SCA Resolver 2.16.2 adds the --resolver-timeout parameter, allowing pipeline users to limit how long dependency resolutions run. This standalone Checkmarx SCA release is available on October 2, 2026. Teams consuming SCA through CxOne should use those release notes to determine which SCA capabilities are available.
Set a limit on resolver execution time
AppSec engineers and developers can now use --resolver-timeout to limit resolution execution time in SCA Resolver. This gives teams a named control for bounding that part of dependency analysis when it runs in their pipelines.
Checkmarx SCA introduces the argument without a stated timeout value, default setting, or required configuration path. QA teams sharing the pipeline can account for the new argument when reviewing dependency-scan behavior and test runs.
Improve Maven resolution on restricted networks
Teams scanning Maven projects can benefit from improved offline version resolution when operating on restricted networks. The change is specific to Maven and offline version resolution; Checkmarx SCA does not identify an equivalent change for other ecosystems in this release.
For developers fixing dependency findings, this concerns the resolver's ability to determine Maven versions in those network conditions. It does not introduce a new finding type, policy, or remediation workflow.
What this means for your team
We see this as a good feature for AppSec engineers who can apply the resolver timeout where their pipeline usage needs a bound on resolution execution, while developers working with Maven on restricted networks can validate the improved offline resolution behavior. QA teams can include both cases in shared pipeline checks. CISOs and audit managers should distinguish this standalone SCA release from Checkmarx One release tracking when reviewing product scope and release evidence reports.
Based on the official Checkmarx release notes.
How Merito helps
Merito can help teams adopt and govern SCA pipeline configuration changes, including resolver behavior and Maven scan validation, through managed services.
Merito is an authorized Checkmarx reseller and services partner. Our Checkmarx SCA team helps you adopt the October 2026 changes, with implementation services to configure them for your environment and training and enablement to bring your teams up to speed.