Skip to main content

April 2024

· 6 min read

The following updates were made to Semgrep in April 2024.

🌐 Semgrep AppSec Platform​

Added​

  • The Teams feature, which provides project-level role-based access control (RBAC), is now in public beta. This feature enables you to assign members to teams, and then grant those teams access to specific projects (repositories added to Semgrep).
  • The Dashboard now displays the Assistant priority inbox, a list of essential tasks that Semgrep Assistant prepares for you each time you log in.

Changed​

  • Editor and playground: Structure mode has replaced simple mode. Try it out in the Playground. Structure mode facilitates the creation of valid Semgrep rules for both power and new users.
  • Semgrep Cloud Platform has been renamed to Semgrep AppSec Platform.
  • The Dashboard now has several UX improvements.
  • The default Bitbucket YAML configuration file has been updated with options for full, diff, and on-demand scans.
  • Improved the process of creating a GitHub Enterprise private Semgrep app.
  • Settings: The Semgrep Pro Engine toggle has been renamed to Cross-file.

Fixed​

💻 Code​

Added​

  • Added support for the QL language, which is used by CodeQL.
  • Added the ability to specify multiple output flags, which allows users to write output to multiple files in multiple formats, such as SARIF and JSON. For example:
# prints findings in text to standard out and writes JSON output to `findings.json`.
semgrep ci --json-output=findings.json
  • Added the ability to copy autofix suggestions displayed on the Findings page.
  • Added the ability to filter findings generated by Pro rules on the Findings page.
  • Added dataflow traces to the SARIF output obtained from the CLI.

Changed​

  • Cross-function (intrafile) analysis is now the default for Semgrep Code.
  • Updated how Semgrep parses regex; some rules may need to be updated to comply with stricter regex standards.

Fixed​

  • Fixed an issue with interfile diff-aware scans where the removal of pre-existing findings didn't work properly when adding a new file or renaming an existing file.
  • Fixed an issue where findings reopened after they were initially removed when the findings metadata was changed.
  • Fixed an issue where bulk triage did not work.
  • IDE Extensions: Semgrep waits longer for users to log in from the IDE.
  • CLI:
    • Upon completion, semgrep ci sends a message to Semgrep AppSec Platform to mark the scan as completed.
    • Fixed an issue where semgrep ci --oss-only crashed when Semgrep Secrets was enabled.

⛓️ Supply Chain​

Changed​

  • Updated the ecosystem used for Elixir from Mix to Hex.

Fixed​

  • Fixed an issue where tooltips for conditionally reachable vulnerabilities were not being displayed.

🤖 Semgrep Assistant​

Changed​

  • Assistant usage is now capped by an hourly rate rather than a monthly limit.

Fixed​

  • Fixed an issue where Assistant sent PR or MR comments for Supply Chain and Secrets findings; Assistant should only be doing so for Code findings.

🔐 Semgrep Secrets​

Added​

  • Added a template to the Semgrep Editor to aid in writing custom rules with validators for use with Secrets. Access this template in the Editor by clicking on the small (+) plus sign and clicking HTTP validators

Changed​

  • Users with access to Secrets can view the Rules > Policies > Secrets page, even if they have Secrets disabled.

Fixed​

  • Fixed an issue where the Secrets page filters disappeared after users selected a single filter.
  • Fixed an issue where historical scanning for credentials leaked in Git commits ran on diff-aware scans instead of on full scans.
  • Fixed an issue where users without access to Secrets could still see Secrets settings in Semgrep AppSec Platform.

📝 Documentation and knowledge base​

Added​

Changed​

Fixed​

  • Fixed some broken links to redirect to the correct doc.
  • Standardized the disuse of trailing slashes in docs URLs.

🔧 OSS Engine​

The following versions of the OSS Engine were released in April 2024: