Semgrep

No entries match these filters. Clear filters

1. updated seen Nov 3, 2026 · issue 129

   Semgrep adds Bun lockfile support, Detect-2Shell agentic workflow, Guardian PHP/Node version checks, and scheduled agentic workflows in public beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Disable Guardian's PHP version gate in a CI environment where PHP2Shell alerts would block an automated coding session.
   copy

   $ export SEMGREP_GUARDIAN_PHP_CHECK=off

   Supply a pre-existing OAuth token from Coder external authentication so Guardian skips the browser login flow entirely.
   copy

   $ export SEMGREP_GUARDIAN_TOKEN_COMMAND='cat /run/secrets/semgrep_token'

   Switch a Bun project from the unsupported binary lockfile to the text lockfile format so Semgrep Supply Chain can analyse its dependencies.
   copy

   $ bun install --save-text-lockfile --frozen-lockfile --lockfile-only && rm bun.lockb

   • Adds options to turn off Semgrep Guardian's version checks via the SEMGREP_GUARDIAN_PHP_CHECK and SEMGREP_GUARDIAN_NODE_CHECK environment variables (set to off); Guardian now checks your local PHP and Node.js versions at the start of each Claude Code and Codex session and flags versions affected by the PHP2Shell and Node2Shell remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supply chain dependency analysis now supports Bun projects that use a bun.lock lockfile with a package.json file, including direct and transitive dependencies and workspaces; the binary bun.lockb format is not supported — switch with bun install --save-text-lockfile --frozen-lockfile --lockfile-only then delete bun.lockb.
   • Adds new Semgrep Guardian authentication options: set SEMGREP_GUARDIAN_TOKEN_COMMAND to a program that prints an OAuth token so Guardian uses it directly without opening a browser, for environments like Coder external authentication, and re-authenticate after credentials expire by running /semgrep:reconnect in your coding agent.
   • Scheduled agentic workflows are now in public beta — schedule Semgrep Agentic Workflows to run daily, weekly, or monthly on chosen projects by going to Policies and clicking Edit on the Scheduled workflows card.
   • Semgrep Agentic Workflows adds the Detect-2Shell workflow, which identifies repositories whose Node.js or PHP version may be affected by the Node2Shell or PHP2Shell remote code execution vulnerabilities, checking Docker image tags, .nvmrc files, infrastructure-as-code files, and CI setup steps.

   +5 more show less

   • Supply Chain Autofix now opens pull requests for transitive dependencies in npm and PyPI projects that have a lockfile.
   • The Wiz integration now accepts findings from Azure DevOps and Bitbucket Data Center repositories, in addition to GitHub.
   • API tokens with the Read-only scope and users with the Read-only role can no longer create, update, or delete automations in remediation policies or create or link tickets.
   • Python packages declared with a version range or without a version in requirements.txt now show the declared range (marked with an unpinned icon) in the Version column on the Dependencies page, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports list them as CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. components without a version, with the declared range included as a component property.
   • Slack notifications now use one layout covering Semgrep Agentic Workflows issues, Semgrep Code, Semgrep Supply Chain, Semgrep Secrets findings, incoming webhook findings, and triage events.
   • Adds options to turn off Semgrep Guardian's version checks via the SEMGREP_GUARDIAN_PHP_CHECK and SEMGREP_GUARDIAN_NODE_CHECK environment variables (set to off); Guardian now checks your local PHP and Node.js versions at the start of each Claude Code and Codex session and flags versions affected by the PHP2Shell and Node2Shell remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supply chain dependency analysis now supports Bun projects that use a bun.lock lockfile with a package.json file, including direct and transitive dependencies and workspaces; the binary bun.lockb format is not supported — switch with bun install --save-text-lockfile --frozen-lockfile --lockfile-only then delete bun.lockb.
   • Adds new Semgrep Guardian authentication options: set SEMGREP_GUARDIAN_TOKEN_COMMAND to a program that prints an OAuth token so Guardian uses it directly without opening a browser, for environments like Coder external authentication, and re-authenticate after credentials expire by running /semgrep:reconnect in your coding agent.
   • Scheduled agentic workflows are now in public beta — schedule Semgrep Agentic Workflows to run daily, weekly, or monthly on chosen projects by going to Policies and clicking Edit on the Scheduled workflows card.
   • Semgrep Agentic Workflows adds the Detect-2Shell workflow, which identifies repositories whose Node.js or PHP version may be affected by the Node2Shell or PHP2Shell remote code execution vulnerabilities, checking Docker image tags, .nvmrc files, infrastructure-as-code files, and CI setup steps.

