Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency semgrep to ~=1.104.0 #737

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 5, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
semgrep ~=1.103.0 -> ~=1.104.0 age adoption passing confidence

Release Notes

returntocorp/semgrep (semgrep)

v1.104.0

Compare Source

Changed
  • Supply chain diff scans now skip resolving dependencies for subprojects without changes. (SC-2026)
Fixed
  • pro: Fixed bug in inter-file matching of subtypes. When looking to match some
    type A, Semgrep will match any type B that is a subtype of A, but in certain
    situations this did not work. (code-7963)

  • taint-mode: Make traces record assignments that transfer taint via shapes.

    For example, in code like:

    B b = new B(taint);
    B b1 = b;
    sink(b1.getTaintedData());
    

    The assignment b1 = b should be recorded in the trace but previously it was not. (code-7966)

  • Python: Parser updated to the most recent tree-sitter grammar.
    Parse rate from 99.8% -> 99.998%. (saf-1810)


Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from thypon as a code owner February 5, 2025 04:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants