v1.152.0

Compare Source

### Added

• Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)

• Turned on DNS rebinding protection for the MCP server (dns-check)

• Environment variables can now be passed to third-party package managers invoked as part of --allow-local-builds dependency resolution via the environment variable SEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)

• Memory management policies

  A memory policy defines how OCaml's garbage collector should be configured for
  a scan. There are two initial policies: "aggressive", the current behaviour,
  which trades longer scan times for lower memory use, and "balanced", which
  finds a middle ground between reclaiming heap memory in short order while
  limiting how often the garbage collector runs. The policy can be configured
  via the --x-mem-policy CLI flag for the pro engine; this flag is unused in
  the OSS engine. (engine-2055)

• Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@​hex0punk) for the contribution! (gh-11347)

• Allows case insensitive string comparisons using lower() and upper() like this:

  - metavariable-comparison:
      metavariable: $VALUE
      comparison: upper(str($VALUE)) == "SEMGREP"
  

  (gh-11502)

• Blocking findings that are outputted in the CI output are now labelled as such. (#​4394)

### Changed

• pro: There should be fewer FNs when the max number of fields to track per object
  is reached. (code-9224)
• Remove legacy combined symbol analysis computation and upload in favor of per-subproject symbol analysis (sc-3153)

### Fixed

• pro: Improved accuracy of taint tracking through assignments, this will help
  reduce FPs in some cases. (code-9220)
• When receiving a 429 or 5xx from the Semgrep app, the CLI will wait for a
  longer period of time before retrying the request, to spread out requests
  during periods of app instability. (engine-2550)

v1.151.0

Compare Source

Added

• Added progress indicators for symbol analysis calculation and upload during CI scans (sc-3103)

Fixed

• bumped glom to at least version 23.3, which includes a fix to a SyntaxWarning
  warning log. (gh-11460)
• Semgrep no longer prints info log lines from semgrep-core RPC calls when --trace is passed and --debug isn't (loglines)
• Fixed the README not appearing in built wheels. (wheelreadme)

v1.150.0

Compare Source

Added

• Connecting to the Semgrep MCP server via streamableHttp now requires OAuth. (saf-2453)

Changed

• Migrated from pipenv to uv for ./cli package management (uv)

Fixed

• pro: Improved virtual method resolution in Scala (code-9213)
• Improved performance for supply chain scans by reducing pre-computation when printing the scan status. This results in slightly less information being displayed in the case that there are no rules to run. (gh-5436)
• Supply Chain Analysis: fixed version range matching for NPM packages with versions containing a prerelease identifier such as -alpha in 1.2.3-alpha. (sc-3001)