# Semgrep changelog > A fast static-analysis engine for finding bugs and enforcing code standards across languages. - Vendor: Semgrep, Inc. - Category: Developer Tools - Official site: https://semgrep.dev - Tracked by: What's New (https://whatsnew.fyi/product/semgrep) - Harvested from: GitHub (semgrep/semgrep) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v1.173.0 — Release v1.173.0 - Date: 2026-08-13 - Version: v1.173.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.173.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.173.0 - **added** — semgrep-core -version now reports the git commit that the binary was built from - **added** — Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk - **changed** — File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos - **changed** — Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time and improving parsing throughput - **changed** — Updated the Solidity parser for newer language features (transient storage, named mapping parameters, layout at, assembly flags, global using-directives, EVM Cancun builtins) and corrected ternary/?: vs member-access precedence - **changed** — Pro: Unsupported patterns in case expressions are now handled more robustly, with improved error recovery during taint analysis — branch bodies are no longer dropped from the dataflow intermediate language when a pattern can't be compiled - **changed** — Improved performance in highly parallel scans with many target files, running on systems using the musl libc implementation - **fixed** — When the internal semgrep-core RPC subprocess is terminated by a signal, Semgrep now logs a clear error naming the signal, instead of the misleading "Expected a number, got ''" message - **fixed** — A target file whose path filtering failed was silently omitted from the scan, appearing in neither the results nor the list of skipped targets. Such paths are now retried, and any that still fail are reported as skipped targets - **fixed** — Fixed a bug where a capture-group metavariable-regex or a binding-introducing metavariable-pattern would emit a duplicate finding on the same range whose message still contained the raw metavariable instead of the substituted value - **fixed** — Fixed fully-qualified name resolution for Rust symbols imported via a braced grouped use with a nested path - **fixed** — Fixed an issue where MCP mode could fail to scan UTF-8 files containing multibyte characters on systems using a non-UTF-8 locale such as cp932. Files are now read as UTF-8, with undecodable bytes replaced so a single unusual file does not fail the entire scan ##### [1.173.0](https://github.com/semgrep/semgrep/releases/tag/v1.173.0) - 2026-08-12 ###### ### Added - `semgrep-core -version` now reports the git commit that the binary was built from. (core-version-git-sha) - Pro: Added a `no_disk_cache` memory policy (`--x-mem-policy no_disk_cache`) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy) ###### ### Changed - File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos. (ENGINE-2854) - Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time and improving parsing throughput. (ENGINE-2920) - Updated the Solidity parser for newer language features (transient storage, named mapping parameters, `layout at`, assembly flags, `global` using-directives, EVM Cancun builtins) and corrected ternary/`?:` vs member-access precedence. (LANG-207) - Pro: Unsupported patterns in case expressions are now handled more robustly, with improved error recovery during taint analysis — branch bodies are no longer dropped from the dataflow intermediate language when a pattern can't be compiled. Pattern matching in statement position also now benefits from the same compilation as expression position. (LANG-598) - Improved performance in highly parallel scans with many target files, running on systems using the musl libc implementation. (pcre2-match-data-reuse) ###### ### Fixed - When the internal semgrep-core RPC subprocess is terminated by a signal (for example an out-of-memory kill or a segfault), Semgrep now logs a clear error naming the signal, instead of the misleading "Expected a number, got ''" message. When debug logging is enabled, the tail of the subprocess's stderr is included as well. (rpc-subprocess-death-diagnostics) - A target file whose path filtering failed was silently omitted from the scan, appearing in neither the results nor the list of skipped targets. Such paths are now retried, and any that still fail are reported as skipped targets so they show up in the scan report. (ENGINE-2854) - Fixed a bug where a capture-group `metavariable-regex` or a binding-introducing `metavariable-pattern` would emit a duplicate finding on the same range whose message still contained the raw metavariable (e.g. `a hash $ALG was detected`) instead of the substituted value. Only the correctly-substituted finding is now reported. (ENGINE-2932) - Fixed fully-qualified name resolution for Rust symbols imported via a braced grouped `use` with a nested path (e.g. `use a::b::C`). It was wrongly being resolved as b::a::C. (LANG-234) - Fixed an issue where MCP mode could fail to scan UTF-8 files containing multibyte characters, including Japanese text, on systems using a non-UTF-8 locale such as cp932. Files are now read as UTF-8, with undecodable bytes replaced so a single unusual file does not fail the entire scan. (gdn-168) ### v1.172.0 — Release v1.172.0 - Date: 2026-07-28 - Version: v1.172.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.172.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.172.0 - **added** — Added support for the OpenTofu .tofu file extension, which are now automatically detected and scanned as Terraform - **changed** — Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block - **changed** — Extended the window for collecting git contributor information during semgrep ci from the last 30 days to the last 90 days - **fixed** — Semgrep now prints richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed - **fixed** — Fixed rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug by building against a compiler fork that backports the upstream fix - **fixed** — Fixed excessive heap growth after explicit major garbage collections by building against an OCaml compiler that improves garbage collection duty cycle pacing - **fixed** — Improved the Scan Status output when no code rules will run by removing the confusing '0 Code rules' message and explicitly stating whether code scanning is not enabled or there are no code rules to run - **fixed** — Fixed lockfileless Gradle dependency resolution failing with 'Parsing dependency output failed' by pinning the github-dependency-graph-gradle-plugin to 1.4.1 ##### [1.172.0](https://github.com/semgrep/semgrep/releases/tag/v1.172.0) - 2026-07-28 ###### ### Added - Added support for the OpenTofu `.tofu` file extension. Because OpenTofu uses the same HCL grammar as Terraform, `.tofu` files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. `p/terraform`) with no extra configuration. (ENGINE-2884) ###### ### Changed - Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for `!=`, case/when expressions with line breaks, and element references that take a block. (LANG-206) - The window for collecting git contributor information during `semgrep ci` has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days) ###### ### Fixed - Semgrep will now print richer error messages on segfaults when `--debug` is NOT passed, matching the segfault error output when `--debug` is passed (engine-segv) - Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix) - Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix) - Improved the `Scan Status` output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878) - Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738) ### v1.171.0 — Release v1.171.0 - Date: 2026-07-22 - Version: v1.171.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.171.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.171.0 - **added** — Added support for the OpenTofu .tofu file extension, which is automatically detected and scanned as Terraform with no extra configuration - **changed** — Extended the window for collecting git contributor information during semgrep ci from the last 30 days to the last 90 days - **fixed** — Fixed rare nondeterministic crashes and incorrect results caused by an OCaml compiler bug by building against a compiler fork that backports the upstream fix - **fixed** — Fixed excessive heap growth after explicit major garbage collections by building against an OCaml compiler that improves garbage collection duty cycle pacing - **fixed** — Improved Scan Status output when no code rules will run to explicitly state whether code scanning is not enabled or there are no code rules to run instead of printing a confusing summary - **fixed** — Fixed lockfileless Gradle dependency resolution failing with parsing errors by pinning the github-dependency-graph-gradle-plugin to version 1.4.1 ##### [1.171.0](https://github.com/semgrep/semgrep/releases/tag/v1.171.0) - 2026-07-22 ###### ### Added - Added support for the OpenTofu `.tofu` file extension. Because OpenTofu uses the same HCL grammar as Terraform, `.tofu` files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. `p/terraform`) with no extra configuration. (ENGINE-2884) ###### ### Changed - The window for collecting git contributor information during `semgrep ci` has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days) ###### ### Fixed - Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix) - Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix) - Improved the `Scan Status` output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878) - Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738) ### v1.170.0 — Release v1.170.0 - Date: 2026-07-15 - Version: v1.170.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.170.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.170.0 - **added** — Pro C/C++ scans now skip code inside statically-dead preprocessor branches such as `#if 0 ... #else ... #endif` - **added** — Restored backtrace printing in semgrep-core and semgrep-core-proprietary when receiving a fatal signal such as SIGSEGV - **added** — semgrep install-semgrep-pro now sends usage metrics to track installation errors, with ability to disable via `--metrics off` or `SEMGREP_SEND_METRICS=off`, and includes the installation method in metric payloads - **changed** — Increased the timeout for dynamic dependency resolution subprocesses from 600 to 900 seconds - **changed** — Pro C/C++ `#if 0` filtering now handles cases where the directive splits a syntactic unit such as function signatures - **fixed** — Fixed crash at startup with error "Fatal error: Failed to allocate signal stack for domain 0" when running on systems with musl 1.2.6 on recent Intel CPUs - **fixed** — Fixed Dockerfile parse errors on `RUN` instructions that use heredoc syntax with `</.git/index.lock': Not a directory' in certain cases ##### [1.166.0](https://github.com/semgrep/semgrep/releases/tag/v1.166.0) - 2026-06-11 ###### ### Added - Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile) - Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789) ###### ### Fixed - Fixed parsing of integer literals with an underscore immediately after the radix prefix (e.g. `0x_dead_beef`, `0o_755`, `0b_1010_1010`). (LANG-533) - Python parsing now preserves type parameters on `def` and `class` definitions. (LANG-536) - Semgrep no longer stores the API token in `~/.semgrep/settings.yml`'s stored token when the current scan's token is supplied via the `SEMGREP_APP_TOKEN` envvar. (SEC-2240) - `semgrep ci` scans originating from a pre-commit hook will no longer fail with `Unable to create '/.git/index.lock': Not a directory` in certain cases. (engine-2736) ###### ### Infra/Release Changes - Added parsing tests covering Python language features (Python 3.0–3.12). (LANG-531) ### v1.165.0 — Release v1.165.0 - Date: 2026-06-03 - Version: v1.165.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.165.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.165.0 - **added** — Added `--max-match-context-size` option to limit the number of characters of source code included as context for each match in the output, with a default value of 0 for unlimited - **changed** — Replaced `--x-no-python-schema-validation` with a value-taking `--x-rule-validation=full|core-only|none` flag, where `full` is the default and preserves existing Python rule validation behavior - **changed** — Updated Python grammar - **fixed** — Added bit shift operations to metavar comparison in addition to standard arithmetic operators and logical bit ops - **fixed** — Reduce intermittent `validation_error` results on HTTP secret validators by retrying transient network failures ##### [1.165.0](https://github.com/semgrep/semgrep/releases/tag/v1.165.0) - 2026-06-03 ###### ### Added - Added `--max-match-context-size` option to limit the number of characters of source code included as context for each match in the output. This prevents matches in minified files (e.g., minified JavaScript where the entire file is a single line) from producing enormous output Set to 0 for unlimited, which is the default value. (ENGINE-2117) ###### ### Changed - Replaced `--x-no-python-schema-validation` with a value-taking `--x-rule-validation=full|core-only|none` flag. The default (`full`) preserves existing Python rule validation behavior; `core-only` matches the old flag's semantics (disables Python rule validation and uses semgrep-core RPC validation only); `none` skips both pre-validation passes, surfacing rule errors at scan-time. `--x-no-python-schema-validation` is still accepted as a no-op with a deprecation warning, and will be removed in a future release. (x-rule-validation) - Python: Updated Python grammar (LANG-201) ###### ### Fixed - Added bit shift operations to metavar comparison in addition to already present standard arithmetic operators