Change log

• Added new Xcode build and MSBuild versions (see Supported build tools)
• Added new .NET (Core), C#, Java, Go, Kotlin, Scala, and Swift versions (see Language compatibility)
• Added new compiler versions OpenJDK javac and Swiftc (see Supported compilers)
• Added new com.fortify.sca.rules.Islibrary and com.fortify.sca.rules.enablePQCRules properties (fortify-rules.properties)
• Added page on analyzing library code (Analyzing Library Code)
• Added new com.fortify.sca.EnableSubtraceFiltering property (Translation and analysis phase properties)
• Added section on Composite Filters to Excluding issues with filter files

• Changed all mentions of Translating <languages> to Analyzing <languages>
• Made all the language sections top level for easy identification
• Simplified Analysis process overview
• Build integration sections have now been moved to the respective language sections
• Merged Java, Kotlin and Android sections. (see Analyzing Java, Kotlin and JSP projects)
• Reorganized iOS section. (see Analyzing iOS and Xcode projects)
• Moved the scan policy section out of the analysis overview, combined with filters and other ways to improve results into a new section. (see Optimizing Results)
• Moved section about regex analysis under a top-level section for secret scanning

• Removed ScanCentral SAST client from the OpenText SAST installer.
• Removed Gradle version 6.5 and earlier versions (see Supported build tools)

• Updated Xcode build versions (see System requirements)

• Added new rule property to control FortifyRemove comments functionality (fortify-rules.properties)

• Added Filtering comments using FortifyRemove

• MacOS ARM installers (see Acquiring software)

Updated:

• Changed all mentions of Fortify Sofware Security content to OpenText Application Security Content

• Removed xcodebuild versions 15, 15.0.1, 15.1, 15.2 (see Supported build tools)

Added:

• System requirements

• Instructions on how to create a custom scan policy (Applying a scan policy to the analysis)

Updated:

• Incorporated product name changes (see Product name changes)

• Installer file names changed for product name change (see various topics in Installing OpenText SAST)

• Test projects are excluded by default in translation of Visual Studio projects (see Visual Studio Project command-line syntax)

• Added support for Jupyter notebooks (see Translating Python code)

• Setting limiter properties is no longer required to translate code created using the Django or Flask framework

Removed:

• Properties com.fortify.sca.SuppressLowSeverity and com.fortify.sca.LowSeverityCutoff were removed because they reference metadata that is deprecated in the Rulepacks.

• The com.fortify.sca.hoa.Enable property was removed from this helpdocument and will be removed from the product in a future release.

Updated:

• Added installer for Linux on ARM (see Installing OpenText SAST)

• Scan policies can exclude dataflow issues based on taint flags (see Applying a Scan Policy to the Analysis)
• By default, NPM dependencies are excluded from the analysis phase (see Managing translation of NPM dependencies)
• Support added for Flask and Jinja2 (see Translating Python code)

• Added the -gotags option to include custom build tags in OpenText SAST translation of Go project (see Including Custom Go Build Tags and Go Properties)

• Changes to the command-line options to analyze PL/SQL (see AnalyzingTranslating SQL)

• Added an option to disable build tool name resolution and translate build script files as source files (see Translation Options and Translation and Analysis Phase Properties)

• The -exclude option is supported in Ant, Bazel, Gradle, and Maven build integrations (see Integrating with Ant, Integrating with Bazel, Using Gradle Integration, Using the Fortify Maven Plugin, and Translation Options)

Removed:

• Modular analysis was removed from this help/document. This feature is deprecated and will be removed from the product in the next release.