Sourced from semgrep's releases.

Release v1.104.0

1.104.0 - 2025-01-22

Changed

• Supply chain diff scans now skip resolving dependencies for subprojects without changes. (SC-2026)

Fixed

• pro: Fixed bug in inter-file matching of subtypes. When looking to match some type A, Semgrep will match any type B that is a subtype of A, but in certain situations this did not work. (code-7963)

• taint-mode: Make traces record assignments that transfer taint via shapes.

  For example, in code like:

  B b = new B(taint);
  B b1 = b;
  sink(b1.getTaintedData());
  

  The assignment b1 = b should be recorded in the trace but previously it was not. (code-7966)

• Python: Parser updated to the most recent tree-sitter grammar. Parse rate from 99.8% -> 99.998%. (saf-1810)

Sourced from semgrep's changelog.

1.104.0 - 2025-01-22

Changed

• Supply chain diff scans now skip resolving dependencies for subprojects without changes. (SC-2026)

Fixed

• pro: Fixed bug in inter-file matching of subtypes. When looking to match some type A, Semgrep will match any type B that is a subtype of A, but in certain situations this did not work. (code-7963)

• taint-mode: Make traces record assignments that transfer taint via shapes.

  For example, in code like:

  B b = new B(taint);
  B b1 = b;
  sink(b1.getTaintedData());
  

  The assignment b1 = b should be recorded in the trace but previously it was not. (code-7966)

• Python: Parser updated to the most recent tree-sitter grammar. Parse rate from 99.8% -> 99.998%. (saf-1810)

1.103.0 - 2025-01-15

Added

• pro: taint: Support for lambdas as callbacks.

  var tainted = source();
  function withCallback1(val, callback) {
  
  if (val) {
  
  callback(val);
  
  }
  
  }
  withCallback1(tainted, function (val) {
  
  sink(val); // finding !
  
  }); (code-7626)
  
  

• pro: python: Semgrep will now consider top-level lambdas like x below for inter-procedural analysis:

... (truncated)

• c13040c chore: release version 1.104.0
• a9c674fsemgrep/semgrep-proprietary#2920
• fca329c Get rid of ugly Deep_scan_phases.setup_hooks -> with_hooks (semgrep/semgrep-p...
• 44126acsemgrep/semgrep-proprietary#2916
• a552694 chore: add a Pro_scan.mli and convert a few Hooks (semgrep/semgrep-proprietar...
• 6e1c5cc perf(dep-resolution): resolve only changed subproject in diff scans (semgrep/...
• 3e533e1 Change the semgrep-core input type to accommodate scanning roots (semgrep/sem...
• 5d6a247 fix(sca): ocaml parsing should be considered lockfile parsing (semgrep/semgre...
• 35bbe02 docs: tainting: Add refs to note on compare functions (semgrep/semgrep-propri...
• ba4e1b3 feat: support multiple functions in -cfg_ilsemgrep/semgrep-proprietary#2913
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)