Release Radar Ep05 | Five Vendors Put a Label on the Blank

Semgrep Guardian now tells you, right in your coding agent, whether its scanner actually ran. Checkmarx One 3.66 reports SCA reachability in a column with 5 possible answers. Tricentis SeaLights lists every SAP object a change touched, covered or uncovered. BlazeMeter puts a banner on a paused alert while the tests keep recording.

Release Radar reads through enterprise release notes every two weeks, so nobody on your team has to dig through them looking for the one line that matters. Episode 05 covers September 23 to October 6, 2026 with 10 releases across 6 vendors, on screen, one page at a time.

Last episode the tools put a stop in front of the save. This time they put a label on the silence. A blank result can mean clean, or it can mean nobody looked, and all of this impacts every gate, dashboard and report you have that counts an empty result as a pass.

Checkmarx One 3.66 is the heavy release this time. SCA reachability now runs inside the SCA scan, with no separate SAST scan, for Python, Java, JavaScript and C# on direct dependencies. The new Reachability column has 5 statuses, and Not Supported, Pending Analysis and Calculation Failed are 3 of them, so decide what each one does to a build before a gate reads the column. Scans started by a push or a pull request can carry the Git commit ID, the AI triage changelog names who triggered each change, and the MCP server can now change a risk's state and severity.

Semgrep September 2026 has Guardian report inside the AI coding agent whether it is set up, whether it is running, and what it scanned. It also surfaces a sign-in requirement or a server error where the developer is working. Scheduled AI detection scans now run on the branches configured for managed scans, where they used to take the source control default.

Tricentis SeaLights September 2026 changes the default in SAP Coverage Analysis. Every executable and object a change touched is listed, covered and uncovered, so the list behind a coverage percentage can be inspected. The previous gap view is still there behind the Uncovered Objects Only filter.

Perforce BlazeMeter 3.6 brings failed transaction filtering to browser based tests, so failures can be split by error code and by failed assertion. API monitoring buckets can pause notifications while the tests keep running, with a banner on the dashboard for as long as the pause lasts.

Panaya TestDynamix/Seemore October 2026 wraps an accepted AI code correction in comments carrying the Correction ID, the issue and the object, and those comments go into SAP with the code. With the compliance package, you now decide whether the person who wrote a test is allowed to approve it.

TestRail 10.8.1 reached early access on September 22 and the default track on September 28. It fixes upgrades from versions before 10.6 that could fail at the database migration, and attachments on archived cases, sections and plan entries that were wrongly reported as orphaned.

Also covered: Tricentis Tosca Cloud October 2026 generating API messages from OpenAPI and WSDL specifications, Tricentis qTest October 2026 linking test cases both ways with Tosca Cloud, Panaya Test Automation 26.10 adding an email alert for an unresponsive execution agent, and Checkmarx SCA September 2026, which adds OWASP Top 10 2025 and LLM security courses with certificate APIs.

Every release covered in this episode is written up in full under product release updates, linked by vendor in the video description.

Somebody on your team has to decide what a gate does when the answer is we don't know, and what the evidence looks like when it passes one. If that is the problem you are working on, that is the work we do. Book a conversation HERE.

Merito is a Value-Added Partner delivering AI-powered, secure, efficient and lasting enterprise solutions in AppSec, Quality, and DevSecOps.

New episode on the first and third Tuesday.