---
name: Semgrep
slug: semgrep
domain: semgrep.dev
category: security
sources: 2
total_releases: 135
releases_last_30d: 4
avg_releases_per_week: 1.9
last_updated: 2026-07-19
tracking_since: 2024-02-09
canonical: https://releases.sh/semgrep
overview_url: https://releases.sh/semgrep/overview.md
tags:
  - code-analysis
  - linting
  - sast
aliases:
  - semgrep.com
accounts:
  github: "semgrep"
  x: "semgrep"
  youtube: "/c/semgrep"
---

## Overview

Gosu joined the list of languages with experimental cross-file taint analysis in v1.166.0, joining a growing interfile-capable set.

**Pro interfile taint analysis got faster and more accurate.** The interfile engine was redesigned in v1.158.0 for an estimated 20–40% speed improvement. Taint config computation now parallelizes across available jobs, and intermediate results serialize to disk to cut redundant recomputation. Cross-file tracking improved for globals, variadic functions, and lambda calls. Nested-function taint tracking landed in v1.162.0; rule validation and parsing now run in parallel across cores (v1.163.0), cutting scan startup time on large rulesets.

**JSON rule parsing became ~5× faster.** A new hand-written RFC 8259 parser replaced the previous JS-parser-based chain in v1.162.0, dropping parse time on a 382 MB rule pack from ~134s to ~28s.

**Language support broadened.** PowerShell arrived in beta (v1.155.0), Scala gained a tree-sitter parser (v1.160.0) and Scala 3.4+ trait parameters parse correctly (v1.161.0), PHP support extended to 8.1–8.5 syntax (v1.163.0), Dart gained typed metavariables and function-definition patterns (v1.164.0), and Gosu gained experimental interfile analysis (v1.166.0).

**Scan output and validation controls tightened.** `--max-match-context-size` (v1.165.0) caps characters of source code in match output, preventing enormous output from minified JavaScript. The `--x-rule-validation=full|core-only|none` flag replaced the old `--x-no-python-schema-validation`, offering finer-grained control over pre-scan rule validation.

**Security posture improved in the CLI and platform.** The CLI no longer stores API tokens in `~/.semgrep/settings.yml` when supplied via `SEMGREP_APP_TOKEN` (v1.166.0); SCM token transmission to the platform was stopped and URL-embedded credentials are redacted from error messages (v1.162.0). The platform added workflow execution usage to the AI credits dashboard, Jira ticketing for AI-powered detection findings, and a corporate SSO login prompt for organizations with SSO configured.

**The MCP server gained branch-scoped filtering.** The `semgrep_findings` tool added a `refs` parameter for branch-scoped queries and made `autotriage_verdict` optional; DNS rebinding protection was also added.

<Source name="Semgrep" slug="semgrep" type="github" releases="111" latest-version="v1.170.0" latest-date="2026-07-15T17:02:36.000Z" url="https://releases.sh/semgrep/semgrep" />
<Source name="Semgrep Release Notes" slug="semgrep-release-notes" type="feed" releases="24" latest-date="2026-07-08T16:39:28.000Z" url="https://releases.sh/semgrep/semgrep-release-notes" />

## Recent Releases

_Summaries below — fetch the release's `canonical` URL for full content, or `url` for the original source._

<Release source="semgrep" version="v1.170.0" date="July 15, 2026" published="2026-07-15T17:02:36.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.170.0" canonical="https://releases.sh/release/rel_vNzEsQo28TNYUJdBFjsEO" truncated="true">
### Release v1.170.0

## [1.170.0](https://github.com/semgrep/semgrep/releases/tag/v1.170.0) - 2026-07-15

### ### Added

- Pro C/C++ scans now skip code inside statically-...
</Release>

<Release source="semgrep" version="v1.169.0" date="July 8, 2026" published="2026-07-08T22:47:29.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.169.0" canonical="https://releases.sh/release/rel_MkPvlmdKOznxWBJlOj4wF" truncated="true">
### Release v1.169.0

