fix(deps): update minor dependencies by renovate[bot] · Pull Request #989 · n24q02m/better-code-review-graph

renovate · 2026-08-29T18:09:30Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	`v4.37.9` → `v4.38.0`
semgrep (changelog)	project.optional-dependencies	minor	`1.79.0` → `1.161.0`
tree-sitter-language-pack	project.dependencies	minor	`>=1.16.2,<2` → `>=1.17.0,<2`

Release Notes

github/codeql-action (github/codeql-action)

`v4.38.0`

Compare Source

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
Update default CodeQL bundle version to 2.27.0. #4129

semgrep/semgrep (semgrep)

`v1.161.0`

Compare Source

### Added

Scala 3.4+ trait parameters are now parsed correctly. (lang-73)

### Fixed

Semgrep's HTTP requests no longer log URLs above the debug level; full request
details remain available when running with SEMGREP_LOG_SRCS=cohttp.client. (ENGINE-2712)

`v1.160.0`

Compare Source

### Added

Scala: Added tree-sitter parser for improved parsing accuracy with pfff fallback. (LANG-255)
pro: taint: Improved support for variadic functions (LANG-375)

### Fixed

Fixed performance issues during parsing Semgrep rules containing emoji or
other non-BMP Unicode characters. (gh-6070)
Emit a warning when semgrep-core rule validation fails and falls back to JSON
schema validation, alongside details of the failure. (gh-6071)

`v1.159.0`

Compare Source

### Fixed

Semgrep now reports an error instead of silently returning zero findings when target file discovery fails (e.g., due to a git ls-files failure). (ENGINE-2626)

`v1.158.0`

Compare Source

### Added

Added support for a supply chain hook for the Semgrep Plugin (supply-chain-hook)
Computing taint configs, ~1/4-1/2 of the semgrep-core time in interfile scans, is now done in parallel according to the number of jobs (ENGINE-2649)
Semgrep Pro interfile engine (--pro) taint analysis has been redesigned, significantly improving performance (estimated 20-40% improvement). This improvement introduces a slight change in how findings are generated, that may result in more true positives, or less false positives. To revert to previous behavior, pass --no-x-run-taint-once as a flag. (engine-2468)

### Changed

semgrep-core macOS binaries are now dynamically linked to the system's libraries. (macos-binary-build)
semgrep-core manylinux binaries are now dynamically linked to the system's glibc on glibc systems. This introduces a minimum glibc version requirement of >=2.35, which is satisfied in Ubuntu >=22.04, Debian >=12, RHEL >=10, and other glibc distributions with at least glibc 2.35. Linux systems running an older glibc will need to upgrade their OS. (manylinux-binary-build)
The manylinux wheel is now tagged as manylinux_2_35_, reflecting a minimum
requirement of glibc version 2.35. (manylinux-wheel-tag)
semgrep-core musllinux binaries are now dynamically linked to the system's musl libc on musl systems. (musllinux-binary-build)
The musllinux PyPI wheel is now tagged as musllinux_1_2_, reflecting a requirement
of musl libc version 1.2. (musllinux-wheel-tag)
The LSP and MCP servers now use the v2 config download endpoint by default when fetching rules from Semgrep AppSec Platform. Set SEMGREP_DISABLE_CONFIG_DOWNLOAD_V2=1 to fall back to the legacy endpoint. (SMS-2284)

### Fixed

Fixed IDE login issues where network errors during token verification were incorrectly clearing the saved token. The LSP now distinguishes 401 Unauthorized (invalid token) from other errors (e.g. network failures), surfacing appropriate messages instead. (ide-login)
Fixed SARIF taint trace output: step locations now use the correct file URI, and the full taint sink call trace is included in codeFlows. (engine-2570)
The --x-mem-policy flag now propagates to the RPC subprocess, fixing memory tuning for dependency resolution and other RPC-based operations. (pylon-20772)

