Semgrep v1.167.0: Binary File Skipping & Constant Propagation

TL;DR

  • Semgrep now skips binary files by default, boosting scan performance.
  • Enhanced constant propagation supports more operators for precise analysis.
  • New nosemgrep_disabled field allows org-wide control over inline ignore comments.

Key Changes

Semgrep v1.167.0, released on 2026-06-17, introduces several enhancements focused on performance and analysis accuracy. For full details, refer to the official release notes.

Added

  • Improved Constant Propagation: The engine now supports a wider range of operators for constant propagation, including subtraction, division, bitwise operations, bit shifts, and comparisons. This leads to more accurate data flow analysis.
  • Org-Wide nosemgrep Control: A new nosemgrep_disabled field in the scan configuration allows platforms to globally disable nosemgrep inline ignore comments for specific scans.
  • Default Binary File Skipping: Semgrep now automatically skips binary files (e.g., images, archives, compiled executables) during scans, detected via file extensions and magic bytes. This significantly improves scan speed. To scan binary files, use the --no-exclude-binary-files flag.

Fixed

  • SARIF Output Accuracy: The semgrep ci command with --sarif now correctly populates the ignores field with nosemgrep-suppressed findings, aligning with other output formats.

Infra/Release Changes

  • Tree-sitter Core Update: The ocaml-tree-sitter-core submodule has been updated, bringing improved thread-safety and bumping the internal Tree-sitter CLI option from 0.20.6 to 0.20.8.

Impact for QA Teams

QA teams will experience faster static analysis scans due to the default skipping of binary files. The enhanced constant propagation improves the precision of security and quality findings, reducing false positives and negatives. The ability to centrally disable nosemgrep comments offers greater control over compliance and policy enforcement, while improved SARIF output ensures consistent reporting for suppressed findings.

FAQ

  • Q: What is the primary performance gain in this update?
    • A: Semgrep now skips binary files by default, which significantly reduces scan time on repositories containing many non-source code assets.
  • Q: How does improved constant propagation benefit analysis?
    • A: It allows Semgrep to track data flow more accurately, leading to more precise detection of vulnerabilities and code quality issues.
  • Q: Can nosemgrep inline comments be ignored globally?
    • A: Yes, the new nosemgrep_disabled field in the scan configuration allows platforms to disable these comments org-wide.