CHANGELOG.md
Rama main · réplica de lectura del repositorio original.
# Changelog
## [1.30.0](https://github.com/opengrep/opengrep/releases/tag/v1.30.0) - 07-09-2026
### New features
* `ci` subcommand reimplemented in OCaml, run as `opengrep --experimental ci` by @dimitris-m in #802
### Language support
* PHP: lex numeric separators (`1_000`, `0x1_C`), explicit octal `0o17` and uppercase `0B` binary by @maciejpirog in #814
* PHP: legacy octal literals are read in base 8, so `017` is 15 and not 17 by @maciejpirog in #814
* PHP: `from` is an ordinary identifier everywhere except directly after `yield` by @maciejpirog in #816
* PHP: parse a trailing comma in attribute arguments, as in `#[Route("/a", name: "a",)]` by @maciejpirog in #817
* PHP: allow a reserved word as a named-argument label in a call by @mcdruid in #819
* PHP: allow keyword named-argument labels in attribute arguments, and `goto`, `true` and `false` as labels by @maciejpirog in #821
* PHP: accept `...` as a named argument's value, so `implode(separator: ..., array: ...)` matches by @maciejpirog in #821
* PHP: accept several exception types in every `catch` of a `try`, not just the first by @maciejpirog in #822
* PHP: parse a variable-less `catch (Exception) {}` (PHP 8.0) by @maciejpirog in #822
* PHP: keep every type of a multi-catch as a union, and match the clause on any one of them by @maciejpirog in #822
* PHP: declare and use semi-reserved keywords as method, class constant and enum case names by @maciejpirog in #823
* PHP: `C::static`, `C::self`, `C::__CLASS__` and `C::array()` parse as member accesses, not as the constructs they spell by @maciejpirog in #823
* PHP: accept a heredoc or nowdoc as a constant expression, initialising a const, property, parameter default, static variable or enum case by @maciejpirog in #824
* PHP: parse PHP 7.3 flexible heredocs, with an indented closing marker, and keep the body's own newlines by @maciejpirog in #824
* PHP: parse intersection types in parameters, as in `f(X&Y $p)`, telling them apart from by-reference `f(X &$p)` by @maciejpirog in #824
* PHP: read a property off any constant expression (PHP 8.3), as in `const P = (new A)->prop` by @maciejpirog in #824
### Improvements
* Remove `--oss-only`, `--diff-depth`, `--x-dump-rule-partitions` and ci's no-op `--autofix`/`--supply-chain`/`--code` by @dimitris-m in #802
* ci: `SEMGREP_RULES` and `SEMGREP_AUDIT_ON` are whitespace-separated lists, `SEMGREP_BASELINE_REF` aliases `--baseline-commit` by @dimitris-m in #802
* Replace `Kcas_data.Hashtbl` with `Saturn.Htbl` and drop the `kcas_data` dependency by @dimitris-m in #813
* Remove uncalled functions from `libs/commons` and `libs/commons2`, including the `Cache_disk` module by @dimitris-m in #813
### Bug fixes
* taint: deliver propagator taints when the `to` l-value is visited before the `from` by @corneliuhoffman in #809
* ci: pass the GitLab job token through the environment rather than the command line, and redact URL userinfo in logged git commands by @dimitris-m in #802
* ci: search deeper for a GitHub merge base only when the branch-off point is missing, and fetch all history on the last attempt by @dimitris-m in #802
### New Contributors
* @JAugusto42 made their first contribution in #801
* @mcdruid made their first contribution in #819
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.29.0...v1.30.0
## [1.29.0](https://github.com/opengrep/opengrep/releases/tag/v1.29.0) - 28-08-2026
### Improvements
* Migrate remaining PCRE1 uses to PCRE2, drop the pcre dependency by @dimitris-m in #807
### Bug fixes
* kotlin: fix AST sharing in scope-function taint desugaring by @corneliuhoffman in #806
* Fix CI failures by @dimitris-m in #808
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.28.0...v1.29.0
## [1.28.0](https://github.com/opengrep/opengrep/releases/tag/v1.28.0) - 26-08-2026
### Improvements
* Improve install scripts by @dimitris-m in #796
* opengrep-cli: fix -o on Windows, check destinations early by @dimitris-m in #798
* Constant propagation: stamp svalues on assignment RHS and array indices by @corneliuhoffman in #803
* PHP fixes in Menhir by @maciejpirog in #795
* More PHP fixes by @maciejpirog in #804
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.27.1...v1.28.0
## [1.27.1](https://github.com/opengrep/opengrep/releases/tag/v1.27.1) - 14-08-2026
### Bug fixes
* fix: force-remove baseline worktree so EOL-normalizing repos don't fail scans by @guydanko-orca in #788
### Improvements
* Remove Semgrep infrastructure and run the python tests in CI by @dimitris-m in #789
### New Contributors
* @guydanko-orca made their first contribution in #788
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.27.0...v1.27.1
## [1.27.0](https://github.com/opengrep/opengrep/releases/tag/v1.27.0) - 12-08-2026
### Language support
* JS/TS: Taint `..rest` of object in destructuring by @maciejpirog in #772
* ast-to-il: bind the variables of destructuring declarations by @corneliuhoffman in #773
* PHP: Readonly properties + promoted properties by @maciejpirog in #785
* Dockerfile: Fix parsing of square brackets by @maciejpirog in #786
### Improvements
* Load rules from a remote git repository via `--config git+<url>` by @maciejpirog in #766