`v1.157.0`

Compare Source

### Added

pro: Improved taint tracking through lambda calls. (LANG-268)
It is now possible to match a class name like in $C.getInstance(...), and then
use metavariable-type on $C to check its type. (LANG-271)
pro: Improve cross-file taint tracking for globals. (LANG-275)

### Changed

Pro: Reduces redundant recomputation during inter-file taint analysis by serializing intermediate results to disk. (ENGINE-2582)
pro: Improved golang module resolution. (code-9225)
Supply Chain Analysis of npm package lock files now uses a proprietary OCaml-based parser, replacing the old Python version. The supply-chain functionality for these files is now available only to Semgrep Pro users. (gh-5658)

### Fixed

Fix Rust parsing of "&raw" where "raw" is an identifier. (rust-parser-updated)
Errors during target file discovery (e.g., permission errors, git failures) are now surfaced as warnings instead of being silently ignored. (ENGINE-2627)
kotlin: Fixed bug parsing FQNs in metavariable-type. (LANG-271)
Fixed requirements.txt parser silently dropping pinned dependencies that followed unpinned package names. (SC-3379)
Prevented certain deeply nested aliengrep matches from segfaulting semgrep-core. (engine-2628)
Fix Python parsing for files that contains empty strings (or quotes in docstrings) along with match statements. (gh-11287)
Fix rule paths.include/paths.exclude filtering when a single file is passed as a scan target. Previously, path patterns like '/src/test//*.java' would not match because only the filename was used for filtering instead of the full project-relative path. (gh-11560)
Pro: Improved type resolution in Scala (lang-79)
Pro: Improved call resolution in Scala for parameterless methods (lang-80)

`v1.156.0`

Compare Source

### Changed

The Kotlin tree-sitter parser has been updated to the latest available grammar significantly improving Kotlin support in Semgrep. (kotlin-parser)

### Fixed

Pro: Experimental interfile tainting for Ruby now disambiguates between variable accesses and zero-argument method calls. (engine-2556)
Pro: Memoize tsconfig.json parsing to avoid redundant re-parsing across a project hierarchy. (engine-2596)
Fixed a crash in semgrep ci when run in a git repo with no remote origin set (gh-11342)

`v1.155.0`

Compare Source

### Added

Added support for (agentic) hooks in Windsurf. (windsurf-hooks)
scala: Improved support for Scala 3's optional braces. (LANG-218)
Added PowerShell language support (beta) with parsing and pattern matching (lang-233)

### Changed

Removed the experimental and undocumented command semgrep install-ci. (osemgrep-install-ci)
Migrate from publishing a single Linux wheel with the platform tag musllinux_1_0_<arch>.manylinux2014_<arch> to publishing two separate wheels:
- A wheel with the platform tag musllinux_1_0_
- A wheel with the platform tag manylinux2014_
(pypi-linux-tag)

### Fixed

When performing parallel operations over a small number of input items, the
engine no longer spawns more OCaml domains than we have items to process. This
assists with resource utilisation. (engine-2588)
Fixed: Prevent SessionStart hook crash when inject-secure-defaults receives empty stdin (JSONDecodeError). (engine-2592)
Semgrep secret validation now times out after 30 seconds instead of 15 minutes. Additionally this timeout is configurable via the --secrets-timeout flag. (engine-2593)
Fixed permission errors during lockfileless Java (Gradle) dependency resolution by invoking gradlew via sh when the executable bit is not set (gh-5747)

`v1.154.0`

### Fixed

Fix crash on Windows when running semgrep ci with --debug and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when --debug was active. (ENGINE-2491)
Changed default memory policy from "eager" to "balanced". Scan times should
noticably improve; however, scans may use 5-10% additional memory. If running
in a resource-constrained environment, consider setting the memory policy back
to "aggressive". (engine-2055)
When Semgrep decides which files to scan (targeting), it can take a long time (over 5 minutes) on very large repos (> 10k files). Semgrep will now parallelize this work according to the number of jobs passed (-j) (engine-2512)
Fixed a performance issues where passing many scannign roots on the command
line (e.g. semgrep scan $(git ls-files '*.py')) caused one semgrep-core
subprocess to be spawned per file. Roots that are not directories are now
handled directly in Python without any subprocess overhead. (gh-11404)
Scala: Restored parse rate after mistaken bug introduced by implicit block parsing fix (lang-215)

`v1.153.0`

Compare Source

### Added

Semgrep core is now optimized with flambda (flambda)
Scala: Support for for-yield (LANG-193)

### Fixed

Scala: Fixed a parsing bug where subsequent calls in an implicit block would not
be considered at the same scope, e.g.
```
def f (a: t) =
  foo()
  bar()
``` (lang-194)
```

1.152.0 - 2026-02-17

### Added

Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of --allow-local-builds dependency resolution via the environment variable SEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)
Memory management policies

A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the --x-mem-policy CLI flag for the pro engine; this flag is unused in
the OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)

Allows case insensitive string comparisons using lower() and upper() like this:

- metavariable-comparison:
    metavariable: $VALUE
    comparison: upper(str($VALUE)) == "SEMGREP"

(gh-11502)

Blocking findings that are outputted in the CI output are now labelled as such. (#4394)

### Changed

pro: There should be fewer FNs when the max number of fields to track per object
is reached. (code-9224)
Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)

### Fixed

pro: Improved accuracy of taint tracking through assignments, this will help
reduce FPs in some cases. (code-9220)
When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)

1.151.0 - 2026-02-04

Added

Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)

Fixed

bumped glom to at least version 23.3, which includes a fix to a SyntaxWarning
warning log. (gh-11460)
Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)
Fixed the README not appearing in built wheels. (wheelreadme)

1.150.0 - 2026-01-29

Added

Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)

Changed

Migrated from pipenv to uv for ./cli package management (uv)

Fixed

pro: Improved virtual method resolution in Scala (code-9213)
Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)
Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as -alpha in 1.2.3-alpha. (sc-3001)

1.149.0 - 2026-01-21

Added

Added a warning in --debug mode when a user runs a parallel scan with a larger
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)

Changed

The MCP server no longer supports SSE transport. (saf-2462)

Fixed

pro: Improved virtual method resolution in Java (code-9210)
pro: Improved virtual method resolution in Scala (code-9212)
Improve performance of scan planning, a part of the Python CLI, by reducing
the cost of re-hashing Target objects. Performance should improve on
large repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)

1.148.0 - 2026-01-14

Added

Performance: subproject discovery in Supply Chain scans is no longer
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

pro: Improved virtual method resolution in Java (code-9174)
pro: Improved handling of parse errors during inter-file analysis. Now, these
errors should be adequately reported back to users and in the JSON output. (code-9216)
Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

1.147.0 - 2026-01-07

Added

Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

Deduplication should now pick the exact same findings across scans. Previously,
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)

1.146.0 - 2025-12-17

Added

Added support for Cursor post-code-generation hooks via new record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)
Added skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)
Symbol analysis, if enabled, now runs for Supply Chain only scans when calling semgrep ci. (sc-2927)

Changed

Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)
bumped the mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)
pro: [experimental] enabling and disabling transitive reachability
analysis in semgrep ci regardless of app settings is now possible with
--x-enable-transitive-reachability (or --x-tr)
and --x-disable-transitive-reachability. (tr-flags)

Fixed

The PHP AST now distinguishes between if statements with no else clause and those with an explicit but empty else {}. (gh-11330)
git-lfs objects are now excluded from baseline scans, as they are usually binary files, or simply too large to scan. (saf-2020)
Fix a OCaml stdlib bug that would cause nondeterministic UnixErrors on Windows under the multicore runtime due to a race condition in the socketpair implementation (saf-2316)
Fixed an issue that in rare cases could lead timeouts to be mishandled. This typically manifested only through slightly different warning messages, but it is possible that more serious consequences could have occasionally resulted. (saf-2368)
Fixed symbol analysis incorrectly analyzing all files instead of only the relevant language files per ecosystem. (sc-3020)

1.145.2 - 2025-12-12

No significant changes.

1.145.1 - 2025-12-11

No significant changes.

1.145.0 - 2025-12-04

Added

Added optional user-prompting for classifying findings as true/false positives via MCP Elicitation in the MCP server (behind SEMGREP_FINDINGS_ELICITATION_ENABLED, off by default). (elicitation)
Added hook to inject secure-by-default library recommendations into Claude Code Agent context. (secure-defaults-hook)

Changed

Symbol analysis upload now runs before scan completion to ensure it is available during initial scan postprocessing. (sc-2933)

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
The correct range for let ... in expressions in OCaml is now reported. Previously, the location of the let was omitted. This is mainly relevant for autofix. (ocaml-let)
Debug log lines concerning telemetry collection that are only relevant inside
Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.1 - 2025-12-04

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.0 - 2025-11-19

Fixed

pro: interfile scans no longer default to -j 1; instead, the number of
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.3 - 2025-11-25

No significant changes.

1.143.2 - 2025-11-25

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)

1.143.1 - 2025-11-14

Fixed

Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.0 - 2025-11-12

Added

Dataflow will now understand empty block expressions as having unit value in
more instances. (code-9141)
Parallel scans will now use shared-memory parallelism using multicore OCaml
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the --x-parmap CLI flag, and this deprecates the --x-eio
flag (since it is now the default behaviour). (saf-2271)
Add -k/ --hook flag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)

Fixed

When running semgrep scan or semgrep ci, the progress bar now always ends at 100%. (SAF-2079)
Pro: fixed various bugs relating to Scala match expression handling in dataflow
analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
Semgrep will now emit better error messages when exceptions are raised at the beginning or end of scan (exit-message)
Enabled taint tracking into Goroutines, by treating them as regular Go function calls. (gh-11207)
Fixed missing Rust type alias translation. We can now
accurately match the () type in a type declaration. (gh-11283)
fixed MCP semgrep_findings tool to accept single issue_type parameter and corrected identity string role parsing (saf-2282)

1.142.0 - 2025-10-30

Added

Pro: improved taint handling of match expressions in Scala. In examples like
```
val x = taint match {
    case Some(t) => t
    case None => return "example"
}
```
dataflow should now track taint from taint to x. (code-9085)
pro: scala: http4s-specific support for case $M -> ... :? ... +& test +& ... => ... patterns. (code-9131)

Fixed

Supply Chain subproject resolution table is now shown even when no subprojects were successfully resolved (SC-2492)
UV lockfiles that include editable and local dependencies without versions are now parsed correctly. The unversioned dependencies will be ignored. (SC-2888)
Failures in parsing UV lockfiles are now correctly reported as "Failed" rather than "Unsupported" (SC-2895)
build.gradle.kts files now resolve correctly when --allow-local-builds is passed. (SC-2899)
Rule parsing in 1.139.0 was switched to happen solely in semgrep-core. This caused some users to exit with code 7, so this change has been reverted. (saf-2265)

`v1.152.0`

Compare Source

### Added

Semgrep core is now optimized with flambda (flambda)
Scala: Support for for-yield (LANG-193)

### Fixed

Scala: Fixed a parsing bug where subsequent calls in an implicit block would not
be considered at the same scope, e.g.
```
def f (a: t) =
  foo()
  bar()
``` (lang-194)
```

1.152.0 - 2026-02-17

### Added

Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of --allow-local-builds dependency resolution via the environment variable SEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)
Memory management policies

A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the --x-mem-policy CLI flag for the pro engine; this flag is unused in
the OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)

Allows case insensitive string comparisons using lower() and upper() like this:

