Semgrep

Supply Chain now reports every package declared in a requirements.txt instead of dropping version ranges and bare names with a "not pinned to an exact version" parse error, though these produce no findings until an installed version is known. Also fixed lockfileless Gradle resolution when builds relocate their build directory, and historical secrets scanning no longer aborts when a preparatory git gc fails.

1.180.0 - 2026-10-07

1.179.0 - 2026-10-01

1.178.0 - 2026-09-23

### Changed

• The bundled tree-sitter C runtime is now 0.26.3. (CODE-9425)

### Fixed

• Fixed an occasional hang when semgrep-core exited on Windows. (windows-hang)

1.177.0 - 2026-09-10

1.176.0 - 2026-09-01

### Changed

• Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

1.175.0 - 2026-08-26

### Changed

• Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

1.174.0 - 2026-08-20

1.173.0 - 2026-08-12

1.172.0 - 2026-07-28

1.171.0 - 2026-07-22

1.170.0 - 2026-07-15

Updated Dart parser to a more recent upstream version.

1.168.0 - 2026-06-24

1.167.0 - 2026-06-17

1.166.0 - 2026-06-11

1.165.0 - 2026-06-03

1.164.0 - 2026-05-26

1.163.0 - 2026-05-13

1.162.0 - 2026-05-07