* Honor `OPENGREP_*` environment variables alongside legacy `SEMGREP_*` by @maciejpirog in #775
* Add osemgrep output flag support by @mspraggs in #761
### Bug fixes
* opengrep-cli: output destination fixes (follow-up to #761) by @dimitris-m in #780
* opengrep-cli: fix the blocking-findings count in compiled ci builds by @dimitris-m in #782
### Binaries
* windows: ship only the DLLs opengrep-core links against by @dimitris-m in #776
* workflows: nuitka 2.8.9 -> 4.1.3 with the onefile extra by @dimitris-m in #783
### CI
* ci: reject merge commits on PR branches by @dimitris-m in #781
### New Contributors
* @mspraggs made their first contribution in #761
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.26.0...v1.27.0
## [1.26.0](https://github.com/opengrep/opengrep/releases/tag/v1.26.0) - 24-07-2026
### Infrastructure
* Fix Pipfile package name and skip deleting the join_rule temp file on Windows by @mitchellspangler in #737
* Upgrade ppxlib to 0.38 and cmdliner to 2.x by @dimitris-m in #757
* Bump OCaml to 5.5.0 by @dimitris-m in #758
### Improvements
* Dart: Add support for `taint-intrafile` by @maciejpirog in #752
* JS/TS: Various fixes in translation to AST by @maciejpirog in #742 and #767
* Elixir: Make conditions' side effects visible in other branches of `cond` expressions by @maciejpirog in #754
* PHP: shorthand for array_push now propagates taint by @corneliuhoffman in #759
* JS/TS: Fix the matching on ellipsis metavariable by @corneliuhoffman in #760
* Matching: Match statement-sequence patterns against every class member by @maciejpirog in #756
### New Contributors
* @mitchellspangler made their first contribution in #737
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.25.0...v1.26.0
## [1.25.0](https://github.com/opengrep/opengrep/releases/tag/v1.25.0) - 01-07-2026
### Improvements
* Dart: Multiple translation fixes by @maciejpirog in #744
* Dart: Support for dot-access-ellipsis by @maciejpirog in #746
* Dart: Ellipsis as a valid class member in patterns by @maciejpirog in #747
* Dart: Translate cascade expression to dot-accesses by @maciejpirog in #748
* Dart: Fix argument patterns by @maciejpirog in #750
* PHP: Lex non-ASCII bytes in identifiers by @dimitris-m in #749
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.24.0...v1.25.0
## [1.24.0](https://github.com/opengrep/opengrep/releases/tag/v1.24.0) - 30-06-2026
### Language support
* C#: Translation fixes by @maciejpirog in #734
* Java: Fixes in Java -> AST by @maciejpirog in #741
### Improvements
* test(pyopengrep): default --test to no timeout by @dimitris-m in #739
### Engine
* Extend `pattern_to_expr`: ellipsis and pat-typed by @maciejpirog in #738
* Represent Taint_set as a Map keyed by taint identity by @corneliuhoffman in #726
### Security
* Fix Aikido security findings: bump setuptools/urllib3, pin cosign, bump semgrep-interfaces by @dimitris-m in #733
### Documentation
* Crystal: Update README after releasing the support for Crystal by @maciejpirog in #732
* Update sponsors by @dimitris-m in #740
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.23.0...v1.24.0
## [1.23.0](https://github.com/opengrep/opengrep/releases/tag/v1.23.0) - 18-06-2026
### Improvements
* Crystal language support by @buger in #715
* Taint: guarded signatures by @dimitris-m in #684 and #724
* Go: Allow tilde and union in function arguments by @maciejpirog in #716
* Ast-to-IL: Translate more types of function parameters by @maciejpirog in #725
* install.sh: add `OPENGREP_SKIP_BINARY_TEST` env var to bypass smoke test by @bchandler-12 in #728
### Bug fixes
* Fix Windows '..' walk-up in reported file paths by @corneliuhoffman in #729
* Clamp out-of-range line reads so a truncated file can't abort the scan by @dimitris-m in #730
### New Contributors
* @buger made their first contribution in #715
* @bchandler-12 made their first contribution in #728
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.22.0...v1.23.0
## [1.22.0](https://github.com/opengrep/opengrep/releases/tag/v1.22.0) - 19-05-2026
### Improvements
* Dockerfile: Support multiline ENV by @maciejpirog in #702
* Go: Allow nontrivial types in interfaces by @maciejpirog in #710
* Fix taint not flowing through return value of `returns_this` methods by @maciejpirog in #711
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.21.0...v1.22.0
## [1.21.0](https://github.com/opengrep/opengrep/releases/tag/v1.21.0) - 08-05-2026
### Improvements
* Fix directory pruning inefficiency by @corneliuhoffman in #682
* Dockerfile: Correct handling of multiline strings by @maciejpirog in #692
* Dockerfile: Legacy `env` and `label` syntax by @maciejpirog in #694
* C: Support glib macros by @maciejpirog in #698
* lsp: expose taint-intrafile by @dimitris-m in #696
### Infrastructure
* port SARIF e2e tests from Python wrapper to opengrep-cli by @dimitris-m in #683
* restore build function of nix flake by @daniel-noland in #668
* ci: match cygwin OSTYPE in build-wheels windows branch by @dimitris-m in #697
### New Contributors
* @daniel-noland made their first contribution in #668
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.20.0...v1.21.0
## [1.20.0](https://github.com/opengrep/opengrep/releases/tag/v1.20.0) - 21-04-2026
### Improvements
* Elixir: Updates in patterns by @maciejpirog in #655
