{"id":"org_duypVRMu8EI-ooodOs--F","slug":"semgrep","name":"Semgrep","domain":"semgrep.dev","description":null,"category":"security","avatarUrl":"https://media.releases.sh/orgs/semgrep.png","isHidden":false,"autoGenerateContent":false,"overviewCadenceDays":null,"featured":false,"fetchPaused":false,"discovery":"curated","status":"tracked","tags":["code-analysis","linting","sast"],"sourceCount":2,"releaseCount":135,"releasesLast30Days":4,"avgReleasesPerWeek":1.9,"lastFetchedAt":"2026-07-19T23:57:34.068Z","lastPolledAt":"2026-07-19T23:57:27.678Z","trackingSince":"2024-02-09T09:01:57.000Z","aliases":["semgrep.com"],"accounts":[{"platform":"github","handle":"semgrep"},{"platform":"x","handle":"semgrep"},{"platform":"youtube","handle":"/c/semgrep"}],"products":[],"sources":[{"id":"src_ifhg1AYVmbNjpUDvGZ9MZ","slug":"semgrep","name":"Semgrep","type":"github","url":"https://github.com/semgrep/semgrep","isPrimary":false,"isHidden":false,"discovery":"curated","fetchPriority":"normal","lastFetchedAt":"2026-07-19T21:45:44.594Z","lastPolledAt":"2026-07-19T21:45:36.284Z","releaseCount":111,"latestVersion":"v1.170.0","latestDate":"2026-07-15T17:02:36.000Z","latestAddedAt":"2026-07-15T20:12:39.232Z","productSlug":null,"productName":null,"kind":"tool","metadata":"{\"evaluatedMethod\":\"github\",\"evaluatedAt\":\"2026-04-11T13:59:08.092Z\",\"changelogUrl\":\"https://github.com/semgrep/semgrep/blob/HEAD/CHANGELOG.md\",\"changelogDetectedAt\":\"2026-04-11T14:01:04.703Z\",\"wellKnownSweptAt\":\"2026-07-16T06:00:26.474Z\",\"sourceActor\":{\"nextAlarmAt\":\"2026-07-20T01:41:48.606Z\",\"lastAlarmAt\":\"2026-07-19T21:41:50.098Z\",\"managed\":true}}"},{"id":"src_Ng5sDm0IB19_t9vq49ndv","slug":"semgrep-release-notes","name":"Semgrep Release Notes","type":"feed","url":"https://semgrep.dev/docs/release-notes","isPrimary":false,"isHidden":false,"discovery":"curated","fetchPriority":"normal","lastFetchedAt":"2026-07-19T23:57:34.068Z","lastPolledAt":"2026-07-19T23:57:27.678Z","releaseCount":24,"latestVersion":null,"latestDate":"2026-07-08T16:39:28.000Z","latestAddedAt":"2026-07-08T20:12:40.415Z","productSlug":null,"productName":null,"kind":"tool","metadata":"{\"evaluatedMethod\":\"feed\",\"evaluatedAt\":\"2026-04-11T13:59:07.656Z\",\"feedUrl\":\"https://semgrep.dev/docs/release-notes/rss.xml\",\"feedType\":\"rss\",\"feedDiscoveredAt\":\"2026-04-11T13:59:07.656Z\",\"noFeedFound\":false,\"provider\":\"docusaurus\",\"providerDetectedAt\":\"2026-04-11T13:59:07.656Z\",\"feedEtag\":\"\\\"8454b7e32155a0b961c7d74bda391dac-ssl\\\"\",\"feedContentLength\":\"131265\",\"feedContentDepth\":\"anchor-fragment\",\"feedLastModified\":\"Sun, 19 Jul 2026 23:57:32 GMT\",\"sourceActor\":{\"nextAlarmAt\":\"2026-07-20T03:54:05.040Z\",\"lastAlarmAt\":\"2026-07-19T23:54:06.427Z\",\"managed\":true}}"}],"overview":{"scope":"org","content":"Gosu joined the list of languages with experimental cross-file taint analysis in v1.166.0, joining a growing interfile-capable set.\n\n**Pro interfile taint analysis got faster and more accurate.** The interfile engine was redesigned in v1.158.0 for an estimated 20–40% speed improvement. Taint config computation now parallelizes across available jobs, and intermediate results serialize to disk to cut redundant recomputation. Cross-file tracking improved for globals, variadic functions, and lambda calls. Nested-function taint tracking landed in v1.162.0; rule validation and parsing now run in parallel across cores (v1.163.0), cutting scan startup time on large rulesets.