Bump semgrep from 1.76.0 to 1.79.0

[dependabot]

Bumps semgrep from 1.76.0 to 1.79.0.

Release notes

Sourced from semgrep's releases.

Release v1.79.0

1.79.0 - 2024-07-10

Added

• Preliminary support for the Move on Aptos language (see https://aptos.dev/move/move-on-aptos for more info on this language). Thanks a lot to Zhiping Liao (ArArgon) and Andrea Cappa for their contributions! (move_on_aptos)
• The language server now reports number of autofixes and ignores triggered throught IDE integrations when metrics are enabled (pdx-autofix-ignore)
• Added support for comparing Golang Pseudo-versions. After replacing calls to the packaging module with some custom logic, Pseudo-versions can now be compared against strict core versions and other pseudo versions accurately. (sc-1601)
• We now perform a git gc as a side-effect of historical scans. (scrt-630)

Fixed

• tainting: Fixed bug in --pro-intrafile that caused Semgrep to confuse a parameter with a top-level function with no arguments that happened to have the same name:

  def foo
    taint
  end
  def bar(foo)
  
  sink(foo) # no more FP here
  
  end (code-6923)
  
  

• Fixed fatal errors on files containing nosemgrep annotation without any rule ID after. (nosemgrep_exn)

• Matching explanations: Focus nodes now appear after filter nodes, which is the correct order of execution of pattern nodes. Filter nodes are now unreversed. (saf-1127)

• Autofix: Previews in the textual CLI output will now join differing lines with a space, rather than joining with no whitespace whatsoever. (saf-1135)

• Secrets: resolved some rare instances where historical scans would skip blobs depending on the structure of the local copy of the repository (i.e., blobs were only skipped if the specific copy of the git store had a certain structure). (scrt-630)

Release v1.78.0

1.78.0 - 2024-06-27

Added

• Matching of fully qualified type names in the metavariable-type operator has

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.79.0 - 2024-07-10

Added

• Preliminary support for the Move on Aptos language (see https://aptos.dev/move/move-on-aptos for more info on this language). Thanks a lot to Zhiping Liao (ArArgon) and Andrea Cappa for their contributions! (move_on_aptos)
• The language server now reports number of autofixes and ignores triggered throught IDE integrations when metrics are enabled (pdx-autofix-ignore)
• Added support for comparing Golang Pseudo-versions. After replacing calls to the packaging module with some custom logic, Pseudo-versions can now be compared against strict core versions and other pseudo versions accurately. (sc-1601)
• We now perform a git gc as a side-effect of historical scans. (scrt-630)

Fixed

• tainting: Fixed bug in --pro-intrafile that caused Semgrep to confuse a parameter with a top-level function with no arguments that happened to have the same name:

  def foo
    taint
  end
  def bar(foo)
  
  sink(foo) # no more FP here
  
  end (code-6923)
  
  

• Fixed fatal errors on files containing nosemgrep annotation without any rule ID after. (nosemgrep_exn)

• Matching explanations: Focus nodes now appear after filter nodes, which is the correct order of execution of pattern nodes. Filter nodes are now unreversed. (saf-1127)

• Autofix: Previews in the textual CLI output will now join differing lines with a space, rather than joining with no whitespace whatsoever. (saf-1135)

• Secrets: resolved some rare instances where historical scans would skip blobs depending on the structure of the local copy of the repository (i.e., blobs were only skipped if the specific copy of the git store had a certain structure). (scrt-630)

1.78.0 - 2024-06-27

Added

• Matching of fully qualified type names in the metavariable-type operator has been improved. For example:

... (truncated)

Commits

• 4f590de chore: Bump version to 1.79.0
• c062effsemgrep/semgrep-proprietary#1806
• 10898bd Add built-in support for identifying Django views (semgrep/semgrep-proprietar...
• 74d1109 Remove test-semgrep-pro.jsonnet
• 036f654semgrep/semgrep-proprietary#1801
• ed49c23 restore mypy-tests
• 2b03b20 chore(sca): Add mypy to CLI testing suite precommit (semgrep/semgrep-propri...
• e8692ce precommit: skip the mypy-test check in OSS precommit (semgrep/semgrep-proprie...
• f43e9a8 fix fatal error inside nosemgrep, and reraise more often fatal exceptions (se...
• e026171 tainting: Fix --pro-intrafile confusing param with function (semgrep/semgrep-...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #158.