chore(deps): update pre-commit repositories

[alma-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
commitizen-tools/commitizen	repository	patch	v3.30.0 -> v3.30.1
returntocorp/semgrep	repository	minor	v1.95.0 -> v1.96.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

commitizen-tools/commitizen (commitizen-tools/commitizen)

v3.30.1

Compare Source

Refactor

• cli: replace magic number 0 with ExitCode.EXPECTED_EXIT
• defaults: disallow style as None
• cz_customize: return empty string for info, example, schema and schema_pattern if not provided

returntocorp/semgrep (returntocorp/semgrep)

v1.96.0

Compare Source

1.96.0 - 2024-11-07

Added

• The pro engine now handles duplicate function names in C. When duplicate
  functions are found, we assume that any of the duplicated functions could be
  called. For example, if the function foo is defined in two different files,
  taint errors will be reported for both instances:

  // "a/test.h"
  void foo(int x) {
      //deepruleid: dup-symbols
      sink(x);
  }
  
  // "b/test.h"
  void foo(int x) {
      //deepruleid: dup-symbols
      sink(x);
  }
  
  // "main.c"
  #ifdef HEADER_A
      #include "a/test.h"
  #else
      #include "b/test.h"
  #endif
  
  int main() {
      int x = source();
      foo(x);
  }
  ``` (code-7654)
  

Changed

• Reduced memory allocations while processing nosemgrep comments, improving memory use and time for scans with a large number of findings. (nosem-mem)

Fixed

• Optimized taint-mode (only in Pro) to scale better when there is a large number
  of matches of sources/propagators/sanitizers/sinks within a function. (flow-83)
• Fixed a bug in the supply chain scanner's gradle lockfile parser. Previously, semgrep would fail to parse
  any gradle lockfile which did not start with a specific block comment. Now, semgrep will parse gradle
  lockfiles correctly by ignoring the comment (allowing any or no comment at all to exist). (gh-10508)
• Exceptions thrown during the processing of a target should not fail
  the whole scan anymore (regression introduced in 1.94.0). The scan will
  have an exit code of 0 instead of 2 (unless the user passed --strict in which
  case it will exit with code 2). (incid-110)
• Fix exponential parsing time with generic mode on input containing many
  unclosed braces on the same line. (saf-1667)
• Fix regexp parsing error occurring during ReDoS analysis when encountering
  a character class starting with [: such as [:a-z]. (saf-1693)
• Fix in semgrep scan: anchored semgrepignore patterns for folders such
  as /tests are now honored properly. Such patterns had previously no
  effect of target file filtering. (semgrepignore-anchored-dirs)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

⏳E2E tests are currently running.
➡️ You can follow their progression here.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[github-actions]

❌ E2E tests have failed.
➡️ You can find the results here.