[dependabot]

Bumps the semgrep group in /.github with 1 update: semgrep.

Updates semgrep from 1.182.1 to 1.183.0

Release notes

Sourced from semgrep's releases.

Release v1.183.0

1.183.0 - 2026-10-29

### Added

• The --help output of semgrep subcommands now includes a "THIRD-PARTY LICENSES" section linking to the licenses and notices for Semgrep's open source dependencies at https://semgrep.dev/cli-credits. (cli-credits)
• Pro: Supply Chain now records which Go module requires which when dependency paths are enabled and local builds are allowed, so transitive Go findings can show the dependency path. (SC-4268)

### Changed

• Semgrep no longer ships binaries for Intel Macs; 1.182 is the last release that supports them. On Intel Macs, use the semgrep/semgrep Docker image; on Apple Silicon, use a native arm64 Python. (drop-intel-macos)

• Speed up scans with many rules that share file prefilter conditions by checking each condition once per file. (prefilter-predicate-memo)

• semgrep ci --no-suppress-errors now exits with code 2 (instead of 0) when dependency resolution fails for a subproject while local builds are allowed (--allow-local-builds): a build or package manager command fails, a lockfile cannot be parsed at all, or a build succeeds but reports an incomplete dependency list (for example, a registry refused a request). The affected dependency sources are listed in the scan output and the scan no longer reports that it completed successfully. Findings from the other subprojects are still reported. The default behavior, where errors are suppressed, is unchanged, and so is any scan without --allow-local-builds. Semgrep Managed Scanning scans are not affected. (SC-3613)

• bash grammar update (v0.25.1):

  • Bash arithmetic ($(( )), $[ ], (( )), C-style for headers) is now translated into operator trees with bash precedence, so patterns such as $(( $X * 2 )) match structurally. $((...)) is no longer confused with $(...).
  • Bash patterns accept a lone ... before done, fi or }, e.g. while ...; do ... done, and until loops now parse as loops.
  • Bash words containing # (x=foo#bar) are no longer truncated, and arguments after a redirect or heredoc delimiter stay with their command.
  • Many Bash constructs that failed to parse now parse, e.g. $[ ], time ( ... ), extglob in case and [[ ]], and if function bodies.

  (bash-v0.25.1)

• clojure grammar update (v0.0.13):

  • Clojure source parsing now accepts reader-evaluated metadata, such as ^#=(keyword "a") [1 2], including the legacy #^ prefix. Semgrep does not execute reader evaluation, and metadata remains ignored during matching.
  • Clojure source parsing now supports reader conditionals inside symbolic values, such as ## #?(:clj Inf :cljs NaN), retaining the conditional branches without evaluating them.

  (clojure-v0.0.13)

• swift grammar update (0.5.0):

  • Swift parsing now supports type and value parameter packs, including each/repeat expansions and pack constraints.
  • Swift parsing now supports if and switch expressions used as variable initializers.
  • Swift parsing now supports macro declarations with typed signatures and #externalMacro definitions. This does not implement macro expansion.
  • Swift property observers now retain their willSet/didSet bodies and parameters separately from property initializers.
  • Swift parsing now supports borrowing, consuming, package, and distributed modifiers while preserving their distinct spellings.
  • Swift parsing now supports #unavailable conditions and distinguishes them from #available conditions. Both are mapped as #… expression nodes (not boolean Not) so patterns like if !$X do not match availability checks.
  • Swift parsing now supports member access on parenthesized existential types, such as (any P).self, and preserves the underlying parenthesized existential or opaque type.
  • Swift parsing now supports references to the bitwise AND operator using (&).

  (swift-0.5.0)

### Fixed

• The Cursor hooks installed by semgrep mcp now track edited files separately for each Cursor conversation, so one window's stop scan no longer scans or discards another conversation's edits. (mcp-hook-cache-per-conversation)
• The semgrep mcp server's semgrep_scan tool now only scans files inside the client's workspace root, or the server's working directory when the client reports none. Set SEMGREP_MCP_ALLOW_SCAN_OUTSIDE_WORKSPACE=true to scan files outside it. (mcp-scan-workspace-roots)
• Interfile scans no longer fail with Failure: Failed to unmarshal cached value: Exception during parallelization: Exception.Timeout(...) when a taint configuration timeout fires at an unlucky moment. The timeout now only skips the affected rule and file, as intended. (CODE-9810)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.183.0 - 2026-10-29

