https://cybertoolchain.io/tools/semgrep New releases and features in Semgrep, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 07:50:02 GMT https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 03 Nov 2026 07:50:02 GMT Semgrep adds Bun lockfile support, Detect-2Shell agentic workflow, Guardian PHP/Node version checks, and scheduled agentic workflows in public beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds options to turn off Semgrep Guardian's version checks via the `SEMGREP_GUARDIAN_PHP_CHECK` and `SEMGREP_GUARDIAN_NODE_CHECK` environment variables (set to `off`); Guardian now checks your local PHP and Node.js versions at the start of each Claude Code and Codex session and flags versions affected by the PHP2Shell and Node2Shell remote code execution vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supply chain dependency analysis now supports Bun projects that use a `bun.lock` lockfile with a `package.json` file, including direct and transitive dependencies and workspaces; the binary `bun.lockb` format is not supported — switch with `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` then delete `bun.lockb`. • Adds new Semgrep Guardian authentication options: set `SEMGREP_GUARDIAN_TOKEN_COMMAND` to a program that prints an OAuth token so Guardian uses it directly without opening a browser, for environments like Coder external authentication, and re-authenticate after credentials expire by running `/semgrep:reconnect` in your coding agent. • Scheduled agentic workflows are now in public beta — schedule Semgrep Agentic Workflows to run daily, weekly, or monthly on chosen projects by going to Policies and clicking Edit on the Scheduled workflows card. • Semgrep Agentic Workflows adds the Detect-2Shell workflow, which identifies repositories whose Node.js or PHP version may be affected by the Node2Shell or PHP2Shell remote code execution vulnerabilities, checking Docker image tags, `.nvmrc` files, infrastructure-as-code files, and CI setup steps. • Supply Chain Autofix now opens pull requests for transitive dependencies in npm and PyPI projects that have a lockfile. • The Wiz integration now accepts findings from Azure DevOps and Bitbucket Data Center repositories, in addition to GitHub. • API tokens with the Read-only scope and users with the Read-only role can no longer create, update, or delete automations in remediation policies or create or link tickets. • Python packages declared with a version range or without a version in `requirements.txt` now show the declared range (marked with an unpinned icon) in the Version column on the Dependencies page, and SBOM exports list them as CycloneDX components without a version, with the declared range included as a component property. • Slack notifications now use one layout covering Semgrep Agentic Workflows issues, Semgrep Code, Semgrep Supply Chain, Semgrep Secrets findings, incoming webhook findings, and triage events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Fri, 30 Oct 2026 07:46:49 GMT Semgrep adds a direct Anthropic connection, PowerShell support in Guardian, a related-issues API endpoint, and expanded Supply Chain dependency coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Query a finding's related issues with the new experimental endpoint `GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues`; the existing `relatedIssues` field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Connect directly to Anthropic by supplying your own Anthropic API key under the custom AI provider mode in Semgrep AppSec Platform settings, for use with in-app features (available to Semgrep Enterprise and existing bring-your-own-key users). • Semgrep Guardian now supports PowerShell, running its hooks on both PowerShell commands and Bash commands. • Filter advisories by Language, Severity, and Advisory type on the Advisories page, using the same filters available on the Findings page; the advisories table also gains an Incident column. • Semgrep Supply Chain now includes every package declared in a Python `requirements.txt` file — including packages with version ranges (e.g. `requests>=2.0`) and packages without a version (e.g. `flask`) — in the dependency inventory and SBOM, not only packages pinned with `==`. • Filter dependencies by version directly on the Dependencies page without opening advanced options; the dependency filter is now an `All dependencies` menu with `Exact` and `Contains matching` modes and `All versions` or `Select versions` options. • Export selected Agentic Workflows issues to CSV; Semgrep exports only the issues or groups you selected, or uses your active filters when nothing is selected, with a 10,000-issue limit applied to the selection. • Add a `Finding type` filter to dashboards to view AI-powered and Rule-based findings