Semgrep
$
npx @buildinternet/releases get semgrepMon
Wed
Fri
SepOctNovDecJanFebMarAprMayJunJulAugSep
LessMore
Releases12Avg4/moVersionsv1.165.0 to v1.176.0
Last Checked
1h ago
npx @buildinternet/releases get semgrep--x-partial-scan-rule-id) now resolve dependencies only for
subprojects whose ecosystem is evaluated by the rules being run. Subprojects in
any other ecosystem are skipped and reported to semgrep-app as skipped
subprojects. (SC-3830)semgrep-core -version now reports the git commit that the binary was built
from. (core-version-git-sha)no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)layout at, assembly flags, global using-directives, EVM Cancun builtins) and corrected ternary/?: vs member-access precedence. (LANG-207)metavariable-regex or a binding-introducing
metavariable-pattern would emit a duplicate finding on the same range whose
message still contained the raw metavariable (e.g. a hash $ALG was detected)
instead of the substituted value. Only the correctly-substituted finding is now
reported. (ENGINE-2932)use with a nested path (e.g. use a::b::C). It was wrongly being
resolved as b:🅰️:C. (LANG-234).tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)!=, case/when expressions with line breaks, and element references that take a block. (LANG-206)semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)--debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)Scan Status output when no code rules will run (e.g. a
Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
confusing "0 Code rules", and the "Code Rules" section now states explicitly
either that code scanning is not enabled or that there are no code rules to run,
instead of printing an empty table. (ENGINE-2878)#if 0 ... #else ... #endif). Patterns that would otherwise
match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)semgrep install-semgrep-pro now sends usage metrics so that
installation errors can be tracked. Metrics can be disabled with
--metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also
now include the method used to install the Semgrep CLI (pip, homebrew,
docker, or unknown), detected heuristically. See metrics.md for
more details of what exactly is sent. (engine-2858)#if 0 filtering now also handles cases where the directive splits a
syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on
recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's
build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)
Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax
(<<EOF, <<-EOF, quoted delimiters). (LANG-263)
metavariable-type now supports fully qualified type names in languages
where a qualified name in type position parses as an expression (e.g.
Python's types: [a.b.C]) when the metavariable's type is determined by
type inference, such as Pro engine cross-file type resolution. (LANG-583)
Updated the ocaml-tree-sitter-core dependency to the latest main.
parser.c with the tree-sitter version that produced it.--x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122)--no-exclude-binary-files to
scan binary files as before. (ENGINE-2708)semgrep ci with --sarif now correctly populates the output's ignores
field with nosemgrep-suppressed findings, in accordance with other output
formatters. (gh-6651)Updated the ocaml-tree-sitter-core submodule to the latest upstream main, providing
(ocaml-tree-sitter-core-bump)
0x_dead_beef, 0o_755, 0b_1010_1010). (LANG-533)def and class definitions. (LANG-536)~/.semgrep/settings.yml's stored
token when the current scan's token is supplied via the SEMGREP_APP_TOKEN
envvar. (SEC-2240)semgrep ci scans originating from a pre-commit hook will no longer fail with
Unable to create '<tmp>/.git/index.lock': Not a directory in certain cases. (engine-2736)--max-match-context-size option to limit the number of characters of source code included as context for each match in the output. This prevents matches in minified files (e.g., minified JavaScript where the entire file is a single line) from producing enormous output Set to 0 for unlimited, which is the default value. (ENGINE-2117)--x-no-python-schema-validation with a value-taking --x-rule-validation=full|core-only|none flag. The default (full) preserves existing Python rule validation behavior; core-only matches the old flag's semantics (disables Python rule validation and uses semgrep-core RPC validation only); none skips both pre-validation passes, surfacing rule errors at scan-time. --x-no-python-schema-validation is still accepted as a no-op with a deprecation warning, and will be removed in a future release. (x-rule-validation)validation_error results on HTTP secret validators (Facebook, Slack, Stripe, Google, Cloudflare, etc.) by retrying transient network failures, mirroring the retry behavior already present for AWS validators. (SCRT-965)$X as T) and metavariable-type,
metavariable binding inside string interpolations, and function-definition
patterns that match Dart function definitions. (gh-11678)>=2.35 to >=2.34, allowing users on distros
that ship glibc 2.34 (e.g RHEL 9 & AL2023) to install the semgrep wheel. (gh-11622)Baseline diff scans (semgrep ci and --baseline-commit) no longer treat every finding on a file as newly introduced when rule(s) failed during the baseline run.
Per-rule failures (for example a timeout for a single rule) on baseline analysis now hide only that rule's matches on that file from the "new vs baseline" comparison. Other rules on the same file are still taken in comparison for the "new vs baseline" comparison.
Per-file, rule-independent failures now hide all findings on that file from the "new vs baseline" comparison. (LANG-515)
Fixed a yarn.lock parse error on Yarn Berry entries written in YAML explicit-key form. Affected lockfiles previously failed to parse. (SC-3479)
The (beta) SBT resolver with --allow-local-builds now correctly identifies dependencies as part of the Maven ecosystem. (SC-3522)
Fix --sarif-output and --sarif causing nosemgrep-suppressed findings to be reported in CLI scan output and to block scans. Suppressed findings are now correctly excluded from terminal text output, the scan-summary count, and the CLI's exit code. (engine-1824)
Fixed a bug that could cause unreliable target filtering in parallel scans. (gh-6313)
Dart: improved parser fidelity for Dart 3 grammar features and routed
pattern parsing for statements beginning with await, rethrow, and other
statement keywords. Eliminates a large class of PartialParsing errors on
real-world pub.dev packages. (gh-11678)
semgrep-core-proprietary so the binary works when semgrep install-semgrep-pro is invoked, and semgrep is installed via Homebrew. (pro-binary-homebrew)<case>.named_ast.expect golden files for tests/intrafile/maturity/ fixtures, exercised by Unit_maturity_named_asts. (LANG-287)semgrep ci startup time with App-provided rules by avoiding duplicate semgrep-core rule validation during CLI rule loading while preserving config-style failures for invalid rules. (ci-rule-validation-startup)json.dumps([rule.raw])) but was being created with a .yaml suffix.
OCaml's Parse_rule.parse_file dispatches purely on file extension, so this
routed every TR rule through Yaml_to_generic.parse_yaml_file (the slow YAML
path) instead of Fast_json.parse_program (the new hand-written RFC 8259
parser). Switching the suffix to .json lines the suffix up with the actual
content and lets every TR rule parse take the fast path. (tr-json-suffix)semgrep_findings tool: added a refs parameter to filter findings by branch (defaults to the primary branch when not specified), and made autotriage_verdict optional so that findings without an AI verdict can also be returned. (engine-2723)import and importstr now reject paths that resolve outside the
rule file's parent directory. (ENGINE-2727)Authorization header
values from git error messages and from the captured tracebacks sent to
the fail-open telemetry endpoint, preventing leaks of secrets like
CI_JOB_TOKEN from a failed git fetch in GitLab CI. Also closes
ENGINE-2731 (raw, unsanitized tracebacks in fail-open telemetry). (ENGINE-2728)semgrep ci no longer transmits SCM tokens to the Semgrep Platform. (ENGINE-2729)~/.semgrep/semgrep.log or $SEMGREP_LOG_FILE) now respects the requested log level instead of always being written at DEBUG. This narrows the surface for credentials to land on disk via CI runner filesystems or job artifacts; pass --debug to restore the previous behavior. (ENGINE-2730)imports
or runtime function calls that recurse forever. (ENGINE-2727-dos)SEMGREP_LOG_SRCS=cohttp.client. (ENGINE-2712)--no-x-run-taint-once as a flag. (engine-2468)SEMGREP_DISABLE_CONFIG_DOWNLOAD_V2=1 to fall back to the legacy endpoint. (SMS-2284)codeFlows. (engine-2570)$C.getInstance(...), and then
use metavariable-type on $C to check its type. (LANG-271)metavariable-type. (LANG-271)semgrep ci when run in a git repo with no remote origin set (gh-11342)Removed the experimental and undocumented command semgrep install-ci. (osemgrep-install-ci)
Migrate from publishing a single Linux wheel with the platform tag musllinux_1_0_<arch>.manylinux2014_<arch> to publishing two separate wheels:
(pypi-linux-tag)
--secrets-timeout flag. (engine-2593)semgrep ci with --debug and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when --debug was active. (ENGINE-2491)-j) (engine-2512)semgrep scan $(git ls-files '*.py')) caused one semgrep-core
subprocess to be spawned per file. Roots that are not directories are now
handled directly in Python without any subprocess overhead. (gh-11404)for-yield (LANG-193)def f (a: t) =
foo()
bar()
``` (lang-194)
Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of --allow-local-builds dependency resolution via the environment variable SEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)
Memory management policies
A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the --x-mem-policy CLI flag for the pro engine; this flag is unused in
the OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)
Allows case insensitive string comparisons using lower() and upper() like this:
- metavariable-comparison:
metavariable: $VALUE
comparison: upper(str($VALUE)) == "SEMGREP"(gh-11502)
Blocking findings that are outputted in the CI output are now labelled as such. (#4394)
glom to at least version 23.3, which includes a fix to a SyntaxWarning
warning log. (gh-11460)pipenv to uv for ./cli package management (uv)-alpha in 1.2.3-alpha. (sc-3001)Target objects. Performance should improve on
large repo scans proportionally to the number of files in the repo. (gh-5407)semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)semgrep ci. (sc-2927)mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)semgrep ci regardless of app settings is now possible with
--x-enable-transitive-reachability (or --x-tr)
and --x-disable-transitive-reachability. (tr-flags)No significant changes.
No significant changes.
let ... in expressions in OCaml is now reported. Previously, the location of the let was omitted. This is mainly relevant for autofix. (ocaml-let)