Updated Dart parser to a more recent upstream version.
</Release>

<Release source="semgrep-release-notes" date="July 8, 2026" published="2026-07-08T16:39:28.000Z" url="https://docs.semgrep.dev/release-notes#july-8-2026-7-min-read" canonical="https://releases.sh/release/rel_LYci7jvkRSxRdNlK8g-lB" truncated="true">
### July 8, 2026 · 7 min read

## [June 2026](https://docs.semgrep.dev/release-notes/june-2026)

The following updates were made to Semgrep in June 2026.
</Release>

<Release source="semgrep" version="v1.168.0" date="June 24, 2026" published="2026-06-24T19:37:09.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.168.0" canonical="https://releases.sh/release/rel_DQLWSAlvqW8KxZTym2wQU" truncated="true">
### Release v1.168.0

## [1.168.0](https://github.com/semgrep/semgrep/releases/tag/v1.168.0) - 2026-06-24

### ### Added

- Added an experimental `--x-dependency-paths` fla...
</Release>

<Release source="semgrep" version="v1.167.0" date="June 17, 2026" published="2026-06-17T18:21:17.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.167.0" canonical="https://releases.sh/release/rel_H5g1jjpQmUchOoTSaAhwh" truncated="true">
### Release v1.167.0

## [1.167.0](https://github.com/semgrep/semgrep/releases/tag/v1.167.0) - 2026-06-17

### ### Added

- Added support for more operators for folding for...
</Release>

<Release source="semgrep" version="v1.166.0" date="June 11, 2026" published="2026-06-11T14:00:10.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.166.0" canonical="https://releases.sh/release/rel_IB05bOIeQfYl86tUw_aLV" truncated="true">
### Release v1.166.0

## [1.166.0](https://github.com/semgrep/semgrep/releases/tag/v1.166.0) - 2026-06-11

### ### Added

- Pro: Added experimental cross-file (interfile) a...
</Release>

<Release source="semgrep" version="v1.165.0" date="June 3, 2026" published="2026-06-03T22:02:47.000Z" url="https://github.com/semgrep/semgrep/releases/tag/v1.165.0" canonical="https://releases.sh/release/rel_MSYjGoYYLVyWFig_nP503" truncated="true">
### Release v1.165.0

## [1.165.0](https://github.com/semgrep/semgrep/releases/tag/v1.165.0) - 2026-06-03

### ### Added

- Added `--max-match-context-size` option to limit...
</Release>

<Release source="semgrep-release-notes" date="June 3, 2026" published="2026-06-03T19:49:55.000Z" url="https://docs.semgrep.dev/release-notes#june-3-2026-5-min-read" canonical="https://releases.sh/release/rel_aMrZfaH9kAsgCbOzGX3Oa" truncated="true">
### June 3, 2026 · 5 min read

## [May 2026](https://docs.semgrep.dev/release-notes/may-2026)

The following updates were made to Semgrep in May 2026.
</Release>

<Release source="semgrep-release-notes" date="June 3, 2026" published="2026-06-03T19:49:55.000Z" url="https://docs.semgrep.dev/release-notes#may-12-2026-7-min-read" canonical="https://releases.sh/release/rel_7Hvzamu_XiiuiN9LcoURf" truncated="true">
### May 12, 2026 · 7 min read

## [April 2026](https://docs.semgrep.dev/release-notes/april-2026)

The following updates were made to Semgrep in April 2026.
</Release>

<Release source="semgrep-release-notes" date="May 28, 2026" published="2026-05-28T18:02:02.000Z" url="https://docs.semgrep.dev/release-notes#july-18-2025-6-min-read" canonical="https://releases.sh/release/rel_WvmsxMbhDUtF2-_LtcNTz" truncated="true">
### July 18, 2025 · 6 min read

## [June 2025](https://docs.semgrep.dev/release-notes/june-2025)

The following updates were made to Semgrep in June 2025.
</Release>

## Fetching more

Append `.md` (markdown), `.json` (raw data), or `.atom` (feed) to any URL on this page.

- Per-source history: `https://releases.sh/semgrep/{source-slug}`
- Atom feed: `https://releases.sh/semgrep.atom`
- Individual release: `https://releases.sh/release/{release-id}`