{
  "slug": "semgrep-scan-and-ci-add-experimental-x-dependency-paths-output-e7be0c43bfb2",
  "title": "semgrep scan and ci add experimental --x-dependency-paths output",
  "tools": [
    "semgrep"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-24T19:37:09.000Z",
  "announced_at": "2026-06-24T19:37:09.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When inspecting transitive supply-chain findings, run `semgrep scan` or `semgrep ci` with `--x-dependency-paths` and select JSON or SARIF output. The flag adds full dependency paths to those findings in the selected output.",
    "examples": [
      "semgrep scan --x-dependency-paths --json",
      "semgrep scan --x-dependency-paths --sarif",
      "semgrep ci --x-dependency-paths --json"
    ],
    "gotchas": [
      "Version: 1.168.0",
      "Availability: experimental",
      "--x-dependency-paths: Experimental flag; includes full dependency paths for transitive supply-chain findings in JSON and SARIF output.",
      "--json: Outputs results in Semgrep JSON format. Use as the selected output format with `--x-dependency-paths`.",
      "--sarif: Outputs results in SARIF format. Use as the selected output format with `--x-dependency-paths`."
    ]
  },
  "why_it_matters": "Inspect transitive supply-chain findings in JSON or SARIF output from a `scan` or `ci` run.",
  "sources": [
    "https://github.com/semgrep/semgrep/releases/tag/v1.168.0",
    "https://docs.semgrep.dev/cli-reference"
  ],
  "rank": 0.93038,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-221b8a2e6a531ab6-0:gate",
    "evidence_hash": "40b34a1c1f608318de96516c5076415573819054fb641d13ac8b4dc8ffec0b82"
  },
  "review": {
    "draft_hash": "f1e8326aa10997764d2f0da3ca5b9812eb46791e31d51735c48b4ad7a97596b2",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.62 (>= 0.6 needed)."
  }
}