chore(deps): Update dependency semgrep to v1.179.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semgrep (changelog)	1.174.0 → 1.179.0

---

Release Notes

semgrep/semgrep (semgrep)

v1.179.0

Compare Source

1.179.0 - 2026-10-01

### Added

• Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

• Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

• c grammar update (v0.24.2):

  • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

  (c-v0.24.2)

• cpp grammar update (v0.23.4):

  • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
  • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
  • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
  • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
  • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
  • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

  (cpp-v0.23.4)

• Update the html grammar to v0.23.2. (html-v0.23.2)

• r grammar update (v1.3.0):

  • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
  • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
  • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
  • R parsing preserves else branches placed on a new line within braced expressions.
  • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
  • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

  (r-v1.3.0)

• sfapex grammar update (v2.3):

  • Apex target parsing now supports null-coalescing expressions using ??, preserving both operands.
  • Apex target parsing now supports DML operations with explicit as user and as system security modes, retaining the mode, operation targets, and optional upsert key.
  • Apex target parsing now supports numeric package-version expressions such as Package.Version.1.2.
  • Apex target parsing now recognizes the webservice modifier and annotations with empty argument lists.
  • Apex target parsing now accepts whitespace within relational and shift operators, including compound shift assignments.
  • Embedded SOQL parsing in Apex now supports dotted TYPEOF operands, functions such as convertTimezone, and HAVING comparisons on grouped fields.
  • Apex target parsing now supports multiple top-level method declarations followed by executable statements in anonymous Apex.
  • Apex parsing now preserves native java: qualifiers on types and supports java:-prefixed field-access expressions.
  • Apex patterns now distinguish safe navigation (?.) from ordinary field and method access (.).

  (sfapex-v2.3)

### Fixed

• Python: except A, B: and except A, B, C: (PEP 758, Python 3.14) and the
  except* forms of both are now parsed as a tuple of exception types, like
  except (A, B):, rather than as the Python 2 except A as B: or a parse
  error. except* is now handled by Semgrep's primary Python parser too, so
  exception groups no longer depend on the fallback parser. Note that Python
  2's except A, e: is no longer read as except A as e:, even for python2.
  One limitation remains: the vendored tree-sitter Python grammar still accepts
  only a single comma, so except A, B, C: is still a parse error there. The
  menhir parser runs first and handles it, so this only surfaces if the
  tree-sitter fallback is reached; upgrading the vendored grammar is follow-up
  work. (gh-11906)
• Fix Dockerfile parsing for environment-expanded EXPOSE ports with TCP/UDP protocols. (gh-11934)
• Semgrep now allows PyJWT 2.15 and later (pyjwt[crypto]>=2.15.0,<3) instead of
  pinning ~=2.13.0, so installs pick up a PyJWT release with fixes for known
  vulnerabilities, and projects that require a newer PyJWT can install Semgrep. (gh-11953)

v1.178.0

Compare Source

1.178.0 - 2026-09-23

### Changed

• The bundled tree-sitter C runtime is now 0.26.3. (CODE-9425)

### Fixed

• Fixed an occasional hang when semgrep-core exited on Windows. (windows-hang)

v1.177.0

1.177.0 - 2026-09-10

### Added

• Added native Supply Chain support for Bazel workspaces using rules_jvm_external. Semgrep now recognizes a maven_install.json pinned lockfile (versions 0.1.0 and 3, as emitted by rules_jvm_external 3.x through current) paired with a MODULE.bazel (or legacy WORKSPACE / WORKSPACE.bazel) marker as a Maven-ecosystem subproject, and attributes findings to the workspace root rather than the lockfile's directory. Workspace-declared root artifacts are identified via __INPUT_ARTIFACTS_HASH for accurate direct-vs-transitive classification; dependencies are emitted with Unknown transitivity when that field is not available. This is the first milestone of native Bazel coverage; broader ecosystem support (rules_python, rules_go, rules_js) and Bazel-aware reachability attribution follow. (SC-2008)
• Several performance improvements for regex-only rules where the underlying
  regex are inefficient to run on our default regex engine (currently PCRE2). For
  example, a rule matching FOOBAR(a+)\1 will skip any file that does not
  contain FOOBAR without running the regex. (scrt-979)

### Changed

• Prefilter conditions now evaluate their cheap string predicates before their
  expensive regex predicates. Since evaluation short-circuits, a file that a
  string check already rules in or out no longer pays for regex predicates
  (which is what a pattern's prefilter falls back to when no literal substring
  can be extracted from it, and which can be slow on files with very long
  lines). (prefilter-rank-conjuncts)
• Supply Chain scans can report dependencies from their Gradle module build files instead of the root manifest. This behavior is disabled by default during rollout and can be tested with --x-gradle-module-attribution. Enabling it can change finding IDs because finding paths change; the ID calculation is unchanged. (SC-2560)

### Fixed

• Speed up semgrep ci filtering when a deployment has many triage-ignored findings. (triage-ignored-performance)

• Semgrep no longer crashes with an OCaml stack trace when a proxy environment
  variable holds an unusable value. HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY
  set to an empty value is now ignored with a warning, and the scan
  proceeds without a proxy. A non-empty value that is not a usable proxy URL
  now exits with an error message, with any credentials in the URL
  redacted, instead of failing inside the HTTP client.

  Semgrep also now adds the missing scheme to a proxy URL supplied
  without one; https for HTTPS_PROXY and http` otherwise. (ENGINE-2208)

• Supply Chain: lockfileless Gradle scans now report a "Resource Inaccessible"
  resolution error when a repository refuses a request (for example a 401 from a
  private registry), instead of exiting successfully with a silently incomplete
  dependency list. (sc-3358)

### Infra/Release Changes

• Improves shutdown time during scans with --trace. (otel-shutdown-flush)

v1.176.0

### Changed

• Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

v1.175.1

### Fixed

• Fixed scans run with --trace that would fail with Stdlib.Effect.Unhandled(Eio__core__Cancel.Get_context) when a secret would fail to validate (CODE-9906)

v1.175.0

Compare Source

1.175.0 - 2026-08-26

### Changed

• Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

### Known Issues

• Homebrew users on macOS Intel systems will experience errors when trying to install or update their Semgrep binary installation.
  • There is no impact on users on other platforms (i.e. ARM64) or using other distribution channels.
  • This is caused by the removal of macOS Intel bottles by Homebrew.
  • Semgrep thus no longer supports Homebrew for installing Semgrep on macOS Intel systems

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4015e7ea-6485-488c-b58b-f5a94fd46b2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.