Issues

• useless-inner-function: false positive when the inner function is only referenced in the context expression of an as-bound with statement

  semgrep/semgrep-rules#4059 · Filter by author roosteer opened on Sep 13, 2026

• hooks-sensitive-file-access-python treats realpath() as a sanitizer

  semgrep/semgrep-rules#4046 · Filter by author wildoranges opened on Aug 21, 2026

• hooks-path-traversal-python treats realpath() and abspath() as complete sanitizers

  semgrep/semgrep-rules#4045 · Filter by author wildoranges opened on Aug 21, 2026

• Path traversal rules treat any replace() call as a sanitizer

  semgrep/semgrep-rules#4044 · Filter by author wildoranges opened on Aug 21, 2026
  1

• Remove insecure-innerhtml.yaml due to duplication with insecure-document-method.yaml

  semgrep/semgrep-rules#4038 · Filter by author lxndrsmrnv0-bit opened on Aug 13, 2026

• p/docker-compose rules fail when obsolete version attribute is omitted

  semgrep/semgrep-rules#4035 · Filter by author webpwnized opened on Jul 30, 2026
  1

• p/docker-compose does not detect service explicitly configured with user: root

  semgrep/semgrep-rules#4036 · Filter by author webpwnized opened on Jul 30, 2026
  2

• Windows Defender flags an intentional reverse-shell test fixture when consuming semgrep-rules on Windows

  semgrep/semgrep-rules#4030 · Filter by author rapointofit opened on Jul 28, 2026

• False positive for java.lang.correctness.eqeq.eqeq

  bug
  semgrep/semgrep-rules#4019 · Filter by author Sjord opened on Jul 27, 2026

• Incorrect suggestion for renovate-missing-minimum-release-age rule

  bug
  semgrep/semgrep-rules#4018 · Filter by author eliashaeussler opened on Jul 27, 2026

• GitHub Actions curl rules parse explicit PowerShell steps as Bash

  semgrep/semgrep-rules#4001 · Filter by author meza opened on Jul 12, 2026
  1

• renovate-missing-minimum-release-age flags packageRules that inherit minimumReleaseAge

  bug
  semgrep/semgrep-rules#3995 · Filter by author janderssonse opened on Jul 9, 2026

• uv-missing-dependency-cooldown fails on config that should pass

  bug
  semgrep/semgrep-rules#3993 · Filter by author jceresini opened on Jul 8, 2026

• [Rule] Unsafe ML model deserialization (torch.load/joblib/dill/numpy allow_pickle) — CWE-502

  semgrep/semgrep-rules#3990 · Filter by author DipesThapa opened on Jul 6, 2026
  1

• no-replaceall is outdated

  bug
  semgrep/semgrep-rules#3984 · Filter by author Sjord opened on Jun 29, 2026

• FP and FNs for documentbuilderfactory-disallow-doctype-decl-missing:

  bug
  semgrep/semgrep-rules#3831 · Filter by author sarr424 opened on Apr 28, 2026

• Proposal: Improve Semgrep Go SQL Injection Detection for query.Get(...) to GORM Raw(...) Flows

  semgrep/semgrep-rules#3826 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep Go Path Traversal Detection for Archive- and Request-Bound Paths

  semgrep/semgrep-rules#3825 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep JavaScript Command Injection Detection for Parameter-Derived exec(...) Commands

  semgrep/semgrep-rules#3824 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep Python Path Traversal Detection for Upload-, Request-, and Parameter-Derived Paths

  semgrep/semgrep-rules#3823 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep Java Open Redirect Detection for Helper-Returned Redirect Targets

  semgrep/semgrep-rules#3822 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep Java Path Traversal Detection for Archive- and Parameter-Derived Paths

  semgrep/semgrep-rules#3821 · Filter by author FORIMOC opened on Apr 27, 2026

• Proposal: Improve Semgrep Go SQL Injection Detection for query.Get(...) to GORM Raw(...) Flows

  semgrep/semgrep-rules#3832 · Filter by author FORIMOC opened on Apr 25, 2026

• Proposal: Improve Semgrep JavaScript Command Injection Detection for Parameter-Derived exec(...) Commands

  semgrep/semgrep-rules#3833 · Filter by author FORIMOC opened on Apr 25, 2026

• Proposal: Improve Semgrep Java Open Redirect Detection for Helper-Returned Redirect Targets

  semgrep/semgrep-rules#3834 · Filter by author FORIMOC opened on Apr 25, 2026