Week of October 19, 2026
- Scheduled workflows in public beta: You can schedule Semgrep Agentic Workflows to run daily, weekly, or monthly on the projects you choose. To set up a schedule, go to Policies and click Edit on the Scheduled workflows card. For more information, see Schedule Agentic Workflows.
- Supply Chain Autofix for transitive dependencies: Supply Chain Autofix now opens pull requests for transitive dependencies in npm and PyPI projects that have a lockfile. Semgrep updates only the vulnerable package in the lockfile, and Open Autofix PR is unavailable if a parent package’s version range doesn’t allow the fixed version.
- Bun lockfile support: Semgrep Supply Chain now supports Bun projects that use a
bun.locklockfile with apackage.jsonfile. Semgrep builds the dependency graph for direct dependencies, transitive dependencies, and workspaces. The binarybun.lockbformat isn’t supported. For more information, see Supply Chain requirements and feature support.
Week of October 12, 2026
- Semgrep Guardian free trial: New Semgrep organizations can start a 30-day free trial and upgrade to a paid plan in Semgrep AppSec Platform. Setup includes steps for Claude Code and Codex. This applies to organizations created on or after October 13, 2026.
- Direct Anthropic connection in Manual mode: You can connect to Anthropic directly by providing an Anthropic API key. Select Manual mode in the AI provider settings and configure the Anthropic connection. This connection is used for in-app features such as Autotriage and Autofix. You can’t use the direct Anthropic connection in Automatic mode with a Semgrep-managed key; Semgrep uses Amazon Bedrock instead. You also can’t use it for AI-powered detection or for Agentic Workflows. Bringing your own API key is available only to Semgrep Enterprise and to users who already had their own API key.
Week of October 5, 2026
- Automatic and Manual AI providers: AI provider settings now include Automatic and Manual selection. In Automatic mode, Semgrep manages the provider list, including Amazon Bedrock, Cloudflare Workers AI, and OpenAI. Turning on Semgrep Multimodal uses Automatic mode.
- Semgrep Guardian for Codex: Semgrep Guardian now supports Codex, with the same capabilities as Claude Code. It scans with Semgrep Code, Supply Chain, and Secrets on a Semgrep-hosted server, so you do not need the Semgrep CLI. Codex uses the fixed
guardian-defaultruleset, not your Policies. On Windows, Guardian requires Windows Subsystem for Linux (WSL).
Week of September 28, 2026
- Cursor Origin support is in public beta: Connect Cursor Origin to Semgrep, sync repositories, run Managed Scans, and see scan checks and finding comments directly in Cursor pull requests. Set up the connection from Semgrep onboarding or the Cursor app installation flow.
- AWS CodeArtifact support is in private beta: Connect a private Maven or Gradle registry so Dynamic Dependency Resolution can resolve packages during Managed Scans. Semgrep assumes an IAM role in your AWS account instead of storing AWS keys. Contact Semgrep Support to enable it.
- Semgrep Guardian auto-update and SLSA Level 3: Guardian 2.5.4 and later downloads a new binary as soon as it is released and cryptographically verifies that it was produced by Semgrep’s build pipeline. Guardian now meets SLSA Level 3 standards. To opt out of auto-update, set
SEMGREP_GUARDIAN_AUTO_UPDATE=0orauto_update: falseinguardian.yaml.
Week of September 21, 2026
- SCIM provisioning is in public beta: Set up SCIM at Settings > Access > Login methods to provision users and groups from your identity provider, including Okta and Microsoft Entra ID. Available to organizations on the default tenant with SSO configured; not yet available for single-tenant deployments.
Week of September 14, 2026
- Guardian status reporting: Semgrep Guardian now reports status in your AI coding agent. It confirms when it is set up and running, summarizes what was scanned and what was found when the agent finishes a turn, and shows sign-in requirements and server errors.
- CSV export for Agentic Workflows issues: Export Agentic Workflows issues as CSV from the Issues page or the public API. Exports respect the current filters and sorting, and are limited to 10,000 issues at a time.
Week of September 7, 2026
- Agentic Workflows for organizations on the minimal data retention policy: Organizations on the minimal data retention policy can now run all nine pre-built Agentic Workflows. Semgrep does not log code or prompts for observability on these deployments.
Week of August 31, 2026
- Autofix is enabled for all customers: Autofix remains opt-in for each finding. It runs only when you request a fix from the finding Details page or through the API.
- Supply Chain Autofix is independent of Upgrade Guidance: You can open a Supply Chain Autofix pull request even when Upgrade Guidance is disabled or has not run. The setting has been renamed to Upgrade Guidance.
Week of August 24, 2026
- Developer exception requests are in public beta: Security administrators can set a developer triage permission between no triage and full triage by adding Require exception requests to any policy. For blocking findings, an exception request must be approved before the finding is ignored and the developer is unblocked.
- Usage and Billing are separate Settings tabs: All users can view credit usage, and customers who bought one product through self-serve checkout can buy additional products.
Week of August 17, 2026
nosemgrepsetting is in public beta: Admins can enable or disablenosemgrepcomments for their organization and filter findings to see which findings were ignored through anosemgrepcomment.- Workflow issues on Projects: A Workflow issues column is now available on the Projects page. Select a count to open the Agentic Workflows issues for that project.
Week of August 10, 2026
- Fix multiple Code findings in one Autofix PR or MR: When several findings in the same file come from the same rule, Semgrep offers to open one Autofix pull request or merge request for the group.
- Agentic Workflows issues API: Issues created by Semgrep Agentic Workflows are now available through the experimental v2 API.
Week of August 3, 2026
- Unified Policies migration schedule: Semgrep will start migrating some organizations to Unified Policies on August 24, 2026, and will sunset the current version of Policies on November 1, 2026.
- Projects findings counts: Findings counts on the Projects page now include Reviewing and To fix findings, in addition to Open.
Week of July 27, 2026
- Semgrep Agentic Workflows is in public beta: Run multi-step AI-enabled detection pipelines from Semgrep AppSec Platform. See Get started with Semgrep Agentic Workflows.
- Supply Chain incident Slack notifications: Released a default Supply Chain incident notification policy to all Supply Chain customers using Unified Policies. You can also configure a Slack channel to be notified during an ongoing Supply Chain incident, including whether you might be affected based on your most recent SBOM.
- License compliance for multi-licensed packages: You can configure license compliance to block a dependency only when all of its licenses are blocked, instead of when any license is blocked.
Week of July 13, 2026
- Unified Policies is generally available: Choose the rules and rulesets used for Semgrep scans and define what happens after Semgrep identifies a finding, such as leaving PR or MR comments, blocking PRs or MRs, creating Jira tickets, or sending Slack notifications.
Week of July 6, 2026
- Archive projects in Semgrep: You can archive a project from Project settings. Projects archived in Semgrep appear on an Archived tab with an archived badge, alongside projects archived in your source code manager.
- Vulnerability class conditions: Remediation policy automations can now be scoped to a vulnerability class such as SQL Injection or Path Traversal.