# Semgrep: Dynamic Maven & Gradle dependency resolution impaired

- Impact (vendor’s label): none
- Status: resolved
- Started: 2026-09-01 22:50 UTC · Resolved: 2026-09-03 00:10 UTC · Duration: 25 h
- Updates: 4 · Affected components: Managed Scans, semgrep.dev - Managed Scans
- [Vendor status page: https://stspg.io/043kszj1qkzw](https://stspg.io/043kszj1qkzw)
- [Company: Semgrep](https://rewindex.com/company/semgrep.md)

## Timeline of updates

- **identified** 2026-09-01 22:50 UTC: A small number (\<1%) of supply chain scans that dynamically resolve dependencies for gradle and maven projects have been failing since August 28, due to rate limiting applied by a public package registry. Affected projects may show incomplete or missing Supply Chain findings. We are rolling out a caching mirror to reduce the impact of these rate limits. Subsequent scheduled scans should resolve any impacted findings. No further action from customers is required at this time.
- **identified** 2026-09-01 22:55 UTC: Under one percent of supply chain scans that dynamically resolve dependencies for gradle and maven projects have been failing, due to rate limiting applied by a third-party package registry. Affected projects may show incomplete or missing Supply Chain findings. We are rolling out a caching mirror to reduce the impact of these rate limits. Subsequent scheduled scans should resolve any impacted findings. No further action from customers is required at this time
- **monitoring** 2026-09-02 16:25 UTC: The third party registry's rate limits have been lifted, and impact to scans appears mitigated.
- **resolved** 2026-09-03 00:10 UTC: Dynamic maven & gradle scans are now operating as normal.


---
Canonical: https://rewindex.com/company/semgrep/incidents/9djnmfbxt2nn · Markdown: https://rewindex.com/company/semgrep/incidents/9djnmfbxt2nn.md · JSON: https://rewindex.com/api/v1/companies/semgrep/incidents/9djnmfbxt2nn · Generated 2026-10-18T11:27:42.834Z