LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep grinds its analysis engine wider — more languages, more taint precision, less noise.

semgrepstatic-analysistaint-trackingsupply-chainiac-scanning
◆Current state
Semgrep is a mature static-analysis scanner shipping weekly point releases. The recent arc is steady engine work: broader language and framework coverage, more precise interfile taint tracking on the Pro tier, and quality-of-life flags that cut false positives. No single release redraws the product, but the cumulative direction is a more capable, quieter scanner.
◆Where it's heading
The throughline is precision and reach — constant-propagation folding, dead-code filtering for C/C++, cross-file taint for more languages (Gosu), and IaC coverage now extending to OpenTofu. Semgrep is closing the gap between what it can parse and what real polyglot codebases actually contain.
◆Prediction
Expect continued incremental language and framework coverage plus supply-chain reachability features (like the experimental dependency-path flag) maturing out of experimental status.

◆Recent moves

  1. 18h ago

    OpenTofu .tofu files now scanned as Terraform

    Adds automatic detection of OpenTofu .tofu files, scanning them with the existing Terraform grammar and rulesets — broadens IaC coverage to the Terraform fork without new rules.

    View source ↗
  2. 8d ago

    Pro C/C++ skips dead preprocessor branches

    Pro C/C++ scans now skip statically-dead preprocessor branches (#if 0), cutting false positives on intentionally-disabled code — a precision gain in the engine's C/C++ path.

    View source ↗
  3. 14d ago

    Dart parser upstream bump (infra)

    An infra release bumping the Dart parser to a newer upstream version; no user-visible behavior change.

    View source ↗
  4. 28d ago

    Experimental transitive dependency-path output for SCA

    Adds an experimental --x-dependency-paths flag exposing full transitive paths for supply-chain findings, plus clearer labeling of malicious-dependency rules — early reachability tooling for SCA.

    View source ↗
  5. 1mo ago

    Broader constant folding; platform nosemgrep control

    Expands constant-propagation folding to more operators (subtraction, division, bit ops, comparisons) and adds a config field to disable nosemgrep suppression — incremental analysis-engine depth.

    View source ↗
  6. 1mo ago

    Experimental cross-file taint tracking for Gosu (Pro)

    Adds experimental cross-file taint tracking for Gosu on the Pro tier, extending interfile analysis to another language — part of the steady reach expansion.

    View source ↗