   5 more in Everything

2. changelog Oct 30, 2026 · issue 125

   Semgrep adds a direct Anthropic connection, PowerShell support in Guardian, a related-issues API endpoint, and expanded Supply Chain dependency coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Retrieve all related issues for a specific finding to triage clusters of related vulnerabilities at once.
   copy

   $ curl -H 'Authorization: Bearer <token>' 'https://semgrep.dev/api/deployments/<deployment_id>/issues/<issue_id>/related-issues'

   • Query a finding's related issues with the new experimental endpoint GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues; the existing relatedIssues field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Connect directly to Anthropic by supplying your own Anthropic API key under the custom AI provider mode in Semgrep AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform settings, for use with in-app features (available to Semgrep Enterprise and existing bring-your-own-key users).
   • Semgrep Guardian now supports PowerShell, running its hooks on both PowerShell commands and Bash commands.
   • Filter advisories by Language, Severity, and Advisory type on the Advisories page, using the same filters available on the Findings page; the advisories table also gains an Incident column.
   • Semgrep Supply Chain now includes every package declared in a Python requirements.txt file — including packages with version ranges (e.g. requests>=2.0) and packages without a version (e.g. flask) — in the dependency inventory and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., not only packages pinned with ==.

   +5 more show less

   • Filter dependencies by version directly on the Dependencies page without opening advanced options; the dependency filter is now an All dependencies menu with Exact and Contains matching modes and All versions or Select versions options.
   • Export selected Agentic Workflows issues to CSV; Semgrep exports only the issues or groups you selected, or uses your active filters when nothing is selected, with a 10,000-issue limit applied to the selection.
   • Add a Finding type filter to dashboards to view AI-powered and Rule-based findings separately in charts, drilldowns, and PDF exports.
   • View a sortable False positive rate column in the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with the ability to select a rate to open associated false-positive findings.
   • AI provider settings now include a required Base model field for Azure OpenAI deployments (needed for new Azure OpenAI setups), and organizations that had not chosen an AI provider mode now default to the Cloudflare Workers AI mode, while organizations that chose their own providers or are on the minimal data retention policy remain unchanged.
   • Query a finding's related issues with the new experimental endpoint GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues; the existing relatedIssues field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Connect directly to Anthropic by supplying your own Anthropic API key under the custom AI provider mode in Semgrep AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform settings, for use with in-app features (available to Semgrep Enterprise and existing bring-your-own-key users).
   • Semgrep Guardian now supports PowerShell, running its hooks on both PowerShell commands and Bash commands.
   • Add a Finding type filter to dashboards to view AI-powered and Rule-based findings separately in charts, drilldowns, and PDF exports.
   • View a sortable False positive rate column in the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with the ability to select a rate to open associated false-positive findings.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Support for QL (the CodeQL query language) is removed: --lang ql and the ql language key in rules are now rejected, and .ql and .qll files are no longer parsed.
   • !The xAI AI provider is renamed to SpaceXAI and its endpoint field is removed; the provider always uses https://api.x.ai/v1.
   • !Azure OpenAI settings now require a Base model field; new Azure OpenAI setups must supply this value.
   • !Rate limits for /api/v2/deployments/public/{id} and /api/v2/deployments/public/search now count every request including repeated and concurrent requests.
3. updated seen Oct 27, 2026 · issue 122

   Semgrep adds Anthropic direct connection, PowerShell support in Guardian, new dashboard filters, and a related-issues API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Fetch related issues for a specific finding to surface correlated alerts without relying on the deprecated relatedIssues field in the finding response.
   copy

   $ curl -s -H 'Authorization: Bearer <token>' \
     'https://semgrep.dev/api/deployments/<deployment_id>/issues/<issue_id>/related-issues'

   Export only a selected subset of findings to CSV when more than 10,000 issues match your filters — select the relevant groups first, then export.
   📍In Semgrep AppSec Platform, go to Findings, select the finding groups you want, then choose Export › CSV. The export applies to your selection; if nothing is selected, your active filters determine the export (10,000-issue limit applies to the selection).
   • Adds experimental GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues endpoint that returns a finding's related issues; the existing relatedIssues field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds direct Anthropic connection support in Semgrep MultimodalMultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. AI settings via Manual mode, used for in-app features such as Autotriage and Autofix.
   • Adds a Finding type filter to dashboards, enabling separate views of AI-powered and Rule-based Semgrep Code findings in charts, drilldowns, and PDF exports.
   • Adds a sortable False positive rate column to the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with drill-down into ignored findings.
   • Adds Language, Severity, and Advisory type filters to the Supply Chain Advisories page, with an Incident column added to the advisories table.

   +5 more show less

   • Adds PowerShell support to Semgrep Guardian, which now runs hooks on both PowerShell and Bash commands.
   • Expands Semgrep Supply Chain dependency inventory and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. to include every package declared in a Python requirements.txt file, not only packages pinned with ==.
   • Adds a Base model required field to Azure OpenAI settings, specifying the model your Azure deployment runs; new Azure OpenAI setups must populate this field.
   • Enables CSV export scoped to selected finding groups, with the existing 10,000-issue limit applying to the selection rather than the full filter result.
   • Adds reviewer-approved exception notes as Semgrep memories, applying to Semgrep Code, AI-powered detection, and Semgrep Secrets findings.
   • Adds experimental GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues endpoint that returns a finding's related issues; the existing relatedIssues field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds direct Anthropic connection support in Semgrep MultimodalMultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. AI settings via Manual mode, used for in-app features such as Autotriage and Autofix.
   • Adds a Finding type filter to dashboards, enabling separate views of AI-powered and Rule-based Semgrep Code findings in charts, drilldowns, and PDF exports.
   • Adds a sortable False positive rate column to the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with drill-down into ignored findings.
   • Adds Language, Severity, and Advisory type filters to the Supply Chain Advisories page, with an Incident column added to the advisories table.

   +2 more show less

   • Adds PowerShell support to Semgrep Guardian, which now runs hooks on both PowerShell and Bash commands.
   • Adds reviewer-approved exception notes as Semgrep memories, applying to Semgrep Code, AI-powered detection, and Semgrep Secrets findings.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Semgrep now rejects --lang ql and the ql language key in rules, and no longer parses .ql or .qll files — QL (CodeQL query language) support has been removed.
   • !The relatedIssues field on finding responses is deprecated; use GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues instead.
   • !The legacy issue details endpoint now returns null for code_snippet on Semgrep Secrets findings instead of the secret value.
   • !The xAI provider is now called SpaceXAI and always uses https://api.x.ai/v1; the endpoint field no longer appears in its settings.
   • !New Azure OpenAI setups require a Base model field to be filled in before the connection can be configured.
   • !The public deployment endpoints /api/v2/deployments/public/{id} and /api/v2/deployments/public/search now count every request (including repeated and concurrent ones) against rate limits, returning HTTP 429 when exceeded.
4. changelog Oct 22, 2026 · issue 116

   Semgrep: Agentic Workflows runs can now take up to five hours instead of failing at two hours.

   └──▷ TRY IT
   Retrieve Autofix PR and failure details for every finding in a deployment — useful for auditing which findings have pending fix PRs or repeated Autofix failures.
   copy

   $ curl -H 'Authorization: Bearer <token>' 'https://semgrep.dev/api/v1/deployments/<deploymentSlug>/findings' | jq '.findings[] | {id, click_to_fix_prs, click_to_fix_failures}'

   Rotate a stale GitHub App webhook secret so that pull request scans resume triggering after secret rotation.
   📍In Semgrep AppSec Platform, go to Settings › Source code managers, find your GitHub App connection, and click Rotate webhook secret.
   • The Total credits used column on the workflow scheduling page now counts runs from every trigger, including pull-request-initiated runs, not only scheduled runs.

   1 more in Everything

5. updated seen Oct 20, 2026 · issue 114

   Semgrep's findings API now surfaces Autofix PR and failure data; MultimodalMultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. gains Automatic AI provider mode and Codex support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Pull Autofix PR and failure data for all findings in a deployment to audit which issues have been auto-remediated and which attempts failed.
   copy

   $ curl -H 'Authorization: Bearer <token>' 'https://semgrep.dev/api/v1/deployments/<deploymentSlug>/findings' | jq '[.findings[] | {id: .id, fix_prs: .click_to_fix_prs, fix_failures: .click_to_fix_failures}]'

   • The GET /api/v1/deployments/{deploymentSlug}/findings endpoint now returns click_to_fix_prs (pull requests created by Autofix) and click_to_fix_failures (failed Autofix attempts) on all Semgrep Code and AI-powered detection findings for every deployment, not only Autofix-beta deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Semgrep Multimodal AI provider settings now offer Automatic mode, which lets Semgrep manage and update the provider list (currently Amazon Bedrock, Cloudflare Workers AI, and OpenAI) without manual configuration; Automatic mode is the default when Semgrep Multimodal is first enabled.
   • Semgrep Guardian now supports Codex, enabling it to scan with Semgrep Code and Supply Chain via a Semgrep-hosted server (no Semgrep CLI required) using the fixed guardian-default ruleset.
   • Agentic Workflows schedule and run management (create, change, delete, view schedules; trigger single runs, workflow packs, and bulk runs) is now restricted to organization admins via the API.
   • Rotating the webhook secret for a customer-owned GitHub App now also updates the secret on all existing webhooks, covering both GitHub Cloud and GitHub Enterprise.
   • The GET /api/v1/deployments/{deploymentSlug}/findings endpoint now returns click_to_fix_prs (pull requests created by Autofix) and click_to_fix_failures (failed Autofix attempts) on all Semgrep Code and AI-powered detection findings for every deployment, not only Autofix-beta deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Semgrep Multimodal AI provider settings now offer Automatic mode, which lets Semgrep manage and update the provider list (currently Amazon Bedrock, Cloudflare Workers AI, and OpenAI) without manual configuration; Automatic mode is the default when Semgrep Multimodal is first enabled.
   • Semgrep Guardian now supports Codex, enabling it to scan with Semgrep Code and Supply Chain via a Semgrep-hosted server (no Semgrep CLI required) using the fixed guardian-default ruleset.

