Bump semgrep from 1.66.1 to 1.103.0

[dependabot]

Bumps semgrep from 1.66.1 to 1.103.0.

Release notes

Sourced from semgrep's releases.

Release v1.103.0

1.103.0 - 2025-01-15

Added

• pro: taint: Support for lambdas as callbacks.

  var tainted = source();
  function withCallback1(val, callback) {
  if (val) {
  callback(val);
  }
  }
  withCallback1(tainted, function (val) {
  sink(val); // finding !
  }); (code-7626)
  

• pro: python: Semgrep will now consider top-level lambdas like x below for inter-procedural analysis:

  x = lambda s: sink(s) # now we get a finding !
  x(taint) (gh-10731)
  

Changed

• Removed pip from the Semgrep Docker image. If you need it, you may install it by running apk add py3-pip. (saf-1774)

Fixed

• Python: Now correctly parsing files with parenthesized withs, like this:

  with (
    f() as a,
    g() as b,
  ):
    pass
  ``` (saf-1802)
  

• Semgrep will now truncate error messages that are produced when they are very long (saf-333)

Release v1.102.0

1.102.0 - 2025-01-08

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.103.0 - 2025-01-15

Added

• pro: taint: Support for lambdas as callbacks.

  var tainted = source();
  function withCallback1(val, callback) {
  if (val) {
  callback(val);
  }
  }
  withCallback1(tainted, function (val) {
  sink(val); // finding !
  }); (code-7626)
  

• pro: python: Semgrep will now consider top-level lambdas like x below for inter-procedural analysis:

  x = lambda s: sink(s) # now we get a finding !
  x(taint) (gh-10731)
  

Changed

• Removed pip from the Semgrep Docker image. If you need it, you may install it by running apk add py3-pip. (saf-1774)

Fixed

• Python: Now correctly parsing files with parenthesized withs, like this:

  with (
    f() as a,
    g() as b,
  ):
    pass
  ``` (saf-1802)
  

• Semgrep will now truncate error messages that are produced when they are very long (saf-333)

1.102.0 - 2025-01-08

... (truncated)

Commits

• 99f81dc chore: release version 1.103.0
• aaf1991semgrep/semgrep-proprietary#2888
• 4cfafdd tainting: interproc: Support lambdas as callbacks (semgrep/semgrep-proprietar...
• 13406ecsemgrep/semgrep-proprietary#2
• 4059e06 osemgrep: restore correct file targeting in semgrep ci (semgrep/semgrep-propr...
• e5a42f3 osemgrep: print the lockfile attached to a match (semgrep/semgrep-proprietary...
• 8753168 RFC: add an osemgrep ci --fake-backend /path/to/jsons/fake/answers/ (part1) (...
• b30039e fix(SAF-333): truncate error messages and others (semgrep/semgrep-proprietary...
• e7e884fsemgrep/semgrep-proprietary#2884
• fb6d0f5 python: dataflow: Treat v = lambda x: ... as a func def (semgrep/semgrep-pr...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)