[dependabot]

Bumps the semgrep group in /.github with 1 update: semgrep.

Updates semgrep from 1.183.0 to 1.184.0

Release notes

Sourced from semgrep's releases.

Release v1.184.0

1.184.0 - 2026-11-05

### Added

• PHP: Improved virtual call resolution for basic trait composition. (CODE-9176)
• Supply Chain: a requirements.txt dependency declared as a version range (litellm>=1.10) or with no version (flask) now produces a finding for every advisory whose affected versions overlap the declared range, in both the Python and native resolvers. Such a finding has no single installed version to confirm, so it needs review. A range line next to a pinned copy of the same package produces no finding of its own, since the pinned copy names the installed version. (SC-4243)
• Set SEMGREP_LOG_JSON_FILE to emit structured execution events with scan metadata alongside existing text output. (SMS-3670)

### Changed

• Scans are slightly faster. The dataflow analyses build the name of each variable with a plain string join, and no longer with Printf and Format. On 6 open-source repos, the scan time was a median of 3% lower, with identical findings. (dataflow-variable-keys)

• go grammar update (v0.25.0):

  • Go source parsing now supports generic type aliases, preserving type parameters, constraints, and alias semantics. Existing alias patterns can match these declarations; spelling generic parameter lists in rule patterns remains unsupported.
  • Go correctly parses unnamed map parameters and results in mixed signatures such as ([]string, int, map[int]int, error), allowing function patterns to match those signatures.
  • Go correctly represents chained indexing such as table[key][next] as nested index expressions, restoring matches for nested-index patterns.

  (go-v0.25.0)

### Fixed

• Semgrep no longer logs credentials embedded in a proxy URL (for example HTTPS_PROXY=http://user:password@proxy:8080) when it reports the configured proxy settings. (proxy-log-redact-userinfo)
• Logs and traces no longer include snippets of the scanned source code when a file fails to parse. Parsing exceptions now report the file, line, column, and the length of the unexpected text instead. Dependency resolution errors for malformed lockfiles are reported the same way. (redact-source-in-telemetry)
• pro: Reduced peak memory for large projects (CODE-10136)
• Supply Chain: the yarn v1 lockfile parser no longer reports a package named "dependencies" with an empty version when a blank line precedes the dependencies block of an entry, and it now keeps that entry's dependency edges. Entries without a version line are reported as parser errors instead of dependencies with an empty version. (SC-4214)
• Gradle module attribution now works for modules whose logical project name does not match their directory (a renamed include or a remapped projectDir in settings.gradle). The resolver's init script reports each project's actual build file, and dependencies are attributed to that file instead of falling back to the root manifest. (SC-4327)
• semgrep ci --no-suppress-errors with --allow-local-builds: when dependency resolution fails and the scan exits with code 2, the reason is now also in the errors of the JSON output (one entry per resolver error or lockfile parse error of each failed subproject, or a generic entry if none was reported; resolver errors include the failed command and the end of its output, with common credential shapes such as URL credentials and Authorization headers redacted), not only in the log. Previously the JSON had no error, so pipelines that read it could not tell why the scan failed. (SC-4348)

Changelog

Sourced from semgrep's changelog.

1.184.0 - 2026-11-05

### Added

• PHP: Improved virtual call resolution for basic trait composition. (CODE-9176)
• Supply Chain: a requirements.txt dependency declared as a version range (litellm>=1.10) or with no version (flask) now produces a finding for every advisory whose affected versions overlap the declared range, in both the Python and native resolvers. Such a finding has no single installed version to confirm, so it needs review. A range line next to a pinned copy of the same package produces no finding of its own, since the pinned copy names the installed version. (SC-4243)
• Set SEMGREP_LOG_JSON_FILE to emit structured execution events with scan metadata alongside existing text output. (SMS-3670)

### Changed

• Scans are slightly faster. The dataflow analyses build the name of each variable with a plain string join, and no longer with Printf and Format. On 6 open-source repos, the scan time was a median of 3% lower, with identical findings. (dataflow-variable-keys)

• go grammar update (v0.25.0):

  • Go source parsing now supports generic type aliases, preserving type parameters, constraints, and alias semantics. Existing alias patterns can match these declarations; spelling generic parameter lists in rule patterns remains unsupported.
  • Go correctly parses unnamed map parameters and results in mixed signatures such as ([]string, int, map[int]int, error), allowing function patterns to match those signatures.
  • Go correctly represents chained indexing such as table[key][next] as nested index expressions, restoring matches for nested-index patterns.

  (go-v0.25.0)

### Fixed

• Semgrep no longer logs credentials embedded in a proxy URL (for example HTTPS_PROXY=http://user:password@proxy:8080) when it reports the configured proxy settings. (proxy-log-redact-userinfo)
• Logs and traces no longer include snippets of the scanned source code when a file fails to parse. Parsing exceptions now report the file, line, column, and the length of the unexpected text instead. Dependency resolution errors for malformed lockfiles are reported the same way. (redact-source-in-telemetry)
• pro: Reduced peak memory for large projects (CODE-10136)
• Supply Chain: the yarn v1 lockfile parser no longer reports a package named "dependencies" with an empty version when a blank line precedes the dependencies block of an entry, and it now keeps that entry's dependency edges. Entries without a version line are reported as parser errors instead of dependencies with an empty version. (SC-4214)
• Gradle module attribution now works for modules whose logical project name does not match their directory (a renamed include or a remapped projectDir in settings.gradle). The resolver's init script reports each project's actual build file, and dependencies are attributed to that file instead of falling back to the root manifest. (SC-4327)
• semgrep ci --no-suppress-errors with --allow-local-builds: when dependency resolution fails and the scan exits with code 2, the reason is now also in the errors of the JSON output (one entry per resolver error or lockfile parse error of each failed subproject, or a generic entry if none was reported; resolver errors include the failed command and the end of its output, with common credential shapes such as URL credentials and Authorization headers redacted), not only in the log. Previously the JSON had no error, so pipelines that read it could not tell why the scan failed. (SC-4348)

Commits

• ac37d1f chore: release 1.184.0
• 4efb491 fix(sca): Stop the yarn v1 parser emitting header lines as packages (semgrep/...
• 2792975 fix(sca): report dependency resolution failures in the JSON output (semgrep/s...
• 6be6128 fix(dist): skip SCA rules when dumping rule partitions (semgrep/semgrep-propr...
• 5d363c7semgrep/semgrep-proprietary#7448
• 47d373d feat(sca): Produce findings for unpinned requirements.txt (semgrep/semgrep-pr...
• 8769aa4semgrep/semgrep-proprietary#7457
• 98b4cba fix(pro): unmarshal one SAST at a time when building the interfile dependency...
• 09e7207 fix: include generated tree-sitter headers in fixtures (semgrep/semgrep-propr...
• e4e0563semgrep/semgrep-proprietary#7447
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions