1.183.0 - 2026-10-29 ### Added The --help output of semgrep subcommands now includes a "THIRD-PARTY LICENSES" section linking to the licenses and notices for Semgrep's open source dependencies at https://semgrep.dev/cli-credits. (cli-credits) Pro: Supply Chain now records which Go module requires which when dependency paths are enabled and local builds are allowed, so transitive Go findings can sh…
1.182.0 - 2026-10-20 ### Added Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled;…
1.181.0 - 2026-10-14 ### Changed semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930) Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) i…
1.180.0 - 2026-10-07 ### Added Promoted Dart to GA maturity. Pattern matching for Dart now supports type inference for typed declarations (id_type propagation), boolean operator typing (&&/|| as bool), alias-aware import equivalence (a pattern like http.get(...) matches code that imports package:http/http.dart under any local alias), method-chain ellipsis (obj.foo(). ... .bar()), multi-statement p…
1.179.0 - 2026-10-01 ### Added Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419) ### Changed Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but determin…
1.178.0 - 2026-09-23 ### Changed The bundled tree-sitter C runtime is now 0.26.3. (CODE-9425) ### Fixed Fixed an occasional hang when semgrep-core exited on Windows. (windows-hang)
1.177.0 - 2026-09-10 ### Added Added native Supply Chain support for Bazel workspaces using rules_jvm_external. Semgrep now recognizes a maven_install.json pinned lockfile (versions 0.1.0 and 3, as emitted by rules_jvm_external 3.x through current) paired with a MODULE.bazel (or legacy WORKSPACE / WORKSPACE.bazel) marker as a Maven-ecosystem subproject, and attributes findings to the workspace roo…
1.176.0 - 2026-09-01 ### Changed Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)
1.175.0 - 2026-08-26 ### Changed Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4) ### Known Issues Homebrew users on macOS Intel systems will experience errors when trying to install or update their Semgrep binary installation. There is no impact on users on other platforms (i.e. ARM64) or using other distribution channels. This is caused by…
1.174.0 - 2026-08-20 ### Added Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources) ### Changed Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped…
1.173.0 - 2026-08-12 ### Added semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha) Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy) ### Changed File targeting now submits path-filtering work to worker domain…
1.172.0 - 2026-07-28 ### Added Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884) ### Changed Updated the Ruby parser to tree-sitter-ruby v0.23.1,…
1.171.0 - 2026-07-22 ### Added Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884) ### Changed The window for collecting git contributor informatio…
1.170.0 - 2026-07-15 ### Added Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter) Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV…
1.169.0 - 2026-07-08 ### Infra/Release Changes Updated Dart parser to a more recent upstream version. (LANG-579)
1.168.0 - 2026-06-24 ### Added Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547) ### Changed Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504) ### Infra/Release Changes semgrep-core no longer depe…
1.167.0 - 2026-06-17 ### Added Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding) Added a nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122) Semgrep now skips binary files (images, archives, c…
1.166.0 - 2026-06-11 ### Added Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile) Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789) ### Fixed Fixed parsing of integer literals with an underscore imm…
1.165.0 - 2026-06-03 ### Added Added --max-match-context-size option to limit the number of characters of source code included as context for each match in the output. This prevents matches in minified files (e.g., minified JavaScript where the entire file is a single line) from producing enormous output Set to 0 for unlimited, which is the default value. (ENGINE-2117) ### Changed Replaced --x-no-…
1.164.0 - 2026-05-26 ### Added Dart: typed metavariables ($X as T) and metavariable-type, metavariable binding inside string interpolations, and function-definition patterns that match Dart function definitions. (gh-11678) ### Changed The default memory limit for Pro interfile scans on Linux now adapts to the container's cgroup memory limit (90% of it) instead of the previous fixed 5 GiB, with an…
1.163.0 - 2026-05-13 ### Added Updated PHP target parsing to support grammar changes from PHP 8.1-8.5 (LANG-380) ### Changed Improved semgrep ci startup time with App-provided rules by avoiding duplicate semgrep-core rule validation during CLI rule loading while preserving config-style failures for invalid rules. (ci-rule-validation-startup) Semgrep now validates dependency aware rules only on the…
1.162.0 - 2026-05-07 ### Added pro: Improved support for tracking taint through nested functions. (LANG-95) Added indexes to file targeting to improve performance of semgrepignore matching. (gh-27830) ### Changed Faster JSON rule parsing: rule files in JSON format now parse roughly 5x faster end-to-end (measured ~134s → ~28s on a 382MB rule pack) by going through a new hand-written RFC 8259 parser…
1.161.0 - 2026-04-22 ### Added Scala 3.4+ trait parameters are now parsed correctly. (lang-73) ### Fixed Semgrep's HTTP requests no longer log URLs above the debug level; full request details remain available when running with SEMGREP_LOG_SRCS=cohttp.client. (ENGINE-2712)
1.160.0 - 2026-04-16 ### Added Scala: Added tree-sitter parser for improved parsing accuracy with pfff fallback. (LANG-255) pro: taint: Improved support for variadic functions (LANG-375) ### Fixed Fixed performance issues during parsing Semgrep rules containing emoji or other non-BMP Unicode characters. (gh-6070) Emit a warning when semgrep-core rule validation fails and falls back to JSON schema…
1.159.0 - 2026-04-10 ### Fixed Semgrep now reports an error instead of silently returning zero findings when target file discovery fails (e.g., due to a git ls-files failure). (ENGINE-2626)