DeepSource

And for the self-hosted crowd: Kubernetes Gateway API support is here. If you've moved off Ingress, DeepSource slots right in. Full notes: deepsource.com/changelog/2026…

AI Review just opened up to 10 more languages: Dart, Elixir, Apex, Groovy, Objective-C, VB.NET, PowerShell, Lua, Erlang, Perl. Your PRs in these languages now get the full DeepSource review treatment.

If you use monorepo mode on DeepSource, this one's for you: SCA support just landed. Each sub-repo gets its own Dependencies tab. Vulnerabilities scoped to the packages that sub-project actually uses, not the noise from elsewhere in the monorepo.

We're also currently topping the benchmarks based on F1 as compared to other tools in the market. Read our full results and methodology: deepsource.com/benchmarks

DeepSource AI Review now scores higher on the OpenSSF CVE Benchmark. Most importantly, we're seeing 4%+ gain on the F1 score. This means we're catching more real vulnerabilities without introducing a single false positive. Our precision hit 100% (zero false positives across 83 patched diffs) while recall climbed to 73.17%.

Read more on the blog: deepsource.com/blog/mcp-server

We've shipped 30 tools in this release that help you do much more: identifying security vulnerabilities in existing code base, gathering code coverage data from across all projects in your organizations, creating custom reports, triaging and marking issues as false positives.

Introducing, DeepSource's MCP Server. This bring all of DeepSource natively in your AI agent. For instance, you can automate fixing code review issues in your PRs with DeepSource + Claude Code 👇

Read more: deepsource.com/changelog/2026…

New: AI Review is now available on DeepSource Enterprise Server, with support for BYOK. This brings state-of-the-art AI code review and code security to self-hosted environments without your code passing through DeepSource Cloud or any third-party endpoint.

Read more in the latest changelog: deepsource.com/changelog/2026…

Studies suggest that most orgs take ~6mo on average to fix CVEs, but attackers exploit new CVEs in <5 days. DeepSource's new continuous CVE monitoring helps security teams change that. Our SCA engine now monitors vulnerability databases every hour. When a new CVE matches a dependency in your codebase, affected repos are re-scanned automatically and your team gets an email alert, so you can take action faster. Available now to all customers on DeepSource Cloud.

BYOK is available to all teams on DeepSource Enterprise Server, starting today. deepsource.com/blog/byok

DeepSource Enterprise Server gives you full control on how your source code is handled during code reviews. No code or data is shared with DeepSource. With this release, we bring the same guarantees for AI Review and all AI-powered features on DeepSource. If you have a BAA, a data residency agreement, or committed cloud spend, those terms cover AI Review automatically. No new vendor to approve, no new line item in procurement.

Introducing, BYOK for AI Review on DeepSource. The number one blocker we hear from enterprise teams evaluating AI code review: "We can't send our source code to a model provider we don't already have an agreement with." You can now bring your own model provider to DeepSource. Starting with support for Anthropic, OpenAI, and Google Gemini.

#install-the-cli" target="_blank" rel="nofollow noopener">docs.deepsource.com/docs/developer…

DeepSource CLI now supports Windows. Works on Windows amd64. Same functionality as macOS and Linux versions.

New: Block PRs only when it matters. Quality Gates now let you filter by severity and category, so you can fail builds on critical security issues without blocking on minor style problems. Works at the repo level and group level. Set different configurations for different teams.