Bump semgrep from 1.78.0 to 1.110.0

[dependabot]

Bumps semgrep from 1.78.0 to 1.110.0.

Release notes

Sourced from semgrep's releases.

Release v1.110.0

1.110.0 - 2025-02-26

Added

• pro: Inter-file analysis will now process Javascript and Typescript files together, so that taint can be tracked across both languages. (code-8076)

• Pro: new metavariable-name operator which allows for expressing a constraint against the fully qualified name or nearest equivalent of a metavariable (useful mainly in JavaScript and TypeScript, where there is no first-class syntax for this, or where such names or pseudo-names containt symbols which cannot appear in identifiers). Requires pro naming passes and works best with interfile naming.

  Additional documentation forthcoming. (code-8121)

Changed

• Upgrade from OCaml 4.14.0 to OCaml 5.2.1 for our PyPI and Homebrew distributions. Our Docker images have been built with OCaml 5.2.1 since Semgrep 1.107.0. (ocaml5)

Fixed

• Fixed a regression in pro interfile mode where type inference for the var keyword in Java was not functioning correctly. (code-7991)

• PRO: Fix the range not found error when using a metavariable pattern match on a typed metavariable. For example, the following metavariable pattern rule will no longer trigger the error:

  patterns:
    - pattern: ($FOO $VAR).bar()
    - metavariable-pattern:
        metavariable: $FOO
        pattern-either:
          - pattern: org.foo.Foo
  ``` (code-8007)
  

• lsp will no longer send diagnostics where the message is MarkupContent since our current implementation does not discriminate on the client capability for recieiving such diagnostics (to-be-added in 3.18). (code-8120)

• Yarn.lock parser now correctly denotes NPM organization scope. (sc-2107)

• Packages in Package.resolved without a version are now ignored. (sc-2116)

• Updated Package.swift parser to support:

  • The url value in a .package entry doesn't have to end with .git
  • You can have an exact field that looks like exact: "1.0.0" instead of .exact("1.0.0")

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.110.0 - 2025-02-26

Added

• pro: Inter-file analysis will now process Javascript and Typescript files together, so that taint can be tracked across both languages. (code-8076)

• Pro: new metavariable-name operator which allows for expressing a constraint against the fully qualified name or nearest equivalent of a metavariable (useful mainly in JavaScript and TypeScript, where there is no first-class syntax for this, or where such names or pseudo-names containt symbols which cannot appear in identifiers). Requires pro naming passes and works best with interfile naming.

  Additional documentation forthcoming. (code-8121)

Changed

• Upgrade from OCaml 4.14.0 to OCaml 5.2.1 for our PyPI and Homebrew distributions. Our Docker images have been built with OCaml 5.2.1 since Semgrep 1.107.0. (ocaml5)

Fixed

• Fixed a regression in pro interfile mode where type inference for the var keyword in Java was not functioning correctly. (code-7991)

• PRO: Fix the range not found error when using a metavariable pattern match on a typed metavariable. For example, the following metavariable pattern rule will no longer trigger the error:

  patterns:
    - pattern: ($FOO $VAR).bar()
    - metavariable-pattern:
        metavariable: $FOO
        pattern-either:
          - pattern: org.foo.Foo
  ``` (code-8007)
  

• lsp will no longer send diagnostics where the message is MarkupContent since our current implementation does not discriminate on the client capability for recieiving such diagnostics (to-be-added in 3.18). (code-8120)

• Yarn.lock parser now correctly denotes NPM organization scope. (sc-2107)

• Packages in Package.resolved without a version are now ignored. (sc-2116)

• Updated Package.swift parser to support:

  • The url value in a .package entry doesn't have to end with .git
  • You can have an exact field that looks like exact: "1.0.0" instead of .exact("1.0.0")
  • The exact version can be an object like Version(1,2,3) instead of a string

... (truncated)

Commits

• ffdd67f chore: release version 1.110.0
• 9e09482semgrep/semgrep-proprietary#3211
• 66c8e6d feat(sca): enable dynamic resolution for multi-lockfile dependency sources (s...
• 9477b52 feat: improve show debugsemgrep/semgrep-proprietary#3131
• e4ddc36 refactor: use Cmdliner for Show_CLIsemgrep/semgrep-proprietary#3130
• 963f46fsemgrep/semgrep-proprietary#3208
• 5e7485d Add Windows dev setup fixes, workarounds, and documentation (semgrep/semgrep-...
• 2d773a1semgrep/semgrep-proprietary#3204
• bda4a54semgrep/semgrep-proprietary#3206
• 4956c6bsemgrep/semgrep-proprietary#3188
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)