[Chris-Wolfgang]

Summary

Fixes Dependabot alerts #35 (semgrep.txt) and #36 (semgrep.in): GHSA-84m7-p3x7-pcfv in mcp (unbounded session accumulation in the StreamableHTTP transport, fixed in 1.30.0).

semgrep 1.180.0 pins mcp==1.29.0, so neither Dependabot nor a plain recompile can move it. This PR:

• adds .github/requirements/semgrep-overrides.txt with mcp>=1.30.0,<2 and a comment saying why and when to delete it;
• regenerates semgrep.txt with uv pip compile --universal --generate-hashes --override semgrep-overrides.txt semgrep.in -o semgrep.txt (header updated to the new command). Only mcp moves (1.29.0 -> 1.30.0); every other pin and hash is unchanged.

semgrep.yaml installs with pip install --no-deps --require-hashes, so pip does not re-apply semgrep's own pin, and semgrep scan never imports mcp (it is only used by semgrep's MCP server). Same approach as Hawsey #1009 and ICollection-Extensions #316. No decision on this alert had been recorded by the owner, so the fleet's override approach was adopted.

Stacked on the Dependabot series top #344; merge #341 -> #342 -> #343 -> #344 first.

Verification

Verified locally; CI blocked by the account billing lock.

• git diff: semgrep.txt changes only the header line and the mcp entry (+7/-5); new file semgrep-overrides.txt.
• Fresh venv, pip install --no-deps --require-hashes -r .github/requirements/semgrep.txt: succeeded; installed mcp 1.30.0, semgrep 1.180.0.
• semgrep scan --config p/csharp --config p/security-audit --config p/secrets --metrics=off src tests with that venv: exit 0, no findings.
• The alert closing can only be confirmed after merge (Dependabot rescans the default branch).

🤖 Generated with Claude Code