sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

semgrep scan and ci add experimental --x-dependency-paths output

Introduced 2026-06-24 · score 0.93

HOW TO USE IT

When inspecting transitive supply-chain findings, run `semgrep scan` or `semgrep ci` with `--x-dependency-paths` and select JSON or SARIF output. The flag adds full dependency paths to those findings in the selected output.

semgrep scan --x-dependency-paths --json
semgrep scan --x-dependency-paths --sarif
semgrep ci --x-dependency-paths --json

WHY THIS HELPS

Inspect transitive supply-chain findings in JSON or SARIF output from a `scan` or `ci` run.

REQUIREMENTS AND LIMITATIONS

  • Version: 1.168.0
  • Availability: experimental
  • --x-dependency-paths: Experimental flag; includes full dependency paths for transitive supply-chain findings in JSON and SARIF output.
  • --json: Outputs results in Semgrep JSON format. Use as the selected output format with `--x-dependency-paths`.
  • --sarif: Outputs results in SARIF format. Use as the selected output format with `--x-dependency-paths`.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card