This week’s roundup covers public Corgea releases from October 19 through October 21, 2026. The updates give PR scans more context, add VB6 and VB.NET support, and make it easier to follow Corgea Agent feedback.

Top 3 features

1. PR scans focus on the changes and their intent

GitHub PR scans now use changed line ranges, available patches that include removed lines, and the PR description. That gives reviews more context about what changed and why.

Corgea scans non-draft pull requests when they open and when updates are pushed. Its comments stay on lines in the PR diff, with multi-line findings anchored to the first changed line in the affected code range.

2. VB6 and VB.NET support

Corgea now supports VB6 and VB.NET, including syntax highlighting in code and fix views. Teams working in Visual Basic can review findings and suggested fixes with the same code-view experience.

3. Clearer Corgea Agent feedback history

Feedback History now separates actions that were not applied from requests that need review in Corgea, and links directly to the related finding.

The Feedback History tab records PR comment interactions, including the original comment, the Agent’s reasoning, and its response. Teams can filter the history by action type, user, or date range.

More features and improvements

  • Scan APIs now return the scan source and triggering user. Scan details also include the pull request ID when available.
  • PR review comments now lead with urgency and finding type. Code-quality comments use the review title and explanation without repeating details.
  • The taint analysis tab now shows the scanner’s data-flow path directly and avoids unnecessary trace generation when no applicable flow exists.
  • Triage decisions now carry forward when Corgea identifies a finding more precisely or recognizes it as the same issue on a non-main branch.
  • Incremental scans preserve finding types, secret subtypes, and urgency updates when they carry findings forward.
  • Scans retain the ignore rules used when they started. Changes to those rules trigger a full scan when needed.
  • CLI partial scans respect the requested file selection and scan settings without archiving unrelated pending scans.
  • The Projects page no longer drops projects that share a name or repository URL.
  • Harness project rescans now work when the integration is resolved from the repository URL.
  • Private package registries use their main repository URL with additional repositories, and their actions menu no longer clips.
  • Long-running pentests can finish their 10-hour runtime window before cleanup begins after 11 hours.
  • Workbench tab counts and grouped browsing now stay consistent across finding types, expanded findings, bulk selections, and CSV exports.
  • Workbench search explains when a file-path search needs a project filter.
  • Findings with no remaining detections are removed from the Workbench after scan deletion, reruns, or incremental-scan cleanup. Findings in other scans keep their details.
  • The Workbench shows a preparation notice until an organization’s findings are ready. Exports and bulk selections become available when preparation completes.
  • Corgea Agent uses earlier explanations and the latest requested status in PR comment threads when processing false-positive and accepted-risk decisions.
  • PR Rules dropdown lists stay with their fields while a dialog scrolls.
  • Findings now show a pending-approval badge when a false-positive or accepted-risk decision is awaiting review.
  • Incremental scans carry revalidated findings forward only after Corgea confirms they are still present. Inconclusive results remain on the earlier scan, and findings are marked fixed only on the main branch when code changes confirm removal.
  • Failed assignee updates, including updates blocked by an expired session, no longer appear successful.