and logical bit ops. (ENGINE-2448) - Reduce intermittent `validation_error` results on HTTP secret validators (Facebook, Slack, Stripe, Google, Cloudflare, etc.) by retrying transient network failures, mirroring the retry behavior already present for AWS validators. (SCRT-965) ### v1.164.0 — Release v1.164.0 - Date: 2026-05-27 - Version: v1.164.0 - Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.164.0 - Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.164.0 - **added** — Dart: typed metavariables ($X as T) and metavariable-type, metavariable binding inside string interpolations, and function-definition patterns that match Dart function definitions - **changed** — The default memory limit for Pro interfile scans on Linux now adapts to the container's cgroup memory limit (90% of it) instead of the previous fixed 5 GiB, with an 8 GiB fallback when no cgroup limit is detected - **changed** — Lower the glibc constraint from >=2.35 to >=2.34, allowing users on distros that ship glibc 2.34 (e.g RHEL 9 & AL2023) to install the semgrep wheel - **fixed** — Baseline diff scans no longer treat every finding on a file as newly introduced when rule(s) failed during the baseline run, and per-rule failures now hide only that rule's matches on that file from the new vs baseline comparison - **fixed** — Fixed a yarn.lock parse error on Yarn Berry entries written in YAML explicit-key form - **fixed** — The SBT resolver with --allow-local-builds now correctly identifies dependencies as part of the Maven ecosystem - **fixed** — Fixed --sarif-output and --sarif causing nosemgrep-suppressed findings to be reported in CLI scan output and to block scans - **fixed** — Fixed a bug that could cause unreliable target filtering in parallel scans - **fixed** — Dart: improved parser fidelity for Dart 3 grammar features and routed pattern parsing for statements beginning with await, rethrow, and other statement keywords - **fixed** — Fixed dynamic library lookup for semgrep-core-proprietary on macOS so the binary works when semgrep install-semgrep-pro is invoked and semgrep is installed via Homebrew ##### [1.164.0](https://github.com/semgrep/semgrep/releases/tag/v1.164.0) - 2026-05-26 ###### ### Added - Dart: typed metavariables (`$X as T`) and `metavariable-type`, metavariable binding inside string interpolations, and function-definition patterns that match Dart function definitions. (gh-11678) ###### ### Changed - The default memory limit for Pro interfile scans on Linux now adapts to the container's cgroup memory limit (90% of it) instead of the previous fixed 5 GiB, with an 8 GiB fallback when no cgroup limit is detected. (ENGINE-2568) - Lower the glibc contraint from `>=2.35` to `>=2.34`, allowing users on distros that ship glibc 2.34 (e.g RHEL 9 & AL2023) to install the semgrep wheel. (gh-11622) ###### ### Fixed - Baseline diff scans (``semgrep ci`` and ``--baseline-commit``) no longer treat every finding on a file as newly introduced when rule(s) failed during the baseline run. Per-rule failures (for example a timeout for a single rule) on baseline analysis now hide only that rule's matches on that file from the "new vs baseline" comparison. Other rules on the same file are still taken in comparison for the "new vs baseline" comparison. Per-file, rule-independent failures now hide all findings on that file from the "new vs baseline" comparison. (LANG-515) - Fixed a yarn.lock parse error on Yarn Berry entries written in YAML explicit-key form. Affected lockfiles previously failed to parse. (SC-3479) - The (beta) SBT resolver with `--allow-local-builds` now correctly identifies dependencies as part of the Maven ecosystem. (SC-3522) - Fix `--sarif-output` and `--sarif` causing nosemgrep-suppressed findings to be reported in CLI scan output and to block scans. Suppressed findings are now correctly excluded from terminal text output, the scan-summary count, and the CLI's exit code. (engine-1824) - Fixed a bug that could cause unreliable target filtering in parallel scans. (gh-6313) - Dart: improved parser fidelity for Dart 3 grammar features and routed pattern parsing for statements beginning with `await`, `rethrow`, and other statement keywords. Eliminates a large class of `PartialParsing` errors on real-world pub.dev packages. (gh-11678) ###### ### Infra/Release Changes - pro: macOS: Fixed dynamic library lookup for `semgrep-core-proprietary` so the binary works when `semgrep install-semgrep-pro` is invoked, and `semgrep` is installed via Homebrew. (pro-binary-homebrew) - Pro: Added optional `.named_ast.expect` golden files for `tests/intrafile/maturity/` fixtures, exercised by `Unit_maturity_named_asts`. (LANG-287)