chore(deps): bump semgrep from 1.113.0 to 1.147.0

[dependabot]

Bumps semgrep from 1.113.0 to 1.147.0.

Release notes

Sourced from semgrep's releases.

Release v1.147.0

1.147.0 - 2026-01-07

Added

• Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
• semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

• Deduplication should now pick the exact same findings across scans. Previously, findings were always equivalent, but not guaranteed to be exactly the same (e.g. metavariable bindings could differ). Depending on the rule and target code, this could cause findings' fingerprints to change from one scan to another, thus leading to finding flakiness and "cycling" in Semgrep App. Note that when upgrading to this Semgrep version, you may see different (but equivalent) findings wrt your current Semgrep version in the first scan, one more time. However, in subsequent scans/upgrades, this problem should go away or at least be greatly reduced. (saf-2304)

Release v1.146.0

1.146.0 - 2025-12-17

Added

• Added support for Cursor post-code-generation hooks via new record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)
• Added skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)
• Symbol analysis, if enabled, now runs for Supply Chain only scans when calling semgrep ci. (sc-2927)

Changed

• Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)
• bumped the mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)
• pro: [experimental] enabling and disabling transitive reachability analysis in semgrep ci regardless of app settings is now possible with --x-enable-transitive-reachability (or --x-tr) and --x-disable-transitive-reachability. (tr-flags)

Fixed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.147.0 - 2026-01-07

Added

• Gradle lockfiles of the form gradle*.lockfile are now supported. Previously, only lockfiles named exactly gradle.lockfile were supported. (SC-2999)
• semgrep login now supports a --force flag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use --force too. (saf-2392)

Fixed

• Deduplication should now pick the exact same findings across scans. Previously, findings were always equivalent, but not guaranteed to be exactly the same (e.g. metavariable bindings could differ). Depending on the rule and target code, this could cause findings' fingerprints to change from one scan to another, thus leading to finding flakiness and "cycling" in Semgrep App. Note that when upgrading to this Semgrep version, you may see different (but equivalent) findings wrt your current Semgrep version in the first scan, one more time. However, in subsequent scans/upgrades, this problem should go away or at least be greatly reduced. (saf-2304)

1.146.0 - 2025-12-17

Added

• Added support for Cursor post-code-generation hooks via new record-file-edit and stop-cli-scan semgrep mcp flags (cursor-hooks)
• Added skipped_paths field to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)
• Symbol analysis, if enabled, now runs for Supply Chain only scans when calling semgrep ci. (sc-2927)

Changed

• Semgrep's Docker image base has been bumped from Alpine Linux 3.22 to 3.23 (docker-version)
• bumped the mcp python-sdk from 1.16.0 to 1.23.3 (mcp-version)
• pro: [experimental] enabling and disabling transitive reachability analysis in semgrep ci regardless of app settings is now possible with --x-enable-transitive-reachability (or --x-tr) and --x-disable-transitive-reachability. (tr-flags)

Fixed

• The PHP AST now distinguishes between if statements with no else clause and those with an explicit but empty else {}. (gh-11330)

... (truncated)

Commits

• e9a7c48 chore: release version 1.147.0
• c638c5csemgrep/semgrep-proprietary#5319
• d540cae ci: Add trailing newline to gha lockfile script (semgrep/semgrep-proprietary#...
• 23b2965 refactor: Remove duplicate trace_endpoint assignment (semgrep/semgrep-proprie...
• df61857semgrep/semgrep-proprietary#5308
• b31b304semgrep/semgrep-proprietary#5304
• d7291casemgrep/semgrep-proprietary#5203
• 5f23fde chore(tracing): Add additional tracing for OCaml rule parsing (semgrep/semgre...
• 6166bb0 chore(tracing): Update name of top-level semgrep-core span (semgrep/semgrep-p...
• d5583absemgrep/semgrep-proprietary#5252
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)