Opengrep v1.27.0 released

Opengrep is the open-source, community-driven SAST engine forked from Semgrep, offering inter-procedural and cross-file analysis with SARIF/JSON output.

v1.27.0 adds remote rule loading via --config git+<url>, honors OPENGREP_* environment variables alongside the legacy SEMGREP_* ones, and brings PHP and Dockerfile parsing fixes.

Language Support:
- JS/TS: Taint ..rest of object in destructuring
- ast-to-il: bind the variables of destructuring declarations
- PHP: Readonly properties + promoted properties
- Dockerfile: Fix parsing of square brackets

Improvements:
- Load rules from a remote git repository via --config git+<url>
- Honor OPENGREP_* environment variables alongside legacy SEMGREP_*
- Added osemgrep output flag support

Bug Fixes:
- opengrep-cli: output destination fixes
- opengrep-cli: fix the blocking-findings count in compiled ci builds

Binaries:
- windows: ship only the DLLs opengrep-core links against
- Updated Nuitka from 2.8.9 to 4.1.3 with onefile extra

CI:
- ci: reject merge commits on PR branches

Contributors: maciejpirog, corneliuhoffman, dimitris-m, mspraggs

Full release notes: github.com/opengrep/opengrep/releases/tag/v1.27.0

• News
• Tools