[{"url":"https://api.github.com/repos/semgrep/semgrep/releases/370069155","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/370069155/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/370069155/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.173.0","id":370069155,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84WDs6j","tag_name":"v1.173.0","target_commitish":"develop","name":"Release v1.173.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-08-13T16:49:19Z","updated_at":"2026-08-13T16:49:55Z","published_at":"2026-08-13T16:49:55Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.173.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.173.0","body":"## [1.173.0](https://github.com/semgrep/semgrep/releases/tag/v1.173.0) - 2026-08-12\n\n### ### Added\n\n- `semgrep-core -version` now reports the git commit that the binary was built\n from. (core-version-git-sha)\n- Pro: Added a `no_disk_cache` memory policy (`--x-mem-policy no_disk_cache`) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)\n\n### ### Changed\n\n- File targeting now submits path-filtering work to worker domains in batches\n removing multithreaded synchronization overhead for very large repos. (ENGINE-2854)\n- Parallel rule parsing for large rulesets now shards rules into files sized by\n bytes rather than by worker count, stabilizing memory allocations at parse-time\n and improving parsing throughput. (ENGINE-2920)\n- Updated the Solidity parser for newer language features (transient storage, named mapping parameters, `layout at`, assembly flags, `global` using-directives, EVM Cancun builtins) and corrected ternary/`?:` vs member-access precedence. (LANG-207)\n- Pro: Unsupported patterns in case expressions are now handled more\n robustly, with improved error recovery during taint analysis — branch\n bodies are no longer dropped from the dataflow intermediate language when\n a pattern can't be compiled. Pattern matching in statement position also\n now benefits from the same compilation as expression position. (LANG-598)\n- Improved performance in highly parallel scans with many target files, running\n on systems using the musl libc implementation. (pcre2-match-data-reuse)\n\n### ### Fixed\n\n- When the internal semgrep-core RPC subprocess is terminated by a signal (for\n example an out-of-memory kill or a segfault), Semgrep now logs a clear error\n naming the signal, instead of the misleading \"Expected a number, got ''\"\n message. When debug logging is enabled, the tail of the subprocess's stderr is\n included as well. (rpc-subprocess-death-diagnostics)\n- A target file whose path filtering failed was silently omitted from the scan,\n appearing in neither the results nor the list of skipped targets. Such paths\n are now retried, and any that still fail are reported as skipped targets so\n they show up in the scan report. (ENGINE-2854)\n- Fixed a bug where a capture-group `metavariable-regex` or a binding-introducing\n `metavariable-pattern` would emit a duplicate finding on the same range whose\n message still contained the raw metavariable (e.g. `a hash $ALG was detected`)\n instead of the substituted value. Only the correctly-substituted finding is now\n reported. (ENGINE-2932)\n- Fixed fully-qualified name resolution for Rust symbols imported via a braced\n grouped `use` with a nested path (e.g. `use a::b::C`). It was wrongly being\n resolved as b::a::C. (LANG-234)\n- Fixed an issue where MCP mode could fail to scan UTF-8 files containing multibyte characters, including Japanese text, on systems using a non-UTF-8 locale such as cp932. Files are now read as UTF-8, with undecodable bytes replaced so a single unusual file does not fail the entire scan. (gdn-168)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/361414274","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/361414274/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/361414274/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.172.0","id":361414274,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84Vir6C","tag_name":"v1.172.0","target_commitish":"develop","name":"Release v1.172.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-07-28T22:40:12Z","updated_at":"2026-07-28T22:40:28Z","published_at":"2026-07-28T22:40:28Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.172.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.172.0","body":"## [1.172.0](https://github.com/semgrep/semgrep/releases/tag/v1.172.0) - 2026-07-28\n\n### ### Added\n\n- Added support for the OpenTofu `.tofu` file extension. Because OpenTofu uses the same HCL grammar as Terraform, `.tofu` files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. `p/terraform`) with no extra configuration. (ENGINE-2884)\n\n### ### Changed\n\n- Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for `!=`, case/when expressions with line breaks, and element references that take a block. (LANG-206)\n- The window for collecting git contributor information during `semgrep ci` has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)\n\n### ### Fixed\n\n- Semgrep will now print richer error messages on segfaults when `--debug` is NOT passed, matching the segfault error output when `--debug` is passed (engine-segv)\n- Fixed a source of rare, nondeterministic crashes and incorrect results caused\n by an OCaml compiler bug. Semgrep now builds against a compiler fork that\n backports the upstream fix. (ocaml_codegen_fix)\n- Fixed excessive heap growth after explicit major garbage collections. Semgrep\n now builds against an OCaml compiler that improves garbage collection duty\n cycle pacing. (ocaml_gc_pacing_fix)\n- Improved the `Scan Status` output when no code rules will run (e.g. a\n Secrets-only or Supply-Chain-only scan). The summary line no longer reports a\n confusing \"0 Code rules\", and the \"Code Rules\" section now states explicitly\n either that code scanning is not enabled or that there are no code rules to run,\n instead of printing an empty table. (ENGINE-2878)\n- Fixed lockfileless Gradle dependency resolution failing with \"Parsing\n dependency output failed (Resolve_gradle.gradle_resolved_dependency)\". The\n github-dependency-graph-gradle-plugin used during resolution was fetched\n unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is\n now pinned to 1.4.1. (sc-3738)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/358370183","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/358370183/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/358370183/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.171.0","id":358370183,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84VXEuH","tag_name":"v1.171.0","target_commitish":"develop","name":"Release v1.171.