CodeRabbit Changelog

When Pre-Merge Check override access is restricted with reviews.pre_merge_checks.override_requested_reviewers_only: true, members of a requested GitHub reviewer team can now ignore failing checks. Individually requested reviewers remain eligible, and the pull request author remains excluded.

Connections to issue trackers, documentation systems, and analytics tools are now configured once as a saved connection and shared across pull request reviews, Agent for Slack, and Agent for Discord, with scopes controlling access per repository, channel, conversation, or server. A Base Scope sets each product's default access, and named scopes can inherit, exclude, or override it for specific repositories, teams, or sub-projects.

Configure chat.integrations.jira.issue_template to define your own structure for Jira issue descriptions created from chat; leave it empty to let CodeRabbit choose the structure.

Enterprise organizations can now retrieve finding-level metadata for review comments on merged pull requests via GET /v1/metrics/review-comments, including severity, category, resolution outcome, and comment URL without comment text.

Comment @coderabbitai generate project vocabulary on a pull request to get an alphabetized Markdown list of up to 50 repository-specific terms. The command requires an active Essentials plan or higher.

Large reviews now send smaller requests and report oversized payloads directly instead of surfacing a generic connection error. Security findings show category, CWE, reachability, and exploitability in terminal output and --agent JSON when available. Usage reporting shows waived review spend and calculates the remaining review cap from review usage instead of unrelated product spend.

CodeRabbit adds an attack surface map that groups mapped code locations into subsystems, sorts each into lanes (entry points, trust boundaries, access controls, sinks, security configuration), and overlays open findings. Selecting a tile opens a focused flow with code location, verification state, recorded connections, and nearby security context.

Guidelines sourced from another repository can now use the { files, applyTo } object form, letting a centralized standards repository apply guidance to specific file patterns in consuming repositories. Cross-repository sources keep existing organization-boundary and access checks, with no migration needed.

CodeRabbit introduces a Review Usage dashboard under Analytics, breaking down pull request review consumption per developer and organization over rolling 7- or 30-day windows, and flags consumption anti-patterns. A new rate limits page documents what draws down the allowance, how it refills, and controls to reduce consumption, including batching commits, auto-pause configuration, and pull request attribution.

Self-hosted admins can now use {{ pr.url }} and {{ event.correlation_id }} placeholders in custom HTTP headers sent to MCP servers, linking tool requests to the triggering pull request. Logs again preserve model-usage token-count fields for per-review cost calculations, and Bitbucket Data Center reviews can pull coding guidelines from another repository with the bot holding REPO_ADMIN on the source.

Enterprise customers with the Security add-on can now pull AI Deep Scan results programmatically. The new REST endpoint requires a non-agent key with security:read scope and supports paginated JSON responses plus CSV or SARIF downloads.

Enterprise organizations can now retrieve MCP server and tool usage via a public API, with counts joinable to Metrics Data on pr_url for context overlay. Requires a new API reference.

Repository-level Custom Path Instructions can now be created, edited, and deleted to guide AI Deep Scan analysis for files matching a repository-relative path or glob.

Enterprise teams can now create, update, and delete Learnings via the public API using user or workspace keys with learning:write. Legacy org and agentic keys are excluded. Supports batch creation of 1–100 repository-scoped Learnings, idempotent deletes, and text-search filters on exports.

New Azure DevOps organizations and SSO workspaces now onboard with a Microsoft Entra service principal using client ID and client secret, while existing PAT setups keep their current flow. Admins can reuse a matching organization credential or connect Azure once when CodeRabbit cannot detect the tenant.

Pro+ and Enterprise repositories on Bitbucket Cloud can now run Post-Merge Actions, joining GitHub Cloud, GitLab Cloud, and Azure DevOps. Each code-producing action opens a distinct follow-up pull request against the default branch.

The review summary now confirms which cross-repository and pull request-specific guideline sources were applied, complementing the existing skipped-sources note.

An inline @coderabbitai autofix command now fixes only the current review thread's unresolved finding; running the command in the pull request conversation still processes all unresolved review threads. Review-checkbox Autofix keeps its review-scoped selection.

Newly scanned dependency findings now display CVE identifiers in the dependency detail drawer, each linking to its National Vulnerability Database record. Existing findings show CVE IDs only after a rescan, with no configuration changes required.

CodeRabbit now runs Vale on changed .md, .markdown, and .txt files, checking prose against your team's own checked-in editorial style rules and reporting violations as review findings. Vale is enabled by default when your repository has a supported root configuration; teams can disable it with reviews.tools.vale.enabled: false in .coderabbit.yaml.