Bump semgrep from 1.85.0 to 1.94.0

[dependabot]

Bumps semgrep from 1.85.0 to 1.94.0.

Release notes

Sourced from semgrep's releases.

Release v1.94.0

1.94.0 - 2024-10-30

Fixed

• pro: taint-mode: Semgrep should no longer confuse a return in a lambda with a return in its enclosing function.

  E.g. In the example below the return value of foo is NOT tainted:

  function foo() {
      bar(() => taint);
      return ok;
  } (code-7657)
  

• OCaml: matching will now recognized "local open" so that a pattern like Foo.bar ... will now correctly match code such as let open Foo in bar 1 or Foo.(bar 1) in addition to the classic Foo.bar 1. (local_open)

• Project files lacking sufficient read permissions are now skipped gracefully by semgrep. (saf-1598)

• Semgrep will now print stderr and additional debugging info when semgrep-core exits with a fatal error code but still returns a json repsonse (finishes scanning) (saf-1672)

• semgrep ci should parse correctly git logs to compute the set of contributors even if some authors have special characters in their names. (saf-1681)

Release v1.93.0

1.93.0 - 2024-10-23

Added

• Improved naming for Common JS module imports (require) in arbitrary expression contexts. Notably, in-line use of require should now be linked to the correct module. For instance, the pattern foo.bar should now match against require('foo').bar and taint is likewise similarily tracked. (code-7485)
• Secrets: semgrep ci output now includes a list of all secrets rules which generated at least one blocking finding (similar to Code) (code-7663)
• Added experimental support via --allow-dynamic-dependency-resolution for dynamic resolution of Maven and Gradle dependencies for projects that do not have lockfiles (in Semgrep Pro only). (gh-2389)
• Expanded support for pip requirement lockfiles is now available by default. Semgrep will now find any requirement.txt file and lockfiles in a requirements folder (**/requirements/*.txt). The existing experimental flag --enable-experimental-requirements is now deprecated and will be removed in a future release. (gh-2441)

Changed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.94.0 - 2024-10-30

Fixed

• pro: taint-mode: Semgrep should no longer confuse a return in a lambda with a return in its enclosing function.

  E.g. In the example below the return value of foo is NOT tainted:

  function foo() {
      bar(() => taint);
      return ok;
  } (code-7657)
  

• OCaml: matching will now recognized "local open" so that a pattern like Foo.bar ... will now correctly match code such as let open Foo in bar 1 or Foo.(bar 1) in addition to the classic Foo.bar 1. (local_open)

• Project files lacking sufficient read permissions are now skipped gracefully by semgrep. (saf-1598)

• Semgrep will now print stderr and additional debugging info when semgrep-core exits with a fatal error code but still returns a json repsonse (finishes scanning) (saf-1672)

• semgrep ci should parse correctly git logs to compute the set of contributors even if some authors have special characters in their names. (saf-1681)

1.93.0 - 2024-10-23

Added

• Improved naming for Common JS module imports (require) in arbitrary expression contexts. Notably, in-line use of require should now be linked to the correct module. For instance, the pattern foo.bar should now match against require('foo').bar and taint is likewise similarily tracked. (code-7485)
• Secrets: semgrep ci output now includes a list of all secrets rules which generated at least one blocking finding (similar to Code) (code-7663)
• Added experimental support via --allow-dynamic-dependency-resolution for dynamic resolution of Maven and Gradle dependencies for projects that do not have lockfiles (in Semgrep Pro only). (gh-2389)
• Expanded support for pip requirement lockfiles is now available by default. Semgrep will now find any requirement.txt file and lockfiles in a requirements folder (**/requirements/*.txt). The existing experimental flag --enable-experimental-requirements is now deprecated and will be removed in a future release. (gh-2441)

Changed

• Removed support for Vue. The tree-sitter grammar has not been updated in 3 years,

... (truncated)

Commits

• 429326f chore: release version 1.94.0
• 459dd34semgrep/semgrep-proprietary#2524
• d48d887semgrep/semgrep-proprietary#2523
• 164b7e8semgrep/semgrep-proprietary#2519
• 4c820d1 refactor: Keep lambdas CFGs separate from the enclosing CFG (semgrep/semgrep-...
• 6f38101semgrep/semgrep-proprietary#2503
• cc4eb17 Parse correctly git log for contributions, handle weird chars (semgrep/semgre...
• 25622f6 Log more info for raise Impossible in SubAST_generic.ml (semgrep/semgrep-prop...
• 87faf1d fix: Bump/mirror some pre-commit and pytest stuff from OSS to pro (semgrep/se...
• 1564a1a Skip files and folders lacking read access permissions (semgrep/semgrep-propr...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #185.