- metavariable-comparison:
    metavariable: $VALUE
    comparison: upper(str($VALUE)) == "SEMGREP"

(gh-11502)

Blocking findings that are outputted in the CI output are now labelled as such. (#4394)

### Changed

pro: There should be fewer FNs when the max number of fields to track per object
is reached. (code-9224)
Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)

### Fixed

pro: Improved accuracy of taint tracking through assignments, this will help
reduce FPs in some cases. (code-9220)
When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)

1.151.0 - 2026-02-04

Added

Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)

Fixed

bumped glom to at least version 23.3, which includes a fix to a SyntaxWarning
warning log. (gh-11460)
Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)
Fixed the README not appearing in built wheels. (wheelreadme)

1.150.0 - 2026-01-29

Added

Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)

Changed

Migrated from pipenv to uv for ./cli package management (uv)

Fixed

pro: Improved virtual method resolution in Scala (code-9213)
Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)
Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as -alpha in 1.2.3-alpha. (sc-3001)

1.149.0 - 2026-01-21

Added

Added a warning in --debug mode when a user runs a parallel scan with a larger
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)

Changed

The MCP server no longer supports SSE transport. (saf-2462)

Fixed

pro: Improved virtual method resolution in Java (code-9210)
pro: Improved virtual method resolution in Scala (code-9212)
Improve performance of scan planning, a part of the Python CLI, by reducing
the cost of re-hashing Target objects. Performance should improve on
large repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)

1.148.0 - 2026-01-14

Added

Performance: subproject discovery in Supply Chain scans is no longer
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

pro: Improved virtual method resolution in Java (code-9174)
pro: Improved handling of parse errors during inter-file analysis. Now, these
errors should be adequately reported back to users and in the JSON output. (code-9216)
Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

1.147.0 - 2026-01-07

Added

Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

Deduplication should now pick the exact same findings across scans. Previously,
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)

1.146.0 - 2025-12-17

Added

Added support for Cursor post-code-generation hooks via new record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)
Added skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)
Symbol analysis, if enabled, now runs for Supply Chain only scans when calling semgrep ci. (sc-2927)

Changed

Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)
bumped the mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)
pro: [experimental] enabling and disabling transitive reachability
analysis in semgrep ci regardless of app settings is now possible with
--x-enable-transitive-reachability (or --x-tr)
and --x-disable-transitive-reachability. (tr-flags)

Fixed

The PHP AST now distinguishes between if statements with no else clause and those with an explicit but empty else {}. (gh-11330)
git-lfs objects are now excluded from baseline scans, as they are usually binary files, or simply too large to scan. (saf-2020)
Fix a OCaml stdlib bug that would cause nondeterministic UnixErrors on Windows under the multicore runtime due to a race condition in the socketpair implementation (saf-2316)
Fixed an issue that in rare cases could lead timeouts to be mishandled. This typically manifested only through slightly different warning messages, but it is possible that more serious consequences could have occasionally resulted. (saf-2368)
Fixed symbol analysis incorrectly analyzing all files instead of only the relevant language files per ecosystem. (sc-3020)

1.145.2 - 2025-12-12

No significant changes.

1.145.1 - 2025-12-11

No significant changes.

1.145.0 - 2025-12-04

Added

Added optional user-prompting for classifying findings as true/false positives via MCP Elicitation in the MCP server (behind SEMGREP_FINDINGS_ELICITATION_ENABLED, off by default). (elicitation)
Added hook to inject secure-by-default library recommendations into Claude Code Agent context. (secure-defaults-hook)

Changed

Symbol analysis upload now runs before scan completion to ensure it is available during initial scan postprocessing. (sc-2933)

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
The correct range for let ... in expressions in OCaml is now reported. Previously, the location of the let was omitted. This is mainly relevant for autofix. (ocaml-let)
Debug log lines concerning telemetry collection that are only relevant inside
Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.1 - 2025-12-04

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.0 - 2025-11-19

Fixed

pro: interfile scans no longer default to -j 1; instead, the number of
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.3 - 2025-11-25

No significant changes.

