> ## Documentation Index > Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt > Use this file to discover all available pages before exploring further. # Week of November 2, 2026 > Updates made to Semgrep during the week of November 2-8, 2026. ## 🌐 Semgrep AppSec Platform ### Added * The hosted Model Context Protocol (MCP) server for Semgrep AppSec Platform is now in public beta. Connect Claude Code, Codex, Cursor, VS Code, or another MCP client to search and triage findings, run scans, and manage policies from your editor or terminal. Tools follow your permissions in AppSec Platform, and a read-only URL is available. The Semgrep Guardian plugin also includes these tools. For more information, see [Semgrep MCP](https://docs.semgrep.dev/mcp/overview.md). ### Changed * New self-service purchases of Semgrep Code, Semgrep Supply Chain, or Semgrep Secrets now have a minimum of 3 seats instead of 10. You can't reduce the seat quantity of an existing subscription. Checkout suggests your contributor count, with a minimum of 3 seats. * In the rules table on the **Policies** page, the **False positive rate** column is now **Ignore rate**. The rate is the share of a rule's findings that are ignored. It counts findings triaged as ignored for any reason and findings ignored with a `nosemgrep` comment. Hover over a rate to see the counts by triage reason. For more information, see [Unified Policies](https://docs.semgrep.dev/semgrep-appsec-platform/unified-policies/overview). * Remediation policy cards on the **Policies** page now show each policy's scope in the header. The scope is **All projects**, a project or tag name, or a count of projects or tags. If a policy's condition names Semgrep Agentic Workflows, each workflow links to its schedule. ### Fixed * Fixed an issue where organizations that use Unified Policies didn't see a rule's suggested fix in pull request and merge request comments. * Fixed an issue where selecting **Other** in the **Category** filter on the **Findings** page excluded AI-powered detection findings. * Fixed an issue where the navigation bar showed finding counts for a product your organization can't use. For example, counts stayed after a Supply Chain trial ended. The counts are now hidden. Your findings aren't deleted. * Fixed an issue where opening **Policy executions** on a scan's details page hid the scan logs and reset the log filters. ## 💻 Semgrep Code ### Added * A link to the licenses for Semgrep's open source dependencies now appears in the `--help` output of most `semgrep` commands, in a new `THIRD-PARTY LICENSES` section. The section points to [semgrep.dev/cli-credits](https://semgrep.dev/cli-credits). ### Changed * The Semgrep CLI no longer ships binaries for Intel Macs, because macOS on Intel has reached [end of life](https://support.apple.com/en-us/102527). Version 1.182 is the last release that supports them. On an Intel Mac, use the `semgrep/semgrep` Docker image. On Apple silicon, use a native arm64 Python. * Semgrep Code parses newer Bash, Clojure, and Swift syntax, so fewer files are skipped because of parse errors: * Bash: patterns now match arithmetic such as `$(( $X * 2 ))` structurally, and words that contain `#` are no longer cut off. * Clojure: files that use reader-evaluated metadata (`^#=(...)`) or the legacy `#^` metadata prefix now parse. * Swift: newer syntax from Swift 5.9, such as macros, parameter packs, and `if` and `switch` expressions, now parses. ### Fixed * Fixed an issue where cross-file (interfile) scans could stop with `Failed to unmarshal cached value` when a single rule timed out. Semgrep now skips only that rule on that file and completes the scan. * Fixed an issue where Semgrep skipped an entire Python file when it combined an f-string prefix, such as `rf`, with a `match` statement. Semgrep now accepts every valid f-string prefix. * Fixed an issue where the Semgrep source distribution on [PyPI](https://pypi.org/project/semgrep/) was published without provenance. This affected versions 1.168.0 through 1.182.1, but not the wheels that `pip` installs by default. ## ⛓️ Semgrep Supply Chain ### Added * Incident cards on the [**Advisories**](https://docs.semgrep.dev/semgrep-supply-chain/advisories.md) page now show how many projects have matching ranges. These are projects whose `requirements.txt` file declares an affected Python package with a version range or without a version. Semgrep can't confirm whether these projects are affected. An advisory's matching projects now include a **Potentially matching: declared in a version range** section that lists each project, branch, file, and declared version. Incident Slack notifications also say how many of these projects there are and which packages they declare. * Supply Chain now shows the dependency path for transitive findings in Go projects. This requires dependency paths to be turned on and local builds to be allowed with `--allow-local-builds`. ### Changed * With `--allow-local-builds`, `semgrep ci --no-suppress-errors` now exits with code 2 when dependency resolution fails for a subproject. For example, a build command fails, a lockfile can't be parsed, or a registry refuses a request. The scan output lists the affected dependency sources, and findings from every other subproject are still reported. This doesn't affect the default behavior, which suppresses these errors, or Semgrep Managed Scans. ### Fixed * Fixed these lockfile and manifest parsing issues: * Multi-document `pnpm-lock.yaml` files, which pnpm 11 and later write, reported no dependencies. A lockfile that can't be parsed now marks its subproject as unresolved instead of reporting zero dependencies. * `go.mod` files that contain a `godebug ( ... )` block reported no dependencies and a parse error. * Poetry 2.0 and later projects that declare dependencies in the `[project] dependencies` table, in dependency groups, or as extras reported every package with unknown transitivity. Packages from Poetry dependency groups are now reported as direct. PyPI rules now match package names regardless of case and of `-`, `_`, or `.` differences. * `yarn.lock` files from Yarn 0.16 and earlier failed with `Failed to parse yarn.lock at 1:1`. ## 🤖 Semgrep Multimodal ### Added * Agentic Workflows now run on your own AI provider keys for OpenAI, Anthropic, Google Gemini, xAI, and Microsoft Foundry. Previously, workflows required Semgrep-managed OpenAI or Amazon Bedrock. When your own keys are configured, every model request from a workflow goes to your providers, and AI-powered detection uses them too. Autofix doesn't use your own keys yet. For more information, see [Use your own AI provider keys](https://docs.semgrep.dev/workflows/get-started.md#use-your-own-ai-provider-keys). * Microsoft Foundry, formerly Azure OpenAI, now has its own card in the AI provider settings. Add a resource endpoint, an API key, and one or more deployments, each with its model. If your resource has only one deployment, Agentic Workflows and AI-powered detection use it for most steps. Its model doesn't have to be on the list of Foundry models for workflows. For more information, see [Microsoft Foundry](https://docs.semgrep.dev/semgrep-multimodal/customize.md#azure-openai). * You can now add notes to Agentic Workflows issues. Click **New note** at the top of an issue's activity. For more information, see [Review Agentic Workflows issues](https://docs.semgrep.dev/workflows/get-started.md#review-agentic-workflows-issues). * Code blocks in Agentic Workflows issue descriptions and reasoning are now syntax highlighted when they name their language. ### Changed * Starting October 31, 2026, autotriage costs 0.1 AI credits per finding, down from 1 credit. The new rate applies to paid plans, trials, and the free plan. Usage before that date keeps its original rate. Usage reporting now shows autotriage at 10 triages per credit. For more information, see [Credits required for AI actions](https://docs.semgrep.dev/usage-and-billing/overview#credits-required-for-ai-actions). ### Fixed * Fixed these issues on a workflow run's **Details** page: * A run in progress showed **Re-run** when it couldn't be canceled. The **Cancel** button now stays visible but unavailable and explains why. * Steps were marked as skipped when Semgrep had no record of how they ran. Their status is now unknown. ## 🔐 Semgrep Secrets ### Fixed * Fixed an issue where historical Secrets findings that are no longer in your code kept showing **Open** after you marked them as **To fix** or **Reviewing**. These findings now show the status you set. ## 🛡️ Semgrep Guardian ### Added * Guardian for GitHub Copilot CLI is now in public beta on macOS and Linux. * Guardian now has an observe-only mode. When the `SEMGREP_GUARDIAN_OBSERVE_ONLY` environment variable is set to `1`, Guardian scans as usual but doesn't show results to developers or their coding agents. Use it to see what Guardian finds before you roll it out to your developers. ### Changed * The `semgrep_scan` tool in the Semgrep MCP server (`semgrep mcp`) now scans only files inside your MCP client's workspace root. If the client doesn't report one, it scans the server's working directory. To scan files outside it, set `SEMGREP_MCP_ALLOW_SCAN_OUTSIDE_WORKSPACE=true`. ### Fixed * Fixed an issue where the Cursor hooks that `semgrep mcp` installs shared edited files across Cursor conversations. A scan at the end of one conversation no longer scans or discards edits from another. ## 📝 Documentation and knowledge base ### Added * The new [Semgrep Guardian incident advisories](https://docs.semgrep.dev/semgrep-guardian/incident-advisories.md) page lists the security incidents that Guardian checks your machine for, and explains how to turn off each check. ## 🔧 Semgrep Community Edition The following versions of Semgrep Community Edition (CE) were released during the week of November 2-8, 2026: > [card] [1.183.0](https://github.com/semgrep/semgrep/releases/tag/v1.183.0)