Week of October 12, 2026

​

🌐 Semgrep AppSec Platform

​

Added

• Added a Finding type filter to dashboards. Use it to view AI-powered and Rule-based Semgrep Code findings separately in charts, drilldowns, and PDF exports.
• Added a sortable False positive rate column to the rules table in Policies. The column covers Semgrep Code and Semgrep Secrets rules. Select a rate to open findings that were ignored as false positives. The rate includes every false positive triage, whether it came from a person, the API, or an automation.
• Added an experimental endpoint, GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues, that returns a finding’s related issues. Finding responses still include relatedIssues, but that field is deprecated.

​

Changed

• The Network Broker toggle now appears only on connections to self-hosted source code managers, which is what Network Broker is for. Previously, the toggle also appeared on GitHub.com, GitLab.com, Bitbucket Cloud, and Azure DevOps connections, and turning it on prevented Semgrep from connecting to them. If any of your cloud connections had Network Broker turned on, Semgrep turned it off. You don’t need to take any action.
• Rate limits for the public deployment endpoints (/api/v2/deployments/public/{id} and /api/v2/deployments/public/search) now count every request, including repeated and concurrent requests. When a client exceeds the limit, Semgrep returns HTTP 429.

​

Fixed

• Fixed an issue where one Cursor Origin connection with a missing repository stopped pull request events for other repositories that use the same Cursor installation.
• Fixed an issue where, in organizations that use Network Broker for a self-hosted source code manager, Semgrep also sent GitHub.com requests through the broker, which caused repository listing and token requests to fail. Semgrep now uses Network Broker only for connections that have it turned on.
• Fixed an issue where a source code manager connection was marked as uninstalled when Network Broker was briefly unreachable, which blocked scans until the next health check. Settings > Source code managers now shows a readable error when the broker can’t reach your source code manager.
• Fixed an issue where a scan configuration request returned HTTP 410 and the error Config generation timed out after Semgrep had already generated the configuration.
• Fixed an issue where Re-run on a Semgrep check in GitHub didn’t start a new scan in Semgrep Managed Scans.
• Fixed an issue where a policy’s matching-findings count was much higher than the list opened from that count. Semgrep Code and AI-powered detection findings now appear together on one Code tab. Tabs for products that the policy excludes are hidden.
• Fixed an issue where the browser tab froze when Semgrep highlighted a large or complex file, such as on the Details page of a Workflows issue. Semgrep shows the code as plain text first, then adds highlighting when it’s ready.

​

💻 Semgrep Code

​

Changed

• Removed support for QL, the CodeQL query language. Semgrep rejects --lang ql and the ql language key in rules, and it doesn’t parse .ql or .qll files.
• Updated the bundled anyio and urllib3 dependencies to versions that fix known security advisories.

​

Fixed

• Fixed an issue where scans stopped responding when Semgrep couldn’t reach the telemetry service.

​

⛓️ Semgrep Supply Chain

​

Added

• Added Language, Severity, and Advisory type filters to the Advisories page. These are the same filters as on the Findings page. The advisories table also includes an Incident column.

​

Changed

• Semgrep Supply Chain now includes every package declared in a Python requirements.txt file in the dependency inventory and software bill of materials (SBOM), not only packages pinned with ==:
  • A package with a version range, such as requests>=2.0, is listed with the range as its version.
  • A package without a version, such as flask, is listed with an empty version.
  • Packages with a range or no version don’t produce findings, because Semgrep can’t determine the installed version.
  • If the project has no requirements.in file, packages with a range or no version are listed as direct dependencies.
  • Local path and URL lines are no longer reported as parse errors.
  • A line that doesn’t start with a valid package name is now reported as a parse error instead of being ignored.
• On the Dependencies page, you can now filter by version without opening the advanced options. The Dependency filter is now an All dependencies menu, like the Projects and License filters. In the menu, choose Exact or Contains matching, and choose All versions or Select versions. If you enter a dependency name followed by a version, such as yn 3.1.1, Semgrep fills in the version fields for you.

