Bump semgrep from 1.76.0 to 1.80.0

[dependabot]

Bumps semgrep from 1.76.0 to 1.80.0.

Release notes

Sourced from semgrep's releases.

Release v1.80.0

1.80.0 - 2024-07-18

Added

• OSemgrep now can take --exclude-minified-files to skip minified files. Additionally --no-exclude-minified-files will disable this option. It is off by default. (cdx-460)

• Users are now required to login before using semgrep scan --pro.

  Previously, semgrep will tell the users to log in, but the scan will still continue.

  With this change, semgrep will tell the users to log in and stop the scan. (saf-1137)

Fixed

• The language server no longer scans large or minified files (cdx-460)

• Pro: Improved module resolution for Python. Imports like from a.b import c where c is a module will now be resolved by Semgrep. And, if a module cannot be found in the search path, Semgrep will try to heuristically resolve the module by matching the module specifier against the files that are being scanned. (code-7069)

• A scan can occasionally freeze when using tracing with multiprocesses.

  This change disables tracing when scanning each target file unless the scan runs in a single process. (saf-1143)

• Improved error handling for rules with invalid patterns. Now, scans will still complete and findings from other rules will be reported. (saf-789)

• The "package-lock.json" parser incorrectly assumed that all paths in the "packages" component of "package-lock.json" started with "node_modules/".

  In reality, a dependency can be installed anywhere, so the parser was made more flexible to recognize alternative locations ("node_modules", "lib", etc). (sc-1576)

Release v1.79.0

1.79.0 - 2024-07-10

Added

• Preliminary support for the Move on Aptos language (see https://aptos.dev/move/move-on-aptos for more info on this language). Thanks a lot to Zhiping Liao (ArArgon) and Andrea Cappa for their contributions! (move_on_aptos)
• The language server now reports number of autofixes and ignores triggered throught IDE integrations when metrics are enabled (pdx-autofix-ignore)
• Added support for comparing Golang Pseudo-versions. After replacing calls to the packaging module with some custom logic, Pseudo-versions can now be compared against strict core versions and other pseudo versions accurately. (sc-1601)
• We now perform a git gc as a side-effect of historical scans. (scrt-630)

Fixed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.80.0 - 2024-07-18

Added

• OSemgrep now can take --exclude-minified-files to skip minified files. Additionally --no-exclude-minified-files will disable this option. It is off by default. (cdx-460)

• Users are now required to login before using semgrep scan --pro.

  Previously, semgrep will tell the users to log in, but the scan will still continue.

  With this change, semgrep will tell the users to log in and stop the scan. (saf-1137)

Fixed

• The language server no longer scans large or minified files (cdx-460)

• Pro: Improved module resolution for Python. Imports like from a.b import c where c is a module will now be resolved by Semgrep. And, if a module cannot be found in the search path, Semgrep will try to heuristically resolve the module by matching the module specifier against the files that are being scanned. (code-7069)

• A scan can occasionally freeze when using tracing with multiprocesses.

  This change disables tracing when scanning each target file unless the scan runs in a single process. (saf-1143)

• Improved error handling for rules with invalid patterns. Now, scans will still complete and findings from other rules will be reported. (saf-789)

• The "package-lock.json" parser incorrectly assumed that all paths in the "packages" component of "package-lock.json" started with "node_modules/".

  In reality, a dependency can be installed anywhere, so the parser was made more flexible to recognize alternative locations ("node_modules", "lib", etc). (sc-1576)

1.79.0 - 2024-07-10

Added

• Preliminary support for the Move on Aptos language (see https://aptos.dev/move/move-on-aptos for more info on this language). Thanks a lot to Zhiping Liao (ArArgon) and Andrea Cappa for their contributions! (move_on_aptos)
• The language server now reports number of autofixes and ignores triggered throught IDE integrations when metrics are enabled (pdx-autofix-ignore)
• Added support for comparing Golang Pseudo-versions. After replacing calls to the packaging module with some custom logic, Pseudo-versions can now be compared against strict core versions and other pseudo versions accurately. (sc-1601)
• We now perform a git gc as a side-effect of historical scans. (scrt-630)

Fixed

... (truncated)

Commits

• 198228f chore: Bump version to 1.80.0
• f1881a5 bug(sca): package-lock parser handles NPM packages not inside node_modules/...
• f10224asemgrep/semgrep-proprietary#1
• 5bba89a feat: require authentication before using pro features (semgrep/semgrep-propr...
• 39fb290 Switch to Nat's RPC instead of semgrep-core -dump_contributions (semgrep/semg...
• 41efa66semgrep/semgrep-proprietary#1867
• e8bbe59semgrep/semgrep-proprietary#1753
• 7b4b49e refactoring: cleanup Git_wrapper.ml, remove get_ prefix (semgrep/semgrep-prop...
• ee7bb2csemgrep/semgrep-proprietary#1836
• 9f659afsemgrep/semgrep-proprietary#1803
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #161.