Transfer the ownership of an account from the dashboard.

Set thresholds for a metric, such as Line Coverage or Documentation Coverage, in your repository and configure DeepSource to fail the check on the VCS (like GitHub, GitLab, or Bitbucket) if a PR makes the metric go below the threshold.

Configure SSO / SAML authentication and user management with Azure AD in DeepSource.

Update the metric thresholds for a metric in a repository. For instance, you'd be able to change the threshold for a metric like Line Coverage or Documentation Coverage for Python using our GraphQL API.

Consolidated report to see all violations of OWASP Top 10 in a repository or across all repositories in the organization.

Consolidated report to see all violations of SANS Top 25 in a repository or across all repositories in the organization.

View a snapshot of the frequency of issues and their trend in a repository or across all repositories in the organization.

Create a password-protected public report and share it with the right stakeholders.

A team-level report will allow you to see the coverage metrics of all repositories in the organization on which DeepSource analysis is active and the Test Coverage analyzer is activated.

We're currently working on the official support for C++ in DeepSource's static analysis and SAST offerings.

A new code coverage metric to track the overall coverage that's a combination of line coverage, branch coverage, and condition coverage.

Problem: In our Bitbucket integration, the DeepSource widget shows for all repositories regardless of whether DeepSource is active or not. This is not a good user experience, as it can be noisy and obtrusive.

Solution: Show the widget only on the PRs made to active repositories on Bitbucket.

Taint analysis is a process used in information security to identify the flow of user input through a system to understand the security implications of the system design. This analysis aims to mitigate risks such as SQL injection, which generally arise when other parts of the program use user input without proper sanitization.

Currently, the test coverage analyzer expects the users to send the combined coverage reports (if there are multiple test suites). This can become difficult if multiple jobs are running independently. With this implementation, the user can send multiple reports and the test coverage analyzer should be able to combine all the reports at our end before analyzing them.

Enable users to delete a user account from the dashboard.

We're making changes to the API schema for metrics under the repository API to make it more accessible and adhering to best practices.

Support for popular code formatters.

Integration with Azure DevOps for syncing teams and repositories.

Authentication and user management with popular SSO / SAML providers in DeepSource Enterprise Cloud. Currently, this is only available for DeepSource Enterprise Server customers.

Some teams do not run tests on the default branch after merging a PR and only run tests on the pull requests. Since DeepSource uses the default branch analysis runs as the source of truth for metrics and issues, coverage metrics are not tracked. We are working on adding support for code coverage even when tests aren't run on the default branch.

We are working on improving account preference settings for users and teams in the dashboard.

Administrators of a team should be able to see a rolled-up audit log of all actions and events in the team. Currently, the audit log is available only on the repository level.

Add support for System for Cross-domain Identity Management (SCIM) in DeepSource for Enterprise Cloud users. This will enable users to use SCIM in conjunction with SAML-based SSO for real-time provisioning, updating, and de-provisioning of team members based on changes in their Identity Provider.

Currently, Autofix™️ commits do not follow the standard commit convention. This can create inconsistencies in the commit history within the repositories. We're working on improving Autofix™️ commits to align with conventional standards.

Users track several repository metrics on DeepSource and set thresholds on the overall values of these metrics. However, when making a new pull request, it's helpful to have different thresholds on the overall metric value and that calculated only on new code being added (generally a higher threshold). For instance, it might be helpful to have a threshold of 75% on branch coverage for the overall code and a higher threshold, like 90%, for new code changes in a pull request.

Currently, we support new line coverage as a separate metric. We're exploring generalizing this so thresholds can be tracked on all metrics.

DeepSource triggers an analysis whenever a PR is created against the default branch. Subsequently, each time a change is pushed, the analysis is rerun. Currently, if users want to manually trigger or stop an analysis, they must close and reopen the PR or push a new change. We are working on enabling users to rerun or cancel an analysis from their dashboard.

Currently, it is not possible to prevent analysis and transformers from running on DeepSource. We are working on adding support for standard skip commands, such as [skip ci], [ci skip], [no ci], or the ci.skip flag in git pushes to enable users to skip running analysis or transformers on a specific commit.

As software projects become more complex and interconnected, organizations use monorepos to have multiple projects in a single large repository. Monorepos are currently treated the same way as single project repositories in DeepSource. We are exploring ways to add first-class support for monorepos. 

Support for the Swift programming language in our Static Analysis and SAST offerings.

Support for the Kotlin programming language in our Static Analysis and SAST offerings.

Support for Autofix™️ in the Java Analyzer

Enable users to Autofix issues raised by C/C++ Analyzer.

Enable users to trigger partial analysis runs from their IDEs, such as VS Code, JetBrains, and others. This will help resolve potential issues before committing code.

We are working on adding support for reporting MISRA(Motor Industry Software Reliability Association) violations in the C and C++ Analyzer. This will enable users to ensure compliance with MISRA standards in their codebases, improving code quality and reducing potential issues.

Support analysing Python files locally in VSCode to detect all DeepSource issues before making a Pull request.

Support for the JavaScript Analyzer locally in VSCode to detect all DeepSource issues before making a Pull request.

Support for the Go Analyzer locally in VSCode to detect all DeepSource issues before making a Pull request.

Currently, only pull requests that are forked off the default branch (such as master or main) have baseline analysis, meaning DeepSource raises only new issues detected in the pull request as compared to the default branch's baseline.

If a new pull request is forked off of an existing pull request, the base branch doesn't match the default branch, making DeepSource unable to infer the new issues. In this case, we default to showing all issues in the branch, which can be annoying.

We're working on implementing baseline analysis for non-default branches to solve this.

Add an embeddable badge for code coverage that can help users promote their coverage metrics in third-party tools and external websites.

Currently, DeepSource Enterprise Server requires you to run the entire DeepSource infrastructure on your servers. This means maintaining the infrastructure on your own, which can cause additional overhead for teams with usage at scale. We're working on simplifying this by moving the control plane to DeepSource Enterprise Cloud while still ensuring the analysis runtime (and hence all access to source code) stays within your servers.

The self-hosted runners are lightweight analysis runners that you can host on your servers and configure with your version control system. All the access to source code will be limited to these runners, while you can use DeepSource Enterprise Cloud as your primary way of interacting with DeepSource, without having to host and manage the entire DeepSource infrastructure.

SARIF, or Static Analysis Results Interchange Format, is an open standard file format that facilitates the exchange of results between static analysis tools. Teams widely use it to integrate different tools, automate workflows and track code quality over time.

We are exploring ways to add support for SARIF 2.0 into our existing Analyzers and to support 3rd party Analyzers in DeepSource.

Official support for the Dart programming language on DeepSource for static analysis and SAST.

Support for Kubernetes in our Infrastructure as Code(IaC) offerings.

For organizations with many repositories, it can become difficult for the users to understand which repositories require adding which Analyzers. Currently, we do not show the language composition of a repository unless it has been activated. We should show the language icons for all repositories regardless.

To provide users with a quick overview of analysis results, we are working on automatically adding a brief summary of the analysis as a comment within the VCS provider once the analysis is complete.

Enable users to quickly access their most frequently used repositories.