🌐 Semgrep AppSec Platform
Added
- Semgrep now shows a confirmation warning when you add or remove project tags that are attached to policies, both during bulk edit and from a project’s settings page.
- Across the Code, Supply Chain, and Secrets findings lists, Semgrep now shows why a finding was ignored.
Changed
- Semgrep cancels in-flight full Managed Scans when an incident-response scan starts for the same repository, so a late-finishing scan cannot overwrite incident-response findings. Superseded scans appear as Cancelled with an explanatory tooltip.
- Opening Slack connect from a policy now opens in a new tab instead of a side drawer.
- Standardized the order and grouping of the integrations settings menu and page.
💻 Semgrep Code
Added
- Extended the window for collecting git contributor information during
semgrep cifrom the last 30 days to the last 90 days, matching the contributor usage policy.
Changed
- Improved the scan status output when no Code rules will run, such as a Secrets-only or Supply Chain-only scan. The summary no longer reports a confusing “0 Code rules” count and instead states that code scanning is not enabled or that there are no Code rules to run.
Fixed
- Fixed rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug.
⛓️ Semgrep Supply Chain
Added
- You can configure license compliance to block a dependency only when all of its licenses are blocked, instead of when any license is blocked.
- The Supply Chain Dependencies page includes an archived projects filter toggle.
- Supply Chain incident Slack notifications include a custom message field.
Changed
- Removed the timestamp from malware incident Slack notifications, since it could inaccurately suggest a slow response to an incident.
Fixed
- Fixed an issue where lockfileless Gradle dependency resolution failed with a “Parsing dependency output failed” error.
🤖 Semgrep Multimodal
Added
- Findings that span multiple files can now be verified against their entire fileset when Semgrep checks whether an AI-powered detection finding is still present, instead of being judged against only one file.
Fixed
- Fixed an issue where AI-powered detection scan eligibility was disabled entirely when Semgrep Managed Scans was disabled, instead of only when no valid AI providers were configured.