Skip to content

v0.3.1 — Opengrep as drop-in SAST engine

Choose a tag to compare

View all tags
@give-jd give-jd released this 10 Jul 18:00
v0.3.1
90b525c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds Opengrep (https://opengrep.dev), the LGPL community fork of the semgrep engine, as an automatic SAST fallback when semgrep is not on PATH.

  • Drop-in compatible with the bundled ruleset and SARIF 2.1.0 output — verified to produce identical findings to semgrep on the test project
  • Gives a fully open-source (MIT/LGPL) toolchain independent of Semgrep's relicensed CLI
  • Not vendored (42MB binary); LC_ALL=C.UTF-8 forced (opengrep's config reader requires a UTF-8 locale)

Patch release: additive fallback, no breaking changes.

Assets 2
Loading