* Elixir: Distinguish field access from zero-arity remote call by @dimitris-m in #659
* Python: Preserve match/case guard and `as` bindings (PEP 634) by @dimitris-m in #679
* Python: Parse PEP 634 match/case statements in the menhir parser by @raphaeldavidf in #665
* Clojure: Support string-key map destructuring by @dimitris-m in #658
* Fix lambda taint tracking in intrafile mode by @corneliuhoffman in #597
* Unconditional taints in lambdas by @corneliuhoffman in #663
* Make switch usable as expression in IL by @maciejpirog in #664
* Exclude more synthetic identifiers from the PCRE prefilter by @dimitris-m in #673
* Hide synthetic identifiers, add prefix-metavar matching, fix Go `chan` direction by @corneliuhoffman in #677
### Infrastructure
* CI: Set CLCACHE_DIR for nuitka clcache on Windows by @dimitris-m in #680
* CI: Skip init steps when cache was restored via restore-keys by @dimitris-m in #672
* CI: Upgrade opam to 2.5.1, re-enable windows sig verification by @dimitris-m in #674
* CI (Alpine): Add curl to apk install by @dimitris-m in #675
* Chore: Remove .circleci, drop dead Makefile targets, align terminology by @dimitris-m in #676
* Fix Windows install: Bundle charset_normalizer, don't treat stderr as fatal by @dimitris-m in #662
* Opam: Make cache version-invariant and pin memprof-limits via template by @dimitris-m in #670
### New Contributors
* @raphaeldavidf made their first contribution in #665
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.19.0...v1.20.0
## [1.19.0](https://github.com/opengrep/opengrep/releases/tag/v1.19.0) - 09-04-2026
### Improvements
* Elixir: fix taint propagation through for comprehensions and pipes by @dimitris-m in #650
* Ruby: remove redundant Call wrapping in `expr_as_stmt` by @dimitris-m in #651
* Fix `obj[key]` parsing in ruby by @corneliuhoffman in #649
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.18.0...v1.19.0
## [1.18.0](https://github.com/opengrep/opengrep/releases/tag/v1.18.0) - 07-04-2026
### Improvements
* Elixir: Updates to syntax (part 1) by @maciejpirog in #642
* Elixir: Updates to syntax (part 2) by @maciejpirog in #646
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.17.0...v1.18.0
## [1.17.0](https://github.com/opengrep/opengrep/releases/tag/v1.17.0) - 03-04-2026
### Improvements
* Treat nested functions as lambdas by @dimitris-m in #621
* Tainting: per-arity signature extraction for Clojure and Elixir by @dimitris-m in #582
* Dockerfile: Preprocess for better line continuations and comments by @maciejpirog in #633
* Elixir: fix map destructuring in function parameters by @dimitris-m in #637
* Elixir: fix taint propagation through map value expressions by @dimitris-m in #640
* Support chained method calls on constructor results with --taint-intrafile by @corneliuhoffman in #638
### Bug fixes
* Fix(Ruby): zero argument method call syntax by @corneliuhoffman in #626
* Fix: proper constructor taint analysis by @corneliuhoffman in #628
* Fix: Elixir scanner CRLF handling by @dimitris-m in #639
### Refactoring
* Refactoring of AST-to-IL, Step 1 by @maciejpirog in #622
### Developer tooling
* Pretty-print IL in C-style syntax by @maciejpirog in #623
### Installation
* Improve error reporting in install.sh by @dimitris-m in #620
### Security
* [Aikido] AI Fix for Template Injection in GitHub Workflows Action by @aikido-autofix[bot] in #624
* [Aikido] AI Fix for 3rd party Github Actions should be pinned by @aikido-autofix[bot] in #625
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.5...v1.17.0
## [1.16.5](https://github.com/opengrep/opengrep/releases/tag/v1.16.5) - 17-03-2026
### Improvements
* Improvements in recognizing language-specific built-in functions in intrafile tainting by @corneliuhoffman in #617
* Elixir: Support for multi-clause functions and interpolated strings by @maciejpirog in #614
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.4...v1.16.5
## [1.16.4](https://github.com/opengrep/opengrep/releases/tag/v1.16.4) - 11-03-2026
### Improvements
* Improvements in the install script by @dimitris-m in #610
* Fix text encoding in python CLI to prevent a bug when reading a non-utf8 character by @maciejpirog in #611
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.3...v1.16.4
## [1.16.3](https://github.com/opengrep/opengrep/releases/tag/v1.16.3) - 05-03-2026
### Improvements
* Elixir: Parse short function form (`def f(), do: ...`) by @maciejpirog in #605
* VB parser updates: no sentinel strings, better handling of compiler directives and attributes by @maciejpirog in #603
* Allow `--semgrepignore-filename` to be an absolute path by @dimitris-m in #608
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.2...v1.16.3
## [1.16.2](https://github.com/opengrep/opengrep/releases/tag/v1.16.2) - 25-02-2026
### Improvements
* Python CLI: Optimize `--exclude` and `.semgrepignore`` to ignore directories without listing their content by @maciejpirog in #596
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.1...1.16.2
## [1.16.1](https://github.com/opengrep/opengrep/releases/tag/v1.16.1) - 17-02-2026
### Improvements
* Pin Nuitka to 2.8.9 across all build workflows by @dimitris-m in #594
* Remove redundant pip and Nuitka dependencies by @dimitris-m in #573
