> ## Documentation Index > Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt > Use this file to discover all available pages before exploring further. # Week of October 19, 2026 > Updates made to Semgrep during the week of October 19-25, 2026. ## 🌐 Semgrep AppSec Platform ### Added * [SCIM provisioning](https://docs.semgrep.dev/deployment/scim), which is in public beta, now supports single-tenant deployments. SCIM setup also includes a step to choose primary admins. Directory sync can't demote or remove a primary admin, and you can change primary admins only in Semgrep AppSec Platform. * Added support for Azure DevOps, Bitbucket Cloud, and Bitbucket Data Center repositories to the [Wiz integration](https://docs.semgrep.dev/semgrep-appsec-platform/wiz.md). Previously, Semgrep sent findings to Wiz only from GitHub and GitLab repositories. You don't need to change your Wiz configuration. ### Changed * API tokens with the **Read-only** scope and users with the **Read-only** role can no longer create, update, or delete automations in [remediation policies](https://docs.semgrep.dev/semgrep-appsec-platform/unified-policies/overview), or create or link tickets. This matches the documented **Read-only** token scope: a **Read-only** token can retrieve data but can't make changes. For more information, see [Access tokens](https://docs.semgrep.dev/deployment/tokens.md). * Deleting a project now runs in the background, so deleting a large project no longer times out. To delete a project, go to **Projects**, open the project, and click **Delete project**. Until Semgrep finishes removing the project's data, the project stays on the **Projects** page marked as pending deletion, and you can't edit or scan it. When the deletion is complete, Semgrep sends you a notification. For more information, see [Delete a project](https://docs.semgrep.dev/deployment/manage-projects.md#delete-a-project). * [Slack notifications](https://docs.semgrep.dev/semgrep-appsec-platform/slack-notifications.md) now use one layout for Semgrep Agentic Workflows issues, Semgrep Code, Semgrep Supply Chain, and Semgrep Secrets findings, incoming webhook findings, and triage events. Agentic Workflows issue alerts include a count in the header and a description, and Semgrep Secrets alerts no longer repeat the remediation text for every finding. ### Fixed * Fixed an issue where members who don't belong to a team couldn't scan a new project in organizations that use project-level role-based access control. * Fixed an issue where syncing a single project didn't update the project name after its repository was renamed in your source code manager. Project names that you changed manually stay the same. * Fixed an issue where an Autofix pull request didn't open when two Autofix requests for the same repository started at the same time. Autofix branch names now include the pull request title. * Fixed an issue where findings links that use the `tab` URL parameter could show only one status. These links now open a view that can show several statuses at once. For example, one link can show both **Open** and **Provisionally ignored** findings. * Fixed an issue where a newly created API token didn't appear in the token list because the list stayed filtered to **Web API** tokens. The list now switches to the scope of the token you created. ## 💻 Semgrep Code ### Changed * The Semgrep CLI and Docker images now reject certificates issued by the compromised eMudhra certificate authority when connecting to Semgrep and to secret validation endpoints. Upgrade now: older versions could let an attacker on your network impersonate Semgrep's servers and steal your Semgrep token. If you run Semgrep from Docker or PyPI, upgrade to the latest version. If you installed Semgrep with Homebrew, run `brew update && brew upgrade certifi ca-certificates`. ## ⛓️ Semgrep Supply Chain ### Added * Semgrep Supply Chain now supports Bun projects that use a `bun.lock` lockfile with a `package.json` file. Semgrep builds the dependency graph, including direct and transitive dependencies and workspaces, and reports vulnerability and malicious dependency findings. Semgrep doesn't support the binary `bun.lockb` format. To switch to `bun.lock`, run `bun install --save-text-lockfile --frozen-lockfile --lockfile-only`, then delete `bun.lockb`. For more information, see [Supply Chain requirements and feature support](https://docs.semgrep.dev/semgrep-supply-chain/requirements-and-feature-support.md). * [Supply Chain Autofix](https://docs.semgrep.dev/semgrep-supply-chain/autofix.md) now opens pull requests for transitive dependencies in npm and PyPI projects that have a lockfile. Semgrep updates only the vulnerable package in the lockfile, and **Open Autofix PR** is unavailable if a parent package's version range doesn't allow the fixed version. ### Changed * On the [**Dependencies**](https://docs.semgrep.dev/semgrep-supply-chain/dependency-search.md) page, Python packages that a `requirements.txt` file declares with a version range or without a version now show the declared range in the **Version** column, with an icon that marks them as unpinned. * In [software bill of materials (SBOM)](https://docs.semgrep.dev/semgrep-supply-chain/sbom.md) exports, Python packages that a `requirements.txt` file declares with a version range or without a version are now listed as CycloneDX components without a version. The declared range is included as a component property. ## 🤖 Semgrep Multimodal ### Added * Scheduled workflows are now in **public beta**. You can schedule [Semgrep Agentic Workflows](https://docs.semgrep.dev/workflows/overview.md) to run daily, weekly, or monthly on the projects you choose. To set up a schedule, go to **Policies** and click **Edit** on the **Scheduled workflows** card: * The **Scheduled workflows** table shows how often each workflow runs. To change a workflow's projects or frequency, click the edit button in the **Actions** column. * The **Add workflow** picker includes filters to help you find a workflow. * The **Scheduled workflows** card counts each scheduled workflow and project once, even if a workflow runs on several projects, branches, or scopes. For more information, see [Schedule Agentic Workflows](https://docs.semgrep.dev/workflows/get-started.md#schedule-agentic-workflows). * Added the **Detect-2Shell** workflow, which finds repositories that might use a Node.js or PHP version affected by the Node2Shell or PHP2Shell remote code execution vulnerabilities. The workflow finds where your code sets the Node.js or PHP version, such as Docker image tags, `.nvmrc` files, infrastructure-as-code files, and CI setup steps, and marks each version as vulnerable, unpinned, fixed, or unknown. It then uses AI to check versions that are set in variables, inherited from base images, or built from source, and shows how to fix each risk. The workflow checks your code, not what runs in production. For more information, see [Run Agentic Workflows](https://docs.semgrep.dev/workflows/get-started.md#run-agentic-workflows). ## 🛡️ Semgrep Guardian ### Added * Semgrep Guardian now checks your local PHP version at the start of each coding session in [Claude Code](https://docs.semgrep.dev/semgrep-guardian/ide-setup/claude-code.md) and [Codex](https://docs.semgrep.dev/semgrep-guardian/ide-setup/codex.md). If the version is affected by the PHP2Shell remote code execution vulnerability, Guardian shows an error that names your version and the version to upgrade to. Guardian doesn't upgrade PHP for you. To turn off the check, set the `SEMGREP_GUARDIAN_PHP_CHECK` environment variable to `off`. For more information, see the [Semgrep Guardian FAQ](https://docs.semgrep.dev/semgrep-guardian/faq.md). * Semgrep Guardian now warns you if your local Node.js version is affected by the Node2Shell remote code execution vulnerability. Guardian doesn't upgrade Node.js for you. To turn off the check, set the `SEMGREP_GUARDIAN_NODE_CHECK` environment variable to `off`. * If Semgrep Guardian times out checking your credentials or can't reach Semgrep when a coding session starts, the message now tells you to ask your coding agent to check Guardian status. Guardian then re-checks your credentials and tells you what to do next. To sign in again after your credentials expire, run `/semgrep:reconnect`. * If your environment already provides a Semgrep OAuth token, such as Coder external authentication, you can set `SEMGREP_GUARDIAN_TOKEN_COMMAND` to a program that prints the token. Semgrep Guardian then uses only that token and doesn't open a browser to sign in. ## 📝 Documentation and knowledge base ### Changed * The [API reference for the v1 findings endpoint](https://docs.semgrep.dev/api-reference/v1/findingsservice/list-code-supply-chain-or-ai-powered-detection-findings.md) now explains that you must request pages in order when you page deep into results.