[dependabot]

Bumps semgrep from 1.175.0 to 1.182.0.

Release notes

Sourced from semgrep's releases.

Release v1.182.0

1.182.0 - 2026-10-20

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

Release v1.181.0

1.181.0 - 2026-10-14

### Changed

• semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)
• Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)
• pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)
• go grammar update (v0.23.4):

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.182.0 - 2026-10-20

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

1.181.0 - 2026-10-14

### Changed

• semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)
• Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)
• pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)
• go grammar update (v0.23.4):

... (truncated)

Commits

• 240da9f chore: release 1.182.0
• 134422csemgrep/semgrep-proprietary#7249
• 5ca9958semgrep/semgrep-proprietary#7086
• fe20976semgrep/semgrep-proprietary#7243
• 7c4c6c9semgrep/semgrep-proprietary#7167
• b38de57semgrep/semgrep-proprietary#7239
• e7fa609semgrep/semgrep-proprietary#7235
• dd8c98c fix(sca): Report unpinned requirements.txt lines as direct with a manifest to...
• 2d453d2semgrep/semgrep-proprietary#7214
• 11293a7semgrep/semgrep-proprietary#7246
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like semgrep is up-to-date now, so this is no longer needed.