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-07-22T23:05:25Z","updated_at":"2026-07-22T23:05:43Z","published_at":"2026-07-22T23:05:43Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.171.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.171.0","body":"## [1.171.0](https://github.com/semgrep/semgrep/releases/tag/v1.171.0) - 2026-07-22\n\n### ### Added\n\n- Added support for the OpenTofu `.tofu` file extension. Because OpenTofu uses the same HCL grammar as Terraform, `.tofu` files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. `p/terraform`) with no extra configuration. (ENGINE-2884)\n\n### ### Changed\n\n- The window for collecting git contributor information during `semgrep ci` has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)\n\n### ### Fixed\n\n- Fixed a source of rare, nondeterministic crashes and incorrect results caused\n by an OCaml compiler bug. Semgrep now builds against a compiler fork that\n backports the upstream fix. (ocaml_codegen_fix)\n- Fixed excessive heap growth after explicit major garbage collections. Semgrep\n now builds against an OCaml compiler that improves garbage collection duty\n cycle pacing. (ocaml_gc_pacing_fix)\n- Improved the `Scan Status` output when no code rules will run (e.g. a\n Secrets-only or Supply-Chain-only scan). The summary line no longer reports a\n confusing \"0 Code rules\", and the \"Code Rules\" section now states explicitly\n either that code scanning is not enabled or that there are no code rules to run,\n instead of printing an empty table. (ENGINE-2878)\n- Fixed lockfileless Gradle dependency resolution failing with \"Parsing\n dependency output failed (Resolve_gradle.gradle_resolved_dependency)\". The\n github-dependency-graph-gradle-plugin used during resolution was fetched\n unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is\n now pinned to 1.4.1. (sc-3738)\n","reactions":{"url":"https://api.github.com/repos/semgrep/semgrep/releases/358370183/reactions","total_count":2,"+1":2,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0}},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/354588838","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/354588838/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/354588838/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.170.0","id":354588838,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84VIpim","tag_name":"v1.170.0","target_commitish":"develop","name":"Release v1.170.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-07-15T17:02:10Z","updated_at":"2026-07-15T17:02:36Z","published_at":"2026-07-15T17:02:36Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.170.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.170.0","body":"## [1.170.0](https://github.com/semgrep/semgrep/releases/tag/v1.170.0) - 2026-07-15\n\n### ### Added\n\n- Pro C/C++ scans now skip code inside statically-dead preprocessor branches\n (for example, `#if 0 ... #else ... #endif`). Patterns that would otherwise\n match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)\n- Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)\n- `semgrep install-semgrep-pro` now sends usage metrics so that\n installation errors can be tracked. Metrics can be disabled with\n `--metrics off` or `SEMGREP_SEND_METRICS=off`. Metrics payloads also\n now include the method used to install the Semgrep CLI (pip, homebrew,\n docker, or unknown), detected heuristically. See metrics.md for\n more details of what exactly is sent. (engine-2858)\n\n### ### Changed\n\n- Increased the timeout for dynamic dependency resolution subprocesses from\n 600 to 900 seconds, giving large projects more time to resolve dependencies\n before timing out. (SC-3699)\n- Pro C/C++ `#if 0` filtering now also handles cases where the directive splits a\n syntactic unit. For example, a function signature toggle like `#if 0 void\n foo(int i) { #else void foo(uint32_t i) { #endif`. (engine-994)\n\n### ### Fixed\n\n- Fixed a crash at startup (`Fatal error: Failed to allocate signal stack for\n domain 0`) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on\n recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's\n build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)\n- Dockerfile: Fixed parse errors on `RUN` instructions that use heredoc syntax\n (`</.git/index.lock': Not a directory` in certain cases. (engine-2736)\n\n### ### Infra/Release Changes\n\n- Added parsing tests covering Python language features (Python 3.0–3.12). (LANG-531)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/334026741","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/334026741/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/334026741/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.165.0","id":334026741,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84T6Nf1","tag_name":"v1.165.0","target_commitish":"develop","name":"Release v1.165.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-06-03T22:02:27Z","updated_at":"2026-06-03T22:02:47Z","published_at":"2026-06-03T22:02:47Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.165.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.165.0","body":"## [1.165.0](https://github.com/semgrep/semgrep/releases/tag/v1.165.0) - 2026-06-03\n\n### ### Added\n\n- Added `--max-match-context-size` option to limit the number of characters of source code included as context for each match in the output. This prevents matches in minified files (e.g., minified JavaScript where the entire file is a single line) from producing enormous output Set to 0 for unlimited, which is the default value. (ENGINE-2117)\n\n### ### Changed\n\n- Replaced `--x-no-python-schema-validation` with a value-taking `--x-rule-validation=full|core-only|none` flag. The default (`full`) preserves existing Python rule validation behavior; `core-only` matches the old flag's semantics (disables Python rule validation and uses semgrep-core RPC validation only); `none` skips both pre-validation passes, surfacing rule errors at scan-time. `--x-no-python-schema-validation` is still accepted as a no-op with a deprecation warning, and will be removed in a future release. (x-rule-validation)\n- Python: Updated Python grammar (LANG-201)\n\n### ### Fixed\n\n- Added bit shift operations to metavar comparison in addition to already present standard arithmetic operators and logical bit ops. (ENGINE-2448)\n- Reduce intermittent `validation_error` results on HTTP secret validators (Facebook, Slack, Stripe, Google, Cloudflare, etc.) by retrying transient network failures, mirroring the retry behavior already present for AWS validators. (SCRT-965)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/330272112","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/330272112/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/330272112/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.164.0","id":330272112,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84Tr41w","tag_name":"v1.164.0","target_commitish":"develop","name":"Release v1.164.