   2 more in Everything

6. docs update Oct 17, 2026 · issue 111
   • New supported platform APEX language support
7. docs update Oct 17, 2026 · issue 111
   • New supported platform APEX language support
8. announced Oct 14, 2026 · issue 109

   Semgrep now integrates with Cursor Origin, scanning every pull request for code vulnerabilities, supply chain risks, and secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Connect Semgrep to Cursor Origin from within Semgrep so every pull request is automatically scanned for vulnerabilities, supply chain risks, and secrets.
   📍In Semgrep, go to Settings → Source Code Managers → Connect → Origin, then authorize the connection. Your repositories sync automatically and each PR triggers a Semgrep Managed Scan.
   Install Semgrep from inside Cursor Origin so the integration is available to all repositories in the Codebase without leaving the Cursor UI.
   📍In Cursor Origin, go to Codebase Settings → Marketplace, find the Semgrep app, and click Install. Once installed, repositories sync automatically and PR scans begin immediately.
   • Adds Cursor Origin as a supported source code manager, installable from Codebase Settings via the Origin marketplace Semgrep app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Triggers Semgrep Managed Scan on every pull request in Origin repositories, covering Semgrep Code, Semgrep Supply Chain, and Semgrep Secrets, with results posted as checks and comments inline.
   • Supports automatic repository sync between Cursor Origin and Semgrep — connect once with no manual re-linking or scripts.
   • Enables connection from the Semgrep side via Settings → Source Code Managers → Connect → Origin.

   4 details in Everything

9. updated seen Oct 10, 2026 · issue 100

   Tag API endpoints now require dedicated tag permissions; read-only tokens gain SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue./Supply Chain API access; Guardian gains SLSA Level 3SLSA Level 3A supply-chain integrity framework tier defined by the OpenSSF requiring that builds run on a hardened, ephemeral build platform and that provenance is generated and signed by the build service itself, not the developer. verification and auto-update with opt-out controls.

   • Deployment tag API endpoints now require tag-specific API permissions: use a token with tag read permission for GET/list/find operations and tag write permission for update/delete operations.
   • Read-only API tokens can now call the v1 Supply Chain dependency and SBOM export endpoints, which previously required an admin-only scope.
   • Running AI analysis or opening an Autofix pull request now requires triage permission; read-only users receive an explanatory error.
   • Adds SEMGREP_GUARDIAN_AUTO_UPDATE=0 environment variable and auto_update: false key in guardian.yaml to opt out of Semgrep Guardian's new automatic self-update behavior.
   • Semgrep Guardian 2.5.4 and later checks for updates and downloads new binaries immediately on release rather than waiting up to a week for the coding agent to re-index the repository.

   +1 more show less

   • Semgrep Guardian now meets SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. Level 3 standards, cryptographically verifying downloaded binaries are signed with a pipeline-only key and validating which commit and pipeline produced each binary.

   6 details in Everything

   • New integration Cursor Origin SCM integration
   • New integration AWS CodeArtifact registry support (private beta)
   • New supported platform Network Broker scms field for private SCM instances
   └──▷ BREAKING ON UPGRADE

   • !Deployment tag API endpoints now require tag-specific permissions; a token that previously managed projects is no longer sufficient — obtain a token with tag read permission for GET/list/find and tag write permission for update/delete.
10. changelog Oct 5, 2026 · issue 095

    Semgrep surfaces Supply Chain incidents on the Advisories page and redesigns Billing to support multi-product single-checkout purchases.

    • Shows active or recent Supply Chain incidents at the top of the Advisories page, with advisory Details pages now linking to affected dependencies and related blog posts.
    • Redesigns Settings > Billing to allow selecting any combination of products and completing purchase in a single checkout with one invoice.

