Semgrep release updates

Semgrep’s September 2026 updates make AI-assisted development scanning more visible to release owners by showing Guardian setup, scan results, sign-in requirements, and server errors directly in supported AI coding agents. Teams can export Agentic Workflows issues through CSV and the public API, while fixes improve branch accuracy, repository attribution, and branch-check reliability for private connectivity. These changes help enterprises produce more dependable security evidence for AI-assisted delivery.

• AppSec
• DevSecOps

Semgrep’s August 2026 update introduces structured, searchable Agentic Workflows logs and improves source-file links when SCM connectivity fails. Organizations using current Policies should plan for unified policies migration beginning August 24, 2026; the existing Policies experience sunsets November 1, 2026. The release also adds breaking_change and full_scan vocabulary to the public beta policies API and updates project finding counts to include Reviewing and To fix statuses.

• AppSec
• DevSecOps

Semgrep’s July 2026 update adds Agentic Workflows in public beta, combining program analysis, deterministic tools, and constrained AI reasoning to generate reviewable security findings. Supply Chain customers can block dependencies only when all associated licenses are prohibited and receive default incident-policy support with Slack notifications based on recent SBOM exposure. The update also strengthens operational governance through policy-tag warnings, clearer webhook failures, and fixes to manual triage and integration behavior.

• AppSec
• DevSecOps

Semgrep's June 2026 release notes (published July 8, 2026) cover the Semgrep AppSec Platform, Semgrep Code, Supply Chain, Secrets and AI features. Unified Policies entered beta as one place to choose rules and define what happens after a finding. Autofix can open pull and merge requests on GitHub, GitLab, Bitbucket and Azure DevOps. Supply Chain adds CycloneDX 1.5 to 1.7 SBOM export and a default malicious-dependency blocking policy for new organizations, and scans skip binary files by default.

• AppSec
• DevSecOps

Learn how Semgrep's documentation index, release notes structure and update cadence support DevSecOps governance, compliance, audit readiness and SDLC risk management.

• AppSec
• DevSecOps

Learn how Semgrep strengthens enterprise application security with SSO governance, managed scans, AI findings, and software supply chain controls.

• AppSec
• Semgrep
• AI

Semgrep’s latest update brings AI-powered detection, Autofix, and enhanced policy control, helping enterprises reduce risk, improve remediation speed, and scale AppSec across code and supply chains.

• AppSec
• AI

The Semgrep February 2026 release improves enterprise application security scanning with better SAST accuracy, supply chain visibility, and governance controls. Learn how Merito helps deploy Semgrep at scale.

• Semgrep
• AppSec
• SAST

Semgrep January 2026 strengthens OAuth governance, reachability analysis, and scan performance, improving enterprise DevSecOps control, software supply chain security, and audit ready risk reporting at scale.

• Semgrep
• DevSecOps
• SDLC