chore(deps-dev): bump semgrep from 1.99.0 to 1.122.0

[dependabot]

Bumps semgrep from 1.99.0 to 1.122.0.

Release notes

Sourced from semgrep's releases.

Release v1.122.0

1.122.0 - 2025-05-14

Added

• Adds support for the UV package manager in Supply Chain scans. (SC-1900)

Fixed

• pro: Fixed inter-file naming bug affecting Go's struct-methods that could result in false negatives.

  Previously, adding a pattern-inside like

  func ($THING $TYPE) $FUNC(...) $R { ... }
  

  to a taint rule could cause some findings to incorrectly stop being reported. (code-7767)

• PRO: Fixed the issue with type matching when a type has a type parameter, e.g., matching the pattern std::vector<$T> with the code std::vector<int> v in C++. (code-8443)

• Make Nuget dependency child parsing case insensitive (sc-2355)

• Fixed bug where direct dev depenencies were not marked as direct when parsing package-lock.json projects. (sc-dev)

Release v1.121.0

1.121.0 - 2025-05-06

Added

• pro: Improved handling of tsconfig.json in instances where multiple typescript "projects" (i.e., separately rooted source directories with their own configurations not joined by a single tsconfig.json with project references) are being scanned as one project under semgrep. This should result in better name/module resolution in TypeScript. (code-7798)
• pro: Improved handling of include, exclude and files properties in tsconfig.json. Projects which use more than one tsconfig in a given directory which apply to different sets of files under that directory should see improvements in name/module resolution. (code-7798-a)
• Improved Supply Chain scan output and logging. (sc-2356)

Changed

• Upgrade the Julia parser to the tree-sitter-julia 0.22.0 (gh-10820)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.122.0 - 2025-05-14

Added

• Adds support for the UV package manager in Supply Chain scans. (SC-1900)

Fixed

• pro: Fixed inter-file naming bug affecting Go's struct-methods that could result in false negatives.

  Previously, adding a pattern-inside like

  func ($THING $TYPE) $FUNC(...) $R { ... }
  

  to a taint rule could cause some findings to incorrectly stop being reported. (code-7767)

• PRO: Fixed the issue with type matching when a type has a type parameter, e.g., matching the pattern std::vector<$T> with the code std::vector<int> v in C++. (code-8443)

• Make Nuget dependency child parsing case insensitive (sc-2355)

• Fixed bug where direct dev depenencies were not marked as direct when parsing package-lock.json projects. (sc-dev)

1.121.0 - 2025-05-06

Added

• pro: Improved handling of tsconfig.json in instances where multiple typescript "projects" (i.e., separately rooted source directories with their own configurations not joined by a single tsconfig.json with project references) are being scanned as one project under semgrep. This should result in better name/module resolution in TypeScript. (code-7798)
• pro: Improved handling of include, exclude and files properties in tsconfig.json. Projects which use more than one tsconfig in a given directory which apply to different sets of files under that directory should see improvements in name/module resolution. (code-7798-a)
• Improved Supply Chain scan output and logging. (sc-2356)

Changed

• Upgrade the Julia parser to the tree-sitter-julia 0.22.0 (gh-10820)

Fixed

... (truncated)

Commits

• 382a8a9 chore: release version 1.122.0
• 4e821besemgrep/semgrep-proprietary#3890
• 53d169f Generate a log when the metavariable is bound to a value without a valid toke...
• 6b6caf6semgrep/semgrep-proprietary#3883
• ad01cd1semgrep/semgrep-proprietary#3877
• 617cc25semgrep/semgrep-proprietary#3
• dbcdca0 chore(multicore): group multicore-relevant values in Core_scan_config (semgre...
• d812dd4semgrep/semgrep-proprietary#3882
• 0512e1csemgrep/semgrep-proprietary#3880
• 74bc8c3 fix(telemetry): fix logs reporting in semgrep-core (semgrep/semgrep-proprieta...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 Changelog requirements

Wonderful, this rule succeeded.

• any of:
  • -title ~= ^feat
  • label = need changelog
  • label = skip changelog

🟢 Enforce conventional commit

Wonderful, this rule succeeded.

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?:

🟢 🔎 Reviews

Wonderful, this rule succeeded.

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

[mergify]

@dependabot[bot] this pull request is now in conflict 😩

[mergify]

@dependabot[bot] this pull request is now in conflict 😩

[mergify]

@dependabot[bot] this pull request is now in conflict 😩