1.143.2 - 2025-11-25

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)

1.143.1 - 2025-11-14

Fixed

Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.0 - 2025-11-12

Added

Dataflow will now understand empty block expressions as having unit value in
more instances. (code-9141)
Parallel scans will now use shared-memory parallelism using multicore OCaml
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the --x-parmap CLI flag, and this deprecates the --x-eio
flag (since it is now the default behaviour). (saf-2271)
Add -k/ --hook flag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)

Fixed

When running semgrep scan or semgrep ci, the progress bar now always ends at 100%. (SAF-2079)
Pro: fixed various bugs relating to Scala match expression handling in dataflow
analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
Semgrep will now emit better error messages when exceptions are raised at the beginning or end of scan (exit-message)
Enabled taint tracking into Goroutines, by treating them as regular Go function calls. (gh-11207)
Fixed missing Rust type alias translation. We can now
accurately match the () type in a type declaration. (gh-11283)
fixed MCP semgrep_findings tool to accept single issue_type parameter and corrected identity string role parsing (saf-2282)

1.142.0 - 2025-10-30

Added

Pro: improved taint handling of match expressions in Scala. In examples like
```
val x = taint match {
    case Some(t) => t
    case None => return "example"
}
```
dataflow should now track taint from taint to x. (code-9085)
pro: scala: http4s-specific support for case $M -> ... :? ... +& test +& ... => ... patterns. (code-9131)

Fixed

Supply Chain subproject resolution table is now shown even when no subprojects were successfully resolved (SC-2492)
UV lockfiles that include editable and local dependencies without versions are now parsed correctly. The unversioned dependencies will be ignored. (SC-2888)
Failures in parsing UV lockfiles are now correctly reported as "Failed" rather than "Unsupported" (SC-2895)
build.gradle.kts files now resolve correctly when --allow-local-builds is passed. (SC-2899)
Rule parsing in 1.139.0 was switched to happen solely in semgrep-core. This caused some users to exit with code 7, so this change has been reverted. (saf-2265)

`v1.151.0`

Compare Source

### Added

Semgrep core is now optimized with flambda (flambda)
Scala: Support for for-yield (LANG-193)

### Fixed

Scala: Fixed a parsing bug where subsequent calls in an implicit block would not
be considered at the same scope, e.g.
```
def f (a: t) =
  foo()
  bar()
``` (lang-194)
```

1.152.0 - 2026-02-17

### Added

Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of --allow-local-builds dependency resolution via the environment variable SEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)
Memory management policies

A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the --x-mem-policy CLI flag for the pro engine; this flag is unused in
the OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)

Allows case insensitive string comparisons using lower() and upper() like this:

- metavariable-comparison:
    metavariable: $VALUE
    comparison: upper(str($VALUE)) == "SEMGREP"

(gh-11502)

Blocking findings that are outputted in the CI output are now labelled as such. (#4394)

### Changed

pro: There should be fewer FNs when the max number of fields to track per object
is reached. (code-9224)
Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)

### Fixed

pro: Improved accuracy of taint tracking through assignments, this will help
reduce FPs in some cases. (code-9220)
When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)

1.151.0 - 2026-02-04

Added

Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)

Fixed

bumped glom to at least version 23.3, which includes a fix to a SyntaxWarning
warning log. (gh-11460)
Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)
Fixed the README not appearing in built wheels. (wheelreadme)

1.150.0 - 2026-01-29

Added

Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)

Changed

Migrated from pipenv to uv for ./cli package management (uv)

Fixed

pro: Improved virtual method resolution in Scala (code-9213)
Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)
Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as -alpha in 1.2.3-alpha. (sc-3001)

1.149.0 - 2026-01-21

Added

Added a warning in --debug mode when a user runs a parallel scan with a larger
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)

Changed

The MCP server no longer supports SSE transport. (saf-2462)

Fixed

pro: Improved virtual method resolution in Java (code-9210)
pro: Improved virtual method resolution in Scala (code-9212)
Improve performance of scan planning, a part of the Python CLI, by reducing
the cost of re-hashing Target objects. Performance should improve on
large repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)

1.148.0 - 2026-01-14

Added

Performance: subproject discovery in Supply Chain scans is no longer
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

pro: Improved virtual method resolution in Java (code-9174)
pro: Improved handling of parse errors during inter-file analysis. Now, these
errors should be adequately reported back to users and in the JSON output. (code-9216)
Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

1.147.0 - 2026-01-07

Added

Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

Deduplication should now pick the exact same findings across scans. Previously,
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)

1.146.0 - 2025-12-17

Added

Added support for Cursor post-code-generation hooks via new record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)
Added skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)
Symbol analysis, if enabled, now runs for Supply Chain only scans when calling semgrep ci. (sc-2927)

Changed

Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)
bumped the mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)
pro: [experimental] enabling and disabling transitive reachability
analysis in semgrep ci regardless of app settings is now possible with
--x-enable-transitive-reachability (or --x-tr)
and --x-disable-transitive-reachability. (tr-flags)

Fixed

The PHP AST now distinguishes between if statements with no else clause and those with an explicit but empty else {}. (gh-11330)
git-lfs objects are now excluded from baseline scans, as they are usually binary files, or simply too large to scan. (saf-2020)
Fix a OCaml stdlib bug that would cause nondeterministic UnixErrors on Windows under the multicore runtime due to a race condition in the socketpair implementation (saf-2316)
Fixed an issue that in rare cases could lead timeouts to be mishandled. This typically manifested only through slightly different warning messages, but it is possible that more serious consequences could have occasionally resulted. (saf-2368)
Fixed symbol analysis incorrectly analyzing all files instead of only the relevant language files per ecosystem. (sc-3020)

1.145.2 - 2025-12-12

No significant changes.

1.145.1 - 2025-12-11

No significant changes.

1.145.0 - 2025-12-04

Added

Added optional user-prompting for classifying findings as true/false positives via MCP Elicitation in the MCP server (behind SEMGREP_FINDINGS_ELICITATION_ENABLED, off by default). (elicitation)
Added hook to inject secure-by-default library recommendations into Claude Code Agent context. (secure-defaults-hook)

Changed

Symbol analysis upload now runs before scan completion to ensure it is available during initial scan postprocessing. (sc-2933)