    2 details in Everything

    • New integration SCIM provisioning with Okta and Microsoft Entra ID
11. changelog Oct 4, 2026 · issue 094

    Semgrep adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning (public beta) and a redesigned Billing page with multi-product checkout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Provision users and groups from Okta or Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. into Semgrep to automate team membership and deployment-role assignment.
    📍In the Semgrep console, go to Settings › Access › Login methods and follow the SCIM provisioning setup flow for your identity provider (Okta or Microsoft Entra ID).
    • Surfaces active or recent Supply Chain incidents at the top of the Advisories page, with advisory Details pages linking to related incidents, dependencies, and blog posts.

    1 more in Everything

12. updated seen Oct 3, 2026 · issue 093

    Semgrep adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning via Okta and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., with group-based role and team management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Provision users and groups from your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. so new hires automatically inherit the correct Semgrep deployment roles.
    📍In Semgrep Cloud, go to Settings › Access › Login methods, then enable SCIM and follow the Okta or Microsoft Entra ID setup guide to configure the SCIM endpoint and bearer token in your IdP.
    • Adds SCIM provisioning at Settings > Access > Login methods to sync users and groups from Okta and Microsoft Entra ID, with groups able to assign deployment roles and manage Semgrep teams (Teams feature in beta); available for default-tenant deployments with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Redesigns Settings > Billing to allow selecting and purchasing any combination of products.
    • Adds SCIM provisioning at Settings > Access > Login methods to sync users and groups from Okta and Microsoft Entra ID, with groups able to assign deployment roles and manage Semgrep teams (Teams feature in beta); available for default-tenant deployments with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

13. changelog Sep 26, 2026 · issue 086

    Semgrep: Adds CSV export for Agentic Workflows issues from the Issues page and through the public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a banner on older Agentic Workflows runs that links to the newest run of the same workflow on that branch.

    1 detail in Everything

14. changelog Sep 25, 2026 · issue 085

    Semgrep Guardian now reports scan status in AI coding agents, and Agentic Workflows issues are exportable as CSV via UI and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Semgrep Guardian now reports status — setup confirmation, scan summaries, sign-in requirements, and server errors — directly inside AI coding agent turns.

    1 more in Everything

15. announced Sep 24, 2026 · issue 084

    Semgrep Supply Chain adds zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. malware detection with automated org-wide response policies and a malware firewall (private beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Adds org-wide Supply Chain policies that trigger automated responses — open a Jira ticket, send a Slack alert, or call a webhook — the moment a malware finding is generated, with no human in the loophuman in the loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds zero-day incident detection that rescans all customer repositories with AI-assisted, expert-verified advisory rules within minutes of a supply chain incident and posts findings to the Semgrep dashboard organized by advisories rolled up into incidents.
    • Adds early-notification opt-in that proactively informs customers via Slack or webhooks of their blast radius — affected repos, projects, findings, and scan progress — when a new supply chain incident is detected.
    • Adds a Malware Firewall (private beta), embedded in Semgrep Guardian via Agent admin, that intercepts dependency requests at the network level between the package manager and public registries and blocks malicious packages before they reach developer machines, with no per-device install.
    • Adds org-wide Supply Chain policies that trigger automated responses — open a Jira ticket, send a Slack alert, or call a webhook — the moment a malware finding is generated, with no human in the loophuman in the loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds early-notification opt-in that proactively informs customers via Slack or webhooks of their blast radius — affected repos, projects, findings, and scan progress — when a new supply chain incident is detected.
    • Adds a Malware Firewall (private beta), embedded in Semgrep Guardian via Agent admin, that intercepts dependency requests at the network level between the package manager and public registries and blocks malicious packages before they reach developer machines, with no per-device install.

    1 more in Everything

16. announced Sep 24, 2026 · issue 013

    Semgrep Supply Chain adds zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. malware detection with automated org-wide response policies and a malware firewall (private beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Adds org-wide Supply Chain policies that trigger automated responses — open a Jira ticket, send a Slack alert, or call a webhook — the moment a malware finding is generated, with no human in the loophuman in the loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds zero-day incident detection that rescans all customer repositories with AI-assisted, expert-verified advisory rules within minutes of a supply chain incident and posts findings to the Semgrep dashboard organized by advisories rolled up into incidents.
    • Adds early-notification opt-in that proactively informs customers via Slack or webhooks of their blast radius — affected repos, projects, findings, and scan progress — when a new supply chain incident is detected.
    • Adds a Malware Firewall (private beta), embedded in Semgrep Guardian via Agent admin, that intercepts dependency requests at the network level between the package manager and public registries and blocks malicious packages before they reach developer machines, with no per-device install.
    • Adds org-wide Supply Chain policies that trigger automated responses — open a Jira ticket, send a Slack alert, or call a webhook — the moment a malware finding is generated, with no human in the loophuman in the loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds early-notification opt-in that proactively informs customers via Slack or webhooks of their blast radius — affected repos, projects, findings, and scan progress — when a new supply chain incident is detected.
    • Adds a Malware Firewall (private beta), embedded in Semgrep Guardian via Agent admin, that intercepts dependency requests at the network level between the package manager and public registries and blocks malicious packages before they reach developer machines, with no per-device install.

