DEVOPSdigest

Semgrep announced that Semgrep Supply Chain is now free for all to use, up to a 10-contributor limit.

Semgrep Supply Chain scans your dependencies and helps you get rid of the 98% false positives that aren’t reachable within your code (i.e., places that don’t use both a vulnerable dependency and its vulnerable functions). This saves substantial time and was previously exclusively available to paying Team tier customers. All new users now run Supply Chain by default. Existing users need to toggle on Supply Chain in Settings.

Semgrep Code's Team tier features are also available for free for teams of up to 10 monthly contributors. This includes advanced code scanning that looks across file and function boundaries to find vulnerabilities via the Pro Engine and high-confidence Pro rules written by Semgrap's Security Research team.

Additional improvements:

- Semgrep is even faster — set up GitHub.com scanning in a minute, scan on every keystroke in the Semgrep Playground and VS Code.

- Expanded language support for Semgrep Code: Semgrep Pro Engine now supports Go, and Semgrep OSS Engine’s Kotlin support is now generally available. Semgrep also added over 100+ new Pro rules across both languages.

- Private beta of config-less scanning for GitHub.com users to make setting up Semgrep scans faster.