|
| 1 | +--- |
| 2 | +slug: january-2025 |
| 3 | +title: January 2025 |
| 4 | +hide_title: true |
| 5 | +description: >- |
| 6 | + Release notes include the changes, fixes, and additions in specific versions of Semgrep. |
| 7 | +tags: |
| 8 | + - Release notes |
| 9 | +--- |
| 10 | + |
| 11 | +# Semgrep release notes for January 2025 |
| 12 | + |
| 13 | +## 🌐 Semgrep AppSec Platform |
| 14 | + |
| 15 | +- The **Policy Management API** is now generally available. The Policy Management API allows you to automate tasks such as: |
| 16 | + - Add, update, and disable rules across multiple policies. |
| 17 | + - Apply rules in different modes, such as monitor, comment, block, or disable, to align with security workflows. |
| 18 | + - Integrate policy management into CI/CD pipelines to ensure consistent enforcement during software development. |
| 19 | +- **Semgrep Managed Scans:** |
| 20 | + - Managed scans for repositories hosted by **Azure DevOps** is now in public beta. |
| 21 | + - GitHub users can turn on or off full scans and diff-aware scans for individual projects scanned by Semgrep Managed Scans. |
| 22 | +- **Jira:** added the ability to map the **Team** information back to Semgrep. |
| 23 | +- Org admins can now invite new users to Semgrep by email. Invited users receive an email with instructions on how to join the organization's Semgrep account. |
| 24 | +- Added pagination to the **Settings > Access > Members** page, as well as the ability to search for members. |
| 25 | + |
| 26 | +## Changed |
| 27 | + |
| 28 | +- The **search bar** in the **Projects** page now loads faster. <!-- 18697 --> |
| 29 | +- Links to the **Project Settings** and **Scans** pages now use project IDs instead of project names. Existing links using project names continue to function normally. |
| 30 | + |
| 31 | +## Fixed |
| 32 | + |
| 33 | +- Fixed an issue where commands not prefixed with `/semgrep` or `/` weren't correctly handled. |
| 34 | +- Fixed an issue where reports generated by Semgrep AppSec Platform weren't correctly displaying the age of findings. |
| 35 | +- Fixed an issue where the first page of Bitbucket Data Center repositories wasn't displayed. |
| 36 | +- Fixed the formatting of Bitbucket Cloud PR comments. |
| 37 | + |
| 38 | +## 💻 Semgrep Code |
| 39 | + |
| 40 | +### Added |
| 41 | + |
| 42 | +- Added support for lambdas (anonymous functions) as callbacks. This is supported for all languages that have lambdas. |
| 43 | + ```javascript |
| 44 | + var tainted = source(); |
| 45 | + |
| 46 | + function withCallback1(val, callback) { |
| 47 | + if (val) { |
| 48 | + callback(val); |
| 49 | + } |
| 50 | + } |
| 51 | + |
| 52 | + withCallback1(tainted, function (val) { |
| 53 | + sink(val); // finding ! |
| 54 | + }); |
| 55 | + ``` |
| 56 | + |
| 57 | +### Changed |
| 58 | + |
| 59 | +- Removed **pip** from the Semgrep Docker image. If necessary, you can install it by running `apk add py3-pip`. |
| 60 | + |
| 61 | +### Fixed |
| 62 | + |
| 63 | +- The `semgrep test` and `semgrep validate` commands have been correctly documented as **EXPERIMENTAL** in `semgrep --help`. |
| 64 | + - Those commands are not GA. It is recommended to use the `semgrep scan --test` and `semgrep scan --validate`. |
| 65 | +- Improve error handling for capabilities ancillary to a scan, such as looking for `nosemgrep` comments and rendering autofixes, to reduce the likelihood of an unexpected error in such a component causing the scan to error. |
| 66 | +- Fix the behavior of Semgrep when running into broken symlinks. If such a path is passed explicitly as a scanning root on the command line, it results in an error. Otherwise, if it's a file discovered while scanning the file system, it's a warning. |
| 67 | +- Fixed an issue with crashes due to an exception in `lines_of_file`. The code should now be more robust and not stop the whole scan when an out-of-bound line access happens during `nosemgrep` analysis or when displaying the lines of a match. |
| 68 | + |
| 69 | +## ⛓️ Semgrep Supply Chain |
| 70 | + |
| 71 | +### Added |
| 72 | + |
| 73 | +<!-- Dependency graphs? --> |
| 74 | +- [Dependency Paths](/semgrep-supply-chain/dependency-search#view-the-dependency-path) are now available for the following languages and package managers: |
| 75 | + - **JavaScript**: all package managers are supported by Semgrep. |
