---
scope: org
organization: semgrep
release_count: 11
last_release: 2026-10-07
generated: 2026-04-21
updated: 2026-10-13
canonical: https://releases.sh/semgrep/overview.md
---

Dart reached GA, and Supply Chain gained native Bazel lockfile coverage for `rules_jvm_external` workspaces.

**Dart reached GA with pattern-matching depth behind it.** v1.180.0 added type inference for typed declarations, `&&`/`||` typed as bool, alias-aware import equivalence (a `http.get(...)` pattern matches code importing `package:http/http.dart` under any local alias), method-chain ellipsis, multi-statement patterns, and class-body ellipsis.

**Two things stopped working.**
- QL, the CodeQL query language, is gone: `--lang ql`, the `ql` rule key, and `.ql`/`.qll` targets no longer parse (v1.180.0).
- Homebrew installs are no longer supported on Intel Macs (v1.176.0).

**Supply Chain widened its lockfile coverage.** Native Bazel support recognizes a `maven_install.json` lockfile from `rules_jvm_external` paired with `MODULE.bazel` or `WORKSPACE`, attributing findings to the workspace root; Python, Go, and JS Bazel rulesets follow (v1.177.0). Bun `bun.lock` text lockfiles now parse with their dependency relationships — the binary `bun.lockb` format stays unsupported (v1.179.0). Diff scans now report added or modified dependency source files (v1.174.0).

**Engines got faster and picked up more languages.** File targeting batches path-filtering work to cut synchronization overhead on very large repos, and parallel rule parsing shards by bytes rather than worker count (v1.173.0). Regex-only rules got faster (v1.177.0). `.tofu` files now scan as Terraform automatically (v1.172.0), and the Ruby and Solidity parsers picked up newer syntax.