# Semgrep v1.171.0 — Release v1.171.0

- Product: Semgrep (https://whatsnew.fyi/product/semgrep)
- Vendor: Semgrep, Inc.
- Date: 2026-07-22
- Version: v1.171.0
- Original notes: https://github.com/semgrep/semgrep/releases/tag/v1.171.0
- Permalink: https://whatsnew.fyi/product/semgrep/releases/v1.171.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added support for the OpenTofu .tofu file extension, which is automatically detected and scanned as Terraform with no extra configuration
- **changed** — Extended the window for collecting git contributor information during semgrep ci from the last 30 days to the last 90 days
- **fixed** — Fixed rare nondeterministic crashes and incorrect results caused by an OCaml compiler bug by building against a compiler fork that backports the upstream fix
- **fixed** — Fixed excessive heap growth after explicit major garbage collections by building against an OCaml compiler that improves garbage collection duty cycle pacing
- **fixed** — Improved Scan Status output when no code rules will run to explicitly state whether code scanning is not enabled or there are no code rules to run instead of printing a confusing summary
- **fixed** — Fixed lockfileless Gradle dependency resolution failing with parsing errors by pinning the github-dependency-graph-gradle-plugin to version 1.4.1

##### [1.171.0](https://github.com/semgrep/semgrep/releases/tag/v1.171.0) - 2026-07-22

###### ### Added

- Added support for the OpenTofu `.tofu` file extension. Because OpenTofu uses the same HCL grammar as Terraform, `.tofu` files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. `p/terraform`) with no extra configuration. (ENGINE-2884)

###### ### Changed

- The window for collecting git contributor information during `semgrep ci` has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

###### ### Fixed

- Fixed a source of rare, nondeterministic crashes and incorrect results caused
  by an OCaml compiler bug. Semgrep now builds against a compiler fork that
  backports the upstream fix. (ocaml_codegen_fix)
- Fixed excessive heap growth after explicit major garbage collections. Semgrep
  now builds against an OCaml compiler that improves garbage collection duty
  cycle pacing. (ocaml_gc_pacing_fix)
- Improved the `Scan Status` output when no code rules will run (e.g. a
  Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
  confusing "0 Code rules", and the "Code Rules" section now states explicitly
  either that code scanning is not enabled or that there are no code rules to run,
  instead of printing an empty table. (ENGINE-2878)
- Fixed lockfileless Gradle dependency resolution failing with "Parsing
  dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
  github-dependency-graph-gradle-plugin used during resolution was fetched
  unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
  now pinned to 1.4.1. (sc-3738)