Semgrep

Dart reached GA, and Supply Chain gained native Bazel lockfile coverage for rules_jvm_external workspaces.

Dart reached GA with pattern-matching depth behind it. v1.180.0 added type inference for typed declarations, &&/|| typed as bool, alias-aware import equivalence (a http.get(...) pattern matches code importing package:http/http.dart under any local alias), method-chain ellipsis, multi-statement patterns, and class-body ellipsis.

Two things stopped working.

• QL, the CodeQL query language, is gone: --lang ql, the ql rule key, and .ql/.qll targets no longer parse (v1.180.0).
• Homebrew installs are no longer supported on Intel Macs (v1.176.0).

Supply Chain widened its lockfile coverage. Native Bazel support recognizes a maven_install.json lockfile from rules_jvm_external paired with MODULE.bazel or WORKSPACE, attributing findings to the workspace root; Python, Go, and JS Bazel rulesets follow (v1.177.0). Bun bun.lock text lockfiles now parse with their dependency relationships — the binary bun.lockb format stays unsupported (v1.179.0). Diff scans now report added or modified dependency source files (v1.174.0).

Engines got faster and picked up more languages. File targeting batches path-filtering work to cut synchronization overhead on very large repos, and parallel rule parsing shards by bytes rather than worker count (v1.173.0). Regex-only rules got faster (v1.177.0). .tofu files now scan as Terraform automatically (v1.172.0), and the Ruby and Solidity parsers picked up newer syntax.