LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep adds Objective-C as an alpha target, its first new language since Dart went GA.

sastsupply-chainlanguage-supportobjective-cpythonterraform
◆Current state
Semgrep ships weekly on two tracks. Supply Chain added Bazel Maven workspaces in 1.177, Bun lockfiles in 1.179 and unpinned Python requirements in 1.181. The matcher promoted Dart to GA in 1.180. 1.182 adds Objective-C (alpha) with search- and taint-mode rules, and updates the C# Pro, Terraform HCL and Lua grammars.
◆Where it's heading
Language coverage is widening toward Apple-platform code, where .m files have so far sat outside Semgrep's rules, and Objective-C++ is promised separately. On the dependency side, Python requirements handling keeps moving toward how people write manifests by hand rather than how pip-compile emits them.
◆Prediction
Expect Objective-C++ (.mm) support next, as the 1.182 notes say, and Objective-C moving out of alpha. The open item from 1.181, turning unpinned Python deps into findings, has no date yet.

◆Recent moves

  1. 2d ago

    Objective-C alpha support; C#, Terraform and Lua grammars updated

    1.182 extends the matcher track with Objective-C as an alpha language and refreshes three grammars, while Supply Chain refines the 1.181 Python work: a hand-written range or bare-name requirement now counts as direct even when a requirements.in exists. It continues the pattern of coverage gains rather than any change in direction.

    View source ↗
  2. 8d ago

    Supply Chain inventories unpinned Python requirements

    Requirements with version ranges or bare names now land in the dependency inventory and SBOM instead of being dropped as parse errors, though they produce no findings yet. It continues the ecosystem-by-ecosystem coverage push, and Go generics and Hack capability parsing ride along on the language track.

    View source ↗
  3. 15d ago

    Dart reaches GA; QL language support removed

    After weeks of Supply Chain work, this release goes back to the core matcher: Dart gets type inference, alias-aware import matching and richer ellipsis patterns, and is promoted to GA. Removing QL as a scan target fits the same cleanup, keeping language support to what the engine can match well.

    View source ↗
  4. 21d ago

    Supply Chain adds Bun bun.lock parsing

    Supply Chain now reads Bun's text bun.lock with a package.json, including dependency relationships, though the binary bun.lockb format is still unsupported. It's another step in the ecosystem-by-ecosystem coverage push, and it comes with a change that makes inter-file analysis order stable.

    View source ↗
  5. 29d ago

    Tree-sitter runtime bump and Windows hang fix

    This is maintenance: a tree-sitter runtime bump and a fix for an occasional hang when semgrep-core exits on Windows.

    View source ↗
  6. 1mo ago

    Native Supply Chain support for Bazel workspaces

    ⚡ SPARK

    Native Bazel coverage via rules_jvm_external is the anchor release of the current Supply Chain push. It points scanning at the monorepo build graphs that larger engineering orgs run, and the notes commit to more Bazel ecosystems after it.

    View source ↗