| 76 | + - **Python**: Only Poetry is supported. |
| 77 | +- **C# **: Semgrep can now scan NuGet codebases without the need for a lockfile. This feature is in **private beta **. See also [Scan a project without lockfiles ](/semgrep-supply-chain/getting-started#scan-a-project-without-lockfiles-beta). Reach out to [< i class= "fa-regular fa-envelope"></ i> [email protected]](mailto:[email protected]) to join the beta program. |
| 78 | +- Semgrep now ingests CVE information from [<i class="fas fa-external-link fa-xs"></i> Electron release notes](https://releases.electronjs.org/releases/stable). This information is used to generate rules that can detect if you're affected by CVEs from this source. |
| 79 | + |
| 80 | +### Changed |
| 81 | + |
| 82 | +- Semgrep Supply Chain [Policies](/semgrep-supply-chain/policies) are now in public beta. Creating a policy enables you to: |
| 83 | + - Customize when Semgrep sends a finding as a PR or MR comment or fails the CI job. |
| 84 | + - Customize the projects and conditions that send a comment or fail a CI job. |
| 85 | + |
| 86 | +### Fixed |
| 87 | + |
| 88 | +- Fixed bug where Supply Chain diff-aware scans of `package-lock.json` v2 projects incorrectly produced non-new findings. |
| 89 | + |
| 90 | +## 🤖 Semgrep Assistant |
| 91 | + |
| 92 | +### Added |
| 93 | + |
| 94 | +- **Noise filtering** is now in public beta. With Noise Filtering, Assistant evaluates each Semgrep Code finding to determine if it's a true positive using additional context and prevents a PR comment from being posted in the developer workflow if it's not. |
| 95 | +- **Auto-triage Memories** is now in public beta. With this feature, you can identify findings that are safe to ignore and write triage notes indicating why this is so. Assistant then stores this information as a memory and uses it to assess whether similar findings are shown to developers in the future. Assistant also takes that memory, reanalyzes similar findings in your backlog, and suggests issues that may be safe to close. |
| 96 | + |
| 97 | +## 📝 Documentation and knowledge base |
| 98 | + |
| 99 | +### Added |
| 100 | +- Added the following new documents, articles, and sections: |
| 101 | + - Set up [Semgrep Managed Scans with Azure DevOps](/deployment/managed-scanning/azure). |
| 102 | + - [Semgrep for developers](/for-developers/overview), a new series of documents that aims to: |
| 103 | + - Help AppSec engineers educate developers about Semgrep and secure coding. |
| 104 | + - Inform developers of how to resolve Semgrep findings in various environments, such as their pull requests or merge requests. |
| 105 | + - [Semgrep Assistant metrics](/semgrep-assistant/metrics), which explains how Assistant's metrics and benchmarks are analyzed. |
| 106 | + - [SAML single-sign on with Google Workspace](/kb/semgrep-appsec-platform/saml-google-workspace). |
| 107 | + - [Reference for Semgrepignore v2](/semgrepignore-v2-reference). |
| 108 | + - [Customize semgrep in `pre-commit`](/kb/integrations/customize-semgrep-precommit). |
| 109 | +- Minor additions and updates: |
| 110 | + - Added instructions to remove projects scanned with Semgrep Managed Scans. |
| 111 | +- Major updates have been made to the following documentation: |
| 112 | + - [Supported languages](/supported-languages) now provides a summary table for both Code and Supply Chain features for each language. |
| 113 | +- Thanks to [savq](https://github.com/savq) for their improvements to Semgrep's contributing documentation. |
| 114 | + |
| 115 | +### Changed |
| 116 | + |
| 117 | +- Clarified language around manifest files and lockfiles. |
| 118 | +- Updated Semgrep rules licensing documentation. |
| 119 | + |
| 120 | +### Removed |
| 121 | + |
| 122 | +- Removed references to the asdf-semgrep plugin. |
| 123 | + |
| 124 | +## 🔧 Semgrep Community Edition (CE) |
| 125 | + |
| 126 | +* The following versions of Semgrep CE were released in January 2025: |
| 127 | + |
| 128 | + - [<i class="fas fa-external-link fa-xs"></i> 1.102.0](https://github.com/semgrep/semgrep/releases/tag/v1.102.0) |
| 129 | + - [<i class="fas fa-external-link fa-xs"></i> 1.103.0](https://github.com/semgrep/semgrep/releases/tag/v1.103.0) |
| 130 | + - [<i class="fas fa-external-link fa-xs"></i> 1.104.0](https://github.com/semgrep/semgrep/releases/tag/v1.104.0) |
0 commit comments