Week of July 27, 2026
- Semgrep Agentic Workflows is in public beta: Run multi-step AI-enabled detection pipelines from Semgrep AppSec Platform. See Get started with Semgrep Agentic Workflows.
- Supply Chain incident Slack notifications: Released a default Supply Chain incident notification policy to all Supply Chain customers using Unified policies. You can also configure a Slack channel to be notified during an ongoing Supply Chain incident, including whether you might be affected based on your most recent SBOM.
Week of July 20, 2026
- License compliance for multi-licensed packages: You can configure license compliance to block a dependency only when all of its licenses are blocked, instead of when any license is blocked.
Week of July 13, 2026
- Unified policies is generally available: Choose the rules and rulesets used for Semgrep scans and define what happens after Semgrep identifies a finding, such as leaving PR or MR comments, blocking PRs or MRs, creating Jira tickets, or sending Slack notifications.
Week of July 6, 2026
- Archive projects in Semgrep: You can archive a project from Project settings. Projects archived in Semgrep appear on an Archived tab with an archived badge, alongside projects archived in your source code manager.
- Vulnerability class conditions: Remediation policy automations can now be scoped to a vulnerability class such as SQL Injection or Path Traversal.