Opengrep

The most advanced code security (SAST) engine - fully open-source. No paywall, no login.

[Opengrep @opengrep]

We ship every week. Follow along the public roadmap /opengrep/issues

What's shipped so far:
✅ windows compatibility (beta)
✅ fingerprints & metavariables restored (SARIF & JSON)
✅ desktop app for rule crafting
⏭️ elixir support
⏭️ cross-file analysis
⌛️inter-file...

[Mark Manning @antitree]

Are people still talking about opengrep? I thought that was a silly mistake we laughed at as an industry and went back to Semgrep, no?

[Opengrep @opengrep]

Full changelog:https://t.co/67QposaYA6
We ship every week. Catch you next release 🤝

[Opengrep @opengrep]

❤️‍🔥 Opengrep v1.23.0 is here.

This release adds Crystal support and guarded taint signatures, a more precise algorithm for intrafile taint tracking.

Highlights:
• Experimental support for the Crystal language.

[Opengrep @opengrep]

• Bug fixes: spurious `..` walk-up in Windows reported paths on case-insensitive filesystems; truncated files no longer abort the scan.

[Aikido Security @AikidoSecurity]

https://t.co/jTjM0gKLHb

[Aikido Security @AikidoSecurity]

npm recently introduced staged publishing, and it directly targets the attack pattern behind most of the supply chain compromises we tracked this year.

Instead of npm publish pushing packages live instantly, npm stage publish puts them in a queue. A human with 2FA has to approve, preventing attackers from pushing malicious package versions with stolen tokens

We open-sourced a SAST rule that catches "npm publish" in your GitHub Actions workflows and flags it for migration.

[Opengrep @opengrep]

• A fix for a bug that caused taint to be dropped in some collection functions when using --𝚝𝚊𝚒𝚗𝚝-𝚒𝚗𝚝𝚛𝚊𝚏𝚒𝚕𝚎

Full changelog: https://t.co/TvpwpJ4S2T

We ship every week. Catch you next release 🫡

[Opengrep @opengrep]

🧡 New Opengrep release is here: v1.22.0

Highlights:
• More Dockerfile support improvements, including legacy syntax and BuildKit extensions
• Better support for Go interfaces

[Opengrep @opengrep]

• LSP mode now supports the --𝚝𝚊𝚒𝚗𝚝-𝚒𝚗𝚝𝚛𝚊𝚏𝚒𝚕𝚎 flag  
• Improved the efficiency of pruning with --𝚎𝚡𝚌𝚕𝚞𝚍𝚎 

Full changelog: https://t.co/OyEwMb5bQQ

We ship every week. Catch you next release. 🫡

[Opengrep @opengrep]

✨ New Opengrep release is here: v1.21.0

Highlights:
• Extended Dockerfile syntax support: correct handling of multiline strings, plus support for legacy syntax in 𝙴𝙽𝚅 and 𝙻𝙰𝙱𝙴𝙻  
• Added support in C for GLib macros in variable definitions

[Opengrep @opengrep]

yes, @openclaw uses Opengrep

[Opengrep @opengrep]

• Support for more Elixir features (e.g. "abc" <> x and ^x patterns, 𝚌𝚊𝚜𝚎 expressions)
• Fixes for patterns in function parameters in Clojure

Full changelog: https://t.co/SlBvXxox7t

We ship every week. Catch you next release 🫡

[Opengrep @opengrep]

✨ Opengrep v1.20.0 is out.

Major improvements in this release:
• Improvements in taint analysis involving anonymous functions
• Better support for Structural Pattern Matching in Python

[Opengrep @opengrep]

Full changelogs: https://t.co/Fz32N8mpEB

We ship every week. Catch you next release 🤝

[Opengrep @opengrep]

✨Three new Opengrep releases are out: v1.17.0 → v1.19.0

A lot shipped across these releases, with a strong focus on taint analysis and Elixir support.

[Opengrep @opengrep]

v1.19.0
• Elixir: taint is now traced through 𝚏𝚘𝚛 comprehensions and the |> operator
• Ruby: fix in distinguishing between a variable and a parameterless function call
• Ruby: fix in 𝚘𝚋𝚓[𝚔𝚎𝚢] expressions, now correctly propagating taint