semgrep 1.171.0 on Python PyPI

1.171.0 - 2026-07-22

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

Fixed a source of rare, nondeterministic crashes and incorrect results caused
by an OCaml compiler bug. Semgrep now builds against a compiler fork that
backports the upstream fix. (ocaml_codegen_fix)
Fixed excessive heap growth after explicit major garbage collections. Semgrep
now builds against an OCaml compiler that improves garbage collection duty
cycle pacing. (ocaml_gc_pacing_fix)
Improved the Scan Status output when no code rules will run (e.g. a
Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
confusing "0 Code rules", and the "Code Rules" section now states explicitly
either that code scanning is not enabled or that there are no code rules to run,
instead of printing an empty table. (ENGINE-2878)
Fixed lockfileless Gradle dependency resolution failing with "Parsing
dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
github-dependency-graph-gradle-plugin used during resolution was fetched
unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
now pinned to 1.4.1. (sc-3738)