> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Week of October 12, 2026

> Updates made to Semgrep during the week of October 12-18, 2026.

## 🌐 Semgrep AppSec Platform

### Added

* Added a **Finding type** filter to [dashboards](https://docs.semgrep.dev/semgrep-appsec-platform/dashboard.md). Use it to view **AI-powered** and **Rule-based** [Semgrep Code](https://docs.semgrep.dev/semgrep-code/overview.md) findings separately in charts, drilldowns, and PDF exports.
* Added a sortable **False positive rate** column to the rules table in [Policies](https://docs.semgrep.dev/semgrep-appsec-platform/unified-policies/overview). The column covers Semgrep Code and [Semgrep Secrets](https://docs.semgrep.dev/semgrep-secrets/conceptual-overview.md) rules. Select a rate to open findings that were ignored as false positives. The rate includes every false positive triage, whether it came from a person, the API, or an automation.
* Added an experimental endpoint, `GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues`, that returns a finding’s related issues. Finding responses still include `relatedIssues`, but that field is deprecated.

### Changed

* The [Network Broker](https://docs.semgrep.dev/semgrep-ci/network-broker.md) toggle now appears only on connections to self-hosted source code managers, which is what Network Broker is for. Previously, the toggle also appeared on GitHub.com, GitLab.com, Bitbucket Cloud, and Azure DevOps connections, and turning it on prevented Semgrep from connecting to them. If any of your cloud connections had Network Broker turned on, Semgrep turned it off. You don’t need to take any action.
* Rate limits for the public deployment endpoints (`/api/v2/deployments/public/{id}` and `/api/v2/deployments/public/search`) now count every request, including repeated and concurrent requests. When a client exceeds the limit, Semgrep returns HTTP `429`.

### Fixed

* Fixed an issue where one [Cursor Origin](https://docs.semgrep.dev/deployment/managed-scanning/cursor.md) connection with a missing repository stopped pull request events for other repositories that use the same Cursor installation.
* Fixed an issue where, in organizations that use [Network Broker](https://docs.semgrep.dev/semgrep-ci/network-broker.md) for a self-hosted source code manager, Semgrep also sent GitHub.com requests through the broker, which caused repository listing and token requests to fail. Semgrep now uses Network Broker only for connections that have it turned on.
* Fixed an issue where a source code manager connection was marked as uninstalled when Network Broker was briefly unreachable, which blocked scans until the next health check. **Settings > Source code managers** now shows a readable error when the broker can’t reach your source code manager.
* Fixed an issue where a scan configuration request returned HTTP `410` and the error `Config generation timed out` after Semgrep had already generated the configuration.
* Fixed an issue where **Re-run** on a Semgrep check in GitHub didn’t start a new scan in [Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/overview).
* Fixed an issue where a policy’s matching-findings count was much higher than the list opened from that count. [Semgrep Code](https://docs.semgrep.dev/semgrep-code/overview.md) and [AI-powered detection](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts) findings now appear together on one **Code** tab. Tabs for products that the policy excludes are hidden.
* Fixed an issue where the browser tab froze when Semgrep highlighted a large or complex file, such as on the **Details** page of a **Workflows** issue. Semgrep shows the code as plain text first, then adds highlighting when it’s ready.

## 💻 Semgrep Code

### Changed

* Removed support for QL, the CodeQL query language. Semgrep rejects `--lang ql` and the `ql` language key in rules, and it doesn’t parse `.ql` or `.qll` files.
* Updated the bundled `anyio` and `urllib3` dependencies to versions that fix known security advisories.

### Fixed

* Fixed an issue where scans stopped responding when Semgrep couldn’t reach the telemetry service.

## ⛓️ Semgrep Supply Chain

### Added

* Added **Language**, **Severity**, and **Advisory type** filters to the [Advisories](https://docs.semgrep.dev/semgrep-supply-chain/advisories.md) page. These are the same filters as on the Findings page. The advisories table also includes an **Incident** column.

### Changed

* Semgrep Supply Chain now includes every package declared in a Python `requirements.txt` file in the dependency inventory and [software bill of materials (SBOM)](https://docs.semgrep.dev/semgrep-supply-chain/sbom.md), not only packages pinned with `==`:
  * A package with a version range, such as `requests>=2.0`, is listed with the range as its version.
  * A package without a version, such as `flask`, is listed with an empty version.
  * Packages with a range or no version don’t produce findings, because Semgrep can’t determine the installed version.
  * If the project has no `requirements.in` file, packages with a range or no version are listed as direct dependencies.
  * Local path and URL lines are no longer reported as parse errors.
  * A line that doesn’t start with a valid package name is now reported as a parse error instead of being ignored.
* On the [**Dependencies**](https://docs.semgrep.dev/semgrep-supply-chain/dependency-search.md) page, you can now filter by version without opening the advanced options. The Dependency filter is now an **All dependencies** menu, like the **Projects** and **License** filters. In the menu, choose **Exact** or **Contains matching**, and choose **All versions** or **Select versions**. If you enter a dependency name followed by a version, such as yn 3.1.1, Semgrep fills in the version fields for you.

