🌐 Semgrep AppSec Platform
Changed
- When Semgrep cannot open an Autofix pull request, the Autofix actions stay visible in the findings menu and explain why.
- Improved scan configuration generation. Scans now start even sooner.
Fixed
- Fixed an issue where Select all in bulk triage ignored the active team or project filter, so Jira tickets were created for every finding rather than the filtered set.
- Fixed an issue where Suggested fix showed a prompt to open an Autofix pull request when Autofix was unavailable.
- Fixed an issue where a source code manager connection could be deleted without a user or API request when a deployment had two connections to different hosts that shared an identifier.
- Fixed an issue where an organization that had already migrated to Unified Policies could be migrated again, reverting policy changes made since the migration.
- Fixed an issue where Semgrep did not retry a pull request comment after a failed post.
- Fixed an issue where clicking New team on Settings > Teams crashed the page.
- Fixed an issue where creating a token selected an inconsistent default role, and where filtering tokens by the Web API scope also returned read-only tokens.
💻 Semgrep Code
Changed
- Improved performance for rules that use only regular expressions. Semgrep now skips files that do not contain a required literal, so a rule that requires
FOOBARdoes not run on files that lackFOOBAR. - Semgrep now runs string checks before regular expressions when deciding whether a file can match a rule. Files that a string check already includes or excludes skip the regular expression, which was slow on files with very long lines.
Fixed
- Fixed an issue where Semgrep crashed if
HTTP_PROXY,HTTPS_PROXY, orALL_PROXYwas set to an unusable value. An empty value is ignored with a warning and the scan continues without a proxy. An invalid value now exits with an error that redacts credentials in the URL, and a proxy URL without a scheme now gets one. - Fixed an issue where
semgrep cifiltering was slow for deployments with many triage-ignored findings.
⛓️ Semgrep Supply Chain
Added
- Added Supply Chain incident triggers to the Logs tab for remediation policies. Entries triggered by an incident show From Supply Chain incident. Demo and dry runs are not recorded.
Fixed
- Fixed an issue where a Gradle Dynamic Dependency Resolution scan could succeed with an incomplete dependency list if a private registry rejected a request.
- Fixed an issue where Gradle scans that use AWS CodeArtifact failed because requests went through the Semgrep Network Broker and were rejected.
- Fixed an issue where Dynamic Dependency Resolution scans failed with an unclear error, or finished without private registry configuration, when Semgrep took too long to fetch private registry authentication. Semgrep now waits up to 10 seconds for that request.
- Fixed an issue where Supply Chain Autofix failed on repositories that use the Semgrep Network Broker because clone requests did not go through the broker.
- Fixed an issue where saving Upgrade Guidance for a large monorepo failed, and no Upgrade Guidance was saved.
🤖 Semgrep Multimodal
Added
- Organizations on the minimal data retention policy can now run all nine pre-built Agentic Workflows. Semgrep does not log code or prompts for observability on these deployments. Workflows outside the pre-built set must declare support for minimal data retention before they can run on these deployments.
Changed
- Workflow jobs lists and job details now show only jobs for projects a user can access.
- Workflow issues lists, groups, and counts now show only issues for repositories a user can access. On deployments that use Teams, ticket creation follows the same scope as triage.
Fixed
- Fixed an issue where the ignore reason and comment selected during triage were discarded for Admins and for deployments without Teams.
- Fixed an issue where a finding from a scan, rather than a workflow run, linked to a job page that did not exist. Findings now link to their scan or their job, and findings with no recorded source have no link.
- Fixed an issue where an Agentic Workflows issue could show a file from the current default branch instead of the scanned commit, and prompted users to reconnect a source code manager that was already working. The Settings link now appears only when the repository is disconnected or inaccessible.