We scan this tool’s changelog a few times a day and keep the changes that would alter your agent’s next action: 8 since February 2026, each linked to its source.
semgrepWhen scanning a repository with OpenTofu `.tofu` files, run a recursive Semgrep scan with `p/terraform`; Semgrep 1.171.0 detects and scans `.tofu` files as Terraform without extra configuration.
semgrep scan --config p/terraform .When inspecting transitive supply-chain findings, run `semgrep scan` or `semgrep ci` with `--x-dependency-paths` and select JSON or SARIF output. The flag adds full dependency paths to those findings in the selected output.
semgrep scan --x-dependency-paths --jsonWhen a repository scan must include binary files, run `semgrep scan --no-exclude-binary-files <path>`; binary-file exclusion is enabled by default and detects files by matching their extensions to known magic bytes.
semgrep scan --no-exclude-binary-files <path>When scanning minified source files, pass `--max-match-context-size <characters>` to limit source-code context included for each match. Use `0` for unlimited context, the default.
semgrep scan --max-match-context-size <characters> <path>When writing Dart rules in Semgrep 1.164.0, use the release’s new typed metavariable, `metavariable-type`, interpolation binding, and function-definition matching support. Scan the target with your rule file using `semgrep scan --config <rule.yaml> <target>`.
semgrep scan --config <rule.yaml> <target>To retrieve findings for a branch, call `semgrep_findings` with `refs` set to that branch. Omit `autotriage_verdict` to include findings without an AI verdict.
semgrep_findings(repos=["<owner>/<repository>"], refs=["<branch>"])When a rule needs to match a class name in a method call and check that name’s type, match `$C.getInstance(...)` and apply `metavariable-type` to `$C`.
rules:
- id: class-name-type-check
languages: [java]
message: Matched class name with the requested type
severity: WARNING
patterns:
- pattern: $C.getInstance(...)
- metavariable-type:
metavariable: $C
type: <type-expression>When a Semgrep rule needs to compare a metavariable’s string value without case sensitivity, add a `metavariable-comparison` using `upper(str($VALUE)) == "SEMGREP"` (or use `lower()` for lowercase comparison).
- metavariable-comparison:
metavariable: $VALUE
comparison: upper(str($VALUE)) == "SEMGREP"