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-05-27T14:35:20Z","updated_at":"2026-05-27T14:35:42Z","published_at":"2026-05-27T14:35:42Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.164.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.164.0","body":"## [1.164.0](https://github.com/semgrep/semgrep/releases/tag/v1.164.0) - 2026-05-26\n\n### ### Added\n\n- Dart: typed metavariables (`$X as T`) and `metavariable-type`,\n metavariable binding inside string interpolations, and function-definition\n patterns that match Dart function definitions. (gh-11678)\n\n### ### Changed\n\n- The default memory limit for Pro interfile scans on Linux now adapts to the container's cgroup memory limit (90% of it) instead of the previous fixed 5 GiB, with an 8 GiB fallback when no cgroup limit is detected. (ENGINE-2568)\n- Lower the glibc contraint from `>=2.35` to `>=2.34`, allowing users on distros\n that ship glibc 2.34 (e.g RHEL 9 & AL2023) to install the semgrep wheel. (gh-11622)\n\n### ### Fixed\n\n- Baseline diff scans (``semgrep ci`` and ``--baseline-commit``) no longer treat every finding on a file as newly introduced when rule(s) failed during the baseline run.\n\n Per-rule failures (for example a timeout for a single rule) on baseline analysis now hide only that rule's matches on that file from the \"new vs baseline\" comparison.\n Other rules on the same file are still taken in comparison for the \"new vs baseline\" comparison.\n\n Per-file, rule-independent failures now hide all findings on that file from the \"new vs baseline\" comparison. (LANG-515)\n- Fixed a yarn.lock parse error on Yarn Berry entries written\n in YAML explicit-key form. Affected lockfiles previously failed to parse. (SC-3479)\n- The (beta) SBT resolver with `--allow-local-builds` now correctly identifies dependencies as part of the Maven ecosystem. (SC-3522)\n- Fix `--sarif-output` and `--sarif` causing nosemgrep-suppressed findings to be reported in CLI scan output and to block scans. Suppressed findings are now correctly excluded from terminal text output, the scan-summary count, and the CLI's exit code. (engine-1824)\n- Fixed a bug that could cause unreliable target filtering in parallel scans. (gh-6313)\n- Dart: improved parser fidelity for Dart 3 grammar features and routed\n pattern parsing for statements beginning with `await`, `rethrow`, and other\n statement keywords. Eliminates a large class of `PartialParsing` errors on\n real-world pub.dev packages. (gh-11678)\n\n### ### Infra/Release Changes\n\n- pro: macOS: Fixed dynamic library lookup for `semgrep-core-proprietary` so the binary works when `semgrep install-semgrep-pro` is invoked, and `semgrep` is installed via Homebrew. (pro-binary-homebrew)\n- Pro: Added optional `.named_ast.expect` golden files for `tests/intrafile/maturity/` fixtures, exercised by `Unit_maturity_named_asts`. (LANG-287)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/323351288","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/323351288/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/323351288/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.163.0","id":323351288,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84TRfL4","tag_name":"v1.163.0","target_commitish":"develop","name":"Release v1.163.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-05-15T16:06:06Z","updated_at":"2026-05-15T16:06:24Z","published_at":"2026-05-15T16:06:24Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.163.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.163.0","body":"## [1.163.0](https://github.com/semgrep/semgrep/releases/tag/v1.163.0) - 2026-05-13\n\n### ### Added\n\n- Updated PHP target parsing to support grammar changes from PHP 8.1-8.5 (LANG-380)\n\n### ### Changed\n\n- Improved `semgrep ci` startup time with App-provided rules by avoiding duplicate semgrep-core rule validation during CLI rule loading while preserving config-style failures for invalid rules. (ci-rule-validation-startup)\n- Semgrep now validates dependency aware rules only on the core side, improving startup time (validate-skip-dep-aware)\n- Rule validation now runs in parallel across cores on large rulesets, reducing scan startup time. (gh-6279)\n- Rule parsing now runs in parallel across shards on multi-core machines, reducing scan startup time on large rulesets. (gh-6281)\n\n### ### Fixed\n\n- Improved name resolution for fully-qualified names in Java, Kotlin, and Scala. This could lead to fewer false positives and more true positives when the code under analysis uses fully-qualified names instead of imports. (java-qualified)\n- Optimised rule prefiltering and parsing to improve engine startup time. (rule-parse-cache)\n- Reduced peak memory usage when scanning repos with large rulesets. (rules-json-compact)\n- Fixed transitive reachability rule parsing performance: the temporary rule\n file written for each transitive-reachability RPC call is JSON content\n (`json.dumps([rule.raw])`) but was being created with a `.yaml` suffix.\n OCaml's `Parse_rule.parse_file` dispatches purely on file extension, so this\n routed every TR rule through `Yaml_to_generic.parse_yaml_file` (the slow YAML\n path) instead of `Fast_json.parse_program` (the new hand-written RFC 8259\n parser). Switching the suffix to `.json` lines the suffix up with the actual\n content and lets every TR rule parse take the fast path. (tr-json-suffix)\n- Pro: Fixed a naming resolution bug in Java. (LANG-274)\n","reactions":{"url":"https://api.github.com/repos/semgrep/semgrep/releases/323351288/reactions","total_count":1,"+1":1,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0}},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/319039525","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/319039525/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/319039525/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.162.0","id":319039525,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84TBCgl","tag_name":"v1.162.0","target_commitish":"develop","name":"Release v1.162.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-05-07T16:02:25Z","updated_at":"2026-05-07T16:03:28Z","published_at":"2026-05-07T16:03:28Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.162.