chore(deps-dev): bump semgrep from 1.93.0 to 1.94.0

[dependabot]

Bumps semgrep from 1.93.0 to 1.94.0.

Release notes

Sourced from semgrep's releases.

Release v1.94.0

1.94.0 - 2024-10-30

Fixed

• pro: taint-mode: Semgrep should no longer confuse a return in a lambda with a return in its enclosing function.

  E.g. In the example below the return value of foo is NOT tainted:

  function foo() {
      bar(() => taint);
      return ok;
  } (code-7657)
  

• OCaml: matching will now recognized "local open" so that a pattern like Foo.bar ... will now correctly match code such as let open Foo in bar 1 or Foo.(bar 1) in addition to the classic Foo.bar 1. (local_open)

• Project files lacking sufficient read permissions are now skipped gracefully by semgrep. (saf-1598)

• Semgrep will now print stderr and additional debugging info when semgrep-core exits with a fatal error code but still returns a json repsonse (finishes scanning) (saf-1672)

• semgrep ci should parse correctly git logs to compute the set of contributors even if some authors have special characters in their names. (saf-1681)

Changelog

Sourced from semgrep's changelog.

1.94.0 - 2024-10-30

Fixed

• pro: taint-mode: Semgrep should no longer confuse a return in a lambda with a return in its enclosing function.

  E.g. In the example below the return value of foo is NOT tainted:

  function foo() {
      bar(() => taint);
      return ok;
  } (code-7657)
  

• OCaml: matching will now recognized "local open" so that a pattern like Foo.bar ... will now correctly match code such as let open Foo in bar 1 or Foo.(bar 1) in addition to the classic Foo.bar 1. (local_open)

• Project files lacking sufficient read permissions are now skipped gracefully by semgrep. (saf-1598)

• Semgrep will now print stderr and additional debugging info when semgrep-core exits with a fatal error code but still returns a json repsonse (finishes scanning) (saf-1672)

• semgrep ci should parse correctly git logs to compute the set of contributors even if some authors have special characters in their names. (saf-1681)

Commits

• 429326f chore: release version 1.94.0
• 459dd34semgrep/semgrep-proprietary#2524
• d48d887semgrep/semgrep-proprietary#2523
• 164b7e8semgrep/semgrep-proprietary#2519
• 4c820d1 refactor: Keep lambdas CFGs separate from the enclosing CFG (semgrep/semgrep-...
• 6f38101semgrep/semgrep-proprietary#2503
• cc4eb17 Parse correctly git log for contributions, handle weird chars (semgrep/semgre...
• 25622f6 Log more info for raise Impossible in SubAST_generic.ml (semgrep/semgrep-prop...
• 87faf1d fix: Bump/mirror some pre-commit and pytest stuff from OSS to pro (semgrep/se...
• 1564a1a Skip files and folders lacking read access permissions (semgrep/semgrep-propr...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

Changelog requirements

• any of:
  • -title ~= ^feat
  • label = need changelog
  • label = skip changelog

Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?:

🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0