In this release:
Initial release date: May 13, 2026
Latest update: 2026.1.3 (August 24, 2026)
Enhancements
MCP Server Endpoint for Static Analysis Violations
- Enables large language models (LLMs) and AI-powered coding assistants that support the Model Context Protocol (MCP), such as Claude Code or GitHub Copilot, to connect directly to DTP.
- Enables AI to apply predefined policies to static analysis results and provide assistance when fixing violations.
- New static analysis tool:
getViolations- Returns information about static analysis violations for given filter and build.
- Supports two output modes:
- Summary mode, which returns number of violations grouped by severity
- Detailed mode, which returns detailed information for violations by severity, by rule, or for certain files.
Cumulative Build Support for Test Impact Analysis (TIA)
- Added support for aggregating partial test and coverage data across multiple builds into a single cumulative build.
- Addresses resource-constrained scenarios where only a subset of tests is executed per build (for example, incremental testing or tests selected by Test Impact Analysis).
- Enables a complete view of test and coverage results as well as Test Impact Analysis in these scenarios.
Important Notes for Upgrades
- In certain AWS or Azure Windows Server 2025 environments, the
machineIdmay change after upgrading. If this happens, you will need to acquire a new license for DTP and will need to acquire new network licenses for pre-existing tools. - The DTP MCP server now requires a license that includes the new MCP Server license feature. If you are upgrading, you must obtain an updated license to continue using the MCP server.
Other Notes
- Improved JVM Performance and Configuration:
- The default JVM maximum heap size (-Xmx) for both DTP and Data Collector has been increased from 4GB to 8GB to enhance performance and support larger workloads.
- Added the ability to configure JVM arguments in a user configuration file and environment variables. See Configuring JVM Arguments Using Environment Variables for more information.
- These improvements apply to both containerized (Docker, Kubernetes) and non-containerized deployments.
- License Server Improvements: Added the ability to export and import filters and reservations from one license to another. See Importing and Exporting Reservations and Importing and Exporting Filters for more information.
- Integration with Source Control Systems: Added ability to configure hyperlinks in the Source Code Viewer of the Violations Explorer. Linked files will open directly in web interface of source control system. GitHub, GitLab, and Atlassian Bitbucket are supported. See Configuring Hyperlinks to the Source Control System for more information.
- Improved Error Handling and Security: Updated the default error handling behavior to prevent exposure of sensitive information and replaced the default Apache Tomcat error page, which could display stack traces and version details.
- API Performance Improvements:
- Improved the performance of
/staticAnalysisViolations/trendsAPI. - Increased limit of
/staticAnalysisViolations/metadataSearchand/unbranchedViolations/metadataSearchfrom 1000 to 10000 violations.
- Improved the performance of
- Test Impact Analysis widget and report: The Impacted Tests Summary widget and drilldown report, which were previously only available through the Process Intelligence Pack, are now available in the core DTP product. See Impacted Tests - Summary Widget and Test Impact Analysis Report for more information.
- CVE Match:
- Enabled sorting and prioritizing violations by CVE Match in the Violations Explorer.
- Added ability to recommend CVE Match for all violations in the filter via the Machine Learning Wizard. See CVE Match for more information.
- Added support for PostgreSQL 18.
- Enterprise Pack can now be configured to connect to up to MongoDB 8.2.3.
- Added support for CWE 4.19.1 and CWE Top 25 2025 (Jtest and dotTEST).
- Added support for OWASP Top 10 2025.