* Support split rule/target directories in test subcommand by @qkaiser in #576
### Benchmarking
* New benchmarking using hyperfine by @dimitris-m in #557 and #579
### Bug fixes
* Allow multiple logical operators in metavariable comparison by @maciejpirog in #590
* In `--experimental`, don't report git untracked files as skipped with `--use-git-ignore` by @maciejpirog in #577
* C#: Add primary constructor arguments to base class by @maciejpirog in #589
* Dockerfile: Add missing buildkit constructs by @maciejpirog in #581
* Dockerfile: Fix CRLF and comment-in-continuation parsing by @abezdina in #586
* Rust: Fix taint propagation through variable shadowing by @dimitris-m in #572
* TS/TSX: Add support for the `satisfies` construct by @maciejpirog in #592
### Installation
* Add Windows install script (pwsh) by @dimitris-m in #569
* Ensure that install.ps1 works on ARM by @dimitris-m in #571
* Fix: handle unparseable cosign version in install.sh by @dimitris-m in #580
### Documentation
* Improve the README by @dimitris-m in #570
### New Contributors
* @qkaiser made their first contribution in #576
* @abezdina made their first contribution in #586
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.16.0...v1.16.1
## [1.16.0](https://github.com/opengrep/opengrep/releases/tag/v1.16.0) - 04-02-2026
### Improvements
* Dart: Add typed metavariabless by @maciejpirog in #551
* Dart: Use case of identifier to guess call vs new by @maciejpirog in #555
* Go: Enable goroutines in taint tracking by @maciejpirog in #559
* Add taint propagation via "for" comprehensions by @maciejpirog in #564
### Bug fixes
* Rust: Missing Rust type alias translation by @smith-xyz in #549
* Fix: Ensure that linux binaries have 8mb stack size (musl) by @dimitris-m in #563
* Fixed a perf regression by removing system calls and improving the reachability graph and the callee lookup by @corneliuhoffman in #556
* Fixed intrafile bug introduced by a superfluous fallback by @corneliuhoffman in #567
* Ruby: Always translate `or` and `and` to expression by @maciejpirog in #562
* Bash: Allow redirects before command arguments by @maciejpirog in #548
### Internal improvements
* Add `show dump-intrafile-graph` and `show dump-taint-signatures` commands by @corneliuhoffman in #552
* Improve tainting code by @maciejpirog in #546
* Graph refactoring by @corneliuhoffman in #553
### New Contributors
* @smith-xyz made their first contribution in #549
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.15.1...v1.16.0
## [1.15.1](https://github.com/opengrep/opengrep/releases/tag/v1.15.1) - 16-01-2026
### Bug fixes
* Clojure translation improvements by @dimitris-m in #534
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.15.0...v1.15.1
## [1.15.0](https://github.com/opengrep/opengrep/releases/tag/v1.15.0) - 14-01-2026
### Improvements
* Clojure translation part III by @dimitris-m in #527
* Php modernisation by @corneliuhoffman in #529
* Intrafile tainting with variadic functions by @maciejpirog in #538
* C#: The `field` implicit parameter can be skipped in a pattern by @maciejpirog in #525
* C#: Add conditional array access (`?[...]`) to l-values by @maciejpirog in #535
* C#: Collection expressions vs attributes with targets (parser fix) by @maciejpirog in #539
* Add `noopengrep` to the default nosem patterns by @dimitris-m in #533
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.14.1...v1.15.0
## [1.14.1](https://github.com/opengrep/opengrep/releases/tag/v1.14.1) - 06-01-2026
### Improvements
* Clojure translation part II by @dimitris-m in #517
* C#: Allow implicit variables in properties to be taint sources by @maciejpirog in #516
* Add core flags `dump_rule` and `dump_patterns_of_rule` as options in the show command by @maciejpirog in #519
### Bug fixes
* Fix: pass sig db to lambda analysis, handle method mutation tainting by @corneliuhoffman in #520
### Tech debt
* Fix CHANGELOG.md, OPENGREP.md, remove unused files by @dimitris-m in #523
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.14.0...v1.14.1
## [1.14.0](https://github.com/opengrep/opengrep/releases/tag/v1.14.0) - 31-12-2025
### Improvements
* Support for higher-order functions in intrafile taint analysis by @corneliuhoffman in #469 and #513
* Clojure: Improved support for Clojure (incl. tainting) by @dimitris-m in #501
* Dart: Improved support for Dart by @maciejpirog in #508
* C#: Better handing of extension methods and extension blocks by @maciejpirog in #514
### CI fixes
* Bump cygwin install action by @dimitris-m in #503 and #509
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.13.2...v1.14.0
## [1.13.2](https://github.com/opengrep/opengrep/releases/tag/v1.13.2) - 17-12-2025
### Improvements
* C#: Add matching on function argument modifiers (ref, in, scoped, etc.) by @maciejpirog in #494
* C#: Support extension blocks by @maciejpirog in #496
### Release process
* Validate tag input on release by @lae in #493
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.13.1...v1.13.2
## [1.13.1](https://github.com/opengrep/opengrep/releases/tag/v1.13.1) - 15-12-2025
### CI fixes
* Force python 3.13 for osx binary workflow by @dimitris-m in #490
#### Notes
* Version 1.13.0 (#489) intentionally skipped.
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.12.1...v1.13.1
## [1.13.0](https://github.com/opengrep/opengrep/releases/tag/v1.13.0) - 15-12-2025
### Improvements
* Improve handling of patterns and `AST_to_IL` translation by @dimitris-m in #483
* Improve rust tainting by @dimitris-m in #485
* Dump generic AST to HTML by @maciejpirog in #484
* Modernise C# by @maciejpirog in #487
### Bug fixes
* Fix for kotlin double-annotation bug by @maciejpirog in #480
* Fix PCRE2 test making OSX build fail by @dimitris-m in #486
* Fix: in `LetPattern(pat, e)`, `e` should be visited first by @dimitris-m in #488
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.12.1...v1.13.0
## [1.12.1](https://github.com/opengrep/opengrep/releases/tag/v1.12.1) - 02-12-2025
### Bug fixes
* vb: fix comment syntax for --test command on python by @maciejpirog in #477
* Fix: remove call_graph.dot debug file write by @maciejpirog and @dimitris-m in #478
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.12.0...v1.12.1
## [1.12.0](https://github.com/opengrep/opengrep/releases/tag/v1.12.0) - 30-11-2025
### New features
* Support for VB.NET by @maciejpirog in #473
### Improvements
* Bump python version to 3.13 in self-contained binary by @dimitris-m in #475
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.5...v1.12.0
## [1.11.5](https://github.com/opengrep/opengrep/releases/tag/v1.11.5) - 03-11-2025
### Bug fixes
* Fix: ensure `--test` works with `--taint-intrafile` by @dimitris-m in #463
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.4...v1.11.5
## [1.11.4](https://github.com/opengrep/opengrep/releases/tag/v1.11.4) - 31-10-2025
### Bug fixes
* Add `taint_intrafile` param to `ci` command by @lae in #458
### New Contributors
* @lae made their first contribution in #458
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.3...v1.11.4
## [1.11.3](https://github.com/opengrep/opengrep/releases/tag/v1.11.3) - 30-10-2025
### Bug fixes
* C/C++: allow for macros in structs by @maciejpirog in #447
* Python: both parsers generate same structure of interpolated strings by @maciejpirog in #455
* Tainting fix for several methods with the same name by @corneliuhoffman in #449
* Tainting fix: fakeTok bug by @corneliuhoffman in #451
* Depth based equality by @corneliuhoffman in #453
* Fix windows workflow by @dimitris-m in #450
* Adapt Sarif output for --taint-intrafile by @dimitris-m in #456
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.2...v1.11.3
## [1.11.2](https://github.com/opengrep/opengrep/releases/tag/v1.11.2) - 21-10-2025
### Bug fixes
* Tainting: rename the functions and simpler eval by @corneliuhoffman in #444
* Fix cosign version detection in install script by @dimitris-m in #441
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.1...v1.11.2
## [1.11.1](https://github.com/opengrep/opengrep/releases/tag/v1.11.1) - 17-10-2025
### Bug fixes
* Add --taint-intrafile to python by @dimitris-m in #439
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.11.0...v1.11.1
## [1.11.0](https://github.com/opengrep/opengrep/releases/tag/v1.11.0) - 17-10-2025
### New features
* Intrafile tainting by @corneliuhoffman in #432
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.10.2...v1.11.0
## [1.10.2](https://github.com/opengrep/opengrep/releases/tag/v1.10.2) - 14-10-2025
### Bug fixes
* Special case for the '+' operator in Scala by @maciejpirog in #429
* c#: fix to-AST-generic for stackalloc arrays by @maciejpirog in #430
* Set windows runner image to 2022 by @dimitris-m in #435
### Improvements
* Cancel taint on no sinks or sources by @maciejpirog in #433
* Emit a warning when a rule gets deduped because of shared rule-id by @maciejpirog in #420
* Remove unused field `id_info_id` from `id_info` by @maciejpirog in #423
### Documentation
* Add `timeout` rule option in OPENGREP.md by @dimitris-m in #424
* Improve OPENGREP.md text by @dimitris-m in #427
### Tech debt
* Remove Semgrep's changelog folder by @dimitris-m in #428
#### Notes
* Version 1.10.1 (#434) intentionally skipped.
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.10.0...v1.10.2
## [1.10.0](https://github.com/opengrep/opengrep/releases/tag/v1.10.0) - 07-09-2025
### New features
* Add `timeout` rule option and fix dynamic timeout parameter passing by @dimitris-m in #421
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.9.1...v1.10.0
## [1.9.1](https://github.com/opengrep/opengrep/releases/tag/v1.9.1) - 04-09-2025
### Bug fixes
* Fix: add docs for dynamic timeout cli parameters by @dimitris-m in #415
* Fix #416: add dynamic timeout params to `ci` command by @dimitris-m and @maciejpirog in #418
### Documentation
* Add OPENGREP.md by @maciejpirog in #417
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.9.0...v1.9.1
## [1.9.0](https://github.com/opengrep/opengrep/releases/tag/v1.9.0) - 03-09-2025
### New features
* Make timeouts dynamic based on file size by @dimitris-m and @maciejpirog in #413
* Kotlin: Enable taint tracking through scope functions (`let`, `also`, `use`, `takeIf`, `takeUnless`) by @fxbru in #332
### Bug fixes
* Fix comparison of tokens and locations by @maciejpirog in #408
* Direct implementation of is_metavar_name and `is_metavar_ellipsis`, not via memoized regex by @maciejpirog in #409
* Kotlin: change reference to semgrep in error message by @dimitris-m in #411
* Scala: Make metavariables in interpolated strings match both string segments and embedded expressions by @maciejpirog in #412
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.8...v1.9.0
## [1.8.8](https://github.com/opengrep/opengrep/releases/tag/v1.8.8) - 29-08-2025
### Bug fixes
* Scala: Support metavars as elements in interpolated strings by @maciejpirog in #403
* Fix: reset memoisation hashtables when performing a baseline scan by @dimitris-m in #404
* Fix: pin ppxlib to 0.35.0 by @dimitris-m in #406
#### Notes
* Version 1.8.7 (#405) intentionally skipped.
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.6...v1.8.8
## [1.8.6](https://github.com/opengrep/opengrep/releases/tag/v1.8.6) - 21-08-2025
### Bug fixes
* Fix naming in the presence of typed patterns in typescript by @corneliuhoffman in #395
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.5...v1.8.6
## [1.8.5](https://github.com/opengrep/opengrep/releases/tag/v1.8.5) - 18-08-2025
### Bug fixes
* Fix: install script `sed` call should be posix-compliant by @dimitris-m in #390
* Make C/C++ parser more lenient by @maciejpirog @dimitris-m @corneliuhoffman in #393
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.4...v1.8.5
## [1.8.4](https://github.com/opengrep/opengrep/releases/tag/v1.8.4) - 12-08-2025
### Bug fixes
* Typescript lambda bug by @corneliuhoffman in #378
* When comparing locations, compare only selected fields by @maciejpirog in #379
* Make entropy data non-lazy by @maciejpirog in #383
* Check Cosign version in install script by @dimitris-m in #384
* Fix failure in to-ast-generic for C and C++ by @maciejpirog in #385
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.3...v1.8.4
## [1.8.3](https://github.com/opengrep/opengrep/releases/tag/v1.8.3) - 31-07-2025
### Bug fixes
* The option `max_match_per_file` now works with `--test` by @dimitris-m in #374
* Inline metavars in incremental json output by @dimitris-m in #375
### Improvements
* Performance improvements by @maciejpirog and @dimitris-m in #369, #372, #373, #376
* Make `--experimental` bypass the executable name by @dimitris-m in https://github.com/opengrep/opengrep/pull/370
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.2...v1.8.3
## [1.8.2](https://github.com/opengrep/opengrep/releases/tag/v1.8.2) - 25-07-2025
### Bug fixes
* Fix bug in propagating taints through composites and dictionaries by @corneliuhoffman in #367
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.1...v1.8.2
## [1.8.1](https://github.com/opengrep/opengrep/releases/tag/v1.8.1) - 24-07-2025
### Bug fixes
* Fix thread-safety bug in Apex parser by @maciejpirog in #365
* Improve deduplication and sorting of results to remove nondetermism by @maciejpirog in #364
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.8.0...v1.8.1
## [1.8.0](https://github.com/opengrep/opengrep/releases/tag/v1.8.0) - 23-07-2025
### New features
* Add new rule option `max-match-per-file` by @dimitris-m in #359 and #357
* Add new rule option `taint-fixpoint-timeout` by @dimitris-m in #360
* Release opengrep-core by @spotdemo4 in #349
### Bug fixes
* For variables, calculate the range in the `extra` section using the original token by @maciejpirog in #356
### Tech debt
* Eliminated references in `AST_to_IL` by @corneliuhoffman in #351
* Eliminated more references by @corneliuhoffman in #358
### New Contributors
* @spotdemo4 made their first contribution in #349
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.7.0...v1.8.0
## [1.7.0](https://github.com/opengrep/opengrep/releases/tag/v1.7.0) - 14-07-2025
### New features
* Add support for Apex by @maciejpirog in #337
### Improvements
* Kotlin: enable taint tracking through the Elvis operator (`?:`) by @fxbru in #334
* Elixir: add `defp` private functions by @dimitris-m in #346
### Bug fixes
* Fix: ensure we fallback to python for `ci` by @dimitris-m in #345
