Companies / Semgrep / incidents

Semgrep: Dynamic Maven & Gradle dependency resolution impaired

Affected components: Managed Scanssemgrep.dev - Managed Scans

Timeline of updates

1. identified2026-09-01 22:50 UTC

   A small number (<1%) of supply chain scans that dynamically resolve dependencies for gradle and maven projects have been failing since August 28, due to rate limiting applied by a public package registry. Affected projects may show incomplete or missing Supply Chain findings. We are rolling out a caching mirror to reduce the impact of these rate limits. Subsequent scheduled scans should resolve any impacted findings. No further action from customers is required at this time.

2. identified2026-09-01 22:55 UTC

   Under one percent of supply chain scans that dynamically resolve dependencies for gradle and maven projects have been failing, due to rate limiting applied by a third-party package registry. Affected projects may show incomplete or missing Supply Chain findings. We are rolling out a caching mirror to reduce the impact of these rate limits. Subsequent scheduled scans should resolve any impacted findings. No further action from customers is required at this time

3. monitoring2026-09-02 16:25 UTC

   The third party registry's rate limits have been lifted, and impact to scans appears mitigated.

4. resolved2026-09-03 00:10 UTC

   Dynamic maven & gradle scans are now operating as normal.

Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab). Semgrep profile · Recent Semgrep incidents · Markdown · JSON