded from the Marketplace and installed separately. It is available at: Test Configuration Editor.
If you use the coverage tool to generate coverage reports, you must also upgrade your Java coverage agents to version 2026.2. The data format for the Java coverage agents has changed and data collected by earlier versions of coverage agents is incompatible with Jtest 2026.2.
- Support for Aider has been removed.
Additional Updates
Git worktrees are now supported.
Deprecated Support
Support for the following IDEs is deprecated and will be removed in a future release:
- Eclipse 4.27 (2023-03) - 4.30 (2023-12)
- IntelliJ 2023.1 - 2023.3
Resolved Bugs and FRs
Bug/FR ID | Description |
|---|---|
| FA-10702 | BD.SECURITY.TDSQL false negatives for JdbcTemplate query methods (Java) |
| FA-10796 | BD-PB-NOTINIT bogus violation caused by incorrect value copying on method exit |
| JT-78536 | Violations are not detected in the Android project |
| JT-78555 | Issue with PB.PDS rule - Java switch expression |
| JT-78604 | GLOBAL.UPAM, GLOBAL.UPAM, and GLOBAL.UPAM rules resulting in false positives |
| XT-44408 | Connection to license server fails to bypass proxy unless non-standard https.nonProxyHosts is set |
| XT-44472 | Jtestcov fails to write project property to coverage.xml when running against multiple agents |