chore(deps-dev): bump semgrep from 1.128.1 to 1.130.0

[dependabot]

Bumps semgrep from 1.128.1 to 1.130.0.

Release notes

Sourced from semgrep's releases.

Release v1.130.0

1.130.0 - 2025-07-23

Fixed

• Fix the Python parser to correctly handle and parse valid structural dictionary patterns. (gh-11100)

Changelog

Sourced from semgrep's changelog.

1.130.0 - 2025-07-23

Fixed

• Fix the Python parser to correctly handle and parse valid structural dictionary patterns. (gh-11100)

1.129.0 - 2025-07-17

Added

• A warning is now printed for each exclude or include pattern found in rules that is considered ambiguous (paths.exclude, paths.include).

  Currently, a pattern that contains a middle slash such as src/*.c is considered floating or unanchored by our implementation. In order to be compliant with Gitignore and Semgrepignore, src/*.c should be treated as anchored. Since many programmers are unaware of this subtlety in the Gitignore specification, Semgrep now prints a warning asking the user to lift the ambiguity. A user will now be asked to change their pattern src/*.c into either /src/*.c (anchored) or **/src/*.c (floating). This clarifies the expected behavior for readers of Semgrep rules and will avoid problems when Semgrep rules adopt the Gitignore/Semgrepignore behavior. (rule-paths-middle-slash-patterns)

• Secrets: Validation for AWS credentials which failed due to possibly transient reasons is now retried (3 attempts max). (scrt-917)

Fixed

• When running semgrep scan in a docker container without an argument and no target project was mounted under /src, instead of a silent exit with code 2, a helpful error message is now printed before exiting. (docker-mount-error)
• In-rule path filters (paths.exclude, paths.include) now apply to normalized file paths relative to the project root. This makes rule selection independent from the current work folder. Patterns with a leading slash such as /src are now anchored instead of being floating. For example, exclude: [ "/src" ] will exclude the target file src/main.c but no longer excludes misc/src/main.c. (rule-paths-leading-slash-patterns)
• Fixed a bug where a Unix.Unix_error would occasionally crash the experimental language server on startup. (saf-2133)
• CLI: Only log a sample of the response from the get_targets endpoint. Previously, scanning large repos with the debug flag significantly ballooned the size of the output log. (saf-2145)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 Changelog requirements

Wonderful, this rule succeeded.

• any of:
  • -title ~= ^feat
  • label = need changelog
  • label = skip changelog

🟢 Enforce conventional commit

Wonderful, this rule succeeded.

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?:

🟢 🔎 Reviews

Wonderful, this rule succeeded.

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0