Semgrep June 2026: Unified Policies Beta, Autofix Pull Requests and CycloneDX 1.7 SBOM Export

Semgrep published its June 2026 release notes on July 8, 2026. Unified Policies entered beta, Autofix can now open pull and merge requests on four source-control platforms, Semgrep Supply Chain gained CycloneDX 1.7 SBOM export and a default malicious-dependency policy, and scans now skip binary files by default. Source: Semgrep June 2026 release notes.

Semgrep AppSec Platform

• Unified Policies (beta). One place to choose the rules and rulesets Semgrep scans with and to define what happens after Semgrep identifies a finding.
• Autofix pull requests. Autofix can open pull requests and merge requests on GitHub, GitLab, Bitbucket and Azure DevOps.
• Remediation policies. A Slack workspace can be connected or reconnected directly from the Slack notification action in a remediation policy.
• Public API. Findings expose their first-detected date in a new created_at field, the findings endpoint no longer stops at 50,000 findings when paginating, and a bulk endpoint revokes several API tokens in one request.
• AI credits. AI autotriage cache hits no longer count against a deployment's AI credit balance, and daily AI credit spend is charted.

Semgrep Code

• Scans skip binary files such as images, archives and compiled executables by default.
• The --max-match-context-size CLI flag limits how much surrounding source code Semgrep includes with each match.
• metavariable-comparison supports bit shift operators, and constant propagation folds more operators.
• Pro users get experimental cross-file taint tracking for Gosu.
• --x-rule-validation replaces --x-no-python-schema-validation.

Semgrep Supply Chain

• New organizations with Supply Chain enabled get the Block malicious dependencies policy by default, and malicious dependency rules are labelled Malicious instead of Basic.
• Dynamic Dependency Resolution, Upgrade Guidance and Autofix pull requests work with self-hosted Python private registries.
• SBOMs export in CycloneDX 1.5, 1.6 or 1.7.
• The experimental --x-dependency-paths flag for semgrep scan and semgrep ci includes full dependency paths.

Semgrep Secrets

• HTTP-based secret validators retry transient network failures, which reduces intermittent validation errors.

What to check before rolling out

The binary-file default and the match-context flag can change finding counts and match output compared with your current baseline. Run the new version against a few representative repositories, compare findings, scan duration and exit codes, and record any change to blocking policies. If you adopt Unified Policies during the beta, pilot it with one team before moving existing policies. Teams that consume the findings API can drop workarounds for the 50,000-finding pagination limit and start reading created_at.

How Merito helps

Merito is an authorized Semgrep reseller and services partner. Merito licenses Semgrep AppSec Platform, Semgrep Code and Semgrep Supply Chain, and its upgrade services plan and validate releases like this one without disrupting delivery. Request Semgrep pricing or upgrade help.