Skip to main content

​
🌐 Semgrep AppSec Platform

​
Added

  • The Billing page in Semgrep AppSec Platform has these new self-service options:
    • Organizations on a self-service plan can now buy Semgrep Secrets by itself or together with other products. Previously, you had to contact Semgrep Sales. Secrets upgrade prompts on the Findings page and the Policies page now link to Billing. Users without access to Billing see a prompt to ask an organization administrator.
    • You can now manage or cancel a self-service subscription. Click Edit plan to open the Stripe customer portal. You can’t change seat quantities in the portal. For more information, see Modify or cancel your plan.
  • Findings CSV exports now include the Last triaged by, Ticket key, and Ticket URL columns. The ticket columns are included only if your organization has a Jira integration, and they’re empty when no ticket is linked. For more information, see Export findings.

​
Changed

  • Semgrep now handles a declined pull request in Bitbucket Cloud or Bitbucket Data Center the same way as a closed pull request in GitHub or GitLab. This applies to Bitbucket webhooks that Semgrep creates from now on.
  • Organizations of the Free and Teams plans can no longer select GitHub Enterprise, GitLab Self-Managed, or Bitbucket Data Center when they set up Semgrep Managed Scans. This matches Settings > Source code managers, where on-premises source code managers already require the Enterprise plan. For more information, see Connect a source code manager.
  • When Semgrep Network Broker blocks an Autofix pull request, Semgrep now explains how to update your Network Broker configuration.
  • To submit a rule to the public Semgrep Registry, you now need permission to edit rules in the organization that owns the rule. Users with the Read-only role can no longer submit an organization’s rules.
  • Notifications API responses no longer include Slack incoming webhook URLs. To change a webhook URL, enter the new URL.
  • Autofix now checks your project access again right before it opens a pull request. If your organization uses project-level role-based access control and you no longer have access to the project, Semgrep doesn’t open the pull request.
  • When an automation in a remediation policy uses an autotriage-based condition, Semgrep now warns that autotriage might not finish before Semgrep makes blocking decisions on diff-aware scans. Until autotriage finishes, those findings are treated as Not analyzed for the condition.

​
Fixed

  • Fixed an issue where failed scan notifications went to every Slack notification policy, including policies whose projects didn’t match.
  • Fixed an issue where tag-scoped policies reported that their project tags had been deleted when the tags still existed, and couldn’t be edited.
  • Fixed an issue where a findings count in a project’s scan history opened an empty Findings page because Semgrep hadn’t finished processing the scan results. The count now links to findings only after processing finishes.
  • Fixed an issue where the Projects page kept showing a project’s previous scan status after you started a scan with Managed Scans. The project now shows Queued right away, and its status updates automatically.
  • Fixed an issue where Semgrep couldn’t read files whose names contain # or ? from GitHub or Bitbucket Cloud.
  • Fixed these sign-in issues:
    • Your first sign-in with an SSO-only email code failed if your email address used different capitalization than the address Semgrep had stored.
    • You couldn’t sign in again after an Invalid SAML Response error.

​
💻 Semgrep Code

​
Added

  • Added experimental support for Objective-C. Semgrep parses .m files and runs search-mode and taint-mode rules on them. Rules can use metavariables and ellipsis operators. Semgrep doesn’t support Objective-C++ .mm files yet.

​
Changed

  • Semgrep Code parses more syntax in these languages:
    • C# now supports Unicode escape sequences and Unicode identifier characters in identifiers. Identifiers that differ only in escaping, such as cl\u0061ss and class, match each other.
    • Terraform now supports provider functions called with a namespace, such as provider::local::fn(...). It also supports conditional and loop template directives.
    • Lua now supports Lua 5.4 variable attributes, and Lua 5.5 leading attributes, global declarations, and named variable-argument parameters. It also accepts Unicode identifiers and lines that start with #!.

​
Fixed

  • Fixed an issue where C++ range-based for loops with structured bindings failed to parse, which caused Semgrep to miss findings in the rest of the file.
  • Fixed an issue where Semgrep Playground and Semgrep Editor reported tests for Pro rules as failing when the tests used the proruleid or deepruleid annotation. The same tests passed with semgrep test --pro.

​
⛓️ Semgrep Supply Chain

​
Added

  • The Advisories page now includes an Advisories with findings filter, which shows only advisories that affect your projects. The filter is rolling out to customers. It respects project-level role-based access control and excludes archived projects.

​
Changed

  • The Advisories page has these changes:
    • Incident cards now show each incident’s status and its matching projects, findings, dependencies, and advisories. From a card, you can open the matching projects or findings, or filter advisories to that incident.
    • Advisory details now show each advisory’s CVE or MAL ID. Matching projects link to the Findings page with the same filters applied.
  • Semgrep Supply Chain now reports a Python package as a direct dependency if a requirements.txt file declares it with a version range or without a version. This now applies even if the project has a requirements.in file. Exact pins still use requirements.in to decide whether a dependency is direct or transitive.

​
Fixed

  • Fixed an issue where Open Autofix PR in Supply Chain Autofix showed an unclear SCM type not found error for repositories that aren’t connected to a source code manager. Semgrep now explains how to connect the repository so you can open the pull request.
  • Fixed an issue where Upgrade Guidance didn’t report results for projects that took a long time to analyze.

​
🤖 Semgrep Multimodal

​
Added

​
Fixed

  • Fixed an issue where the Scheduled workflows page and card showed incorrect counts for organizations with more than 100 project schedules. Some workflows were also missing from the table.
  • Fixed these display issues in Semgrep Agentic Workflows:
    • The Issues column on the Jobs page showed 0 for runs that were still in progress. It now shows a dash until the run finishes.
    • Issue rows showed the creation time when you sorted by last detection. Rows now show the date that matches the sort.
    • Logs on a workflow run’s Details page couldn’t be scrolled when the run had several retry attempts.
  • Fixed an issue where Slack alerts for Agentic Workflows issues cut descriptions off mid-word or in the middle of code.
  • Fixed an issue where Amazon Bedrock requests that use your own credentials could go to an AWS region other than the specific region you configured. For more information, see Select your AI provider.

​
🔐 Semgrep Secrets

​
Changed

  • Users with the Read-only role and API tokens with the Read-only scope can no longer bulk ignore or reopen Semgrep Secrets findings. Bulk triage now requires triage permission, as it does for Semgrep Code findings.

​
🛡️ Semgrep Guardian

​
Added

  • Guardian Policies and local developer rules for Semgrep Guardian are now generally available for all organizations. In the Claude Code remote plugin and the Codex plugin, you can choose which rules Guardian runs. These rules are separate from the rules that your CI and platform scans use:
    • To add or turn off rules for everyone in your organization, use the Policies page or Semgrep Editor. In Semgrep Editor, the Add to detection policy menu shows whether a rule is already in your policy and lets you turn it on for Guardian.
    • To add your own rules, put rule files in ~/.semgrep/guardian-rules/ or in .semgrep/guardian-rules/ at the root of a repository.
    Guardian runs up to 1,000 organization rules and up to 50 local developer rules per scan. For more information, see Semgrep Guardian rules and configuration.
  • Guardian now warns you if the Claude Code for VS Code extension 2.1.313 from the Cursor Marketplace is installed in any editor, or if your machine shows signs of the SSH backdoor that the extension installs. Uninstalling the extension doesn’t remove the backdoor. The warning includes remediation steps that your coding agent can follow. To turn off the check, set the SEMGREP_GUARDIAN_EXTENSION_CHECK environment variable to off.