In this release:

Initial release date: May 13, 2026
Latest update: 2026.1.3 (August 24, 2026)

Enhancements

MCP Server Endpoint for Static Analysis Violations

  • Enables large language models (LLMs) and AI-powered coding assistants that support the Model Context Protocol (MCP), such as Claude Code or GitHub Copilot, to connect directly to DTP.
  • Enables AI to apply predefined policies to static analysis results and provide assistance when fixing violations.
  • New static analysis tool: getViolations
    • Returns information about static analysis violations for given filter and build.
    • Supports two output modes: 
      • Summary mode, which returns number of violations grouped by severity
      • Detailed mode, which returns detailed information for violations by severity, by rule, or for certain files.

Cumulative Build Support for Test Impact Analysis (TIA)

  • Added support for aggregating partial test and coverage data across multiple builds into a single cumulative build.
  • Addresses resource-constrained scenarios where only a subset of tests is executed per build (for example, incremental testing or tests selected by Test Impact Analysis).
  • Enables a complete view of test and coverage results as well as Test Impact Analysis in these scenarios.

Important Notes for Upgrades

  • In certain AWS or Azure Windows Server 2025 environments, the machineId may change after upgrading. If this happens, you will need to acquire a new license for DTP and will need to acquire new network licenses for pre-existing tools.
  • The DTP MCP server now requires a license that includes the new MCP Server license feature. If you are upgrading, you must obtain an updated license to continue using the MCP server.

Other Notes

  • Improved JVM Performance and Configuration:
    • The default JVM maximum heap size (-Xmx) for both DTP and Data Collector has been increased from 4GB to 8GB to enhance performance and support larger workloads.
    • Added the ability to configure JVM arguments in a user configuration file and environment variables. See Configuring JVM Arguments Using Environment Variables for more information.
    • These improvements apply to both containerized (Docker, Kubernetes) and non-containerized deployments.
  • License Server Improvements: Added the ability to export and import filters and reservations from one license to another. See Importing and Exporting Reservations and Importing and Exporting Filters for more information.
  • Integration with Source Control Systems: Added ability to configure hyperlinks in the Source Code Viewer of the Violations Explorer. Linked files will open directly in web interface of source control system. GitHub, GitLab, and Atlassian Bitbucket are supported. See Configuring Hyperlinks to the Source Control System for more information.
  • Improved Error Handling and Security: Updated the default error handling behavior to prevent exposure of sensitive information and replaced the default Apache Tomcat error page, which could display stack traces and version details.
  • API Performance Improvements:
    • Improved the performance of /staticAnalysisViolations/trends API.
    • Increased limit of /staticAnalysisViolations/metadataSearch and /unbranchedViolations/metadataSearch from 1000 to 10000 violations.
  • Test Impact Analysis widget and report: The Impacted Tests Summary widget and drilldown report, which were previously only available through the Process Intelligence Pack, are now available in the core DTP product. See Impacted Tests - Summary Widget and Test Impact Analysis Report for more information.
  • CVE Match:
    • Enabled sorting and prioritizing violations by CVE Match in the Violations Explorer.
    • Added ability to recommend CVE Match for all violations in the filter via the Machine Learning Wizard. See CVE Match for more information.
  • Added support for PostgreSQL 18.
  • Enterprise Pack can now be configured to connect to up to MongoDB 8.2.3.
  • Added support for CWE 4.19.1 and CWE Top 25 2025 (Jtest and dotTEST).
  • Added support for OWASP Top 10 2025.

Software Shipped with DTP

The following software is shipped with DTP 2026.1:

  • Apache Tomcat: 10.1.54
  • Java Azul OpenJDK 17.0.18+8 (17.64.17)

Resolved PRs and FRs

IDDescription
DTP-29822Prevent server out of memory issue when calling violation trend API
DTP-30258Include checksum with Azure SDK jar file.
DTP-30517Error duplicating filter with resource groups while changing associated project
DTP-30702Address CVE-2026-21945 by upgrading to latest Java 17

Updates in 2026.1.1

Resolved PRs and FRs

IDDescription
CVE-2026-41842

Vulnerability resolved by upgrading to Spring 6.2.19

CVE-2026-43515

Vulnerability resolved by upgrading to Tomcat 10.1.56

CVE-2026-47838

Vulnerability resolved by upgrading to Spring Security 6.5.11

CVE-2026-48713

Vulnerability resolved by upgrading to i18next-fs-backend 2.6.6

CVE-2026-48714

Vulnerability resolved by upgrading to i18next-http-middleware 3.9.7

CVE-2026-54512
CVE-2026-54513

Vulnerability resolved by upgrading to Jackson to 2.21.4

Updates in 2026.1.2

Resolved PRs and FRs

IDDescription
CVE-2026-13149Vulnerability resolved by upgrading brace-expansion to version 5.0.7
CVE-2026-13676Vulnerability resolved by upgrading fast-uri to version 3.1.3
CVE-2026-39244Vulnerability resolved by upgrading adm-zip to version 0.6.0
CVE-2026-42588
CVE-2026-45505
CVE-2026-49157
CVE-2026-49432
CVE-2026-49434
CVE-2026-49877
CVE-2026-50734
CVE-2026-53916
CVE-2026-53917
CVE-2026-54475
Vulnerability resolved by upgrading ActiveMQ to version 6.2.7









CVE-2026-48618
CVE-2026-48933
Vulnerability resolved by upgrading NodeJS to version 22.23.1
CVE-2026-52746Vulnerability resolved by upgrading jsonata to version 2.2.1
CVE-2026-53914Vulnerability resolved by upgrading kotlin-stdlib to version 2.4.20
CVE-2026-55276
CVE-2026-53434
CVE-2026-59083
CVE-2026-59084

Vulnerability resolved by upgrading Tomcat to version 10.1.57

CVE-2026-55153Vulnerability resolved by upgrading com.mchange:c3p0 to version 0.14.1 to upgrade com.mchange:mchange-commons-java to 0.6.1
CVE-2026-59724Vulnerability resolved by upgrading socket.io to version 4.8.3
CVE-2026-59869Vulnerability resolved by upgrading js-yaml to version 4.3.0
CVE-2026-59873Vulnerability resolved by upgrading tar to version 7.5.20

Updates in 2026.1.3

  • Upgraded Azul JRE to 17.0.20.1+1
  • Upgraded Apache Tomcat to 10.1.59

Resolved PRs and FRs

IDDescription
CVE‐2026‐8763Vulnerability resolved by upgrading Bouncy Castle Java FIPS to 2.1.3
CVE-2026-14257
GHSA-rgw5-rvv9-x895
Vulnerabilities resolved by upgrading brace-expansion to 5.0.9 
CVE-2026-16221
CVE-2026-18446
Vulnerabilities resolved by upgrading fast-uri to 3.1.5
CVE-2026-56846
CVE-2026-56848
CVE-2026-58043
Vulnerabilities resolved by upgrading NodeJS to version 22.23.2
CVE-2026-59870Vulnerability resolved by upgrading js-yaml to 4.3.1
CVE-2026-59878Vulnerability resolved by upgrading ActiveMQ to 6.2.8
CVE-2026-68497Vulnerability resolved by upgrading Jackson to 2.21.6
CVE-2026-69185Vulnerability resolved by upgrading socket.io-parser to 4.2.7
CVE-2026-73566Vulnerability resolved by upgrading tar to 7.5.22
GHSA-2fvj-hgj9-j2grVulnerability resolved by upgrading Jetty to 12.0.37
GHSA-gcfj-64vw-6mp9Vulnerability resolved by upgrading axios to 1.18.1



  • No labels