Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 19, 2026

Bumps semgrep from 1.113.0 to 1.148.0.

Release notes

Sourced from semgrep's releases.

Release v1.148.0

1.148.0 - 2026-01-14

Added

  • Performance: subproject discovery in Supply Chain scans is no longer significantly slowed down by the presence of Git-untracked files resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

  • pro: Improved virtual method resolution in Java (code-9174)
  • pro: Improved handling of parse errors during inter-file analysis. Now, these errors should be adequately reported back to users and in the JSON output. (code-9216)
  • Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
  • Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

Release v1.147.0

1.147.0 - 2026-01-07

Added

  • Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
  • semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

  • Deduplication should now pick the exact same findings across scans. Previously, findings were always equivalent, but not guaranteed to be exactly the same (e.g. metavariable bindings could differ). Depending on the rule and target code, this could cause findings' fingerprints to change from one scan to another, thus leading to finding flakiness and "cycling" in Semgrep App. Note that when upgrading to this Semgrep version, you may see different (but equivalent) findings wrt your current Semgrep version in the first scan, one more time. However, in subsequent scans/upgrades, this problem should go away or at least be greatly reduced. (saf-2304)

Release v1.146.0

1.146.0 - 2025-12-17

Added

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.148.0 - 2026-01-14

Added

  • Performance: subproject discovery in Supply Chain scans is no longer significantly slowed down by the presence of Git-untracked files resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

  • pro: Improved virtual method resolution in Java (code-9174)
  • pro: Improved handling of parse errors during inter-file analysis. Now, these errors should be adequately reported back to users and in the JSON output. (code-9216)
  • Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
  • Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

1.147.0 - 2026-01-07

Added

  • Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
  • semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

  • Deduplication should now pick the exact same findings across scans. Previously, findings were always equivalent, but not guaranteed to be exactly the same (e.g. metavariable bindings could differ). Depending on the rule and target code, this could cause findings' fingerprints to change from one scan to another, thus leading to finding flakiness and "cycling" in Semgrep App. Note that when upgrading to this Semgrep version, you may see different (but equivalent) findings wrt your current Semgrep version in the first scan, one more time. However, in subsequent scans/upgrades, this problem should go away or at least be greatly reduced. (saf-2304)

1.146.0 - 2025-12-17

Added

... (truncated)

Commits
  • 62d70f0 chore: release version 1.148.0
  • dc17db4semgrep/semgrep-proprietary#5390
  • 452b0a5semgrep/semgrep-proprietary#5373
  • 542f69csemgrep/semgrep-proprietary#5344
  • a5365e2semgrep/semgrep-proprietary#5329
  • 6b21d65 Revert "fix(ci): bump setup-ocaml cache version for compiler bump (semgrep/se...
  • 43521db Revert "fix(multicore): Propagate child domain's backtrace on top-level exn (...
  • 86c8d40 fix(ci): bump setup-ocaml cache version for compiler bump (semgrep/semgrep-pr...
  • 0c9e4afsemgrep/semgrep-proprietary#5374
  • ae4197csemgrep/semgrep-proprietary#5285
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [semgrep](https://github.com/returntocorp/semgrep) from 1.113.0 to 1.148.0.
- [Release notes](https://github.com/returntocorp/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.113.0...v1.148.0)

---
updated-dependencies:
- dependency-name: semgrep
  dependency-version: 1.148.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jan 19, 2026
@dependabot dependabot bot requested a review from behnazh-w as a code owner January 19, 2026 13:06
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jan 19, 2026
@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Jan 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file OCA Verified All contributors have signed the Oracle Contributor Agreement. python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants