LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep extends supply chain coverage to Bazel and squashes a cluster of engine reliability bugs.

supply-chainbazelsastengine-reliabilitylanguage-coverage
◆Current state
Semgrep is shipping weekly releases at a steady pace, advancing on two fronts: broader language and build-system coverage (Bazel/Maven via rules_jvm_external, OpenTofu, Solidity, Ruby parser improvements) and engine reliability (OCaml GC bug fixes, proxy handling, UTF-8 in MCP mode, better crash diagnostics). The Bazel supply chain milestone in v1.177.0 is the most directional move in the recent window — it's the first step of a stated roadmap to cover more Bazel ecosystems.
◆Where it's heading
Semgrep is filling in supply chain coverage across the build-system ecosystem one lockfile format at a time. The parallel track is making the engine more trustworthy in edge cases: fixes for nondeterministic crashes, clearer error messages on signals and segfaults, and UTF-8/locale resilience. Neither track is finished — Bazel support explicitly lists rules_python, rules_go, and rules_js as follow-on work, and the performance wins suggest there's more headroom being found.
◆Prediction
The next Bazel milestone will likely extend supply chain attribution to Python and JS ecosystems inside Bazel workspaces. Engine work will continue to be driven by edge-case reliability reports from CI deployments at scale.

◆Recent moves

  1. 5d ago

    Semgrep v1.177.0: native Bazel supply chain support and regex prefilter gains

    v1.177.0 lands native Bazel supply chain coverage for Maven dependencies managed by rules_jvm_external — the first declared milestone of a multi-ecosystem Bazel roadmap. Also included: regex prefilter short-circuiting that skips expensive PCRE2 evaluation when a cheaper string predicate already rules a file in or out, plus the usual round of bug fixes for proxy handling and Gradle resolution errors.

    View source ↗
  2. 14d ago

    Release v1.176.0

    Homebrew distribution for Intel Macs is removed. For most teams running Semgrep in CI on Linux or Apple Silicon, this is a no-op.

    View source ↗
  3. 20d ago

    Release v1.175.0

    Internal build toolchain bumped to OCaml 5.4; Semgrep's stated user-visible behavior is unchanged.

    View source ↗
  4. 26d ago

    Semgrep v1.174.0: diff scans report changed dependency sources

    Diff scans now surface which dependency source files changed relative to the merge base — useful for supply chain triage in PR workflows. Partial scans also skip subprojects whose ecosystems aren't in scope for the active ruleset, trimming unnecessary dependency resolution.

    View source ↗
  5. 1mo ago

    Release v1.173.0

    v1.173.0 ships a fix for MCP mode failing to scan UTF-8 files on non-UTF-8 locales, meaningful for teams using Semgrep's MCP integration in heterogeneous CI environments. Taint analysis is more robust to unsupported patterns in case expressions, and parallel scan performance improved on musl libc systems.

    View source ↗
  6. 1mo ago

    Release v1.172.0

    v1.172.0 adds OpenTofu (.tofu) file detection as a first-class extension (treated as Terraform, picked up by p/terraform rulesets), fixes two nondeterministic OCaml GC bugs that caused rare crashes and incorrect results in long-running scans, and resolves a Gradle lockfileless resolution failure from an unpinned plugin dependency.

    View source ↗