[dependabot]

Bumps the semgrep group in /.github with 1 update: semgrep.

Updates semgrep from 1.180.0 to 1.181.0

Release notes

Sourced from semgrep's releases.

Release v1.181.0

1.181.0 - 2026-10-14

### Changed

• semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)

• Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)

• pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)

• go grammar update (v0.23.4):

  • Go target parsing now supports composite type-set constraints and shorthand union constraints on type parameters, preserving underlying-type markers and all union members. Literal generic rule-pattern syntax remains unchanged.
  • Go target parsing now supports embedded generic struct fields, including pointer and package-qualified embeddings, while retaining their type arguments.
  • Go target parsing now supports standalone generic function instantiations with multiple or composite type arguments, such as Pair[int, string] and Identity[[]int], including qualified function names.
  • Go target parsing now accepts Unicode decimal digits after the first character of an identifier, including Arabic-Indic and Devanagari digits.

  (go-v0.23.4)

• Hack grammar update:

  • Hack target parsing now supports capability lists on functions, methods, function types, lambdas, and anonymous functions, including empty lists and context-dependent capabilities.
  • Hack target parsing now supports context constants with capability bounds or initializers, preserving the distinction between super bounds, as bounds, and assigned capabilities. Unbounded abstract context constants retain their existing representation limitation.
  • Hack target parsing now supports concrete and abstract enum classes with typed members, plus qualified and unqualified enum class labels.
  • Hack target parsing now supports function and static-method references with empty or explicit type arguments, such as foo<> and MyClass::bar.
  • Hack target parsing now preserves type arguments on calls and constructors such as foo(), $obj->bar(...), and new MyClass(...), matching other languages' typed-call representation.
  • Hack target parsing now supports expression-tree literals such as Example1 + 2, preserving the visitor and body text. Embedded DSL bodies remain opaque rather than being parsed as Hack expressions.
  • Hack target parsing now supports file-level attributes such as <<file: SomeAttribute(...)>>, preserving attribute names and arguments.
  • Hack target parsing now supports internal visibility on methods and properties, keeping it distinct from public, protected, and private visibility.
  • Hack target parsing now accepts namespace-relative names such as namespace\run() and include/require member names in piped expressions.

  (hack-1a7ded90288189746c54861ac144ede97df95081)

### Fixed

• pro: Historical secrets scanning no longer aborts when preparatory git gc fails. (SCRT-982-historical-gc-nonfatal)
• Supply Chain: lockfileless Gradle resolution now tells the dependency graph plugin where to write its report, so builds that relocate their build directory resolve instead of failing. When the plugin writes no report, the scan reports a resolution error that includes the Gradle log instead of crashing on the missing file. (code-9953)
• Supply Chain: lockfileless Gradle and Maven scans now report incomplete dependency resolution when dependencies or transitive metadata cannot be resolved. Registry HTTP failures include the affected URL when available. (sc-3358)

### Infra/Release Changes

• Forward optional job context when registering CLI scans. (SMS-3333)

Changelog

Sourced from semgrep's changelog.

1.181.0 - 2026-10-14

### Changed

• semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)

• Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)

• pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)

• go grammar update (v0.23.4):

  • Go target parsing now supports composite type-set constraints and shorthand union constraints on type parameters, preserving underlying-type markers and all union members. Literal generic rule-pattern syntax remains unchanged.
  • Go target parsing now supports embedded generic struct fields, including pointer and package-qualified embeddings, while retaining their type arguments.
  • Go target parsing now supports standalone generic function instantiations with multiple or composite type arguments, such as Pair[int, string] and Identity[[]int], including qualified function names.
  • Go target parsing now accepts Unicode decimal digits after the first character of an identifier, including Arabic-Indic and Devanagari digits.

  (go-v0.23.4)

• Hack grammar update:

  • Hack target parsing now supports capability lists on functions, methods, function types, lambdas, and anonymous functions, including empty lists and context-dependent capabilities.
  • Hack target parsing now supports context constants with capability bounds or initializers, preserving the distinction between super bounds, as bounds, and assigned capabilities. Unbounded abstract context constants retain their existing representation limitation.
  • Hack target parsing now supports concrete and abstract enum classes with typed members, plus qualified and unqualified enum class labels.
  • Hack target parsing now supports function and static-method references with empty or explicit type arguments, such as foo<> and MyClass::bar.
  • Hack target parsing now preserves type arguments on calls and constructors such as foo(), $obj->bar(...), and new MyClass(...), matching other languages' typed-call representation.
  • Hack target parsing now supports expression-tree literals such as Example1 + 2, preserving the visitor and body text. Embedded DSL bodies remain opaque rather than being parsed as Hack expressions.
  • Hack target parsing now supports file-level attributes such as <<file: SomeAttribute(...)>>, preserving attribute names and arguments.
  • Hack target parsing now supports internal visibility on methods and properties, keeping it distinct from public, protected, and private visibility.
  • Hack target parsing now accepts namespace-relative names such as namespace\run() and include/require member names in piped expressions.

  (hack-1a7ded90288189746c54861ac144ede97df95081)

### Fixed

• pro: Historical secrets scanning no longer aborts when preparatory git gc fails. (SCRT-982-historical-gc-nonfatal)
• Supply Chain: lockfileless Gradle resolution now tells the dependency graph plugin where to write its report, so builds that relocate their build directory resolve instead of failing. When the plugin writes no report, the scan reports a resolution error that includes the Gradle log instead of crashing on the missing file. (code-9953)
• Supply Chain: lockfileless Gradle and Maven scans now report incomplete dependency resolution when dependencies or transitive metadata cannot be resolved. Registry HTTP failures include the affected URL when available. (sc-3358)

### Infra/Release Changes

• Forward optional job context when registering CLI scans. (SMS-3333)

Commits

• 72d3525 chore: release 1.181.0
• 51602ad feat(sca): Report unpinned requirements.txt dependencies instead of skipping ...
• 3be31edsemgrep/semgrep-proprietary#7161
• 460ef57 fix(sca): Pin the Gradle dependency graph report dir and report a missing gra...
• 945793a fix(ci): unlink openssl@3 before brew installs on macOS jobs (CODE-10023) (se...
• 2c029cd feat(cli): Share async config fetching between scan and ci (semgrep/semgrep-p...
• 7cae498 feat(cli): forward opaque job context at scan registration (semgrep/semgrep-p...
• d8345fd fix(grammar-update): Claude output budget and c-sharp-pro fyi.list (semgrep/s...
• 14a2d04semgrep/semgrep-proprietary#7199
• ad19937 chore: regenerate parsers with tree-sitter 0.26.3 where possible (semgrep/sem...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions