From 998ef1380f7e8c94dea380a50a1b2bc075c2c5e1 Mon Sep 17 00:00:00 2001
From: staging-update-bot <staging-update-bot@chainguard.dev>
Date: Wed, 17 Dec 2025 22:04:13 +0000
Subject: [PATCH 1/2] semgrep/1.146.0 package update

---
 semgrep.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/semgrep.yaml b/semgrep.yaml
index 2bca53b67fa0..47b2eaa178d9 100644
--- a/semgrep.yaml
+++ b/semgrep.yaml
@@ -1,6 +1,6 @@
 package:
   name: semgrep
-  version: "1.145.0"
+  version: "1.146.0"
   epoch: 0
   description: "Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
   copyright:
@@ -55,7 +55,7 @@ pipeline:
     with:
       repository: https://github.com/returntocorp/semgrep
       tag: v${{package.version}}
-      expected-commit: c93a066ea94157c10207f2946ebd7f5807a11cf2
+      expected-commit: 079e05d08b86ec1b07509d2e755c631156d3705b
       recurse-submodules: true
 
   - uses: patch

From 76f1ed853b7a1664c4a2a17eccf8a106f04fd4b0 Mon Sep 17 00:00:00 2001
From: Daniel Watkins <daniel.watkins@chainguard.dev>
Date: Thu, 18 Dec 2025 10:06:40 -0500
Subject: [PATCH 2/2] semgrep: drop superseded CVE remediation patch

Upstream are now on 1.23.3.
---
 semgrep.yaml                      |  4 ----
 semgrep/GHSA-9h52-p55h-vw2f.patch | 13 -------------
 2 files changed, 17 deletions(-)
 delete mode 100644 semgrep/GHSA-9h52-p55h-vw2f.patch

diff --git a/semgrep.yaml b/semgrep.yaml
index 47b2eaa178d9..a3628475c9c1 100644
--- a/semgrep.yaml
+++ b/semgrep.yaml
@@ -58,10 +58,6 @@ pipeline:
       expected-commit: 079e05d08b86ec1b07509d2e755c631156d3705b
       recurse-submodules: true
 
-  - uses: patch
-    with:
-      patches: GHSA-9h52-p55h-vw2f.patch
-
   - name: Change tree sitter version to 0.25
     runs: |
       # The tree-sitter version in the repo is 0.20.6, but we need to use 0.25.3
diff --git a/semgrep/GHSA-9h52-p55h-vw2f.patch b/semgrep/GHSA-9h52-p55h-vw2f.patch
deleted file mode 100644
index 507ebe53342b..000000000000
--- a/semgrep/GHSA-9h52-p55h-vw2f.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/cli/setup.py b/cli/setup.py
-index f4a73cc..676dff1 100644
---- a/cli/setup.py
-+++ b/cli/setup.py
-@@ -127,7 +127,7 @@ install_requires = [
-     "exceptiongroup~=1.2.0",
-     "glom~=22.1",
-     "jsonschema~=4.25.1",
--    "mcp==1.16.0",
-+    "mcp==1.23.0",
-     "opentelemetry-api~=1.37.0",
-     "opentelemetry-sdk~=1.37.0",
-     "opentelemetry-exporter-otlp-proto-http~=1.37.0",