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.162.0","body":"## [1.162.0](https://github.com/semgrep/semgrep/releases/tag/v1.162.0) - 2026-05-07\n\n### ### Added\n\n- pro: Improved support for tracking taint through nested functions. (LANG-95)\n- Added indexes to file targeting to improve performance of semgrepignore matching. (gh-27830)\n\n### ### Changed\n\n- Faster JSON rule parsing: rule files in JSON format now parse roughly 5x faster end-to-end (measured ~134s → ~28s on a 382MB rule pack) by going through a new hand-written RFC 8259 parser instead of the previous JS-parser-based chain. (ENGINE-2725)\n- Scala projects are now identified for Supply Chain only by their root build.sbt, rather than treating each build.sbt as a different subproject. (SC-3293)\n- MCP `semgrep_findings` tool: added a `refs` parameter to filter findings by branch (defaults to the primary branch when not specified), and made `autotriage_verdict` optional so that findings without an AI verdict can also be returned. (engine-2723)\n\n### ### Fixed\n\n- jsonnet: `import` and `importstr` now reject paths that resolve outside the\n rule file's parent directory. (ENGINE-2727)\n- semgrep ci: redact URL-embedded credentials and `Authorization` header\n values from git error messages and from the captured tracebacks sent to\n the fail-open telemetry endpoint, preventing leaks of secrets like\n `CI_JOB_TOKEN` from a failed `git fetch` in GitLab CI. Also closes\n ENGINE-2731 (raw, unsanitized tracebacks in fail-open telemetry). (ENGINE-2728)\n- `semgrep ci` no longer transmits SCM tokens to the Semgrep Platform. (ENGINE-2729)\n- semgrep CLI: the on-disk log file (`~/.semgrep/semgrep.log` or `$SEMGREP_LOG_FILE`) now respects the requested log level instead of always being written at DEBUG. This narrows the surface for credentials to land on disk via CI runner filesystems or job artifacts; pass `--debug` to restore the previous behavior. (ENGINE-2730)\n- jsonnet rules: bound recursion in both rule loading and evaluation so a\n malicious rule can no longer hang semgrep via mutually-recursive `import`s\n or runtime function calls that recurse forever. (ENGINE-2727-dos)\n- Scala: Merging consecutive top-level package declarations into a single package path. (LANG-374)\n- Fixed PHP parse errors during highly-parallel parsing. (gh-6197)\n- Fixed Scala parse errors during highly-parallel parsing. (gh-6198)\n- Surface a clearer error from the MCP scan tool when metrics is off and auto config is specified (gh-11649)\n- Fixed unknown option error when spawning the MCP daemon (gh-11660)\n","reactions":{"url":"https://api.github.com/repos/semgrep/semgrep/releases/319039525/reactions","total_count":1,"+1":0,"-1":0,"laugh":0,"hooray":1,"confused":0,"heart":0,"rocket":0,"eyes":0}},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/312433147","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/312433147/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/312433147/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.161.0","id":312433147,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84Sn1n7","tag_name":"v1.161.0","target_commitish":"develop","name":"Release v1.161.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-04-22T20:27:59Z","updated_at":"2026-04-22T20:28:49Z","published_at":"2026-04-22T20:28:49Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.161.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.161.0","body":"## [1.161.0](https://github.com/semgrep/semgrep/releases/tag/v1.161.0) - 2026-04-22\n\n### ### Added\n\n- Scala 3.4+ trait parameters are now parsed correctly. (lang-73)\n\n### ### Fixed\n\n- Semgrep's HTTP requests no longer log URLs above the debug level; full request\n details remain available when running with `SEMGREP_LOG_SRCS=cohttp.client`. (ENGINE-2712)\n","reactions":{"url":"https://api.github.com/repos/semgrep/semgrep/releases/312433147/reactions","total_count":1,"+1":1,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0}},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/309986925","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/309986925/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/309986925/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.160.0","id":309986925,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84SegZt","tag_name":"v1.160.0","target_commitish":"develop","name":"Release v1.160.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-04-16T18:10:33Z","updated_at":"2026-04-16T18:11:46Z","published_at":"2026-04-16T18:11:46Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.160.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.160.0","body":"## [1.160.0](https://github.com/semgrep/semgrep/releases/tag/v1.160.0) - 2026-04-16\n\n### ### Added\n\n- Scala: Added tree-sitter parser for improved parsing accuracy with pfff fallback. (LANG-255)\n- pro: taint: Improved support for variadic functions (LANG-375)\n\n### ### Fixed\n\n- Fixed performance issues during parsing Semgrep rules containing emoji or\n other non-BMP Unicode characters. (gh-6070)\n- Emit a warning when semgrep-core rule validation fails and falls back to JSON\n schema validation, alongside details of the failure. (gh-6071)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/307730080","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/307730080/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/307730080/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.159.0","id":307730080,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84SV5ag","tag_name":"v1.159.0","target_commitish":"develop","name":"Release v1.159.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-04-10T20:59:45Z","updated_at":"2026-04-10T21:00:34Z","published_at":"2026-04-10T21:00:33Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.159.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.159.0","body":"## [1.159.0](https://github.com/semgrep/semgrep/releases/tag/v1.159.0) - 2026-04-10\n\n### ### Fixed\n\n- Semgrep now reports an error instead of silently returning zero findings when target file discovery fails (e.g., due to a git ls-files failure). (ENGINE-2626)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/307350205","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/307350205/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/307350205/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.158.0","id":307350205,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84SUcq9","tag_name":"v1.158.0","target_commitish":"develop","name":"Release v1.158.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-04-10T01:45:57Z","updated_at":"2026-04-10T01:46:55Z","published_at":"2026-04-10T01:46:48Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.158.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.158.0","body":"## [1.158.0](https://github.com/semgrep/semgrep/releases/tag/v1.158.0) - 2026-04-09\n\n### ### Added\n\n- Added support for a supply chain hook for the Semgrep Plugin (supply-chain-hook)\n- Computing taint configs, ~1/4-1/2 of the semgrep-core time in interfile scans, is now done in parallel according to the number of jobs (ENGINE-2649)\n- Semgrep Pro interfile engine (--pro) taint analysis has been redesigned, significantly improving performance (estimated 20-40% improvement). This improvement introduces a slight change in how findings are generated, that may result in more true positives, or less false positives. To revert to previous behavior, pass `--no-x-run-taint-once` as a flag. (engine-2468)\n\n### ### Changed\n\n- semgrep-core macOS binaries are now dynamically linked to the system's libraries. (macos-binary-build)\n- semgrep-core manylinux binaries are now dynamically linked to the system's glibc on glibc systems. This introduces a minimum glibc version requirement of >=2.35, which is satisfied in Ubuntu >=22.04, Debian >=12, RHEL >=10, and other glibc distributions with at least glibc 2.35. Linux systems running an older glibc will need to upgrade their OS. (manylinux-binary-build)\n- The manylinux wheel is now tagged as manylinux_2_35_, reflecting a minimum\n requirement of glibc version 2.35. (manylinux-wheel-tag)\n- semgrep-core musllinux binaries are now dynamically linked to the system's musl libc on musl systems. (musllinux-binary-build)\n- The musllinux PyPI wheel is now tagged as musllinux_1_2_, reflecting a requirement\n of musl libc version 1.2. (musllinux-wheel-tag)\n- The LSP and MCP servers now use the v2 config download endpoint by default when fetching rules from Semgrep AppSec Platform. Set `SEMGREP_DISABLE_CONFIG_DOWNLOAD_V2=1` to fall back to the legacy endpoint. (SMS-2284)\n\n### ### Fixed\n\n- Fixed IDE login issues where network errors during token verification were incorrectly clearing the saved token. The LSP now distinguishes 401 Unauthorized (invalid token) from other errors (e.g. network failures), surfacing appropriate messages instead. (ide-login)\n- Fixed SARIF taint trace output: step locations now use the correct file URI, and the full taint sink call trace is included in `codeFlows`. (engine-2570)\n- The --x-mem-policy flag now propagates to the RPC subprocess, fixing memory tuning for dependency resolution and other RPC-based operations. (pylon-20772)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/303938278","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/303938278/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/303938278/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.157.0","id":303938278,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84SHbrm","tag_name":"v1.157.0","target_commitish":"develop","name":"Release v1.157.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-31T22:50:32Z","updated_at":"2026-03-31T22:51:27Z","published_at":"2026-03-31T22:51:26Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.157.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.157.0","body":"## [1.157.0](https://github.com/semgrep/semgrep/releases/tag/v1.157.0) - 2026-03-31\n\n### ### Added\n\n- pro: Improved taint tracking through lambda calls. (LANG-268)\n- It is now possible to match a class name like in `$C.getInstance(...)`, and then\n use `metavariable-type` on `$C` to check its type. (LANG-271)\n- pro: Improve cross-file taint tracking for globals. (LANG-275)\n\n### ### Changed\n\n- Pro: Reduces redundant recomputation during inter-file taint analysis by serializing intermediate results to disk. (ENGINE-2582)\n- pro: Improved golang module resolution. (code-9225)\n- Supply Chain Analysis of npm package lock files now uses a proprietary OCaml-based parser, replacing the old Python version. The supply-chain functionality for these files is now available only to Semgrep Pro users. (gh-5658)\n\n### ### Fixed\n\n- Fix Rust parsing of \"&raw\" where \"raw\" is an identifier. (rust-parser-updated)\n- Errors during target file discovery (e.g., permission errors, git failures) are now surfaced as warnings instead of being silently ignored. (ENGINE-2627)\n- kotlin: Fixed bug parsing FQNs in `metavariable-type`. (LANG-271)\n- Fixed requirements.txt parser silently dropping pinned dependencies that followed unpinned package names. (SC-3379)\n- Prevented certain deeply nested aliengrep matches from segfaulting semgrep-core. (engine-2628)\n- Fix Python parsing for files that contains empty strings (or quotes in docstrings) along with match statements. (gh-11287)\n- Fix rule paths.include/paths.exclude filtering when a single file is passed as a scan target. Previously, path patterns like '**/src/test/**/*.java' would not match because only the filename was used for filtering instead of the full project-relative path. (gh-11560)\n- Pro: Improved type resolution in Scala (lang-79)\n- Pro: Improved call resolution in Scala for parameterless methods (lang-80)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/298163535","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/298163535/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/298163535/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.156.0","id":298163535,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84RxZ1P","tag_name":"v1.156.0","target_commitish":"develop","name":"Release v1.156.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-17T21:17:17Z","updated_at":"2026-03-17T21:18:26Z","published_at":"2026-03-17T21:18:25Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.156.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.156.0","body":"## [1.156.0](https://github.com/semgrep/semgrep/releases/tag/v1.156.0) - 2026-03-17\n\n### ### Changed\n\n- The Kotlin tree-sitter parser has been updated to the latest available grammar significantly improving Kotlin support in Semgrep. (kotlin-parser)\n\n### ### Fixed\n\n- Pro: Experimental interfile tainting for Ruby now disambiguates between variable accesses and zero-argument method calls. (engine-2556)\n- Pro: Memoize tsconfig.json parsing to avoid redundant re-parsing across a project hierarchy. (engine-2596)\n- Fixed a crash in `semgrep ci` when run in a git repo with no remote origin set (gh-11342)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/295875694","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/295875694/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/295875694/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.155.0","id":295875694,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84RorRu","tag_name":"v1.155.0","target_commitish":"develop","name":"Release v1.155.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-11T20:53:36Z","updated_at":"2026-03-11T20:54:33Z","published_at":"2026-03-11T20:54:32Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.155.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.155.0","body":"## [1.155.0](https://github.com/semgrep/semgrep/releases/tag/v1.155.0) - 2026-03-11\n\n### ### Added\n\n- Added support for (agentic) hooks in Windsurf. (windsurf-hooks)\n- scala: Improved support for Scala 3's optional braces. (LANG-218)\n- Added PowerShell language support (beta) with parsing and pattern matching (lang-233)\n\n### ### Changed\n\n- Removed the experimental and undocumented command `semgrep install-ci`. (osemgrep-install-ci)\n- Migrate from publishing a single Linux wheel with the platform tag `musllinux_1_0_.manylinux2014_` to publishing two separate wheels:\n\n - A wheel with the platform tag musllinux_1_0_\n - A wheel with the platform tag manylinux2014_\n\n (pypi-linux-tag)\n\n### ### Fixed\n\n- When performing parallel operations over a small number of input items, the\n engine no longer spawns more OCaml domains than we have items to process. This\n assists with resource utilisation. (engine-2588)\n- Fixed: Prevent SessionStart hook crash when inject-secure-defaults receives empty stdin (JSONDecodeError). (engine-2592)\n- Semgrep secret validation now times out after 30 seconds instead of 15 minutes. Additionally this timeout is configurable via the `--secrets-timeout` flag. (engine-2593)\n- Fixed permission errors during lockfileless Java (Gradle) dependency resolution by invoking gradlew via sh when the executable bit is not set (gh-5747)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/293145741","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/293145741/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/293145741/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.154.0","id":293145741,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84ReQyN","tag_name":"v1.154.0","target_commitish":"develop","name":"Release v1.154.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-04T20:04:40Z","updated_at":"2026-03-04T20:05:30Z","published_at":"2026-03-04T20:05:29Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.154.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.154.0","body":"## [1.154.0](https://github.com/semgrep/semgrep/releases/tag/v1.154.0) - 2026-03-04\n\n### ### Fixed\n\n- Fix crash on Windows when running `semgrep ci` with `--debug` and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when `--debug` was active. (ENGINE-2491)\n- Changed default memory policy from \"eager\" to \"balanced\". Scan times should\n noticably improve; however, scans may use 5-10% additional memory. If running\n in a resource-constrained environment, consider setting the memory policy back\n to \"aggressive\". (engine-2055)\n- When Semgrep decides which files to scan (targeting), it can take a long time (over 5 minutes) on very large repos (> 10k files). Semgrep will now parallelize this work according to the number of jobs passed (`-j`) (engine-2512)\n- Fixed a performance issues where passing many scannign roots on the command\n line (e.g. `semgrep scan $(git ls-files '*.py')`) caused one semgrep-core\n subprocess to be spawned per file. Roots that are not directories are now\n handled directly in Python without any subprocess overhead. (gh-11404)\n- Scala: Restored parse rate after mistaken bug introduced by implicit block parsing fix (lang-215)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/290635999","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/290635999/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/290635999/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.153.0","id":290635999,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84RUsDf","tag_name":"v1.153.0","target_commitish":"develop","name":"Release v1.153.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-02-25T23:55:17Z","updated_at":"2026-02-25T23:56:01Z","published_at":"2026-02-25T23:56:00Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.153.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.153.0","body":"## [1.153.0](https://github.com/semgrep/semgrep/releases/tag/v1.153.0) - 2026-02-25\n\n### ### Added\n\n- Semgrep core is now optimized with flambda (flambda)\n- Scala: Support for `for`-`yield` (LANG-193)\n\n### ### Fixed\n\n- Scala: Fixed a parsing bug where subsequent calls in an implicit block would not\n be considered at the same scope, e.g.\n ```\n def f (a: t) =\n foo()\n bar()\n ``` (lang-194)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/287476329","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/287476329/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/287476329/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.152.0","id":287476329,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84RIopp","tag_name":"v1.152.0","target_commitish":"develop","name":"Release v1.152.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-02-18T00:42:14Z","updated_at":"2026-02-18T00:43:15Z","published_at":"2026-02-18T00:43:14Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.152.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.152.0","body":"## [1.152.0](https://github.com/semgrep/semgrep/releases/tag/v1.152.0) - 2026-02-17\n\n### ### Added\n\n- Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)\n- Turned on DNS rebinding protection for the MCP server (dns-check)\n- Environment variables can now be passed to third-party package managers invoked as part of `--allow-local-builds` dependency resolution via the environment variable `SEMGREP_LOCAL_BUILD_ENV`, which accepts a JSON object with string keys and string values. (SC-3163)\n- Memory management policies\n\n A memory policy defines how OCaml's garbage collector should be configured for\n a scan. There are two initial policies: \"aggressive\", the current behaviour,\n which trades longer scan times for lower memory use, and \"balanced\", which\n finds a middle ground between reclaiming heap memory in short order while\n limiting how often the garbage collector runs. The policy can be configured\n via the `--x-mem-policy` CLI flag for the pro engine; this flag is unused in\n the OSS engine. (engine-2055)\n- Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)\n- Allows case insensitive string comparisons using lower() and upper() like this:\n\n ```\n - metavariable-comparison:\n metavariable: $VALUE\n comparison: upper(str($VALUE)) == \"SEMGREP\"\n ```\n\n (gh-11502)\n- Blocking findings that are outputted in the CI output are now labelled as such. (#4394)\n\n### ### Changed\n\n- pro: There should be fewer FNs when the max number of fields to track per object\n is reached. (code-9224)\n- Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)\n\n### ### Fixed\n\n- pro: Improved accuracy of taint tracking through assignments, this will help\n reduce FPs in some cases. (code-9220)\n- When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a\n longer period of time before retrying the request, to spread out requests\n during periods of app instability. (engine-2550)\n","mentions_count":1},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/283087967","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/283087967/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/283087967/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.151.0","id":283087967,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84Q35Rf","tag_name":"v1.151.0","target_commitish":"develop","name":"Release v1.151.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-02-04T18:35:59Z","updated_at":"2026-02-04T18:36:58Z","published_at":"2026-02-04T18:36:56Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.151.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.151.0","body":"## [1.151.0](https://github.com/semgrep/semgrep/releases/tag/v1.151.0) - 2026-02-04\n\n\n### Added\n\n\n- Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)\n\n\n### Fixed\n\n\n- bumped `glom` to at least version `23.3`, which includes a fix to a `SyntaxWarning`\n warning log. (gh-11460)\n- Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)\n- Fixed the README not appearing in built wheels. (wheelreadme)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/281310093","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/281310093/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/281310093/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.150.0","id":281310093,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84QxHON","tag_name":"v1.150.0","target_commitish":"develop","name":"Release v1.150.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-01-29T22:49:29Z","updated_at":"2026-01-29T22:50:08Z","published_at":"2026-01-29T22:50:07Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.150.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.150.0","body":"## [1.150.0](https://github.com/semgrep/semgrep/releases/tag/v1.150.0) - 2026-01-29\n\n\n### Added\n\n\n- Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)\n\n\n### Changed\n\n\n- Migrated from `pipenv` to `uv` for `./cli` package management (uv)\n\n\n### Fixed\n\n\n- pro: Improved virtual method resolution in Scala (code-9213)\n- Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)\n- Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as `-alpha` in `1.2.3-alpha`. (sc-3001)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/278774479","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/278774479/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/278774479/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.149.0","id":278774479,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84QncLP","tag_name":"v1.149.0","target_commitish":"develop","name":"Release v1.149.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-01-21T20:20:54Z","updated_at":"2026-01-21T20:21:38Z","published_at":"2026-01-21T20:21:37Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.149.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.149.0","body":"## [1.149.0](https://github.com/semgrep/semgrep/releases/tag/v1.149.0) - 2026-01-21\n\n\n### Added\n\n\n- Added a warning in --debug mode when a user runs a parallel scan with a larger\n value for -j/--jobs than the number of CPUs we detect the host has made\n available to Semgrep. Additionally, a suggested starting value for -j/--jobs\n is reported to give the user a place to start tuning their scan. (saf-2474)\n- Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)\n\n\n### Changed\n\n\n- The MCP server no longer supports SSE transport. (saf-2462)\n\n\n### Fixed\n\n\n- pro: Improved virtual method resolution in Java (code-9210)\n- pro: Improved virtual method resolution in Scala (code-9212)\n- Improve performance of scan planning, a part of the Python CLI, by reducing\n the cost of re-hashing `Target` objects. Performance should improve on\n large repo scans proportionally to the number of files in the repo. (gh-5407)\n- `semgrep ci` no longer applies autofixes to disk, even when the \"Suggest autofixes\" toggle in the app is enabled. (saf-2446)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/276920711","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/276920711/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/276920711/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.148.0","id":276920711,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84QgXmH","tag_name":"v1.148.0","target_commitish":"develop","name":"Release v1.148.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-01-15T02:23:26Z","updated_at":"2026-01-15T02:24:23Z","published_at":"2026-01-15T02:24:21Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.148.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.148.0","body":"## [1.148.0](https://github.com/semgrep/semgrep/releases/tag/v1.148.0) - 2026-01-14\n\n\n### Added\n\n\n- Performance: subproject discovery in Supply Chain scans is no longer\n significantly slowed down by the presence of Git-untracked files\n resulting in faster diff scans in such cases. (sc-subproject-speedup)\n\n\n### Fixed\n\n\n- pro: Improved virtual method resolution in Java (code-9174)\n- pro: Improved handling of parse errors during inter-file analysis. Now, these\n errors should be adequately reported back to users and in the JSON output. (code-9216)\n- Dataflow now accounts for Python for/else and while/else loops. (gh-8405)\n- Fix rare \"bad file descriptor\" when performing Git operations on Windows (saf-2358)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/274965770","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/274965770/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/274965770/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.147.0","id":274965770,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84QY6UK","tag_name":"v1.147.0","target_commitish":"develop","name":"Release v1.147.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-01-07T21:43:53Z","updated_at":"2026-01-07T21:44:35Z","published_at":"2026-01-07T21:44:34Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.147.