December 2024 Summaries

Semgrep has rebranded its open-source tool Semgrep OSS to Semgrep Community Edition to emphasize its free, community-centric nature while differentiating it from commercial offerings. The rebranding includes a new licensing model, the Semgrep Rules License v.1.0, restricting the use of Semgrep-maintained rules to internal, non-competing contexts, impacting vendors using these rules in competing products or SaaS offerings. The tool remains free, with over 2,800 rules and is aimed at individuals and security professionals needing quick scans, whereas AppSec teams are directed to the Semgrep AppSec Platform for scalable solutions. Additionally, certain internal fields in JSON and SARIF outputs and experimental features are being transitioned to the logged-in commercial engine. Semgrep is committed to balancing its commercial growth with community support, providing a grace period until January 31, 2025, for vendors to adjust their usage, and welcomes feedback to ensure a successful transition.

Dependency Graph, introduced by Semgrep, is a new technology designed to enhance the security and efficiency of managing software supply chains by providing a clearer understanding of both direct and transitive dependencies. This tool addresses the challenges posed by hidden vulnerabilities within transitive dependencies, which are often difficult to prioritize and remediate due to complex dependency interrelations. By minimizing reliance on lockfile scans and introducing the Dependency Path feature, Semgrep enables AppSec teams to visualize and navigate these dependencies more effectively, helping them identify and address vulnerabilities with reduced effort. This approach not only improves visibility and risk management but also adapts to diverse real-world scenarios, even when lockfiles are unavailable or inconsistent. As a result, AppSec engineers are empowered to automate parts of the vulnerability triage process, prioritize remediation efforts based on the depth and complexity of dependency paths, and focus on reducing risk and enhancing security guardrails within their software projects. The Dependency Graph is now available in public beta, with plans for future expansion to support additional programming languages.

Semgrep Supply Chain has expanded its dataflow reachability coverage to include Scala and Swift, enhancing its support to a total of 10 languages and significantly reducing false positives, which saves developers time by focusing on critical security risks. This positions Semgrep Supply Chain as a leader in reachability coverage, offering both breadth and depth in identifying how libraries are used and assessing potential vulnerabilities. Scala, a popular functional programming language, benefits from running on the Java Virtual Machine despite inheriting some vulnerabilities, while Swift, known for developing mobile applications, faces issues from open-source dependencies. Semgrep ensures comprehensive rule coverage for critical vulnerabilities in both languages and plans to continue expanding its language support based on customer feedback and global language trends. The company emphasizes its commitment to covering historical vulnerabilities and maintaining robust partnerships with customers to address evolving needs. Users are encouraged to explore the enhanced reachability features and provide feedback on their experience.