Semgrep vs Depot
Side-by-side trajectory, velocity, and editorial themes.
Semgrep grinds out weekly gains in language coverage, scan speed, and supply-chain depth
Semgrep is on a steady weekly release train dominated by language-parser fidelity (Dart, Scala, PHP, Python, Java), engine startup and scan performance, and supply-chain plus secrets tooling. Recent releases added transitive dependency-path reporting, binary-file skipping by default, and configurable rule validation, alongside repeated hardening against credential leaks in CI output and telemetry.
The direction is incremental breadth and speed rather than new product surface: more languages parsed accurately, faster rule loading and parsing, and deeper Pro interfile taint analysis. Supply-chain reachability and secrets validation keep getting attention, signaling those remain the commercial focus over the open-source CLI.
Expect continued weekly point releases extending interfile and taint analysis to more languages and further trimming scan startup time; no single release in view signals a directional shift.
Depot extends from build acceleration into hosted source control with Depot Code.
Depot is broadening from a CI and build-cache company into a full developer-infrastructure platform. This cycle it launched Depot Code — a diskless git server backed by S3 blob storage — into private beta, moved CI and Sandboxes onto a re-architected Depot Metal compute tier, and kept extending Depot CI with new triggers, snapshot improvements, OIDC auth, and Datadog observability.
The direction is a vertically integrated build-and-source stack: Depot Code stores git packfiles as S3 objects and runs stateless git workers, mirroring the same storage-compute separation behind Depot Metal. Each piece plugs into Depot CI, so the company is assembling an end-to-end alternative to the hub-and-spoke GitHub model rather than just accelerating it. The CI surface is maturing in parallel with reliability and integration features.
Expect Depot Code to move toward wider access and tighter Depot CI integration, and GitHub Actions runners and container builds to migrate onto Depot Metal over the coming months as promised.
See more alternatives to Semgrep →
See more alternatives to Depot →