Update semgrep requirement from ~=1.41.0 to ~=1.42.0

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.42.0

1.42.0 - 2023-09-29

Added

• Rule-writing: Capture group metavariables used in regexes in a metavariable-regex can now introduce their bindings into the scope of the pattern, similarly to metavariable-pattern.

  For instance, in the pattern: patterns:

  • pattern: | foo($BAR)
  • metavariable-regex: metavariable: $BAR regex: "(?.*)end"
  • focus-metavariable: $X

  the rule will match the contents of what is inside of the foo to the regex that binds anything before an "end" to the metavariable $X. This metavariable can then be focused at a later time, or processed somewhere above this pattern. (pa-3011)

• Try-catch-else-finally is now supported in taint analysis.

  This change also includes some updates to our analysis. Previously we assumed that any statement inside the try clause may throw an exception, but now only function calls are assumed to possibly throw exceptions.

  Throw statements always throw an exception as it was before.

  This kind of statement is supported in languages including Python, Ruby, and Julia.

  Python example:

  def f(tainted_input):
    try:
      a = 0
      b = 0
      c = tainted_input
      d = tainted_input
    except RuntimeError:
      a = tainted_input
      c = sanitize(c)
    else:
      b = tainted_input
    finally:
      d = sanitize(d)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.42.0 - 2023-09-29

Added

• Rule-writing: Capture group metavariables used in regexes in a metavariable-regex can now introduce their bindings into the scope of the pattern, similarly to metavariable-pattern.

  For instance, in the pattern: patterns:

  • pattern: | foo($BAR)
  • metavariable-regex: metavariable: $BAR regex: "(?.*)end"
  • focus-metavariable: $X

  the rule will match the contents of what is inside of the foo to the regex that binds anything before an "end" to the metavariable $X. This metavariable can then be focused at a later time, or processed somewhere above this pattern. (pa-3011)

• Try-catch-else-finally is now supported in taint analysis.

  This change also includes some updates to our analysis. Previously we assumed that any statement inside the try clause may throw an exception, but now only function calls are assumed to possibly throw exceptions.

  Throw statements always throw an exception as it was before.

  This kind of statement is supported in languages including Python, Ruby, and Julia.

  Python example:

  def f(tainted_input):
    try:
      a = 0
      b = 0
      c = tainted_input
      d = tainted_input
    except RuntimeError:
      a = tainted_input
      c = sanitize(c)
    else:
      b = tainted_input
    finally:
      d = sanitize(d)

... (truncated)

Commits

• d2cbd3b chore: Bump version to 1.42.0
• be7b81d fixes and improvements to docker image promotion and set workflows (#8864)
• 7900f91 fix semgrep.js s3 upload for the millionth time (#8866)
• 9135b27 fix(cli): clarify that the user should run semgrep install-semgrep-pro and no...
• 83f6e8a comment the test semgrep js workflow, prevent release (#8863)
• 35373f7 refactor: kill ForIn (#8853)
• 593ba45 chore: Show conflicts when running make dev-setup (#8852)
• 469e6a1 Get rid of Rule.languages (#8851)
• 41dbf18 Extensive Semgrep JS Testing (#8773)
• 8e79682 fix(secrets): permit both CI and scan config IDs (#8856)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov-commenter]

Codecov Report

Merging #55 (daad9bc) into main (e2dabb5) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main      #55   +/-   ##
=======================================
  Coverage   96.14%   96.14%           
=======================================
  Files          42       42           
  Lines        1610     1610           
=======================================
  Hits         1548     1548           
  Misses         62       62