chore(deps): bump semgrep from 1.113.0 to 1.124.0

[dependabot]

Bumps semgrep from 1.113.0 to 1.124.0.

Release notes

Sourced from semgrep's releases.

Release v1.124.0

1.124.0 - 2025-06-04

Added

• Parallelizes rule validation to improve performance when scanning with many rule files. (SAF-2061)
• Semgrep should now respect ALL_PROXY, HTTP_PROXY, HTTPS_PROXY, NO_PROXY, PROXY_USERNAME and PROXY_PASSWORD for all networking (including that done via the OCaml components). Moreover, the environment variable OCAML_EXTRA_CA_CERTS should now allow additional CA certs to be used for network operations done by OCaml components. (code-8157)

Fixed

• Stop attempting to parse build.gradle.kts files as build.gradle. (SC-2209)
• Taint rules using the experimental feature labels, and specifying sinks with a requires: of the form not A, could produce findings with an empty list of traces, potentially causing a crash. We now recognize the issue and prevent the crash from happening. (code-8531)
• Fixed inconsistency where the empty Python fstring f"" was not matched by the pattern "...". (gh-10047)
• Fixed bug where dev depenencies (and their dependencies, and so on) were incorrectly marked as "transitivity: unknown" when parsing package-lock.json projects, specifically v3 lockfiles. (gh-4003)
• Fixed scenario where a multiplication expression of ints was not considered an int. This will help with metavariable-type. Concretely, "2 * groups" was not considered an int, where groups is an int. Additionally adds type inference for mod, floor division, and pow. (gh-9855)
• pro: python: Fixed a regression that could (in rare cases) cause naming to take a disproportionate amount of time significantly slowing down scans. (saf-1978)

Release v1.123.0

1.123.0 - 2025-05-28

Fixed

• Fixed bug where supply chain reachability rules which match multiple dependencies could produce reachable findings on transitive dependencies even when the actually used direct dependency was not vulnerable. (SC-2088)
• Fixed documentation to reflect that, for --metrics="auto", pseudoanonymous metrics are sent when the user is logged in. (gh-11028)

Release v1.122.0

1.122.0 - 2025-05-14

Added

• Adds support for the UV package manager in Supply Chain scans. (SC-1900)

Fixed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.124.0 - 2025-06-04

Added

• Parallelizes rule validation to improve performance when scanning with many rule files. (SAF-2061)
• Semgrep should now respect ALL_PROXY, HTTP_PROXY, HTTPS_PROXY, NO_PROXY, PROXY_USERNAME and PROXY_PASSWORD for all networking (including that done via the OCaml components). Moreover, the environment variable OCAML_EXTRA_CA_CERTS should now allow additional CA certs to be used for network operations done by OCaml components. (code-8157)

Fixed

• Stop attempting to parse build.gradle.kts files as build.gradle. (SC-2209)
• Taint rules using the experimental feature labels, and specifying sinks with a requires: of the form not A, could produce findings with an empty list of traces, potentially causing a crash. We now recognize the issue and prevent the crash from happening. (code-8531)
• Fixed inconsistency where the empty Python fstring f"" was not matched by the pattern "...". (gh-10047)
• Fixed bug where dev depenencies (and their dependencies, and so on) were incorrectly marked as "transitivity: unknown" when parsing package-lock.json projects, specifically v3 lockfiles. (gh-4003)
• Fixed scenario where a multiplication expression of ints was not considered an int. This will help with metavariable-type. Concretely, "2 * groups" was not considered an int, where groups is an int. Additionally adds type inference for mod, floor division, and pow. (gh-9855)
• pro: python: Fixed a regression that could (in rare cases) cause naming to take a disproportionate amount of time significantly slowing down scans. (saf-1978)

1.123.0 - 2025-05-28

Fixed

• Fixed bug where supply chain reachability rules which match multiple dependencies could produce reachable findings on transitive dependencies even when the actually used direct dependency was not vulnerable. (SC-2088)
• Fixed documentation to reflect that, for --metrics="auto", pseudoanonymous metrics are sent when the user is logged in. (gh-11028)

1.122.0 - 2025-05-14

Added

• Adds support for the UV package manager in Supply Chain scans. (SC-1900)

Fixed

... (truncated)

Commits

• b32cd39 chore: release version 1.124.0
• 91c375esemgrep/semgrep-proprietary#4021
• f07c4e4semgrep/semgrep-proprietary#4019
• 05ded1b fix(python): python fstring evaluation is more accurate (semgrep/semgrep-prop...
• 98d26ea Fix(sca): add a parameter through the tr logic to control caching (semgrep/se...
• c2310f8 fix: benchmark script couldn't find baseline ver (semgrep/semgrep-proprietary...
• 2cebe5c fix(sca): no longer ignore dep dependencies in v3 npm lockfiles (semgrep/semg...
• 748526bsemgrep/semgrep-proprietary#3987
• db722dcsemgrep/semgrep-proprietary#3711
• 744ee4asemgrep/semgrep-proprietary#3710
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)