### Fixed

* Fixed an issue where Supply Chain incident counts didn’t match the findings shown when you opened them. **Matching projects** counts projects from both your dependencies and your findings. Counts exclude archived projects and projects you don’t have permission to view. Incident notifications also exclude archived projects.
* Fixed several issues with [Dynamic Dependency Resolution](https://docs.semgrep.dev/semgrep-supply-chain/set-up-and-configure.md#dynamic-dependency-resolution-beta) scans for Gradle and Maven projects:
  * Gradle scans no longer fail with `Could not find` errors when a private registry is declared in an `exclusiveContent` block. Semgrep adds registry credentials to your existing repository declaration, so that declaration’s other settings still apply.
  * Gradle scans no longer fail when the build directory is relocated. If dependency resolution doesn’t produce a report, the scan reports a resolution error that includes the Gradle log.
  * Gradle and Maven scans now report incomplete dependency resolution instead of finishing without an error. If a registry request fails, the error includes the registry URL when one is available.

## 🤖 Semgrep Multimodal

### Added

* Added support for directly connecting to Anthropic by providing an Anthropic API key. To provide a key, select **Manual** mode in the [AI provider settings](https://docs.semgrep.dev/semgrep-multimodal/customize.md#select-your-ai-provider) and configure the Anthropic connection. When configured, this connection is used for in-app features such as [Autotriage](https://docs.semgrep.dev/semgrep-multimodal/overview#autotriage) and [Autofix](https://docs.semgrep.dev/semgrep-code/triage-remediation/autofix.md). Today, you can’t use the direct Anthropic connection in **Automatic** mode with a Semgrep-managed key; Semgrep uses Amazon Bedrock instead. You also can’t use the direct Anthropic connection for [AI-powered detection](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts) or for [Agentic Workflows](https://docs.semgrep.dev/workflows/overview.md). Bringing your own API key is available only to Semgrep Enterprise and to users who already had their own API key.
* When a reviewer approves a [developer exception request](https://docs.semgrep.dev/semgrep-appsec-platform/developer-exception-requests.md) that includes a note, Semgrep creates a memory from that note. This applies to Semgrep Code, [AI-powered detection](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts), and Semgrep Secrets findings.

### Changed

* Organizations that hadn’t chosen an AI provider mode, and that used Semgrep’s default providers, now use **Automatic** mode. That mode includes Cloudflare Workers AI. Organizations that chose their own providers, and organizations on the [minimal data retention policy](https://docs.semgrep.dev/semgrep-multimodal/privacy.md#minimal-data-retention-policy-optional), are unchanged.
* The **xAI** provider is now called **SpaceXAI**. It always uses `https://api.x.ai/v1`, so the endpoint field no longer appears.
* Azure OpenAI settings now include a required **Base model** field for the model that your Azure deployment runs. New Azure OpenAI setups must fill in this field.
* When you [export Agentic Workflows issues to CSV](https://docs.semgrep.dev/workflows/get-started.md#export-issues), Semgrep exports only the issues or groups you selected. If you select nothing, the export uses your filters. The 10,000-issue limit applies to the selection, so you can export a subset when more than 10,000 issues match your filters.

### Fixed

* Fixed an issue where the **Findings** column on the **Suggested** tab of **Rules & Policies > Memories** didn’t finish loading for organizations with archived projects.

## 🔐 Semgrep Secrets

### Changed

* The legacy issue details endpoint now returns `null` for `code_snippet` on Semgrep Secrets findings, so the response doesn’t include secret values. Other endpoints already do this.

### Fixed

* Fixed an issue where historical secrets scanning stopped when Git repository maintenance failed. The scan now continues.

## 🛡️ Semgrep Guardian

### Added

* New Semgrep organizations can start a 30-day free trial of [Semgrep Guardian](https://docs.semgrep.dev/semgrep-guardian/overview.md) and upgrade to a paid plan in Semgrep AppSec Platform. Trial setup includes steps for [Claude Code](https://docs.semgrep.dev/semgrep-guardian/ide-setup/claude-code.md) and [Codex](https://docs.semgrep.dev/semgrep-guardian/ide-setup/codex.md). This applies to organizations created on or after October 13, 2026.
* Added PowerShell support. Semgrep Guardian runs its hooks on PowerShell commands and on Bash commands.

### Changed

* Semgrep Guardian now scans files in the background, so your agent no longer waits for each scan to finish. Previously, Guardian paused the agent after it wrote a file until the scan completed. When a scan completes, Guardian sends the results to the agent. If the agent has stopped, Guardian resumes it with the results so it can fix the findings. This also applies to subagents.

### Fixed

* Fixed an issue where organization members and read-only users who weren’t on a team got an HTTP `404` error when they opened Semgrep Guardian custom rules in organizations that use project-level role-based access control.

## 🔧 Semgrep Community Edition

The following versions of Semgrep Community Edition were released during the week of October 12-18, 2026:

> **[1.181.0](https://github.com/semgrep/semgrep/releases/tag/v1.181.0)**