v1.171.0
Release v1.171.0
Added 1
- Added support for the OpenTofu .tofu file extension, which is automatically detected and scanned as Terraform with no extra configuration
Changed 1
- Extended the window for collecting git contributor information during semgrep ci from the last 30 days to the last 90 days
Fixed 4
- Fixed rare nondeterministic crashes and incorrect results caused by an OCaml compiler bug by building against a compiler fork that backports the upstream fix
- Fixed excessive heap growth after explicit major garbage collections by building against an OCaml compiler that improves garbage collection duty cycle pacing
- Improved Scan Status output when no code rules will run to explicitly state whether code scanning is not enabled or there are no code rules to run instead of printing a confusing summary
- Fixed lockfileless Gradle dependency resolution failing with parsing errors by pinning the github-dependency-graph-gradle-plugin to version 1.4.1
1.171.0 - 2026-07-22
### Added
- Added support for the OpenTofu
.tofufile extension. Because OpenTofu uses the same HCL grammar as Terraform,.tofufiles are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g.p/terraform) with no extra configuration. (ENGINE-2884)
### Changed
- The window for collecting git contributor information during
semgrep cihas been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)
### Fixed
- Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
- Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
- Improved the
Scan Statusoutput when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878) - Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)