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
The correct range for let ... in expressions in OCaml is now reported. Previously, the location of the let was omitted. This is mainly relevant for autofix. (ocaml-let)
Debug log lines concerning telemetry collection that are only relevant inside
Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.1 - 2025-12-04

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)
pro: in 1.144.0 interfile scans no longer default to -j 1; instead, the number of available CPUs on the system was used to inform how many jobs should be spawned. This caused a change in timeouts due to how time is measured for certain parts of the pro engine. This change has now been reverted (saf-default-jobs)

1.144.0 - 2025-11-19

Fixed

pro: interfile scans no longer default to -j 1; instead, the number of
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.3 - 2025-11-25

No significant changes.

1.143.2 - 2025-11-25

Fixed

Fix issue that could lead to validation failures for certain well-formed rules, such as those with emoji in their messages. (incid-293)

1.143.1 - 2025-11-14

Fixed

Semgrep will no longer rarely crash when --trace is passed. (incid-280)

1.143.0 - 2025-11-12

Added

Dataflow will now understand empty block expressions as having unit value in
more instances. (code-9141)
Parallel scans will now use shared-memory parallelism using multicore OCaml
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the --x-parmap CLI flag, and this deprecates the --x-eio
flag (since it is now the default behaviour). (saf-2271)
Add -k/ --hook flag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)

Fixed

When running semgrep scan or semgrep ci, the progress bar now always ends at 100%. (SAF-2079)
Pro: fixed various bugs relating to Scala match expression handling in dataflow
analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
Semgrep will now emit better error messages when exceptions are raised at the beginning or end of scan (exit-message)
Enabled taint tracking into Goroutines, by treating them as regular Go function calls. (gh-11207)
Fixed missing Rust type alias translation. We can now
accurately match the () type in a type declaration. (gh-11283)
fixed MCP semgrep_findings tool to accept single issue_type parameter and corrected identity string role parsing (saf-2282)

1.142.0 - 2025-10-30

Ad

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Ho_Chi_Minh)

Branch creation
- "before 5am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-08-29T18:09:46Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/analyze	b96794f015dfd88f77b49b1c93e0fa7110f94c63	Unknown	Unknown
actions/github/codeql-action/init	b96794f015dfd88f77b49b1c93e0fa7110f94c63	Unknown	Unknown
pip/tree-sitter-language-pack	1.17.0	Unknown	Unknown

Scanned Files

.github/workflows/ci.yml
uv.lock

socket-security · 2026-09-04T17:08:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tree-sitter-language-pack@1.16.2 ⏵ 1.17.0

View full report

renovate Bot requested a review from n24q02m as a code owner August 29, 2026 18:09

renovate Bot added the dependencies Dependency updates label Aug 29, 2026

renovate Bot changed the title ~~fix(deps): update semgrep to v1.161.0~~ fix(deps): update semgrep to v1.161.0 - autoclosed Aug 30, 2026

renovate Bot closed this Aug 30, 2026

renovate Bot deleted the renovate/all-minor branch August 30, 2026 04:06

renovate Bot changed the title ~~fix(deps): update semgrep to v1.161.0 - autoclosed~~ fix(deps): update minor dependencies Sep 4, 2026

renovate Bot reopened this Sep 4, 2026

renovate Bot force-pushed the renovate/all-minor branch from b657270 to af122b6 Compare September 4, 2026 17:08

renovate Bot force-pushed the renovate/all-minor branch 9 times, most recently from f940c02 to c9b1c28 Compare September 10, 2026 15:05

fix(deps): update minor dependencies

23e5756

renovate Bot force-pushed the renovate/all-minor branch from c9b1c28 to 23e5756 Compare September 10, 2026 15:29

Navigation Menu

Uh oh!

fix(deps): update minor dependencies - #989

fix(deps): update minor dependencies#989
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor

renovate Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

### Added

### Fixed

### Added

### Fixed

### Fixed

### Added

### Changed

### Fixed

### Added

### Changed

### Fixed

### Changed

### Fixed

### Added

### Changed

### Fixed

### Fixed

### Added

### Fixed

1.152.0 - 2026-02-17

### Added

### Changed

### Fixed

1.151.0 - 2026-02-04

Added

Fixed

1.150.0 - 2026-01-29

Added

Changed

Fixed

1.149.0 - 2026-01-21

Added

Changed

Fixed

1.148.0 - 2026-01-14

Added

Fixed

1.147.0 - 2026-01-07

Added

Fixed

1.146.0 - 2025-12-17

Added

Changed

Fixed

1.145.2 - 2025-12-12

1.145.1 - 2025-12-11

1.145.0 - 2025-12-04

Added

Changed

Fixed

1.144.1 - 2025-12-04

Fixed

1.144.0 - 2025-11-19

Fixed

1.143.3 - 2025-11-25

1.143.2 - 2025-11-25

Fixed

1.143.1 - 2025-11-14

Fixed

1.143.0 - 2025-11-12

Added

Fixed

1.142.0 - 2025-10-30

Added

Fixed

### Added

### Fixed

1.152.0 - 2026-02-17

### Added

### Changed

### Fixed

1.151.0 - 2026-02-04

Added

Fixed

1.150.0 - 2026-01-29

renovate Bot commented Aug 29, 2026 •

edited

Loading