build(deps): bump semgrep from 1.14.0 to 1.15.0

[dependabot]

Bumps semgrep from 1.14.0 to 1.15.0.

Release notes

Sourced from semgrep's releases.

Release v1.15.0

1.15.0 - 2023-03-15

Added

• On full sca scans with dep search feature on, send dependency data for dep search (depsearch)

• metavariable-comparison: Added support for bitwise operators ~, &, | and ^. (gh-7284)

• Taint: pattern-propagators now have optional fields requires and label, which are used identically to their counterparts in pattern-sources and pattern-sinks, for the experimental taint labels feature.

  For instance, we can define:

  pattern-propagators:
    - pattern: |
        $TO.foo($FROM)
      from: $FROM
      to: $TO
      requires: A
      replace-labels: [A, C]
      label: B
  

  to denote a propagator which only propagates from $FROM to $TO if $FROM has taint label A. In addition, it converts any taints from $TO with labels A or C to have label B.

  If label is not specified, the to is tainted with the same label of taint that $FROM has. If requires is not specified, it does not require $FROM to have a particular label of taint.

  Additionally, replace-labels only restricts the label being propagated if the output label is specified. (pa-1633)

• taint-mode: Java: Support for basic field sensitivity via getters and setters. Given obj.setX(tainted), Semgrep will identify that a subsequent obj.getX() carries the same taint as tainted. It will also differentiate between obj.getX() and obj.getY(). Note that Semgrep does not examine the definitions for the getter or setter methods, and it does not know whether e.g. some other method obj.clearX() clears the taint that obj.setX(tainted) adds. (pa-2585)

• Pro Engine: Semgrep CLI will now download a version of Semgrep Pro Engine compatible with the current version of Semgrep CLI, as opposed to the most recently released version.

  This behavior is only supported for Semgrep 1.12.1 and later. Previous versions will still download the most recently released version, as before. (pa-2595)

Changed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.15.0 - 2023-03-15

Added

• On full sca scans with dep search feature on, send dependency data for dep search (depsearch)

• metavariable-comparison: Added support for bitwise operators ~, &, | and ^. (gh-7284)

• Taint: pattern-propagators now have optional fields requires and label, which are used identically to their counterparts in pattern-sources and pattern-sinks, for the experimental taint labels feature.

  For instance, we can define:

  pattern-propagators:
    - pattern: |
        $TO.foo($FROM)
      from: $FROM
      to: $TO
      requires: A
      replace-labels: [A, C]
      label: B
  

  to denote a propagator which only propagates from $FROM to $TO if $FROM has taint label A. In addition, it converts any taints from $TO with labels A or C to have label B.

  If label is not specified, the to is tainted with the same label of taint that $FROM has. If requires is not specified, it does not require $FROM to have a particular label of taint.

  Additionally, replace-labels only restricts the label being propagated if the output label is specified. (pa-1633)

• taint-mode: Java: Support for basic field sensitivity via getters and setters. Given obj.setX(tainted), Semgrep will identify that a subsequent obj.getX() carries the same taint as tainted. It will also differentiate between obj.getX() and obj.getY(). Note that Semgrep does not examine the definitions for the getter or setter methods, and it does not know whether e.g. some other method obj.clearX() clears the taint that obj.setX(tainted) adds. (pa-2585)

• Pro Engine: Semgrep CLI will now download a version of Semgrep Pro Engine compatible with the current version of Semgrep CLI, as opposed to the most recently released version.

  This behavior is only supported for Semgrep 1.12.1 and later. Previous versions will still download the most recently released version, as before. (pa-2595)

Changed

• Pro: semgrep ci will run intrafile interprocedural taint analysis by default in differential scans (aka PR scans). (Note that interfile analysis is not run

... (truncated)

Commits

• eb62e4e chore: Bump version to 1.15.0
• 28ca802 docker: Remove custom entrypoint (#7334)
• 905e22d fix the getting started link in the readme file (#7339)
• d1e9c53 Make image urls absolute and make them clickable (#7337)
• 5d9985d add: necessary changes for dependency search (#7319)
• 3004151 Add changes to readme (#7298)
• 61d8f9e Update changelog for #7294 (#7333)
• f8ecafd fix(SSC): Fix maven comparison bug (#7307)
• ae5bf2a Perf: update to 1.14.0 instead of 0.122.0 for baseline (#7329)
• 768ddcf Update to latest semgrep-interface (#7328)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codeclimate]

Code Climate has analyzed commit 51b0986 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 65.3% (0.0% change).

View more on Code Climate.

[chyccs]

@dependabot squash and merge