chore(deps): update dependency semgrep to v1.153.0#7281
Merged
Conversation
renovate
bot
requested review from
bdovaz,
echoix and
nvuillam
as code owners
Contributor
✅
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.152.0→1.153.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
semgrep/semgrep (semgrep)
v1.153.0Compare Source
### Added
for-yield(LANG-193)### Fixed
be considered at the same scope, e.g.
1.152.0 - 2026-02-17
### Added
Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of
--allow-local-buildsdependency resolution via the environment variableSEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)Memory management policies
A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the
--x-mem-policyCLI flag for the pro engine; this flag is unused inthe OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)
Allows case insensitive string comparisons using lower() and upper() like this:
(gh-11502)
Blocking findings that are outputted in the CI output are now labelled as such. (#4394)
### Changed
is reached. (code-9224)
### Fixed
reduce FPs in some cases. (code-9220)
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)
1.151.0 - 2026-02-04
Added
Fixed
glomto at least version23.3, which includes a fix to aSyntaxWarningwarning log. (gh-11460)
1.150.0 - 2026-01-29
Added
Changed
pipenvtouvfor./clipackage management (uv)Fixed
-alphain1.2.3-alpha. (sc-3001)1.149.0 - 2026-01-21
Added
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Changed
Fixed
the cost of re-hashing
Targetobjects. Performance should improve onlarge repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep cino longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)1.148.0 - 2026-01-14
Added
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)
Fixed
errors should be adequately reported back to users and in the JSON output. (code-9216)
1.147.0 - 2026-01-07
Added
gradle*.lockfileare now supported. Previously, only lockfiles named exactlygradle.lockfilewere supported. (SC-2999)semgrep loginnow supports a--forceflag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use--forcetoo. (saf-2392)Fixed
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)
1.146.0 - 2025-12-17
Added
record-file-editandstop-cli-scansemgrep mcp flags (cursor-hooks)skipped_pathsfield to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)semgrep ci. (sc-2927)Changed
mcppython-sdk from1.16.0to1.23.3(mcp-version)analysis in
semgrep ciregardless of app settings is now possible with--x-enable-transitive-reachability(or--x-tr)and
--x-disable-transitive-reachability. (tr-flags)Fixed
1.145.2 - 2025-12-12
No significant changes.
1.145.1 - 2025-12-11
No significant changes.
1.145.0 - 2025-12-04
Added
Changed
Fixed
let ... inexpressions in OCaml is now reported. Previously, the location of theletwas omitted. This is mainly relevant for autofix. (ocaml-let)Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
1.144.1 - 2025-12-04
Fixed
1.144.0 - 2025-11-19
Fixed
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
1.143.3 - 2025-11-25
No significant changes.
1.143.2 - 2025-11-25
Fixed
1.143.1 - 2025-11-14
Fixed
1.143.0 - 2025-11-12
Added
more instances. (code-9141)
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the
--x-parmapCLI flag, and this deprecates the--x-eioflag (since it is now the default behaviour). (saf-2271)
-k/ --hookflag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)Fixed
semgrep scanorsemgrep ci, the progress bar now always ends at 100%. (SAF-2079)analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
accurately match the () type in a
typedeclaration. (gh-11283)1.142.0 - 2025-10-30
Added
matchexpressions in Scala. In examples liketainttox. (code-9085)case $M -> ... :? ... +& test +& ... => ...patterns. (code-9131)Fixed
--allow-local-buildsis passed. (SC-2899)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.