Skip to main content

Semgrep release notes for January 2025

🌐 Semgrep AppSec Platform​

  • The Policy Management API is now generally available. The Policy Management API allows you to automate tasks such as:
    • Add, update, and disable rules across multiple policies.
    • Apply rules in different modes, such as monitor, comment, block, or disable, to align with security workflows.
    • Integrate policy management into CI/CD pipelines to ensure consistent enforcement during software development.
  • Semgrep Managed Scans:
    • Managed scans for repositories hosted by Azure DevOps is now in public beta.
    • GitHub users can turn on or off full scans and diff-aware scans for individual projects scanned by Semgrep Managed Scans.
  • Jira: added the ability to map the Team information back to Semgrep.
  • Org admins can now invite new users to Semgrep by email. Invited users receive an email with instructions on how to join the organization's Semgrep account.
  • Added pagination to the Settings > Access > Members page, as well as the ability to search for members.

Changed​

  • The search bar in the Projects page now loads faster.
  • Links to the Project Settings and Scans pages now use project IDs instead of project names. Existing links using project names continue to function normally.

Fixed​

  • Fixed an issue where commands not prefixed with /semgrep or / weren't correctly handled.
  • Fixed an issue where reports generated by Semgrep AppSec Platform weren't correctly displaying the age of findings.
  • Fixed an issue where the first page of Bitbucket Data Center repositories wasn't displayed.
  • Fixed the formatting of Bitbucket Cloud PR comments.

💻 Semgrep Code​

Added​

  • Added support for lambdas (anonymous functions) as callbacks. This is supported for all languages that have lambdas. 
      var tainted = source();

      function withCallback1(val, callback) {
          if (val) {
              callback(val);
        }
      }

      withCallback1(tainted, function (val) {
          sink(val); // finding !
      });

Changed​

  • Removed pip from the Semgrep Docker image. If necessary, you can install it by running apk add py3-pip.

Fixed​

  • The semgrep test and semgrep validate commands have been correctly documented as EXPERIMENTAL in semgrep --help.
    • Those commands are not GA. It is recommended to use the semgrep scan --test and semgrep scan --validate.
  • Improve error handling for capabilities ancillary to a scan, such as looking for nosemgrep comments and rendering autofixes, to reduce the likelihood of an unexpected error in such a component causing the scan to error.
  • Fix the behavior of Semgrep when running into broken symlinks. If such a path is passed explicitly as a scanning root on the command line, it results in an error. Otherwise, if it's a file discovered while scanning the file system, it's a warning.
  • Fixed an issue with crashes due to an exception in lines_of_file. The code should now be more robust and not stop the whole scan when an out-of-bound line access happens during nosemgrep analysis or when displaying the lines of a match.

⛓️ Semgrep Supply Chain​

Added​

  • Dependency Paths are now available in public beta for the following languages and package managers:
    • JavaScript: npm, pnpm, and yarn are supported.
    • Python: Only Poetry is supported. Reach out to Semgrep Support to join the beta program.
  • C#: Semgrep can now scan NuGet codebases without the need for a lockfile. This feature is in private beta. See also Scan a project without lockfiles. Reach out to support@semgrep.com to join the beta program.
  • Semgrep now ingests CVE information from Electron release notes. This information is used to generate rules that can detect if you're affected by CVEs from this source.

Changed​

  • Semgrep Supply Chain Policies are now in public beta. Creating a policy enables you to:
    • Customize when Semgrep sends a finding as a PR or MR comment or fails the CI job.
    • Customize the projects and conditions that send a comment or fail a CI job.

Fixed​

  • Fixed bug where Supply Chain diff-aware scans of package-lock.json v2 projects incorrectly produced non-new findings.

🤖 Semgrep Assistant​

Added​

  • Noise filtering is now in public beta. With Noise Filtering, Assistant evaluates each Semgrep Code finding to determine if it's a true positive using additional context and prevents a PR comment from being posted in the developer workflow if it's not.
  • Auto-triage Memories is now in public beta. With this feature, you can identify findings that are safe to ignore and write triage notes indicating why this is so. Assistant then stores this information as a memory and uses it to assess whether similar findings are shown to developers in the future. Assistant also takes that memory, reanalyzes similar findings in your backlog, and suggests issues that may be safe to close.

📝 Documentation and knowledge base​

Added​

Changed​

  • Clarified language around manifest files and lockfiles.
  • Updated Semgrep rules licensing documentation.

Removed​

  • Removed references to the asdf-semgrep plugin.

🔧 Semgrep Community Edition (CE)​

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.