Skip to content

build(deps): bump semgrep from 1.173.0 to 1.176.0 in /internal/semgrep - #50

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/internal/semgrep/semgrep-1.176.0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/internal/semgrep/semgrep-1.176.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps semgrep from 1.173.0 to 1.176.0.

Release notes

Sourced from semgrep's releases.

Release v1.176.0

1.176.0 - 2026-09-01

### Changed

  • Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

Release v1.175.0

1.175.0 - 2026-08-26

### Changed

  • Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

### Known Issues

  • Homebrew users on macOS Intel systems will experience errors when trying to install or update their Semgrep binary installation.
    • There is no impact on users on other platforms (i.e. ARM64) or using other distribution channels.
    • This is caused by the removal of macOS Intel bottles by Homebrew.
    • Semgrep thus no longer supports Homebrew for installing Semgrep on macOS Intel systems

Release v1.174.0

1.174.0 - 2026-08-20

### Added

  • Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

  • Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped subprojects. (SC-3830)
Changelog

Sourced from semgrep's changelog.

1.176.0 - 2026-09-01

### Changed

  • Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

1.175.0 - 2026-08-26

### Changed

  • Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

1.174.0 - 2026-08-20

### Added

  • Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

  • Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped subprojects. (SC-3830)
Commits
  • 5bdaec1 chore: release 1.176.0
  • 7e4ac39 chore: drop Homebrew Intel Mac smoke test (ENGINE-2951) (semgrep/semgrep-prop...
  • e1bb0c2semgrep/semgrep-proprietary#6998
  • 0187090semgrep/semgrep-proprietary#6885
  • 704ebe6 fix: make core match ordering independent of hash iteration order (semgrep/se...
  • 0744a17 fix: drop duplicate hash-table bindings (add -> replace) (semgrep/semgrep-pro...
  • 089569esemgrep/semgrep-proprietary#6938
  • 5fcf5c7 chore: restructure hashtbl multi-binding call sites (semgrep/semgrep-propriet...
  • cc40806 chore: update slack action to v2+ chat.postMessage API (semgrep/semgrep-propr...
  • cb3a4aesemgrep/semgrep-proprietary#6921
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [semgrep](https://github.com/semgrep/semgrep) from 1.173.0 to 1.176.0.
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.173.0...v1.176.0)

---
updated-dependencies:
- dependency-name: semgrep
  dependency-version: 1.176.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 10, 2026
@github-actions

Copy link
Copy Markdown

bulwark

  • scan — no findings

  • coverage — go: 64.1% (baseline 64.1%)

📦 Full bulwark output — complete scan and coverage logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants