LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep 1.185 drops the SSH server from its Docker image and sharpens PHP call resolution.

sastsupply-chainphpcontainer securityobservability
◆Current state
Semgrep keeps a weekly cadence on two tracks, matcher depth and Supply Chain. 1.185 resolves virtual calls through basic PHP trait composition, extends range-based requirements.txt findings to the native resolver, adds structured JSON execution logs and secrets-validator telemetry, and removes sshd and sftp-server from the semgrep/semgrep Docker image. A 3% median scan speedup comes from simpler dataflow variable keys.
◆Where it's heading
Supply Chain is closing the gaps where unpinned Python requirements used to go unseen, now in both resolvers. Alongside, Semgrep is investing in operability: structured logs, telemetry and a smaller container attack surface suggest more customers run it in their own pipelines and want to audit it.
◆Prediction
Expect the requirements.txt range logic to spread to other ecosystems with loose version specs, and more structured log events following SEMGREP_LOG_JSON_FILE.

◆Recent moves

  1. 4d ago

    Docker image drops sshd; PHP trait call resolution improves

    1.185 mixes both tracks: PHP trait-aware call resolution on the matcher side, range-based requirements.txt findings in the native resolver on the Supply Chain side. Dropping the SSH server from the Docker image and adding JSON execution logs make Semgrep easier to run and audit inside CI.

    View source ↗
  2. 8d ago

    Unpinned Python requirements now raise advisory findings

    A requirements.txt line with a range or no version now raises a finding for each advisory whose affected versions overlap, flagged for review. It finishes what 1.181 started when those lines first entered the inventory, and adds JSON execution logs and Go generic aliases.

    View source ↗
  3. 15d ago

    Intel Mac binaries dropped; Bash and Swift parsing widened

    1.183 returns to matcher depth with Bash operator trees and broad Swift parsing, while Supply Chain stops treating unparseable lockfiles as empty. Intel Mac users must move to the Docker image, finishing what the Homebrew drop began in 1.176.

    View source ↗
  4. 24d ago

    Objective-C alpha support; C#, Terraform and Lua grammars updated

    1.182 extends the matcher track with Objective-C as an alpha language and refreshes three grammars, while Supply Chain refines the 1.181 Python work: a hand-written range or bare-name requirement now counts as direct even when a requirements.in exists. It continues the pattern of coverage gains rather than any change in direction.

    View source ↗
  5. 1mo ago

    Supply Chain inventories unpinned Python requirements

    Requirements with version ranges or bare names now land in the dependency inventory and SBOM instead of being dropped as parse errors, though they produce no findings yet. It continues the ecosystem-by-ecosystem coverage push, and Go generics and Hack capability parsing ride along on the language track.

    View source ↗
  6. 1mo ago

    Dart reaches GA; QL language support removed

    After weeks of Supply Chain work, this release goes back to the core matcher: Dart gets type inference, alias-aware import matching and richer ellipsis patterns, and is promoted to GA. Removing QL as a scan target fits the same cleanup, keeping language support to what the engine can match well.

    View source ↗