DeepSource

If you run DeepSource in monorepo mode, today's release is for you. Monorepo mode lets you map subfolders of a single git repo as first-class repos on DeepSource, each with its own settings, dashboards, and configs. Until today, the one piece missing was SCA. That's fixed. Every sub-repo now gets its own Dependencies tab, with vulnerabilities scoped to the packages that sub-project actually uses. No noise from elsewhere in the monorepo. Clean ownership, clean triage. Two more updates in this release: AI Review just opened up to 10 more languages: Dart, Elixir, Apex, Groovy, Objective-C, VB.NET, PowerShell, Lua, Erlang, and Perl. Your PRs in these languages now get the full DeepSource review treatment. And for self-hosted teams: Enterprise Server now supports the Kubernetes Gateway API. If you've moved off Ingress, DeepSource fits in natively. Full notes: https://lnkd.in/gkE5pN_c

DeepSource AI Review now scores higher on the OpenSSF CVE Benchmark. Most importantly, we're seeing 4%+ gain on the F1 score. This means we're catching more real vulnerabilities without introducing a single false positive. Our precision hit 100% (zero false positives across 83 patched diffs) while recall climbed to 73.17%. Read our full results and methodology: https://lnkd.in/gXG-KZha

Introducing, DeepSource's MCP Server. This bring all of DeepSource natively in your AI agent. For instance, you can automate fixing code review issues in your PRs with DeepSource + Claude Code. Or, run a loop to automatically audit all vulnerabilities in OSS dependencies in your project. DeepSource provides reachability information, so any agent like Claude Code can effectively identify and upgrade packages to keep your project secure. We've shipped 30 tools in this release that help you do much more: identifying security vulnerabilities in existing code base, gathering code coverage data from across all projects in your organizations, creating custom reports, triaging and marking issues as false positives. Link to the full blog post in comments!

New: AI Review is now available on DeepSource Enterprise Server, with support for BYOK. This brings state-of-the-art AI code review and code security to self-hosted environments without your code passing through DeepSource Cloud or any third-party endpoint. Read more: https://lnkd.in/gusYSBP7

Studies suggest that most orgs take ~6mo on average to fix CVEs, but attackers exploit new CVEs in <5 days. DeepSource's new continuous CVE monitoring helps security teams change that. Our SCA engine now monitors vulnerability databases every hour. When a new CVE matches a dependency in your codebase, affected repos are re-scanned automatically and your team gets an email alert, so you can take action faster. Available now to all customers on DeepSource Cloud.

Introducing, BYOK for AI Review on DeepSource. The number one blocker we hear from enterprise teams evaluating AI code review: "We can't send our source code to a model provider we don't already have an agreement with." You can now bring your own model provider to DeepSource. Starting with support for Anthropic, OpenAI, and Google Gemini. DeepSource Enterprise Server gives you full control on how your source code is handled during code reviews. No code or data is shared with DeepSource. With this release, we bring the same guarantees for AI Review and all AI-powered features on DeepSource. If you have a BAA, a data residency agreement, or committed cloud spend, those terms cover AI Review automatically. No new vendor to approve, no new line item in procurement. BYOK is available to all teams on DeepSource Enterprise Server, starting today.

DeepSource CLI now supports Windows. Works on Windows amd64. Same functionality as macOS and Linux versions.

New: Block PRs only when it matters. Quality Gates now let you filter by severity and category, so you can fail builds on critical security issues without blocking on minor style problems. Works at the repo level and group level. Set different configurations for different teams.

Meet the new DeepSource's CLI, built to make it easier for your AI coding agent to work with our code review results. Once the CLI is installed, get the DeepSource skill and just ask your agent to monitor DeepSource's review on a PR and fix. The CLI provides several flags to get details of the review — by category, severity, or per file. Install the skill: https://lnkd.in/gjf5NbEq Read the full changelog: https://lnkd.in/gNABUVa6

We're excited to welcome Phillip Mitto to our GTM team in our SF office. Originally hailing from Connecticut, Phil is a soccer fanatic, Fulham F.C. fan, and an avid traveller. Bragging rights? He's hiked the Inca Trail to Machu Picchu.