    1 more in Everything

17. changelog Sep 23, 2026 · issue 083

    Semgrep: Semgrep Guardian now reports status inside AI coding agents, including setup confirmation, per-turn scan summaries, sign-in requirements, and server errors.

    • Adds a banner when viewing older Agentic Workflows runs that links to the newest run of the same workflow on that branch.

    1 detail in Everything

18. updated seen Sep 23, 2026 · issue 083

    Semgrep adds CSV export for Agentic Workflows issues via the Issues page and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

19. updated seen Sep 23, 2026 · issue 013

    Semgrep adds CSV export for Agentic Workflows issues via the Issues page and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

20. 1.0.0 Sep 22, 2026 · issue 082

    API surface changed: −2 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: −2 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • − GET /api/v1/bootstrap-sms-vpc (breaking)
    • − GET /api/v1/ping (breaking)
    └──▷ BREAKING ON UPGRADE

    • !Removed endpoint GET /api/v1/bootstrap-sms-vpc
    • !Removed endpoint GET /api/v1/ping
21. changelog Sep 14, 2026 · issue 074

    Semgrep: Autofix is now generally available for all customers, running on demand per finding via the finding page or API.

    └──▷ HOW TO FIND IT
    Add a webhook action to the Early notification for Supply Chain incidents policy so your team gets real-time HTTP callbacks on new Supply Chain incidents.
    📍In Semgrep AppSec Platform, go to Policies › Supply Chain › Early notification for Supply Chain incidents, click Add action, select Webhook, and enter your endpoint URL.
    └──▷ BREAKING ON UPGRADE

    • !Homebrew installs of Semgrep are no longer supported on Intel Macs.
22. changelog Sep 13, 2026 · issue 073

    Semgrep adds webhook actions on Supply Chain incident policies, expands Issues API fields, and makes Autofix available to all customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Add a webhook action to the Early notification for Supply Chain incidents policy so your security team is notified of new incidents in real time.
    📍In the Semgrep console, go to Policies › Early notification for Supply Chain incidents › Actions, click Add action, select Webhook, and enter your webhook URL.
    • Enables Autofix for all customers; it remains opt-in per finding and runs only when requested from the finding page or through the API.
    • Makes Supply Chain Autofix independent of Upgrade Guidance, allowing Autofix pull requests to be opened even when Upgrade Guidance is disabled or has not yet run.
    • Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue.
    • Persists Workflow jobs filters across page refreshes and navigation.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Homebrew installs of Semgrep are no longer supported on Intel Macs.
23. changelog Sep 12, 2026 · issue 072

    Semgrep adds webhook support for Supply Chain incident policies, Autofix GA, and richer Issues API fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • The Issues API now includes descriptions for the status, triageState, and aggregateState values, and designates aggregateState as the recommended field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds webhook as a supported action on the Early notification for Supply Chain incidents policy, alongside Slack.
    • Supports reauthorizing or reconnecting OAuth ticketing integrations without creating a new connection.
    • Improved scan configuration generation, starting scans up to 6 seconds sooner.
    • The Issues API now includes descriptions for the status, triageState, and aggregateState values, and designates aggregateState as the recommended field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Homebrew installs of Semgrep are no longer supported on Intel Macs.
24. updated seen Sep 10, 2026 · issue 070

    Semgrep enables Autofix for all customers, adds webhook incident policy actions, and makes Supply Chain Autofix independent of Upgrade Guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Autofix is now enabled for all customers; it remains opt-in per finding, triggered from the finding Details page or through the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports adding a webhook as an action on an incidents policy, in addition to Slack.
    • Supply Chain Autofix is now independent of Upgrade Guidance — pull requests can be opened even when Upgrade Guidance is disabled or has not run.
    • Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue.
    • Workflow jobs filters now persist across page refreshes and navigation.
    • Autofix is now enabled for all customers; it remains opt-in per finding, triggered from the finding Details page or through the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Homebrew installs of Semgrep are no longer supported on Intel Macs.
25. changelog Sep 5, 2026 · issue 065

    Semgrep adds exception requests, read-only tokens, multi-webhook policies, and is_partial_scan to the scans API.