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.147.0","body":"## [1.147.0](https://github.com/semgrep/semgrep/releases/tag/v1.147.0) - 2026-01-07\n\n\n### Added\n\n\n- Gradle lockfiles of the form `gradle*.lockfile` are now supported. Previously, only lockfiles named exactly `gradle.lockfile` were supported. (SC-2999)\n- `semgrep login` now supports a `--force` flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use `--force` too. (saf-2392)\n\n\n### Fixed\n\n\n- Deduplication should now pick the exact same findings across scans. Previously,\n findings were always *equivalent*, but not guaranteed to be *exactly* the same\n (e.g. metavariable bindings could differ). Depending on the rule and target code,\n this could cause findings' fingerprints to change from one scan to another, thus\n leading to finding flakiness and \"cycling\" in Semgrep App. Note that when\n upgrading to this Semgrep version, you may see different (but equivalent) findings\n wrt your current Semgrep version in the first scan, one more time. However, in\n subsequent scans/upgrades, this problem should go away or at least be greatly\n reduced. (saf-2304)\n","reactions":{"url":"https://api.github.com/repos/semgrep/semgrep/releases/274965770/reactions","total_count":1,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":1,"eyes":0}},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/271229061","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/271229061/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/271229061/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.146.0","id":271229061,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84QKqCF","tag_name":"v1.146.0","target_commitish":"develop","name":"Release v1.146.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2025-12-17T20:42:55Z","updated_at":"2025-12-17T20:44:03Z","published_at":"2025-12-17T20:44:01Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.146.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.146.0","body":"## [1.146.0](https://github.com/semgrep/semgrep/releases/tag/v1.146.0) - 2025-12-17\n\n\n### Added\n\n\n- Added support for Cursor post-code-generation hooks via new `record-file-edit` and `stop-cli-scan` semgrep mcp flags (cursor-hooks)\n- Added `skipped_paths` field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)\n- Symbol analysis, if enabled, now runs for Supply Chain only scans when calling `semgrep ci`. (sc-2927)\n\n\n### Changed\n\n\n- Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)\n- bumped the `mcp` python-sdk from `1.16.0` to `1.23.3` (mcp-version)\n- pro: [experimental] enabling and disabling transitive reachability\n analysis in `semgrep ci` regardless of app settings is now possible with\n `--x-enable-transitive-reachability` (or `--x-tr`)\n and `--x-disable-transitive-reachability`. (tr-flags)\n\n\n### Fixed\n\n\n- The PHP AST now distinguishes between if statements with no else clause and those with an explicit but empty else {}. (gh-11330)\n- git-lfs objects are now excluded from baseline scans, as they are usually binary files, or simply too large to scan. (saf-2020)\n- Fix a OCaml stdlib bug that would cause nondeterministic UnixErrors on Windows under the multicore runtime due to a race condition in the socketpair implementation (saf-2316)\n- Fixed an issue that in rare cases could lead timeouts to be mishandled. This typically manifested only through slightly different warning messages, but it is possible that more serious consequences could have occasionally resulted. (saf-2368)\n- Fixed symbol analysis incorrectly analyzing all files instead of only the relevant language files per ecosystem. (sc-3020)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/267635211","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/267635211/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/267635211/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.145.0","id":267635211,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84P88oL","tag_name":"v1.145.0","target_commitish":"develop","name":"Release v1.145.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2025-12-05T02:25:29Z","updated_at":"2025-12-05T02:26:12Z","published_at":"2025-12-05T02:26:11Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.145.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.145.0","body":"## [1.145.0](https://github.com/semgrep/semgrep/releases/tag/v1.145.0) - 2025-12-04\n\n\n### Added\n\n\n- Added optional user-prompting for classifying findings as true/false positives via MCP Elicitation in the MCP server (behind SEMGREP_FINDINGS_ELICITATION_ENABLED, off by default). (elicitation)\n- Added hook to inject secure-by-default library recommendations into Claude Code Agent context. (secure-defaults-hook)\n\n\n### Changed\n\n\n- Symbol analysis upload now runs before scan completion to ensure it is available during initial scan postprocessing. (sc-2933)\n\n\n### Fixed\n\n\n- Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)\n- The correct range for `let ... in` expressions in OCaml is now reported. Previously, the location of the `let` was omitted. This is mainly relevant for autofix. (ocaml-let)\n- Debug log lines concerning telemetry collection that are only relevant inside\n Semgrep's managed scanning environment are not emitted if a scan runs outside\n that environment. (saf-2321)\n- pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)\n"},{"url":"https://api.github.com/repos/semgrep/semgrep/releases/263827141","assets_url":"https://api.github.com/repos/semgrep/semgrep/releases/263827141/assets","upload_url":"https://uploads.github.com/repos/semgrep/semgrep/releases/263827141/assets{?name,label}","html_url":"https://github.com/semgrep/semgrep/releases/tag/v1.144.0","id":263827141,"author":{"login":"semgrep-ci[bot]","id":106279034,"node_id":"BOT_kgDOBlWweg","avatar_url":"https://avatars.githubusercontent.com/u/29760937?v=4","gravatar_id":"","url":"https://api.github.com/users/semgrep-ci%5Bbot%5D","html_url":"https://github.com/apps/semgrep-ci","followers_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/semgrep-ci%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"node_id":"RE_kwDODZQCp84Pua7F","tag_name":"v1.144.0","target_commitish":"develop","name":"Release v1.144.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2025-11-20T00:43:41Z","updated_at":"2025-11-20T00:44:31Z","published_at":"2025-11-20T00:44:29Z","assets":[],"tarball_url":"https://api.github.com/repos/semgrep/semgrep/tarball/v1.144.0","zipball_url":"https://api.github.com/repos/semgrep/semgrep/zipball/v1.144.0","body":"## [1.144.0](https://github.com/semgrep/semgrep/releases/tag/v1.144.0) - 2025-11-19\n\n\n### Fixed\n\n\n- pro: interfile scans no longer default to -j 1; instead, the number of\n available CPUs on the system is polled as part of a heuristic to determine how\n many threads should be spawned. (gh-4952)\n- Semgrep will no longer rarely crash when --trace is passed. (incid-280)\n"}]