* Remove metrics in the bench command by @corneliuhoffman in #352
* Cleanup metrics and settings related code on the Python CLI by @dimitris-m in #342
### Tech debt
* Refactor: remove duplicate `metavar_string_of_any` by @dimitris-m in #344
### New Contributors
* @fxbru made their first contribution in #334
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.6.0...v1.7.0
## [1.6.0](https://github.com/opengrep/opengrep/releases/tag/v1.6.0) - 10-07-2025
### Removed features
* Remove semgrep-specific functionality including the `--metrics` parameter by @dimitris-m in #329 and #336
### Improvements
* Ensure that python has the expected version in the manylinux binary by @dimitris-m in #322
* Make tests invariant to version by @dimitris-m in #325
* Align --profile table output by @dimitris-m in #327
### Bug fixes
* Fix: install script flow for cosign by @dimitris-m in #321
* Improve Ruby tainting by @corneliuhoffman in #324
* Fix baseline scan when using --experimental by @dimitris-m in #326
* Fix: pin memprof-limits by @dimitris-m in #328
* fix: detect musl in install script by @securityPirate in #330
* Ensure fingerprint is unique by @dimitris-m in #338
### New Contributors
* @securityPirate made their first contribution in #330
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.5.0...v1.6.0
## [1.5.0](https://github.com/opengrep/opengrep/releases/tag/v1.5.0) - 03-07-2025
### New features
* Binary install script for Mac OSX and Linux by @Gable-github in #294 with improvements by @dimitris-m in #309
* Optionally expand metavariables in output metadata using `--inline-metavariables` by @corneliuhoffman in #310
### Improvements
* Build self-contained binaries using Nuitka by @dimitris-m in #311
* Add Cosign signing of binaries by @corneliuhoffman in #315
* Associate Containerfiles with the dockerfile language by @chrisnovakovic in #314
* Add match and enum in the primary PHP parser by @corneliuhoffman in #306
### Bug fixes
* Fix a segfault: replace pcre with pcre2 in Eval_generic by @dimitris-m in #308
* Create _opam in container when no GHA cache hit by @dimitris-m in #318
* Windows: fix settings.yml permission issue by @dimitris-m in #319
### Tech debt
* Remove opentelemetry and curl dependencies by @dimitris-m in #317
### New Contributors
* @Gable-github made their first contribution in #294
* @chrisnovakovic made their first contribution in #314
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.4.2...v1.5.0
## [1.4.2](https://github.com/opengrep/opengrep/releases/tag/v1.4.2) - 23-06-2025
### Bug fixes
* Fix #291: cwd can begin with lowecase drive letter on windows by @dimitris-m in #300
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.4.1...v1.4.2
## [1.4.1](https://github.com/opengrep/opengrep/releases/tag/v1.4.1) - 16-06-2025
### Bug fixes
* Fix #295: PHP interpolated strings parsed as normal strings by @corneliuhoffman in #296
### New Contributors
* @corneliuhoffman made their first contribution in #296
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.4.0...v1.4.1
## [1.4.0](https://github.com/opengrep/opengrep/releases/tag/v1.4.0) - 09-06-2025
### New features
* Add new `--semgrepignore-filename` flag by @tom-paz in #288
### Improvements
* Static linking for Mac OSX by @dimitris-m in #279
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.3.1...v1.4.0
## [1.3.1](https://github.com/opengrep/opengrep/releases/tag/v1.3.1) - 03-06-2025
### Bug fixes
* Adjust paths on windows: ensure that tagets in WSL can be scanned by @dimitris-m in #280
* Bump alpine image for aarch64 build by @dimitris-m in #281
### Improvements
* Reorder fields in classes for name resolution and constant propagation by @maciejpirog in #277
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.3.0...v1.3.1
## [1.3.0](https://github.com/opengrep/opengrep/releases/tag/v1.3.0) - 27-05-2025
### New features
* New `--force-exclude` flag: apply `--exclude` on file targets by @dimitris-m in #270
* New `--incremental-output-postprocess` flag: enable post-processing (autofix, nosem) for incremental output by @dimitris-m in #274
### Bug fixes
* Fix autofix in javascript template strings by @dimitris-m in #255
* Fix: --opengrep-ignore-pattern declared twice in python cli by @maciejpirog in #260
* Fix opengrep ignore pattern by @dimitris-m in #265
* Bug: name resolution in blocks by @maciejpirog in #268
* Adjust ranges of parenthesized expressions in Java by @maciejpirog in #258
* Fix ranges of parenthesized expressions in C# by @maciejpirog in #271
* Fix parenthesized expressions in Rust by @maciejpirog in #273
* Fix ranges of of parenthesized expressions in Kotlin by @maciejpirog in #275
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.2.2...v1.3.0
## [1.2.2](https://github.com/opengrep/opengrep/releases/tag/v1.2.2) - 12-05-2025
### Bug fixes
* Fix #112: combine consecutive strings in templates by @dimitris-m in #245
* Fix #249: synchronised incremental outputs by @dimitris-m in #251
### Improvements
* Pull performance fixes from semgrep by @maciejpirog in #248
* Add script to compare running time of two executables by @maciejpirog in #247
* Remove search for proprietary binary by @dimitris-m in #252
* Adapt version bump script by @dimitris-m in #253
