LoginSign Up
← Back to all sparks
S

Semgrep

INFRA · APIS
Velocity5.0

Fast, open-source static analysis for finding bugs and security issues.

semgrep.dev ↗

Semgrep keeps spending releases on parser breadth and large-repo throughput, not new surface.

static-analysislanguage-coveragescan-performancelarge-repo-scalingsupply-chainreliability
◆Current state
Ten consecutive releases have gone into the engine rather than the product. The recurring shape is a parser refresh (Solidity, Ruby, Dart), a scan-performance change, and a batch of correctness fixes for Pro analysis. Nothing in this window changes what a team buys Semgrep for; it changes how reliably a scan finishes on a large repository.
◆Where it's heading
The performance work is converging on one problem: very large monorepos. File targeting now batches path filtering across worker domains, rule parsing shards by bytes instead of worker count, and a new Pro memory policy lets a scan trade RAM for skipping on-disk caching. Running alongside it is a quieter thread of trust work, and the 1.173.0 fix for silently dropped targets belongs to it: a file whose path filtering failed appeared in neither the findings nor the skipped list, which is the kind of gap that undermines a scan report more than any missing rule.
◆Prediction
Expect the parser-refresh-plus-throughput cadence to continue, with the memory policy and the dependency-path output likely graduating out of experimental once large-repo users report back on them.

◆Recent moves

  1. 5d ago

    Solidity parser refresh; batched targeting for very large repos

    The large-repo throughput thread continues: path filtering is submitted to worker domains in batches, and parallel rule parsing shards by bytes rather than by worker count, with a new Pro memory policy that skips intermediate disk caching at the cost of RAM. The Solidity parser picks up transient storage, named mapping parameters and Cancun builtins. The fix underneath matters more than either: targets whose path filtering failed were silently absent from both the results and the skipped list, and are now retried and reported.

    View source ↗
  2. 21d ago

    OpenTofu files scanned as Terraform; Ruby parser updated

    Continues the coverage-widening pattern: .tofu files are detected and scanned under the existing Terraform rulesets with no configuration, and the Ruby parser moves to tree-sitter-ruby v0.23.1 for better handling of case/when across line breaks and element references taking a block. The contributor-collection window for semgrep ci also stretches from 30 to 90 days to match the usage policy.

    View source ↗
  3. 27d ago

    Build moves to a patched OCaml compiler to stop rare crashes

    The reliability strand of the current arc: Semgrep now builds against an OCaml compiler fork that backports fixes for a codegen bug behind rare nondeterministic crashes and incorrect results, plus excessive heap growth after major garbage collections. The OpenTofu extension support and the 90-day contributor window land here first and carry into 1.172.0.

    View source ↗
  4. 1mo ago

    Pro C/C++ scans skip statically-dead preprocessor branches

    Precision work aimed squarely at false positives: Pro C/C++ scans no longer report matches inside #if 0 blocks and other branches the preprocessor has already eliminated. Fatal-signal backtraces return to semgrep-core, and the Pro installer now reports usage metrics so install failures can be tracked.

    View source ↗
  5. 1mo ago

    Dart parser updated to a newer upstream version

    A single infra line — the Dart parser tracks a more recent upstream version. No user-visible behavior change beyond whatever the newer grammar accepts.

    View source ↗
  6. 1mo ago

    Experimental flag exposes full paths for transitive dependency findings

    The clearest supply-chain movement in this window: an experimental --x-dependency-paths flag emits the full dependency path for transitive findings in JSON and SARIF output, which is what makes a transitive alert actionable rather than noise. Malicious-package findings are also relabeled from Basic to Malicious in the summary table, and the engine drops libpcre 8.x for libpcre2 with matching behavior unchanged.

    View source ↗