    └──▷ TRY IT
    Filter the scans API to find all partial scans — useful for auditing which CI runs skipped part of the rule set.
    copy

    $ curl -H 'Authorization: Bearer <token>' 'https://semgrep.dev/api/v1/scans?is_partial_scan=true'

    Isolate incident scans from full and diff scans when reviewing scan history for a project on the Details > Scans page.
    📍In Semgrep AppSec Platform, open a project and go to Details › Scans. In the scan type filter, select Incident to show only incident scans.
    • Introduces developer exception requests (public beta): admins can gate ignored findings behind an approval workflow by adding Require exception requests to any policy.
    • Supports adding more than one webhook action to a single remediation policy automation.
    • Adds an Incident scan type to the filter on a project's Details > Scans page, alongside Full and Diff.
    • Adds confirmation step to Semgrep Registry before rules are added to a detection policy, showing the rule count, target policy, and immediate-effect warning.
    • Splits Usage and Billing into separate tabs in Semgrep AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform Settings, with credit usage visible to all users and self-serve product purchasing available.
    • Introduces developer exception requests (public beta): admins can gate ignored findings behind an approval workflow by adding Require exception requests to any policy.

    4 more in Everything

26. updated seen Sep 3, 2026 · issue 063

    Semgrep adds multi-webhook policy automations, read-only API tokens, is_partial_scan filter, and Agentic Workflows v2 endpoints.

    └──▷ HOW TO FIND IT
    Provision a read-only CI token so a reporting pipeline can pull findings data without any risk of modifying policies or triage state.
    📍In Semgrep AppSec Platform, go to Settings › Tokens › Create Token, set type to Agent (CI), and select the Read-only permission before saving.
    • Adds is_partial_scan field to the public API response and request filter, indicating whether a scan ran only part of the rule set.
    • Adds Agentic Workflows endpoints to the public v2 API reference.
    • Adds Incident as a scan type option in the Details > Scans page scan type filter, alongside Full and Diff, for incident-scoped rule checks.
    • Supports multiple webhook actions on a single remediation policy automation, enabling richer automated response workflows.
    • Adds read-only permission option when creating an Agent (CI) Web API token, allowing data reads without write access.

    +3 more show less

    • Adds Require exception requests setting to policies, enabling teams to set developer triage permissions between no triage and full triage and require approval before a blocking finding can be ignored.
    • Semgrep Registry now shows a confirmation dialog before adding rules to a detection policy, displaying rule count, target policy, and immediate-effect notice.
    • Workflow issues can now be searched by title and description (including partial matches) via the magnifier filter bar.

    8 details in Everything

27. 1.0.0 Aug 31, 2026 · issue 060
    API change

    • ~ POST /api/v1/deployments/{deploymentId}/sbom/export: response schema changed
    └──▷ BREAKING ON UPGRADE

    • !POST /api/v1/deployments/{deploymentId}/sbom/export: response schema changed
28. 1.0.0 Aug 28, 2026 · issue 058

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ POST /api/v1/deployments/{deploymentId}/scans/search: request body changed; response schema changed
    • POST /api/v1/deployments/{deploymentId}/scans/search: request body changed; response schema changed

    1 detail in Everything

29. updated seen Aug 26, 2026 · issue 057

    Semgrep adds org-wide nosemgrep controls in public beta and a Workflow issues column on the Projects page.

    • Adds a Workflow issues column to the Projects page, letting you select a count to open Agentic Workflows issues for that project.
    • Introduces the organization-wide nosemgrep setting in public beta, allowing admins to enable or disable nosemgrep comments org-wide and filter findings by whether they were ignored via a nosemgrep comment.
    • Semgrep MultimodalMultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. now defaults to GPT-5.6 Luna in more places, with clearer validation when adding OpenAI credentials via bring-your-own-key; alternative models remain available for bring-your-own-key and fallback.
    • Supply Chain now runs license checks during diff scans even when no dependency source file (lockfile or manifest) changed in the merge request — requires Semgrep CLI 1.174.0 or later.
    • Improves performance of target selection for Supply Chain incident scans on organizations with large numbers of projects.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !For organizations migrated to Unified Policies, the Policies V1 and Ruleboard endpoints now return 410 Gone with a DEPLOYMENT_MIGRATED code instead of a normal response.
    • !Organizations without Semgrep Multimodal enabled now receive a 403 response from every trigger path, including scheduled and API-initiated runs.
30. changelog Aug 19, 2026 · issue 050

    Semgrep adds multi-finding Autofix PRs, branch filtering on workflow jobs, and experimental v2 API for agentic workflow issues.

