Semgrep vs Windmill
Side-by-side trajectory, velocity, and editorial themes.
Semgrep grinds out weekly gains in language coverage, scan speed, and supply-chain depth
Semgrep is on a steady weekly release train dominated by language-parser fidelity (Dart, Scala, PHP, Python, Java), engine startup and scan performance, and supply-chain plus secrets tooling. Recent releases added transitive dependency-path reporting, binary-file skipping by default, and configurable rule validation, alongside repeated hardening against credential leaks in CI output and telemetry.
The direction is incremental breadth and speed rather than new product surface: more languages parsed accurately, faster rule loading and parsing, and deeper Pro interfile taint analysis. Supply-chain reachability and secrets validation keep getting attention, signaling those remain the commercial focus over the open-source CLI.
Expect continued weekly point releases extending interfile and taint analysis to more languages and further trimming scan startup time; no single release in view signals a directional shift.
Windmill is quietly turning its orchestrator into a DuckLake-native data platform.
Windmill remains a script-and-workflow orchestrator, but its recent output has narrowed almost entirely to the data layer: DuckLake materialization, partitioned assets, freshness, and now schema contracts. The changelog reads less like a general automation tool and more like a managed lakehouse being assembled on top of the existing job engine, with most of the heavier machinery gated to Enterprise Edition.
The direction is a governed, self-maintaining data platform: fork-scoped data environments for isolated iteration, freshness SLAs with an auto-healing watchdog, scheduled compaction and retention, range backfills, and save-time schema validation between producers and consumers. Each release hardens a different operational corner of the DuckLake stack rather than adding breadth, so Windmill is deepening into data-ops rather than widening its surface.
Schema contracts shipped as non-blocking warnings, so the next likely move is to tighten that loop — enforceable contracts or richer lineage on the DuckLake graph. Continued Enterprise gating of the data-ops features (maintenance, freshness watchdog, range backfill) also points to a productized data-platform tier.
See more alternatives to Semgrep →
See more alternatives to Windmill →