### Added

• The --help output of semgrep subcommands now includes a "THIRD-PARTY LICENSES" section linking to the licenses and notices for Semgrep's open source dependencies at https://semgrep.dev/cli-credits. (cli-credits)
• Pro: Supply Chain now records which Go module requires which when dependency paths are enabled and local builds are allowed, so transitive Go findings can show the dependency path. (SC-4268)

### Changed

• Semgrep no longer ships binaries for Intel Macs; 1.182 is the last release that supports them. On Intel Macs, use the semgrep/semgrep Docker image; on Apple Silicon, use a native arm64 Python. (drop-intel-macos)

• Speed up scans with many rules that share file prefilter conditions by checking each condition once per file. (prefilter-predicate-memo)

• semgrep ci --no-suppress-errors now exits with code 2 (instead of 0) when dependency resolution fails for a subproject while local builds are allowed (--allow-local-builds): a build or package manager command fails, a lockfile cannot be parsed at all, or a build succeeds but reports an incomplete dependency list (for example, a registry refused a request). The affected dependency sources are listed in the scan output and the scan no longer reports that it completed successfully. Findings from the other subprojects are still reported. The default behavior, where errors are suppressed, is unchanged, and so is any scan without --allow-local-builds. Semgrep Managed Scanning scans are not affected. (SC-3613)

• bash grammar update (v0.25.1):

  • Bash arithmetic ($(( )), $[ ], (( )), C-style for headers) is now translated into operator trees with bash precedence, so patterns such as $(( $X * 2 )) match structurally. $((...)) is no longer confused with $(...).
  • Bash patterns accept a lone ... before done, fi or }, e.g. while ...; do ... done, and until loops now parse as loops.
  • Bash words containing # (x=foo#bar) are no longer truncated, and arguments after a redirect or heredoc delimiter stay with their command.
  • Many Bash constructs that failed to parse now parse, e.g. $[ ], time ( ... ), extglob in case and [[ ]], and if function bodies.

  (bash-v0.25.1)

• clojure grammar update (v0.0.13):

  • Clojure source parsing now accepts reader-evaluated metadata, such as ^#=(keyword "a") [1 2], including the legacy #^ prefix. Semgrep does not execute reader evaluation, and metadata remains ignored during matching.
  • Clojure source parsing now supports reader conditionals inside symbolic values, such as ## #?(:clj Inf :cljs NaN), retaining the conditional branches without evaluating them.

  (clojure-v0.0.13)

• swift grammar update (0.5.0):

  • Swift parsing now supports type and value parameter packs, including each/repeat expansions and pack constraints.
  • Swift parsing now supports if and switch expressions used as variable initializers.
  • Swift parsing now supports macro declarations with typed signatures and #externalMacro definitions. This does not implement macro expansion.
  • Swift property observers now retain their willSet/didSet bodies and parameters separately from property initializers.
  • Swift parsing now supports borrowing, consuming, package, and distributed modifiers while preserving their distinct spellings.
  • Swift parsing now supports #unavailable conditions and distinguishes them from #available conditions. Both are mapped as #… expression nodes (not boolean Not) so patterns like if !$X do not match availability checks.
  • Swift parsing now supports member access on parenthesized existential types, such as (any P).self, and preserves the underlying parenthesized existential or opaque type.
  • Swift parsing now supports references to the bitwise AND operator using (&).

  (swift-0.5.0)

### Fixed

• The Cursor hooks installed by semgrep mcp now track edited files separately for each Cursor conversation, so one window's stop scan no longer scans or discards another conversation's edits. (mcp-hook-cache-per-conversation)
• The semgrep mcp server's semgrep_scan tool now only scans files inside the client's workspace root, or the server's working directory when the client reports none. Set SEMGREP_MCP_ALLOW_SCAN_OUTSIDE_WORKSPACE=true to scan files outside it. (mcp-scan-workspace-roots)
• Interfile scans no longer fail with Failure: Failed to unmarshal cached value: Exception during parallelization: Exception.Timeout(...) when a taint configuration timeout fires at an unlucky moment. The timeout now only skips the affected rule and file, as intended. (CODE-9810)
• The Semgrep source distribution on PyPI is once again published with provenance. (CODE-10070)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions