Semgrep v1.166.0: Gosu Interfile Analysis & Performance Boosts

TL;DR

  • Experimental cross-file analysis for Gosu (Pro feature).
  • Expanded constant propagation for improved static analysis.
  • Key fixes for Python parsing and semgrep ci stability.

Key Changes

Semgrep v1.166.0, released on 2026-06-11, focuses on performance and security enhancements. For the full details, refer to the official release notes.

New Features:

  • Gosu Interfile Analysis (Pro): Introduces experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)
  • Enhanced Constant Propagation: Adds support for more operators in constant propagation, including subtraction, division, bit operations, bit shifts, and comparisons, improving analysis precision.

Fixes:

  • Parsing Improvements: Corrected parsing of integer literals with underscores after radix prefixes (e.g., 0x_dead_beef). Python parsing now preserves type parameters on def and class definitions.
  • Security: Semgrep no longer stores API tokens supplied via the SEMGREP_APP_TOKEN environment variable in ~/.semgrep/settings.yml.
  • CI Stability: Resolved semgrep ci failures originating from pre-commit hooks related to Unable to create '<tmp>/.git/index.lock' errors.

Impact for QA Teams

QA teams will benefit from more accurate static analysis, particularly for Gosu applications, and increased reliability of semgrep ci within pre-commit workflows. The enhanced constant propagation helps identify more potential issues earlier in the development cycle.