Software Shipped with DTP
The following software is shipped with DTP 2026.1:
- Apache Tomcat: 10.1.54
- Java Azul OpenJDK 17.0.18+8 (17.64.17)
Resolved PRs and FRs
| ID | Description |
|---|---|
| DTP-29822 | Prevent server out of memory issue when calling violation trend API |
| DTP-30258 | Include checksum with Azure SDK jar file. |
| DTP-30517 | Error duplicating filter with resource groups while changing associated project |
| DTP-30702 | Address CVE-2026-21945 by upgrading to latest Java 17 |
Updates in 2026.1.1
Resolved PRs and FRs
| ID | Description |
|---|---|
| CVE-2026-41842 | Vulnerability resolved by upgrading to Spring 6.2.19 |
| CVE-2026-43515 | Vulnerability resolved by upgrading to Tomcat 10.1.56 |
| CVE-2026-47838 | Vulnerability resolved by upgrading to Spring Security 6.5.11 |
| CVE-2026-48713 | Vulnerability resolved by upgrading to i18next-fs-backend 2.6.6 |
| CVE-2026-48714 | Vulnerability resolved by upgrading to i18next-http-middleware 3.9.7 |
| CVE-2026-54512 CVE-2026-54513 | Vulnerability resolved by upgrading to Jackson to 2.21.4 |
Updates in 2026.1.2
Resolved PRs and FRs
| ID | Description |
|---|---|
| CVE-2026-13149 | Vulnerability resolved by upgrading brace-expansion to version 5.0.7 |
| CVE-2026-13676 | Vulnerability resolved by upgrading fast-uri to version 3.1.3 |
| CVE-2026-39244 | Vulnerability resolved by upgrading adm-zip to version 0.6.0 |
| CVE-2026-42588 CVE-2026-45505 CVE-2026-49157 CVE-2026-49432 CVE-2026-49434 CVE-2026-49877 CVE-2026-50734 CVE-2026-53916 CVE-2026-53917 CVE-2026-54475 | Vulnerability resolved by upgrading ActiveMQ to version 6.2.7 |
| CVE-2026-48618 CVE-2026-48933 | Vulnerability resolved by upgrading NodeJS to version 22.23.1 |
| CVE-2026-52746 | Vulnerability resolved by upgrading jsonata to version 2.2.1 |
| CVE-2026-53914 | Vulnerability resolved by upgrading kotlin-stdlib to version 2.4.20 |
| CVE-2026-55276 CVE-2026-53434 CVE-2026-59083 CVE-2026-59084 | Vulnerability resolved by upgrading Tomcat to version 10.1.57 |
| CVE-2026-55153 | Vulnerability resolved by upgrading com.mchange:c3p0 to version 0.14.1 to upgrade com.mchange:mchange-commons-java to 0.6.1 |
| CVE-2026-59724 | Vulnerability resolved by upgrading socket.io to version 4.8.3 |
| CVE-2026-59869 | Vulnerability resolved by upgrading js-yaml to version 4.3.0 |
| CVE-2026-59873 | Vulnerability resolved by upgrading tar to version 7.5.20 |
Updates in 2026.1.3
- Upgraded Azul JRE to 17.0.20.1+1
- Upgraded Apache Tomcat to 10.1.59
Resolved PRs and FRs
| ID | Description |
|---|---|
| CVE‐2026‐8763 | Vulnerability resolved by upgrading Bouncy Castle Java FIPS to 2.1.3 |
| CVE-2026-14257 GHSA-rgw5-rvv9-x895 | Vulnerabilities resolved by upgrading brace-expansion to 5.0.9 |
| CVE-2026-16221 CVE-2026-18446 | Vulnerabilities resolved by upgrading fast-uri to 3.1.5 |
| CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 | Vulnerabilities resolved by upgrading NodeJS to version 22.23.2 |
| CVE-2026-59870 | Vulnerability resolved by upgrading js-yaml to 4.3.1 |
| CVE-2026-59878 | Vulnerability resolved by upgrading ActiveMQ to 6.2.8 |
| CVE-2026-68497 | Vulnerability resolved by upgrading Jackson to 2.21.6 |
| CVE-2026-69185 | Vulnerability resolved by upgrading socket.io-parser to 4.2.7 |
| CVE-2026-73566 | Vulnerability resolved by upgrading tar to 7.5.22 |
| GHSA-2fvj-hgj9-j2gr | Vulnerability resolved by upgrading Jetty to 12.0.37 |
| GHSA-gcfj-64vw-6mp9 | Vulnerability resolved by upgrading axios to 1.18.1 |