​

Fixed

• Fixed an issue where Supply Chain incident counts didn’t match the findings shown when you opened them. Matching projects counts projects from both your dependencies and your findings. Counts exclude archived projects and projects you don’t have permission to view. Incident notifications also exclude archived projects.
• Fixed several issues with Dynamic Dependency Resolution scans for Gradle and Maven projects:
  • Gradle scans no longer fail with Could not find errors when a private registry is declared in an exclusiveContent block. Semgrep adds registry credentials to your existing repository declaration, so that declaration’s other settings still apply.
  • Gradle scans no longer fail when the build directory is relocated. If dependency resolution doesn’t produce a report, the scan reports a resolution error that includes the Gradle log.
  • Gradle and Maven scans now report incomplete dependency resolution instead of finishing without an error. If a registry request fails, the error includes the registry URL when one is available.

​

🤖 Semgrep Multimodal

​

Added

• Added support for directly connecting to Anthropic by providing an Anthropic API key. To provide a key, select Manual mode in the AI provider settings and configure the Anthropic connection. When configured, this connection is used for in-app features such as Autotriage and Autofix. Today, you can’t use the direct Anthropic connection in Automatic mode with a Semgrep-managed key; Semgrep uses Amazon Bedrock instead. You also can’t use the direct Anthropic connection for AI-powered detection or for Agentic Workflows. Bringing your own API key is available only to Semgrep Enterprise and to users who already had their own API key.
• When a reviewer approves a developer exception request that includes a note, Semgrep creates a memory from that note. This applies to Semgrep Code, AI-powered detection, and Semgrep Secrets findings.

​

Changed

• Organizations that hadn’t chosen an AI provider mode, and that used Semgrep’s default providers, now use Automatic mode. That mode includes Cloudflare Workers AI. Organizations that chose their own providers, and organizations on the minimal data retention policy, are unchanged.
• The xAI provider is now called SpaceXAI. It always uses https://api.x.ai/v1, so the endpoint field no longer appears.
• Azure OpenAI settings now include a required Base model field for the model that your Azure deployment runs. New Azure OpenAI setups must fill in this field.
• When you export Agentic Workflows issues to CSV, Semgrep exports only the issues or groups you selected. If you select nothing, the export uses your filters. The 10,000-issue limit applies to the selection, so you can export a subset when more than 10,000 issues match your filters.

​

Fixed

• Fixed an issue where the Findings column on the Suggested tab of Rules & Policies > Memories didn’t finish loading for organizations with archived projects.

​

🔐 Semgrep Secrets

​

Changed

• The legacy issue details endpoint now returns null for code_snippet on Semgrep Secrets findings, so the response doesn’t include secret values. Other endpoints already do this.

​

Fixed

• Fixed an issue where historical secrets scanning stopped when Git repository maintenance failed. The scan now continues.

​

🛡️ Semgrep Guardian

​

Added

• New Semgrep organizations can start a 30-day free trial of Semgrep Guardian and upgrade to a paid plan in Semgrep AppSec Platform. Trial setup includes steps for Claude Code and Codex. This applies to organizations created on or after October 13, 2026.
• Added PowerShell support. Semgrep Guardian runs its hooks on PowerShell commands and on Bash commands.

​

Changed

• Semgrep Guardian now scans files in the background, so your agent no longer waits for each scan to finish. Previously, Guardian paused the agent after it wrote a file until the scan completed. When a scan completes, Guardian sends the results to the agent. If the agent has stopped, Guardian resumes it with the results so it can fix the findings. This also applies to subagents.

​

Fixed

• Fixed an issue where organization members and read-only users who weren’t on a team got an HTTP 404 error when they opened Semgrep Guardian custom rules in organizations that use project-level role-based access control.

​

🔧 Semgrep Community Edition

The following versions of Semgrep Community Edition were released during the week of October 12-18, 2026: