The latest public changelog in Corgea Docs still centers on the releases published between August 17 and August 19, 2026, so this week’s roundup pulls from that release set. The highlights add broader webhook coverage for operational events, make SARIF exports more useful for dependency findings, and improve dependency scanning for teams that rely on private package registries.

Top 3 features

1. Webhooks now cover more operational events

Corgea now sends webhooks for scheduled scan failures, expired accepted risks, expired integration credentials, and completed AI pentests. That gives teams a better way to plug Corgea into the systems they already use for incident response, ticketing, and operations without waiting for someone to notice a problem in the UI.

The docs show why this matters in practice. Corgea webhooks support scan lifecycle events such as scan.failed, can be filtered by project or scheduled scan, and include plain-text summary fields that are easy to drop into Slack, Zapier, or custom endpoints. The broader event coverage also fills some real operational gaps: a failed scheduled scan can point to a missing branch or expired integration, accepted-risk expirations reopen issues automatically when the deadline hits, and completed AI pentests can kick off downstream reporting workflows.

2. SARIF exports now carry SCA findings as a separate run

Corgea now includes SCA findings in SARIF exports as a separate Corgea SCA run alongside code findings. That matters for teams that want one export artifact but still need code scanning platforms to treat dependency results as their own stream of alerts instead of flattening everything together.

The docs add useful detail here. The SCA run carries active dependency and container findings, excludes fixed findings, false positives, and accepted risks, and records data such as package name, ecosystem, CVSS score, fixed version, reachability, dependency type, and licenses. Results are attached to the manifest or lockfile that declares the dependency, and the run uses its own corgea/sca/ analysis category so tools like GitHub code scanning can track code and dependency findings separately.

3. Private package registries close a common SCA blind spot

Corgea now supports private package registries for Maven, PyPI, and NuGet, which means dependency scans can resolve internal packages and the transitive dependencies behind them. For teams with shared internal libraries, this is one of the most practical SCA upgrades in the release set because it removes a blind spot that often hides real risk.

The documentation spells out how the feature works. Registry connections can be applied across the whole organization or limited to selected projects, and a project can use multiple registries at once. Once a registry is connected, internal packages appear in the dependency tree with their sub-dependencies, previously missing vulnerabilities can surface in the usual workflows, and Corgea keeps the connection read-only so it only downloads packages and dependency metadata during scans.

More features and improvements

  • Added support for removing company administrators from teams.
  • Added page-size controls to the Scans list and scan finding tables so teams can review more than 20 results at a time.
  • Improved project filters with search and scrolling for long team and tag lists.
  • Improved issue explanations with clearer formatting and more consistent scanner-provided details.
  • Fixed duplicate page updates that could cause lists and controls to refresh twice.
  • Added support for signing in directly to Corgea Admin.
  • Unified issue tracking for SCA, container, and IaC findings so triage, assignments, due dates, accepted-risk expirations, and SLA status stay consistent across rescans.
  • Added reachability filtering to CI dependency Blocking Rules.
  • Simplified the Scans list by removing metadata-specific filters and organizing scan metadata into expandable tags with clearer project and repository details.
  • Improved Harness repository identification by unifying clone and web URLs.
  • Fixed SCA findings so bulk-triage decisions carry forward correctly across rescans.
  • Added tag filtering to the Vulnerability Workbench.
  • Added downloadable PDF scan reports through the API, including reports for completed scans with no code findings.
  • Added the acting user to issue status change webhook payloads.
  • Fixed scan detail loading indicators so they refresh when a scan completes.
  • Improved project search performance and responsiveness for workspaces with many projects.
  • Refined team badges on project pages with less dominant colors.
  • Removed the focus shadow from vulnerability accordions.
  • Improved SCA and container finding identifiers so issues stay consistently tracked across scans.
  • Fixed scan summaries so findings with image: identifiers are counted as container findings.
  • Prevented oversized IaC classification values from interrupting finding ingestion.
  • Fixed Free plan usage enforcement so unlimited scanning works as intended.
  • Fixed Harness integration selection and repository identification for projects created through the CLI.
  • Made SSO and JWT authentication availability independent of Enterprise plan checks.
  • Improved API handling of malformed or non-UTF-8 JSON requests so they return a clear validation error.