\n\n**JSON rule parsing became ~5× faster.** A new hand-written RFC 8259 parser replaced the previous JS-parser-based chain in v1.162.0, dropping parse time on a 382 MB rule pack from ~134s to ~28s.\n\n**Language support broadened.** PowerShell arrived in beta (v1.155.0), Scala gained a tree-sitter parser (v1.160.0) and Scala 3.4+ trait parameters parse correctly (v1.161.0), PHP support extended to 8.1–8.5 syntax (v1.163.0), Dart gained typed metavariables and function-definition patterns (v1.164.0), and Gosu gained experimental interfile analysis (v1.166.0).\n\n**Scan output and validation controls tightened.** `--max-match-context-size` (v1.165.0) caps characters of source code in match output, preventing enormous output from minified JavaScript. The `--x-rule-validation=full|core-only|none` flag replaced the old `--x-no-python-schema-validation`, offering finer-grained control over pre-scan rule validation.\n\n**Security posture improved in the CLI and platform.** The CLI no longer stores API tokens in `~/.semgrep/settings.yml` when supplied via `SEMGREP_APP_TOKEN` (v1.166.0); SCM token transmission to the platform was stopped and URL-embedded credentials are redacted from error messages (v1.162.0). The platform added workflow execution usage to the AI credits dashboard, Jira ticketing for AI-powered detection findings, and a corporate SSO login prompt for organizations with SSO configured.\n\n**The MCP server gained branch-scoped filtering.** The `semgrep_findings` tool added a `refs` parameter for branch-scoped queries and made `autotriage_verdict` optional; DNS rebinding protection was also added.","releaseCount":24,"lastContributingReleaseAt":"2026-06-11T14:00:10.000Z","generatedAt":"2026-04-21T01:05:53.427Z","updatedAt":"2026-06-16T12:40:36.744Z","citations":[{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.166.0","title":"Release v1.166.0","releaseId":"rel_IB05bOIeQfYl86tUw_aLV","releaseWebUrl":"https://releases.sh/release/rel_IB05bOIeQfYl86tUw_aLV-release-v1-166-0"},{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.158.0","title":"Release v1.158.0","releaseId":"rel_pDQRXdTC3oO0yxdBigdSL","releaseWebUrl":"https://releases.sh/release/rel_pDQRXdTC3oO0yxdBigdSL-release-v1-158-0"},{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.162.0","title":"Release v1.162.0","releaseId":"rel_ZqlMLdNRP61z35ul06JMs","releaseWebUrl":"https://releases.sh/release/rel_ZqlMLdNRP61z35ul06JMs-release-v1-162-0"},{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.164.0","title":"Release v1.164.0","releaseId":"rel_8NZaLt16ID0nptXrsr7mh","releaseWebUrl":"https://releases.sh/release/rel_8NZaLt16ID0nptXrsr7mh-release-v1-164-0"},{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.166.0","title":"Release v1.166.0","releaseId":"rel_IB05bOIeQfYl86tUw_aLV","releaseWebUrl":"https://releases.sh/release/rel_IB05bOIeQfYl86tUw_aLV-release-v1-166-0"},{"sourceUrl":"https://semgrep.dev/docs/release-notes/april-2026","title":"April 2026","releaseId":"rel_LUULnUvjuKyFiMMVsJEwC","releaseWebUrl":"https://releases.sh/release/rel_LUULnUvjuKyFiMMVsJEwC-april-2026"},{"sourceUrl":"https://github.com/semgrep/semgrep/releases/tag/v1.162.0","title":"Release v1.162.0","releaseId":"rel_ZqlMLdNRP61z35ul06JMs","releaseWebUrl":"https://releases.sh/release/rel_ZqlMLdNRP61z35ul06JMs-release-v1-162-0"}]},"playbook":null,"notice":null}