    • Exposes issues created by Semgrep Agentic Workflows through the experimental v2 API.
    • Supports fixing multiple Code findings from the same rule in a single Autofix pull request or merge request when they appear in the same file.
    • Adds advisory affected-projects list directly below the description on the Rules & Policies > Advisories Details page.
    • Enables sorting suggested memories by number of affected findings on Rules & Policies > Memories.
    • Adds confirmation dialog when deleting a rule in Semgrep Editor, showing which policies use that rule and automatically removing the rule from those policies (and deleting any policy left with no remaining conditions).

    +3 more show less

    • Shows a specific Free-tier AI scan limit reached message (suppressing the generic internal error and the Retry scan option) when an AI scan limit is hit.
    • Removes the Code Autofix toggle from Settings; Supply Chain retains its own separate toggle for Upgrade Guidance and Supply Chain Autofix.
    • Improves load time of the Dependencies page for organizations with large dependency sets.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Code Autofix toggle has been removed from Settings. Supply Chain retains its own toggle for Upgrade Guidance and Supply Chain Autofix.
31. updated seen Aug 18, 2026 · issue 049

    Semgrep adds multi-finding Autofix PRs, workflow search in remediation policies, and an experimental v2 API for Code issues.

    • Adds multi-finding Autofix: when several findings in the same file share a rule, Semgrep now offers a single pull request or merge request to fix them all at once.
    • Code findings are now available through the experimental v2 API.
    • Adds a branch filter to the Workflow jobs tab on a project's Details page, with the primary branch pinned to the top of the list.
    • Adds name-based search when configuring the Run a workflow action in a remediation policy.
    • Sorts suggested memories on Rules & Policies > Memories by the number of findings they affect.

    +2 more show less

    • Supply Chain's Advisories Details page now shows affected packages directly below the description.
    • When a scan hits the free-tier AI scan limit, Semgrep now shows a Free-tier AI scan limit reached message instead of a generic internal error, and does not offer a Retry scan option.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Code Autofix toggle has been removed from Settings; Supply Chain retains its own separate toggles for Upgrade Guidance and Supply Chain Autofix.
    • !Deleting a rule in Semgrep Editor now requires confirmation and automatically removes the rule from all policies; policies with no remaining conditions are also deleted.
32. changelog Aug 11, 2026 · issue 042

    Semgrep adds structured step-log viewer for Agentic Workflows and expands the public policies API with breaking_change and full_scan vocabulary.

    • Adds breaking_change and full_scan vocabulary to the public policies API (currently in public beta for organizations using unified policies), enabling scan policies that use those options to be represented through the API.
    • Agentic Workflows step logs now use a structured viewer that parses run logs into individual searchable and filterable fields instead of a single block of text.

    2 details in Everything

33. updated seen Aug 11, 2026 · issue 042

    Semgrep adds breaking_change and full_scan vocabulary to the public policies API, now in public beta.

    • Adds breaking_change and full_scan fields to the public policies API vocabulary, enabling scan policies that use those options to be represented through the API (API is in public beta for organizations using unified policies).
    • Run logs are now parsed into individual searchable and filterable fields instead of a single block of text.
    • Unified policies migration banner now displays the migration schedule: migrations begin August 24, 2026, with the current Policies version sunsetting November 1, 2026.

    3 details in Everything

34. updated seen Aug 5, 2026 · issue 036

    Semgrep adds Agentic Workflows public beta, license compliance block logic, and Supply Chain incident notification policies.

    • Semgrep Agentic Workflows enters public beta — runs multi-step AI-enabled detection pipelines from Semgrep AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform, combining program analysis, deterministic tools, and constrained AI-based reasoning to produce reviewable security issues.
    • License compliance can now be configured to block a dependency only when all of its licenses are blocked, rather than when any single license is blocked.
    • A default Supply Chain incident notification policy is now available to all Supply Chain customers using Unified policies, with optional Slack channel notifications for ongoing incidents based on the most recent SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Webhook validation and test failure error messages now include specific failure reasons.
    • Semgrep now shows a confirmation warning when adding or removing project tags attached to policies, during bulk edit and from a project's settings page.

    5 details in Everything

35. 1.0.0 seen Aug 4, 2026 · issue 035

    API surface changed: 3 deprecated

    API change

    API surface changed: 3 deprecated

    • ⚠ GET /api/v1/deployments/{deploymentId}/policies
    • ⚠ GET /api/v1/deployments/{deploymentId}/policies/{policyId}
    • ⚠ PUT /api/v1/deployments/{deploymentId}/policies/{policyId}
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint GET /api/v1/deployments/{deploymentId}/policies (still works)
    • !Deprecated endpoint GET /api/v1/deployments/{deploymentId}/policies/{policyId} (still works)
    • !Deprecated endpoint PUT /api/v1/deployments/{deploymentId}/policies/{policyId} (still works)