Welcome to Lucent Sky AVM version 2606 MR. Our latest release focused on expanding analysis coverage, improving remediation accuracy, and enhancing performance across the platform. Building on the unified parsing and lexing infrastructure introduced in previous releases, version 2606 delivers enhanced analysis and remediation for modern and legacy development environments, smarter dependency intelligence, and optimizations to ensure fast and consistent performance at scale. To learn more about this release, visit the Lucent Sky AVM version 2606 release notes.

Let’s take a look at the key new features and enhancements in Lucent Sky AVM version 2606.

Coverage for new standards and expanded analysis capabilities

Version 2606 extends Lucent Sky AVM’s support for industry standards and secure coding practices with updated weakness policies, including support for CWE 4.20, MISRA C 2023 and 2025, and MISRA C++ 2023. These updates help organizations align their secure development practices with the latest regulatory and industry requirements.

We also continue to expand analysis coverage across languages and platforms. The source code analysis engines for all major supported languages — including C/C++, C#, ECMAScript, Go, Java, PHP, Python, Ruby, Rust, Swift, and more — have been further optimized for performance and accuracy.

In addition, version 2606 introduces multi-platform Go analysis, enabling Go applications targeting multiple operating systems and architectures to be scanned without requiring explicit configuration. This simplifies automated workflows such as CI/CD integrations. Support for fourth-generation languages has also been expanded, including 4GL, EGL, and SQR, helping organizations modernize and secure critical systems that remain central to enterprise operations.

More intelligent dependency analysis across ecosystems

Version 2606 enhances dependency discovery and analysis for both C/C++ and ECMAScript ecosystems, improving accuracy and completeness across modern software supply chains. It also improves ingestion of SBOMs generated by ecosystem tools, enabling smoother integration with existing DevSecOps workflows and third-party tooling.

To further strengthen vulnerability prioritization, this release introduces CVSS score estimation. When a vulnerability does not have an assigned CVSS score, Lucent Sky AVM calculates an estimated score using Secure Score algorithms, ensuring vulnerabilities can still be properly filtered, prioritized, and managed based on severity.

More contextual remediation for deterministic security

Version 2606 continues to advance Lucent Sky AVM’s deterministic security approach to vulnerability remediation, focusing on producing consistent, verifiable fixes that align with application context.

This release includes improvements to C/C++ remediation algorithms, enabling automatic discovery and use of security libraries defined in custom runtimes. This is complemented by support for custom C/C++ runtimes, allowing organizations to define shared environments with specific standards, platforms, and libraries. Together, these capabilities enable remediation logic to better align with the actual execution environment and generate fixes that leverage available security libraries.

Guided Fix has also been improved, with updates to ML‑augmented remediation algorithms to generate changes that more closely match the original source code structure and style. This reduces the effort required for validation and integration while maintaining deterministic behavior in remediation outcomes.

Faster workflows and improved user experience

We continued to enhance performance across the platform in version 2606. Building on the adaptive I/O subsystem introduced in version 2603, further optimizations deliver faster and more consistent API and Web UI performance, particularly for large-scale environments with many applications or scans.

We’ve also improved the user experience across developer and stakeholder workflows:

• Express Scan (formerly Autopilot) introduces improved framework detection, directory upload support, and configurable defaults, making it easier to get started and quickly analyze applications.
• The CLI now supports the Vulnerability interface and can output JSON directly to stdout, enabling easier automation and integration into CI/CD pipelines.
• IDE extensions have improved task and I/O management, providing a smoother experience when scanning large applications or reviewing results at scale.
• Generation of JSON reports and SBOMs (CycloneDX and SPDX) is now more straightforward in both the Web UI and CLI, while PDF report generation benefits from improved performance.

Updating to 2606 MR

Version 2606 introduces several breaking changes affecting default analysis vectors, available Go runtimes, and CLI behavior. Visit the Lucent Sky AVM version 2606 release notes for details.

For customers with managed Lucent Sky AVM instances and Lucent Sky AVM On-Demand, your instances will be updated to 2606 MR in the coming days, unless affected by backward compatibility issues or an opt-out is in effect.

For customers with on-premise Lucent Sky AVM instances, you can update to 2606 MR immediately. Our support team will reach out shortly to schedule the update.