Week of August 10, 2026
- Fix multiple Code findings in one Autofix PR or MR: When several findings in the same file come from the same rule, Semgrep offers to open one Autofix pull request or merge request for the group.
- Agentic Workflows issues API: Issues created by Semgrep Agentic Workflows are now available through the experimental v2 API.
Week of August 3, 2026
- Unified Policies migration schedule: Semgrep will start migrating some organizations to Unified Policies on August 24, 2026, and will sunset the current version of Policies on November 1, 2026.
- Projects findings counts: Findings counts on the Projects page now include Reviewing and To fix findings, in addition to Open.
Week of July 27, 2026
- Semgrep Agentic Workflows is in public beta: Run multi-step AI-enabled detection pipelines from Semgrep AppSec Platform. See Get started with Semgrep Agentic Workflows.
- Supply Chain incident Slack notifications: Released a default Supply Chain incident notification policy to all Supply Chain customers using Unified Policies. You can also configure a Slack channel to be notified during an ongoing Supply Chain incident, including whether you might be affected based on your most recent SBOM.
- License compliance for multi-licensed packages: You can configure license compliance to block a dependency only when all of its licenses are blocked, instead of when any license is blocked.
Week of July 13, 2026
- Unified Policies is generally available: Choose the rules and rulesets used for Semgrep scans and define what happens after Semgrep identifies a finding, such as leaving PR or MR comments, blocking PRs or MRs, creating Jira tickets, or sending Slack notifications.
Week of July 6, 2026
- Archive projects in Semgrep: You can archive a project from Project settings. Projects archived in Semgrep appear on an Archived tab with an archived badge, alongside projects archived in your source code manager.
- Vulnerability class conditions: Remediation policy automations can now be scoped to a vulnerability class such as SQL Injection or Path Traversal.