Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 12, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
semgrep >=1.99,<1.108 -> >=1.109,<1.110 age adoption passing confidence

Release Notes

returntocorp/semgrep (semgrep)

v1.109.0

Compare Source

Changed
  • Pyproject.toml files are now parsed using a toml parser (tomli). (sc-2054)
Fixed
  • pro: taint-mode: Fixed limitation in custom taint propagators.
    See https://semgrep.dev/playground/s/ReJQO (code-7967)
  • taint-mode: Disable symbolic-propagation when matching taint propagators
    to prevent unintended interactions. See https://semgrep.dev/playground/s/7KE0k. (code-8054)
  • Fixed pattern match deduplication to avoid an O(n^2) worst-case complexity, and
    optimized the matching of ordered ..., PAT, ... patterns. (saf-682)

v1.108.0

Compare Source

Added
  • pro: Semgrep can now dynamically resolve dependencies for Python projects using pip, allowing it to determine transitive dependencies automatically. (sc-2069)
Changed
  • Bump base Alpine docker image from 3.19 to 3.21. (alpine-version)
  • The semgrep-appsec-platform specific metadata fields "semgrep.dev:" and
    "semgrep.policy:" are now filtered from the JSON output unless you
    are logged in with the Semgrep appsec platform.
    See https://semgrep.dev/docs/semgrep-appsec-platform/json-and-sarif#json for more information. (metadata-filter)
  • The Semgrep Docker image now uses Python 3.12 (bumped from 3.11). (python-version)
Fixed
  • This PR changes the way we handle failures in git worktree remove more gracefully.
    Instead of erroring, we continue to scan so that the user can still get results, but
    log the error. It also adds a guard so that this failure is less likely to happen
    and will include more debugging information when it does. (sms-521)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/semgrep-1.x branch 3 times, most recently from c4ce38b to 4a5686b Compare February 19, 2025 22:16
@renovate renovate bot changed the title Update dependency semgrep to >=1.108,<1.109 Update dependency semgrep to >=1.109,<1.110 Feb 19, 2025
@renovate renovate bot force-pushed the renovate/semgrep-1.x branch 2 times, most recently from 2763592 to 4ddabf9 Compare February 20, 2025 14:35
@renovate renovate bot force-pushed the renovate/semgrep-1.x branch from 4ddabf9 to b7388b6 Compare February 20, 2025 19:57
@sonarqubecloud
Copy link

@renovate
Copy link
Contributor Author

renovate bot commented Feb 21, 2025

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (>=1.109,<1.110). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/semgrep-1.x branch February 21, 2025 11:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant