💻 Semgrep Code
Added
- You can now fix multiple Code findings in a single Autofix pull request or merge request. When several findings in the same file come from the same rule, Semgrep offers to open one pull request or merge request for the group.
Changed
- The Code Autofix toggle has been removed from Settings. Supply Chain keeps its own toggle for Upgrade Guidance and Supply Chain Autofix.
🤖 Semgrep Multimodal
Added
- Issues created by Semgrep Agentic Workflows are now available through the experimental v2 API.
- The Workflow jobs tab on a project’s Details page now includes a branch filter, with the primary branch pinned to the top of the list.
- On Rules & Policies > Memories, you can now sort suggested memories by the number of findings they affect.
Changed
- When a scan hits the free-tier AI scan limit, Semgrep now shows Free-tier AI scan limit reached instead of a generic internal error. Retry scan is not offered in that case.
Fixed
- Fixed an issue where Suggested fix guidance could include dependency versions, commit SHAs, or hashes that Semgrep could not verify. Semgrep now uses a placeholder in the guidance instead of an unverified value.
🌐 Semgrep AppSec Platform
Added
- You can now search for a workflow by name when configuring the Run a workflow action in a remediation policy.
Changed
- When you delete a rule in Semgrep Editor, Semgrep now asks for confirmation and shows which policies use that rule. Confirming the deletion removes the rule from those policies. If a policy has no remaining conditions, Semgrep deletes the policy.
- Teams that are pending deletion are no longer listed in Settings > Teams or in team search results.
Fixed
- Fixed an issue where a single failure while updating a pull request status stopped Semgrep from updating the remaining pull requests in the same batch.
- Fixed an issue where the Semgrep Code findings tour did not launch and Supply Chain triage did not advance onboarding checklist completion.
⛓️ Semgrep Supply Chain
Changed
- On Rules & Policies > Advisories, an advisory’s Details page now shows affected projects directly below the description.
- Improved the load time of the Dependencies page for organizations with large dependency sets.
- Supply Chain incident notifications now refer to affected packages rather than dependencies.
Fixed
- Fixed an issue where Semgrep Managed Scans that use Dynamic Dependency Resolution failed if the organization had a private registry configured.
- Fixed an issue where Semgrep could not clone Azure DevOps repositories when opening a Supply Chain Autofix pull request.
- Fixed an issue where a long dependency name in the dependency search field pushed the filter’s remove button out of view, making the filter impossible to remove.
📝 Documentation and knowledge base
Added
- Added a knowledge base article for troubleshooting GitLab group permissions when no SCMs with code access are found.
- Added a knowledge base article explaining why some findings remain in Open status instead of Provisionally ignored when Semgrep flags them as False positives.