separately in charts, drilldowns, and PDF exports. • View a sortable `False positive rate` column in the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with the ability to select a rate to open associated false-positive findings. • AI provider settings now include a required `Base model` field for Azure OpenAI deployments (needed for new Azure OpenAI setups), and organizations that had not chosen an AI provider mode now default to the `Cloudflare Workers AI` mode, while organizations that chose their own providers or are on the minimal data retention policy remain unchanged. Breaking changes: • Support for QL (the CodeQL query language) is removed: `--lang ql` and the `ql` language key in rules are now rejected, and `.ql` and `.qll` files are no longer parsed. • The `xAI` AI provider is renamed to `SpaceXAI` and its endpoint field is removed; the provider always uses `https://api.x.ai/v1`. • Azure OpenAI settings now require a `Base model` field; new Azure OpenAI setups must supply this value. • Rate limits for `/api/v2/deployments/public/{id}` and `/api/v2/deployments/public/search` now count every request including repeated and concurrent requests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 27 Oct 2026 07:46:56 GMT Semgrep adds Anthropic direct connection, PowerShell support in Guardian, new dashboard filters, and a related-issues API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds experimental `GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues` endpoint that returns a finding's related issues; the existing `relatedIssues` field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds direct Anthropic connection support in Semgrep Multimodal AI settings via Manual mode, used for in-app features such as Autotriage and Autofix. • Adds a `Finding type` filter to dashboards, enabling separate views of AI-powered and Rule-based Semgrep Code findings in charts, drilldowns, and PDF exports. • Adds a sortable `False positive rate` column to the rules table in Policies, covering Semgrep Code and Semgrep Secrets rules, with drill-down into ignored findings. • Adds `Language`, `Severity`, and `Advisory type` filters to the Supply Chain Advisories page, with an `Incident` column added to the advisories table. • Adds PowerShell support to Semgrep Guardian, which now runs hooks on both PowerShell and Bash commands. • Expands Semgrep Supply Chain dependency inventory and SBOM to include every package declared in a Python `requirements.txt` file, not only packages pinned with `==`. • Adds a `Base model` required field to Azure OpenAI settings, specifying the model your Azure deployment runs; new Azure OpenAI setups must populate this field. • Enables CSV export scoped to selected finding groups, with the existing 10,000-issue limit applying to the selection rather than the full filter result. • Adds reviewer-approved exception notes as Semgrep memories, applying to Semgrep Code, AI-powered detection, and Semgrep Secrets findings. Breaking changes: • Semgrep now rejects `--lang ql` and the `ql` language key in rules, and no longer parses `.ql` or `.qll` files — QL (CodeQL query language) support has been removed. • The `relatedIssues` field on finding responses is deprecated; use `GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues` instead. • The legacy issue details endpoint now returns `null` for `code_snippet` on Semgrep Secrets findings instead of the secret value. • The xAI provider is now called `SpaceXAI` and always uses `https://api.x.ai/v1`; the endpoint field no longer appears in its settings. • New Azure OpenAI setups require a `Base model` field to be filled in before the connection can be configured. • The public deployment endpoints `/api/v2/deployments/public/{id}` and `/api/v2/deployments/public/search` now count every request (including repeated and concurrent ones) against rate limits, returning HTTP 429 when exceeded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Thu, 22 Oct 2026 07:50:37 GMT Semgrep: Agentic Workflows runs can now take up to five hours instead of failing at two hours. • The `Total credits used` column on the workflow scheduling page now counts runs from every trigger, including pull-request-initiated runs, not only scheduled runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 20 Oct 2026 07:47:16 GMT Semgrep's findings API now surfaces Autofix PR and failure data; Multimodal gains Automatic AI provider mode and Codex support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The `GET /api/v1/deployments/{deploymentSlug}/findings` endpoint now returns `click_to_fix_prs` (pull requests created by Autofix) and `click_to_fix_failures` (failed Autofix attempts) on all Semgrep Code and AI-powered detection findings for every deployment, not only Autofix-beta deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Semgrep Multimodal AI provider settings now offer Automatic mode, which lets Semgrep manage and update the provider list (currently Amazon Bedrock, Cloudflare Workers AI, and OpenAI) without manual configuration; Automatic mode is the default when Semgrep Multimodal is first enabled. • Semgrep Guardian now supports Codex, enabling it to scan with Semgrep Code and Supply Chain via a Semgrep-hosted server (no Semgrep CLI required) using the fixed `guardian-default` ruleset. • Agentic Workflows schedule and run management (create, change, delete, view schedules; trigger single runs, workflow packs, and bulk runs) is now restricted to organization admins via the API. • Rotating the webhook secret for a customer-owned GitHub App now also updates the secret on all existing webhooks, covering both GitHub Cloud and GitHub Enterprise. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sat, 10 Oct 2026 07:41:43 GMT Semgrep adds Cursor Origin SCM support, AWS CodeArtifact private beta, scms broker config, and SLSA Level 3 Guardian binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `scms` configuration field to Network Broker source code manager instances (GitHub, GitLab, Bitbucket, Azure DevOps) so private instances can be listed once instead of maintaining per-instance custom allowlists; requires Network Broker v0.47.0 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SEMGREP_GUARDIAN_AUTO_UPDATE=0` environment variable and `auto_update: false` key in `guardian.yaml` to opt out of Semgrep Guardian's new automatic self-update behavior. • Adds Cursor Origin support: sync repositories, run Managed Scans, and see scan checks and finding comments directly in Cursor pull requests, configured from Semgrep onboarding or the Cursor app installation flow. • Adds AWS CodeArtifact support (private beta) for connecting private Maven or Gradle registries so Dynamic Dependency Resolution can resolve packages during Managed Scans using IAM role assumption instead of stored AWS keys. • Deployment tag API endpoints now require tag-specific API permissions: use a token with tag read permission for `GET`/list/find operations and tag write permission for update/delete operations. • Read-only API tokens can now call the v1 Supply Chain dependency and SBOM export endpoints, which previously required an admin-only scope. • Running AI analysis or opening an Autofix pull request now requires triage permission; read-only users receive an explanatory error. • Semgrep Guardian 2.5.4 and later checks for updates and downloads new binaries immediately on release rather than waiting up to a week for the coding agent to re-index the repository. • Semgrep Guardian now meets SLSA Level 3 standards, cryptographically verifying downloaded binaries are signed with a pipeline-only key and validating which commit and pipeline produced each binary. Breaking changes: • Deployment tag API endpoints now require tag-specific permissions; a token that previously managed projects is no longer sufficient — obtain a token with tag read permission for GET/list/find and tag write permission for update/delete. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Mon, 05 Oct 2026 07:55:30 GMT Semgrep adds SCIM provisioning (public beta) and surfaces active Supply Chain incidents on the Advisories page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sun, 04 Oct 2026 07:49:01 GMT Semgrep adds SCIM provisioning (public beta) and a redesigned Billing page with multi-product checkout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Surfaces active or recent Supply Chain incidents at the top of the `Advisories` page, with advisory `Details` pages linking to related incidents, dependencies, and blog posts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sat, 03 Oct 2026 07:35:05 GMT Semgrep adds SCIM provisioning via Okta and Microsoft Entra ID, with group-based role and team management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds SCIM provisioning at `Settings > Access > Login methods` to sync users and groups from Okta and Microsoft Entra ID, with groups able to assign deployment roles and manage Semgrep teams (Teams feature in beta); available for default-tenant deployments with SSO configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Redesigns `Settings > Billing` to allow selecting and purchasing any combination of products. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sat, 26 Sep 2026 07:48:14 GMT Semgrep: Adds CSV export for Agentic Workflows issues from the Issues page and through the public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a banner on older Agentic Workflows runs that links to the newest run of the same workflow on that branch. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Fri, 25 Sep 2026 07:51:11 GMT Semgrep Guardian now reports scan status in AI coding agents, and Agentic Workflows issues are exportable as CSV via UI and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Semgrep Guardian now reports status — setup confirmation, scan summaries, sign-in requirements, and server errors — directly inside AI coding agent turns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 23 Sep 2026 13:12:47 GMT Semgrep: Semgrep Guardian now reports status inside AI coding agents, including setup confirmation, per-turn scan summaries, sign-in requirements, and server errors. • Adds a banner when viewing older Agentic Workflows runs that links to the newest run of the same workflow on that branch. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 23 Sep 2026 07:34:27 GMT Semgrep adds CSV export for Agentic Workflows issues via the Issues page and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports exporting Agentic Workflows issues as CSV from the Issues page and through the public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 23 Sep 2026 07:34:27 GMT Semgrep adds CSV export for Agentic Workflows issues via the Issues page and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports exporting Agentic Workflows issues as CSV from the Issues page and through the public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://semgrep.dev/api/v1/public_v1.openapi.yaml https://semgrep.dev/api/v1/public_v1.openapi.yaml Tue, 22 Sep 2026 07:46:32 GMT API surface changed: −2 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Removed endpoint GET /api/v1/bootstrap-sms-vpc • Removed endpoint GET /api/v1/ping Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Mon, 14 Sep 2026 07:43:12 GMT Semgrep: Autofix is now generally available for all customers, running on demand per finding via the finding page or API. Breaking changes: • Homebrew installs of Semgrep are no longer supported on Intel Macs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sun, 13 Sep 2026 07:42:14 GMT Semgrep adds webhook actions on Supply Chain incident policies, expands Issues API fields, and makes Autofix available to all customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables `Autofix` for all customers; it remains opt-in per finding and runs only when requested from the finding page or through the API. • Makes `Supply Chain Autofix` independent of `Upgrade Guidance`, allowing Autofix pull requests to be opened even when Upgrade Guidance is disabled or has not yet run. • Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue. • Persists `Workflow jobs` filters across page refreshes and navigation. Breaking changes: • Homebrew installs of Semgrep are no longer supported on Intel Macs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sat, 12 Sep 2026 10:43:43 GMT Semgrep adds webhook support for Supply Chain incident policies, Autofix GA, and richer Issues API fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The Issues API now includes descriptions for the `status`, `triageState`, and `aggregateState` values, and designates `aggregateState` as the recommended field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `webhook` as a supported action on the 'Early notification for Supply Chain incidents' policy, alongside Slack. • Supports reauthorizing or reconnecting OAuth ticketing integrations without creating a new connection. • Improved scan configuration generation, starting scans up to 6 seconds sooner. Breaking changes: • Homebrew installs of Semgrep are no longer supported on Intel Macs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Thu, 10 Sep 2026 07:33:32 GMT Semgrep enables Autofix for all customers, adds webhook incident policy actions, and makes Supply Chain Autofix independent of Upgrade Guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Autofix is now enabled for all customers; it remains opt-in per finding, triggered from the finding Details page or through the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports adding a webhook as an action on an incidents policy, in addition to Slack. • Supply Chain Autofix is now independent of Upgrade Guidance — pull requests can be opened even when Upgrade Guidance is disabled or has not run. • Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue. • Workflow jobs filters now persist across page refreshes and navigation. Breaking changes: • Homebrew installs of Semgrep are no longer supported on Intel Macs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Sat, 05 Sep 2026 07:37:29 GMT Semgrep adds exception requests, read-only tokens, multi-webhook policies, and `is_partial_scan` to the scans API. • Introduces developer exception requests (public beta): admins can gate ignored findings behind an approval workflow by adding 'Require exception requests' to any policy. • Supports adding more than one webhook action to a single remediation policy automation. • Adds an 'Incident' scan type to the filter on a project's Details > Scans page, alongside 'Full' and 'Diff'. • Adds confirmation step to Semgrep Registry before rules are added to a detection policy, showing the rule count, target policy, and immediate-effect warning. • Splits 'Usage' and 'Billing' into separate tabs in Semgrep AppSec Platform Settings, with credit usage visible to all users and self-serve product purchasing available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Thu, 03 Sep 2026 07:32:34 GMT Semgrep adds multi-webhook policy automations, read-only API tokens, `is_partial_scan` filter, and Agentic Workflows v2 endpoints. • Adds `is_partial_scan` field to the public API response and request filter, indicating whether a scan ran only part of the rule set. • Adds Agentic Workflows endpoints to the public v2 API reference. • Adds 'Incident' as a scan type option in the `Details > Scans` page scan type filter, alongside 'Full' and 'Diff', for incident-scoped rule checks. • Supports multiple webhook actions on a single remediation policy automation, enabling richer automated response workflows. • Adds read-only permission option when creating an Agent (CI) Web API token, allowing data reads without write access. • Adds 'Require exception requests' setting to policies, enabling teams to set developer triage permissions between no triage and full triage and require approval before a blocking finding can be ignored. • Semgrep Registry now shows a confirmation dialog before adding rules to a detection policy, displaying rule count, target policy, and immediate-effect notice. • Workflow issues can now be searched by title and description (including partial matches) via the magnifier filter bar. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://semgrep.dev/api/v1/public_v1.openapi.yaml https://semgrep.dev/api/v1/public_v1.openapi.yaml Mon, 31 Aug 2026 20:48:24 GMT Breaking changes: • POST /api/v1/deployments/{deploymentId}/sbom/export: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://semgrep.dev/api/v1/public_v1.openapi.yaml https://semgrep.dev/api/v1/public_v1.openapi.yaml Fri, 28 Aug 2026 19:44:19 GMT API surface changed: 1 modified • POST /api/v1/deployments/{deploymentId}/scans/search: request body changed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 26 Aug 2026 09:03:16 GMT Semgrep adds org-wide nosemgrep controls in public beta and a Workflow issues column on the Projects page. • Adds a 'Workflow issues' column to the Projects page, letting you select a count to open Agentic Workflows issues for that project. • Introduces the organization-wide `nosemgrep` setting in public beta, allowing admins to enable or disable `nosemgrep` comments org-wide and filter findings by whether they were ignored via a `nosemgrep` comment. • Semgrep Multimodal now defaults to GPT-5.6 Luna in more places, with clearer validation when adding OpenAI credentials via bring-your-own-key; alternative models remain available for bring-your-own-key and fallback. • Supply Chain now runs license checks during diff scans even when no dependency source file (lockfile or manifest) changed in the merge request — requires Semgrep CLI 1.174.0 or later. • Improves performance of target selection for Supply Chain incident scans on organizations with large numbers of projects. Breaking changes: • For organizations migrated to Unified Policies, the Policies V1 and Ruleboard endpoints now return `410 Gone` with a `DEPLOYMENT_MIGRATED` code instead of a normal response. • Organizations without Semgrep Multimodal enabled now receive a `403` response from every trigger path, including scheduled and API-initiated runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 19 Aug 2026 00:34:54 GMT Semgrep adds multi-finding Autofix PRs, branch filtering on workflow jobs, and experimental v2 API for agentic workflow issues. • Exposes issues created by Semgrep Agentic Workflows through the experimental v2 API. • Supports fixing multiple Code findings from the same rule in a single Autofix pull request or merge request when they appear in the same file. • Adds advisory affected-projects list directly below the description on the Rules & Policies > Advisories Details page. • Enables sorting suggested memories by number of affected findings on Rules & Policies > Memories. • Adds confirmation dialog when deleting a rule in Semgrep Editor, showing which policies use that rule and automatically removing the rule from those policies (and deleting any policy left with no remaining conditions). • Shows a specific 'Free-tier AI scan limit reached' message (suppressing the generic internal error and the `Retry scan` option) when an AI scan limit is hit. • Removes the Code Autofix toggle from Settings; Supply Chain retains its own separate toggle for Upgrade Guidance and Supply Chain Autofix. • Improves load time of the Dependencies page for organizations with large dependency sets. Breaking changes: • The Code Autofix toggle has been removed from Settings. Supply Chain retains its own toggle for Upgrade Guidance and Supply Chain Autofix. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 18 Aug 2026 08:55:11 GMT Semgrep adds multi-finding Autofix PRs, workflow search in remediation policies, and an experimental v2 API for Code issues. • Adds multi-finding Autofix: when several findings in the same file share a rule, Semgrep now offers a single pull request or merge request to fix them all at once. • Code findings are now available through the experimental v2 API. • Adds a branch filter to the Workflow jobs tab on a project's Details page, with the primary branch pinned to the top of the list. • Adds name-based search when configuring the 'Run a workflow' action in a remediation policy. • Sorts suggested memories on Rules & Policies > Memories by the number of findings they affect. • Supply Chain's Advisories Details page now shows affected packages directly below the description. • When a scan hits the free-tier AI scan limit, Semgrep now shows a 'Free-tier AI scan limit reached' message instead of a generic internal error, and does not offer a Retry scan option. Breaking changes: • The Code Autofix toggle has been removed from Settings; Supply Chain retains its own separate toggles for Upgrade Guidance and Supply Chain Autofix. • Deleting a rule in Semgrep Editor now requires confirmation and automatically removes the rule from all policies; policies with no remaining conditions are also deleted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 11 Aug 2026 15:43:22 GMT Semgrep adds structured step-log viewer for Agentic Workflows and expands the public policies API with `breaking_change` and `full_scan` vocabulary. • Adds `breaking_change` and `full_scan` vocabulary to the public policies API (currently in public beta for organizations using unified policies), enabling scan policies that use those options to be represented through the API. • Agentic Workflows step logs now use a structured viewer that parses run logs into individual searchable and filterable fields instead of a single block of text. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Tue, 11 Aug 2026 09:15:12 GMT Semgrep adds `breaking_change` and `full_scan` vocabulary to the public policies API, now in public beta. • Adds `breaking_change` and `full_scan` fields to the public policies API vocabulary, enabling scan policies that use those options to be represented through the API (API is in public beta for organizations using unified policies). • Run logs are now parsed into individual searchable and filterable fields instead of a single block of text. • Unified policies migration banner now displays the migration schedule: migrations begin August 24, 2026, with the current Policies version sunsetting November 1, 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://docs.semgrep.dev/release-notes https://docs.semgrep.dev/release-notes Wed, 05 Aug 2026 00:29:59 GMT Semgrep adds Agentic Workflows public beta, license compliance block logic, and Supply Chain incident notification policies. • Semgrep Agentic Workflows enters public beta — runs multi-step AI-enabled detection pipelines from Semgrep AppSec Platform, combining program analysis, deterministic tools, and constrained AI-based reasoning to produce reviewable security issues. • License compliance can now be configured to block a dependency only when all of its licenses are blocked, rather than when any single license is blocked. • A default Supply Chain incident notification policy is now available to all Supply Chain customers using Unified policies, with optional Slack channel notifications for ongoing incidents based on the most recent SBOM. • Webhook validation and test failure error messages now include specific failure reasons. • Semgrep now shows a confirmation warning when adding or removing project tags attached to policies, during bulk edit and from a project's settings page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep https://semgrep.dev/api/v1/public_v1.openapi.yaml https://semgrep.dev/api/v1/public_v1.openapi.yaml Tue, 04 Aug 2026 11:23:19 GMT API surface changed: 3 deprecated Breaking changes: • Deprecated endpoint GET /api/v1/deployments/{deploymentId}/policies (still works) • Deprecated endpoint GET /api/v1/deployments/{deploymentId}/policies/{policyId} (still works) • Deprecated endpoint PUT /api/v1/deployments/{deploymentId}/policies/{policyId} (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/semgrep