Bump semgrep from 1.48.0 to 1.60.1 in /export

[dependabot]

Bumps semgrep from 1.48.0 to 1.60.1.

Release notes

Sourced from semgrep's releases.

Release v1.60.1

1.60.1 - 2024-02-09

Added

• Rule syntax: Metavariables by the name of $_ are now anonymous, meaning that they do not unify within a single pattern or across patterns, and essentially just unconditionally specify some expression.

  For instance, the pattern foo($_, $_) may match the code foo(1, 2).

  This will change the behavior of existing rules that use the metavariable $_, if they rely on unification still happening. This can be fixed by simply giving the metavariable a real name like $A. (ea-837)

• Added infrastructure for semgrep supply chain in semgrep-core. Not fully functional yet. (ssc-port)

Changed

• Dataflow: Simplified the IL translation for Python with statements to let symbolic propagation assume that with foo() as x: ... entails x = foo(), so that e.g. Session().execute("...") matches:

  with Session() as s:
      s.execute("SELECT * from T") (CODE-6633)
  

Fixed

• Output: Semgrep CLI now no longer sometimes interpolated metavariables twice, if the message that was substituted for a metavariable itself contained a valid metavariable to be interpolated (ea-838)

Release v1.60.0

1.60.0 - 2024-02-08

Added

• Rule syntax: Metavariables by the name of $_ are now anonymous, meaning that they do not unify within a single pattern or across patterns, and essentially just unconditionally specify some expression.

  For instance, the pattern foo($_, $_) may match the code foo(1, 2).

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.60.1 - 2024-02-09

Added

• Rule syntax: Metavariables by the name of $_ are now anonymous, meaning that they do not unify within a single pattern or across patterns, and essentially just unconditionally specify some expression.

  For instance, the pattern foo($_, $_) may match the code foo(1, 2).

  This will change the behavior of existing rules that use the metavariable $_, if they rely on unification still happening. This can be fixed by simply giving the metavariable a real name like $A. (ea-837)

• Added infrastructure for semgrep supply chain in semgrep-core. Not fully functional yet. (ssc-port)

Changed

• Dataflow: Simplified the IL translation for Python with statements to let symbolic propagation assume that with foo() as x: ... entails x = foo(), so that e.g. Session().execute("...") matches:

  with Session() as s:
      s.execute("SELECT * from T") (CODE-6633)
  

Fixed

• Output: Semgrep CLI now no longer sometimes interpolated metavariables twice, if the message that was substituted for a metavariable itself contained a valid metavariable to be interpolated (ea-838)

1.59.1 - 2024-02-02

Added

• taint-mode: Pro: Semgrep can now track taint via static class fields and global variables, such as in the following example:

  static char* x;
  void foo() {

... (truncated)

Commits

• 6060f2e chore: Bump version to 1.60.1
• 98925c9 AST_to_IL: Python: Simplify with-stmts translation (#9735)
• d1aac00 Fix tests.jsonnet syntax error and runtine error in release.yml (#9745)
• c6b5b10 fix(pro): Add kind to Dataflow_svalue.constness type (#9741)
• daf27b3 Update README.md (#9744)
• 19e9825 fix typo (#9714)
• 5b9b0f2 Cron - update semgrep-rules (#9740)
• a4106d0 refactor: Move ctype_of_literal to AST_generic_helpers (#9742)
• 1cf921e feat(ci): use semgrep container from semgrep docker org (#9739)
• 6635628 osemgrep: use sarif>=0.3.0 (#9701)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1826.