- Semgrep Guardian
  Scan and fix AI-generated code the moment it's written
- Agentic Workflows
  Empower agents with tools and context required to automate threat detection, triage, and remediation.
- Semgrep Code
  Find and fix the issues that matter in your code (SAST)
- Semgrep Supply Chain
  Fix vulnerabilities in open source dependencies and block malware
- Semgrep Secrets
  Find and fix hardcoded secrets with semantic analysis
- Product Updates
  Stay up to date on changes to the Semgrep platform, big and small
- Open-Source Malware Protection
  Protect against software supply chain attacks
- Agentic Appsec Platform
  Automate and Scale AppSec with Agentic Code Security
- MCP Server
  Give any agent access to the full Semgrep suite
- Secure Guardrails
  Protect Your Code with Secure Guardrails
- Fintech
  Ship faster, without compromising on security.
- SaaS & Cloud
  Increase security while accelerating development
- Docs
  Want to read all the docs? Start here
- Blog
  Get the latest news about Semgrep
- ROI Calculator
  See how Semgrep can save you time and money
- Community Slack
  Join the friendly Slack group to ask questions or share feedback
- Events
  Join us at a Semgrep Event!
- Case Studies
  See why users love Semgrep
- Video Library
  View our library of on-demand webinars
- Community Edition
- About
  The Semgrep story & values
- Careers
  Join the team!
- Partners
  Become a Semgrep partner
Pricing
Sign in
Product support
Contact us
Book demo Try for free

Semgrep Product Update

May 15, 2026

Dependency paths now in SBOM exports and the Issue API

Teams need to know not just which dependencies are vulnerable, but how a vulnerable transitive package connects back to a direct dependency. Dependency path data is now available in two places: SBOM exports include the full dependency graph in the CycloneDX dependencies section, and the Issue API now shows which direct dependency introduced each vulnerable transitive package.

Pablo Estrada