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.2.1...v1.2.2
## [1.2.1](https://github.com/opengrep/opengrep/releases/tag/v1.2.1) - 02-05-2025
### Bug fixes
* Fix #241: missing `opengrep_ignore_pattern` in CI command by @dimitris-m in #242
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.2.0...v1.2.1
## [1.2.0](https://github.com/opengrep/opengrep/releases/tag/v1.2.0) - 01-05-2025
### New features
* Allow multiple targets in the test command by @maciejpirog in #238
* Add custom ignore pattern support for code comments by @tom-paz in #216 with improvements by @maciejpirog in #232: this adds a new command-line flag `--opengrep-ignore-pattern=VAL` that lets users specify a custom ignore pattern that will override the default ones
### Improvements
* Update .semgrepignore with latest from Semgrep by @dimitris-m in #225
* Adapt perf benchmarks in #223 and add new script to compare performance in #226 and #234 by @maciejpirog
### Bug fixes
* Fix for issue #92: relax C# parser which previously led to some code not being scanned by @dimitris-m in #231 and #239
* Windows: add two missing DLLs by @dimitris-m in #236
* Show more enclosing context information when focusing on a metavar by @maciejpirog in #233
## New Contributors
* @tom-paz from Kodem Security made his first contribution in https://github.com/opengrep/opengrep/pull/216
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.5...v1.2.0
## [1.1.5](https://github.com/opengrep/opengrep/releases/tag/v1.1.5) - 18-04-2025
### Improvements
* Performance improvements by @maciejpirog and @dimitris-m in #221
* Add workflows for Intel Mac by @dimitris-m in #219
### Bug fixes
* Ensure that `min-version:` in rules is respected by @dimitris-m in #220
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.4...v1.1.5
## [1.1.4](https://github.com/opengrep/opengrep/releases/tag/v1.1.4) - 14-04-2025
### Improvements
* PHP: Add arrow functions to the menhir parser by @maciejpirog in #205
### Bug fixes
* Fix logging mutex by @dimitris-m and @maciejpirog in #208
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.3...v1.1.4
## [1.1.3](https://github.com/opengrep/opengrep/releases/tag/v1.1.3) - 10-04-2025
### Improvements
* Fix string templates in Kotlin by @maciejpirog in #191
* Add union types to PHP menhir parser by @maciejpirog in #201
### Bug fixes
* Fix: .semgrepignore not working on windows when path is not relative by @dimitris-m in #194
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.2...v1.1.3
## [1.1.2](https://github.com/opengrep/opengrep/releases/tag/v1.1.2) - 02-04-2025
### Improvements
* Fix string literals in parser for C# by @maciejpirog in #186
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.1...v1.1.2
## [1.1.1](https://github.com/opengrep/opengrep/releases/tag/v1.1.1) - 31-03-2025
### Bug fixes
* Elixir: allow pairs to be ellipsis by @dimitris-m in #181; now patterns such as `%{..., some_item: $V, ...}` work as expected.
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.1.0...v1.1.1
## [1.1.0](https://github.com/opengrep/opengrep/releases/tag/v1.1.0) - 31-03-2025
### New features
* Add support for reporting enclosure of matches by @maciejpirog in #169 and #178
* Resurrection of Elixir by @mbacarella and @dimitris-m in #150
### Details
There's now a new flag `--output-enclosing-context` that can be added to the `scan` command, adding information about the surrounding context of the matched fragments of code, such as the innermost function and/or class in which the match occurs.
This is only available for json output, so the `--json`flag must also be passed, and it's an experimental feature so it also requires `--experimental`.
Elixir support has been restored and will continue to be improved.
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.0.2...v1.1.0
## [1.0.2](https://github.com/opengrep/opengrep/releases/tag/v1.0.2) - 24-03-2025
### Improvements
* Produce aarch64 linux binaries by @dimitris-m in #171
* Use opengrep's fork of semgrep-interfaces by @maciejpirog in #168
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.0.1...v1.0.2
## [1.0.1](https://github.com/opengrep/opengrep/releases/tag/v1.0.1) - 19-03-2025
### Bug fixes
- Fix tree-sitter parsers for lisp, clojure and terraform in #166
- Pass jobs parameter to scan with --test in #164
### Improvements
- Pin Github actions to commit SHA in #162 and #163
### Contributors
@dimitris-m
**Full Changelog**: https://github.com/opengrep/opengrep/compare/v1.0.0...v1.0.1
## [1.0.0](https://github.com/opengrep/opengrep/releases/tag/v1.0.0) - 18-03-2025
### Highlights
- Windows support is now in beta, without any restrictions and with full parallelism enabled.
- Self-contained binaries for x86 Linux, arm64 Mac and x86 Windows.
- SARIF output has been re-enabled.
- Fingerprint and metavars fields are exposed again.
### Improvements
- Transitioned to OCaml 5.3.0, making use of the new multicore features.
- Timeouts and memory limits have been re-implemented and now they also work on Windows.
- Reduced memory footprint thanks to several optimisations.
### Contributors
@dimitris-m @mbacarella @madelinelawren @pritchyspritch @nir-valtman @maciejpirog @jesse-merhi @hansott @Kirill89 @HenriqueOCabral @willem-delbare