Update semgrep requirement from <1.60,>=1.50 to >=1.50,<1.61

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.60.0

1.60.0 - 2024-02-08

Added

• Rule syntax: Metavariables by the name of $_ are now anonymous, meaning that they do not unify within a single pattern or across patterns, and essentially just unconditionally specify some expression.

  For instance, the pattern foo($_, $_) may match the code foo(1, 2).

  This will change the behavior of existing rules that use the metavariable $_, if they rely on unification still happening. This can be fixed by simply giving the metavariable a real name like $A. (ea-837)

• Added infrastructure for semgrep supply chain in semgrep-core. Not fully functional yet. (ssc-port)

Fixed

• Output: Semgrep CLI now no longer sometimes interpolated metavariables twice, if the message that was substituted for a metavariable itself contained a valid metavariable to be interpolated (ea-838)

Changelog

Sourced from semgrep's changelog.

Changelog

1.59.1 - 2024-02-02

Added

• taint-mode: Pro: Semgrep can now track taint via static class fields and global variables, such as in the following example:

  static char* x;
  void foo() {
  x = "tainted";
  }
  void bar() {
  sink(x);
  }
  void main() {
  foo();
  bar();
  }
  
  </code></pre>
  </li>
  </ul>
  <h3>Fixed</h3>
  <ul>
  <li>Pro: Make inter-file analysis more tolerant to small bugs, resorting to graceful
  degradation and continuing with the scan, rather than crashing. (pa-3387)</li>
  </ul>
  <h2><a href="https://github.com/returntocorp/semgrep/releases/tag/v1.59.0&quot;&gt;1.59.0&lt;/a> - 2024-01-30</h2>
  <h3>Added</h3>
  <ul>
  <li>Swift: Now supports typed metavariables, such as <code>($X : ty)</code>. (pa-3370)</li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a href="https://github.com/semgrep/semgrep/commit/330ae5cc29d14a5eb1065e52dfb508a5f35cca0a&quot;&gt;&lt;code&gt;330ae5c&lt;/code&gt;&lt;/a> chore: Bump version to 1.60.0</li>
  <li><a href="https://github.com/semgrep/semgrep/commit/19e98252a063dafbf02d3a2c57036f5f7f45d0c7&quot;&gt;&lt;code&gt;19e9825&lt;/code&gt;&lt;/a> fix typo (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9714&quot;&gt;#9714&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/5b9b0f26f0ad99fea5591c43877087d72a921134&quot;&gt;&lt;code&gt;5b9b0f2&lt;/code&gt;&lt;/a> Cron - update semgrep-rules (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9740&quot;&gt;#9740&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/a4106d0800d6a856a928281db27ca87607491342&quot;&gt;&lt;code&gt;a4106d0&lt;/code&gt;&lt;/a> refactor: Move ctype_of_literal to AST_generic_helpers (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9742&quot;&gt;#9742&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/1cf921eda611563ef192234d861d4f271298fad7&quot;&gt;&lt;code&gt;1cf921e&lt;/code&gt;&lt;/a> feat(ci): use semgrep container from semgrep docker org (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9739&quot;&gt;#9739&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/6635628ac7f64567232b5f85f3d79d582715e209&quot;&gt;&lt;code&gt;6635628&lt;/code&gt;&lt;/a> osemgrep: use sarif&gt;=0.3.0 (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9701&quot;&gt;#9701&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/d0539da5395233221c390c3d735545bb1b9eaa69&quot;&gt;&lt;code&gt;d0539da&lt;/code&gt;&lt;/a> Call opam update in install-deps-from-semgrep-core (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9736&quot;&gt;#9736&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/28f4779407282516885c4c2865b4e70d68bfb428&quot;&gt;&lt;code&gt;28f4779&lt;/code&gt;&lt;/a> chore: no double interpolation of messages (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9722&quot;&gt;#9722&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/38b377a6e0df8a2ad220426352e13d12b95e6d2e&quot;&gt;&lt;code&gt;38b377a&lt;/code&gt;&lt;/a> feat(rule writing): anonymous metavariables (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9719&quot;&gt;#9719&lt;/a&gt;)&lt;/li>
  <li><a href="https://github.com/semgrep/semgrep/commit/5be90363199ca71534d87d3967bc8197203cd9d7&quot;&gt;&lt;code&gt;5be9036&lt;/code&gt;&lt;/a> chore(doc): update PRIVACY.md for the findings by product metrics (<a href="https://redirect.github.com/returntocorp/semgrep/issues/9724&quot;&gt;#9724&lt;/a&gt;)&lt;/li>
  <li>Additional commits viewable in <a href="https://github.com/returntocorp/semgrep/compare/v1.50.0...v1.60.0&quot;&gt;compare view</a></li>
  </ul>
  </details>
  <br />
  
  Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
  
  
  Dependabot commands and options
  
  You can trigger Dependabot actions by commenting on this PR:
  
  @dependabot rebase will rebase this PR
  @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  @dependabot merge will merge this PR after your CI passes on it
  @dependabot squash and merge will squash and merge this PR after your CI passes on it
  @dependabot cancel merge will cancel a previously requested merge and block automerging
  @dependabot reopen will reopen this PR if it is closed
  @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud