> ## Documentation Index > Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt > Use this file to discover all available pages before exploring further. # Week of October 5, 2026 > Updates made to Semgrep during the week of October 5-11, 2026. ## 🌐 Semgrep AppSec Platform ### Changed * Rotating the webhook secret for a customer-owned GitHub App now also updates the secret on existing webhooks, so pull request workflows continue to trigger after rotation. If your webhooks already have a stale secret, go to **Settings > Source code managers** and click **Rotate webhook secret**. This applies to GitHub Cloud and GitHub Enterprise. * When you connect a self-hosted source code manager, Semgrep now shows the reason for a connection failure. If **Connect** fails for an expected reason, Semgrep keeps the saved connection so you can correct it and retry. * When you add a new source code manager connection, Semgrep now requires a hostname in the base URL instead of an IP address. This change doesn’t affect existing connections. * The [findings API](/api-reference/v1/findingsservice/list-code-supply-chain-or-ai-powered-detection-findings) (`GET /api/v1/deployments/{deploymentSlug}/findings`) now returns `click_to_fix_prs` and `click_to_fix_failures` on [Semgrep Code](/semgrep-code/overview) and [AI-powered detection](/semgrep-code/ai-powered-detection-concepts) findings for every deployment. `click_to_fix_prs` lists pull requests created by [Autofix](/semgrep-code/triage-remediation/autofix), and `click_to_fix_failures` lists failed Autofix attempts. Previously, these fields returned empty lists unless the deployment was in the Autofix beta. ### Fixed * Fixed issues where pull requests or merge requests could remain blocked beyond the fail-open deadline for [Semgrep Managed Scans](/deployment/managed-scanning/overview). The overhauled fail-open system now reliably updates PRs and MRs on time, even if scans are delayed or the source code manager is temporarily unavailable. The fail-open deadline is 10 minutes by default, and you can change it. * Fixed an issue where changing a GitHub pull request’s base branch didn’t trigger a new diff-aware scan unless you also pushed a commit. Other changes, like editing the title or description, still don't trigger a scan. ## ⛓️ Semgrep Supply Chain ### Changed * When [Supply Chain Autofix](/semgrep-supply-chain/autofix) opens a pull request, the finding moves from **Open** or **Reviewing** to **To fix**, matching [Autofix for Semgrep Code](/semgrep-code/triage-remediation/autofix). If the finding already has a different triage state, it keeps that state. If the pull request fails, the finding stays in the triage state it already had. ## 🤖 Semgrep Multimodal ### Changed * The [AI provider settings](/semgrep-multimodal/customize#select-your-ai-provider) now offer **Automatic** and **Manual** selection. In **Automatic** mode, Semgrep manages the list of AI providers, which includes Amazon Bedrock, Cloudflare Workers AI, and OpenAI, and updates it when Semgrep adds a provider. When you turn on Semgrep Multimodal, Semgrep uses **Automatic** mode. * Only organization admins can use the API to create, change, delete, or view [Agentic Workflows](/workflows/overview) schedules, or to trigger workflow runs, including a single run, a workflow pack, and a bulk run. This behavior matches Semgrep AppSec Platform, which already limits these pages to admins. * The **Total credits used** column on the workflow scheduling page now counts runs from every trigger, including runs started by pull requests, instead of only scheduled runs. ### Fixed * Fixed an issue where [Semgrep Agentic Workflows](/workflows/overview) runs exceeding two hours were marked as failed before completion, preventing their results from appearing in Agentic Workflows issues. Runs can now take up to five hours. * Fixed an issue where saving xAI, OpenAI, or Google Gemini without re-entering your API key erased the stored key. Saving Azure OpenAI failed in the same case. Semgrep now keeps the stored key. If you change an Azure OpenAI or xAI endpoint to a different host, re-enter the key. Bringing your own API key is available only to Semgrep Enterprise and to users who already had their own API key. * Fixed an issue where [Agentic Workflows](/workflows/overview) runs failed to start on [Cursor Origin](/deployment/managed-scanning/cursor) repositories if the Semgrep installation didn't have write access or used a different API host. Workflows that only read code now run with read-only access. ## 🔐 Semgrep Secrets ### Fixed * Fixed an issue where [Autotriage](/semgrep-multimodal/overview#autotriage) of [Generic secrets](/semgrep-secrets/generic-secrets) failed repeatedly for an issue that already had more than one triage result. ## 🛡️ Semgrep Guardian ### Added * [Semgrep Guardian](/semgrep-guardian/overview) now supports Codex, with the same capabilities as Claude Code. It scans with Semgrep Code, Supply Chain, and Secrets on a Semgrep-hosted server, so you do not need the Semgrep CLI. Codex uses the fixed `guardian-default` ruleset, not your Policies. On Windows, Guardian requires Windows Subsystem for Linux (WSL). See [Set up Semgrep Guardian for Codex](/semgrep-guardian/ide-setup/codex).