LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep ships consistent engine hardening with an Intel Mac Homebrew deprecation.

code-securitysaststatic-analysisdevtoolsocaml-engine
◆Current state
Semgrep is in steady maintenance mode across its core scanning engine, releasing frequently with language support additions, parallel scan performance improvements, and edge-case bug fixes. The MCP mode UTF-8 multibyte scan fix in v1.173.0 and the Solidity parser update reflect continued attention to language coverage. Dropping Intel Mac Homebrew support in v1.176.0 is the most user-visible move in recent months.
◆Where it's heading
The release pattern points to infrastructure hygiene over feature expansion: OCaml 5.4 migration, libpcre to libpcre2 transition, and the OpenTofu .tofu extension support all clear technical debt or extend existing capabilities incrementally. The git contributor window extension from 30 to 90 days tightens usage tracking, likely for enterprise licensing purposes, suggesting Semgrep is also rationalizing its commercial layer.
◆Prediction
The next notable move is likely a Pro engine capability update — recent dataflow and taint analysis fixes indicate active development on the Pro cross-file analysis layer. Continued language parser updates are expected as the team works through its tree-sitter migration backlog.

◆Recent moves

  1. 6d ago

    Semgrep v1.176.0 drops Intel Mac Homebrew support

    Dropping Intel Mac Homebrew support marks a platform deprecation users on older hardware will notice. It fits Semgrep's broader infrastructure modernization trajectory — clearing legacy support obligations to concentrate CI on Apple Silicon and Linux environments.

    View source ↗
  2. 12d ago

    Release v1.175.0

    Compiler upgrade from OCaml 5.3 to 5.4 with no user-visible behavior change — pure internal infrastructure. End users see nothing different.

    View source ↗
  3. 18d ago

    Release v1.174.0

    Diff scans now surface which dependency source files changed since the merge base, giving teams clearer supply chain change attribution. Partial scans also skip ecosystems outside the active ruleset, reducing unnecessary dependency resolution overhead on large monorepos.

    View source ↗
  4. 25d ago

    Release v1.173.0

    A dense release that fixes several correctness issues: metavariable-regex duplicate findings, Rust grouped use-import name resolution, MCP mode scan failures on multibyte UTF-8 files. The parallel scan performance improvement on musl systems and improved signal-on-crash diagnostics round out a release focused on production reliability.

    View source ↗
  5. 1mo ago

    Release v1.172.0

    OpenTofu .tofu extension support lets Terraform-targeted rulesets cover OpenTofu projects with no configuration change. OCaml compiler GC pacing and codegen bug fixes address rare nondeterministic crashes. The git contributor window expanding to 90 days reflects a usage policy update on the commercial side.

    View source ↗
  6. 1mo ago

    Release v1.171.0

    An earlier release that shares the OpenTofu and OCaml GC fixes later carried in v1.172.0 — likely a backport or overlapping release branch. No unique features relative to v1.172.0.

    View source ↗