Tolgee
Tolgee adds OAuth 2.1 for MCP clients, making agent access a first-class login path.
Comparison · Infra & APIs
Harbor vs Semgrep
A side-by-side editorial comparison of Harbor and Semgrep — release velocity, themes, recent moves, and the top alternatives to consider.
Shared themes:supply-chain
Harbor vs Semgrep: at a glance
What is Harbor?
Harbor 2.15 patches swap Redis for Valkey and tighten registry security.
Harbor is shipping 2.15.x patch candidates with security and dependency work. 2.15.2 replaced Redis with Valkey as the cache backend and moved to Go 1.26. 2.15.3 added a manifest upload size limit, blocked proxy-cache poisoning through robot-name prefixes and neutralised CSV formulas in scan exports. 2.15.4-rc1 relaxes two defaults that had caused regressions: webhooks can reach private networks and legacy signer pulls are allowed.
What is Semgrep?
Semgrep takes Dart to GA and drops CodeQL's QL, while Supply Chain keeps widening.
Semgrep ships roughly weekly. Supply Chain has carried the substantive work lately: Bun lockfiles in 1.179, Bazel Maven workspaces in 1.177, changed-dependency reporting in 1.174. 1.180 shifts to the language side, promoting Dart to GA with type-aware matching and removing QL as a target language.
Harbor vs Semgrep: editorial side-by-side
Harbor
5.0INFRA · APIS
Harbor 2.15 patches swap Redis for Valkey and tighten registry security.
◆ Current state
Harbor is shipping 2.15.x patch candidates with security and dependency work. 2.15.2 replaced Redis with Valkey as the cache backend and moved to Go 1.26. 2.15.3 added a manifest upload size limit, blocked proxy-cache poisoning through robot-name prefixes and neutralised CSV formulas in scan exports. 2.15.4-rc1 relaxes two defaults that had caused regressions: webhooks can reach private networks and legacy signer pulls are allowed.
◆ Where it's heading
The patch line is closing abuse paths in a registry many teams expose internally, while walking back defaults that broke existing setups. The Valkey switch shows Harbor following the wider move off Redis after its licence change.
◆ Prediction
Expect 2.15.4 to go final with the restored defaults and a refreshed Trivy; the entries don't show what the next minor release contains.
Semgrep
6.3INFRA · APIS
Semgrep takes Dart to GA and drops CodeQL's QL, while Supply Chain keeps widening.
◆ Current state
Semgrep ships roughly weekly. Supply Chain has carried the substantive work lately: Bun lockfiles in 1.179, Bazel Maven workspaces in 1.177, changed-dependency reporting in 1.174. 1.180 shifts to the language side, promoting Dart to GA with type-aware matching and removing QL as a target language.
◆ Where it's heading
Two tracks run in parallel: more dependency ecosystems for Supply Chain, with the 1.177 notes naming rules_python, rules_go and rules_js as next Bazel milestones, and deeper semantics for languages Semgrep already parses. Dropping QL shows the team is also pruning languages it doesn't intend to support well.
◆ Prediction
Expect the next Bazel ecosystem via rules_python or rules_go within a few releases, and possibly more languages moved between maturity tiers following Dart's promotion.
Alternatives to Harbor and Semgrep
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Harbor or Semgrep.
ToolJet
ToolJet follows AI Builder 3 on LTS with Salesforce and signup fixes.
Tyk
Tyk's release feed is CVE dependency bumps across three maintained lines.
Keycloak
Keycloak patches its 26.4 and 26.6 lines in lockstep; the tags carry no notes.
GitHub
GitHub's Copilot push shifts to admin plumbing: billing, account controls and agent access.
Retool
Retool's agent is wiring backends now; the self-hosted release trains keep rolling underneath.
See all Harbor alternatives → · See all Semgrep alternatives →
Recent activity from Harbor and Semgrep
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 1d agoHarbor2.15.4-rc1 restores private-network webhooks and legacy signer pulls
- 2d agoSemgrepDart reaches GA; QL language support removed
- 8d agoSemgrepSupply Chain adds Bun bun.lock parsing
- 16d agoHarbor2.15.3-rc2: second candidate of the security patch
- 16d agoSemgrepTree-sitter runtime bump and Windows hang fix
- 29d agoHarbor2.15.3-rc1: manifest size limit and proxy-cache poisoning fix
- 29d agoSemgrepNative Supply Chain support for Bazel workspaces ⚡
- 1mo agoSemgrepHomebrew installs dropped on Intel Macs
- 1mo agoSemgrepToolchain moves to OCaml 5.4
- 3mo agoHarbor2.15.2-rc3: Valkey replaces Redis as cache backend
- 3mo agoHarbor2.15.2-rc2: earlier candidate of the Valkey patch
Frequently asked questions
What is the difference between Harbor and Semgrep?
Both compete on the same themes — supply-chain — within Infra & APIs. Semgrep is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Harbor better than Semgrep?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Semgrep is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Harbor?
Top Harbor alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Harbor alternatives" section above for the current picks, or visit /alternatives/harbor for the full list with editorial commentary on each.
What are the best alternatives to Semgrep?
Top Semgrep alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Semgrep alternatives" section above for the current picks, or visit /alternatives/semgrep for the full list with editorial commentary on each.