# Semgrep v1.168.0 — Release v1.168.0

- Product: Semgrep (https://whatsnew.fyi/product/semgrep)
- Vendor: Semgrep, Inc.
- Date: 2026-06-24
- Version: v1.168.0
- Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.168.0
- Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.168.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output
- **changed** — Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table
- **changed** — semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine
- **changed** — Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x
- **changed** — The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x

##### [1.168.0](https://github.com/semgrep/semgrep/releases/tag/v1.168.0) - 2026-06-24

###### ### Added

- Added an experimental `--x-dependency-paths` flag to `scan` and `ci` that includes the full dependency path(s) for transitive supply-chain findings in `--json` and `--sarif` output. (SC-3547)

###### ### Changed

- Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

###### ### Infra/Release Changes

- semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
- Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
- The `metavariable-regex` and `metavariable-comparison` (`re.match()`) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)