Image Added

Version Feature Changes

New versions of ThreadFix may deprecate, remove, and/or reintroduce features. To view a list of feature changes please see below:

3.1.2

• No feature changes in 3.1.2

3.1.1

Note the following changes to features with the introduction of ThreadFix 3.1.1:

Reintroduced

• The Check Remote Provider Application Import Status endpoint has been reintroduced

• Coverity Remote Provider has been reintroduced

Deprecated and Removed

For other REST API updates, refer to the Change Log

• The Black Duck call "/remediating" has been deprecated by Black Duck in version 2021.10.0 and has been replaced by "/upgrade"

• The SSVL Converter Tool deprecated in 3.1 has been removed

3.1

Note the following changes to features with the introduction of ThreadFix 3.1:

Deprecated and Removed

• Support has been ended for the SSVL Converter

• Bi-directional capability for Checkmarx and AppSpider has been removed

• Service Delivery/Service Request feature set is no longer supported

• Removed the Import All Vulnerabilities remote provider option

• Saved scan files on the file system will not be migrated to 3.1 (NOTE: this only impacts the raw scan files. All vulnerability data is fully retained and migrated)

• SonarQube Plugin removed from the Tools section.  Remote Provider integration still behaves as before.

• Support for the following integrations has been removed:

  • SkipFish

  • Swamp Scarf

Limitations, Scheduled for Enhancement Post 3.1

• Limit of 3000 vulnerabilities when exporting Vulnerability Search data to a .csv file.

• Remediation filters do not update automatically in 3.1, they will update with a defect status call sync. This feature is planned to be reintroduced. (NOTE: this may impact created policies based on these filters)

Absent, Scheduled for Re-introduction Post 3.1 

• The Disable Vulnerability Merging option when creating a new application has been removed, this feature is planned to be reintroduced

• Scan File Retention feature has been removed, this feature is planned to be reintroduced

• The Vulnerability Close Settings option, allowing users to close vulnerabilities only when all scanners report them closed, has been removed, but is planned to be reintroduced

• The Scan Agent tool API endpoints have not been migrated, this feature is planned to be reintroduced

• The ability to cancel queued scans has been removed, this feature is planned to be reintroduced in the future

• Time to Remediate Date policy override has been disabled, this feature will be reinstated

• Dashboard and Analytics page report caching time configuration has been disabled with plans to be re-enabled

• The Global FPR Filter Set API REST calls have been removed, with plans to be reintroduced

• Support for the following integrations has been removed, with plans for reintroduction:

  • Acunetix File Importer

  • Brakeman

  • Coverity

  • Dependency Check

  • Sonatype