chore(deps): update dependency semgrep to v1.118.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
semgrep	1.116.0 -> 1.118.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

returntocorp/semgrep (semgrep)

v1.118.0

Compare Source

Fixed

• Pro: Failure to parse a package.json file when analysing JavaScript or
  TypeScript is no longer a fatal error. (code-8227)

• taint-mode: Fixed bug in taint "auto-cleaning" where we automatically clean the
  LHS of an assigmnet if the RHS is clean, provided that the LHS is not subject to
  any "side-effects". In some cases, this could cause the taint analysis to timeout.
  Some combinations of rules and repos will see a major perf improvement, in other
  cases it may not be noticeable. (code-8288)

• In a Semgrep rule's metadata section, two fields may provide URLs:

  • source: populated dynamically by the Semgrep registry serving the rule, it's a URL that
    offers information about the rule.
  • source-rule-url: optional string, a URL for the source of inspiration for the rule.

  The SARIF format supports only one URL under the field helpUri.
  Previously, Semgrep populated the SARIF helpUri field only with metadata.source.
  This fix is to use metadata.source if available, otherwise falling back to metadata.source-rule-url.

  Contributed by @​candrews. (gh-10891)

v1.117.0

Compare Source

Added

• Add temporary backward compatibility in Semgrepignore v2 for patterns
  that start with ./. For example, the pattern ./*.py should be written as
  /*.py to have the desired effect of excluding the .py files
  located in the same directory as the .semgrepignore file containing
  the pattern.
  To minimize surprises for users switching to Semgrepignore v2,
  we'll be interpreting automatically ./*.py as /*.py for the time
  being so as to match the legacy Semgrepignore v1 behavior. Users should not
  rely on this since it doesn't comply with the Gitignore/Semgrepignore
  standard and will be removed in the future. (tolerate-semgrepignore-v1-dotslash)
• Target file selection now uses
  Semgrepignore v2 by default. This brings the behavior of the Semgrepignore file
  exclusions closer to Git and .gitignore files. There can now
  be multiple .semgrepignore files in the project. The .semgrepignore file
  in the current folder is no longer consulted unless it in the project.
  Negated patterns are now supported such as !scanme.py as with Gitignore.
  Some bugs were fixed. (use-semgrepignore-v2)

Changed

• Upgrade Semgrep from OCaml 5.2.1 to 5.3.0 (#​3)

Fixed

• In Semgrepignore v2, allow wildcards * and ? to match file names with a leading period. This matches the behavior of Gitignore and Semgrepignore v1. (semgrepignore-dotfiles)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ API	spectral	1		0	0	1.76s
⚠️ BASH	bash-exec	6		1	0	0.01s
✅ BASH	shellcheck	6		0	0	0.13s
✅ BASH	shfmt	6	0	0	0	0.56s
✅ COPYPASTE	jscpd	yes		no	no	3.23s
✅ DOCKERFILE	hadolint	129		0	0	29.28s
✅ JSON	jsonlint	20		0	0	0.2s
✅ JSON	v8r	22		0	0	15.68s
⚠️ MARKDOWN	markdownlint	267	0	302	0	21.67s
✅ MARKDOWN	markdown-table-formatter	267	0	0	0	171.31s
⚠️ PYTHON	bandit	215		66	0	3.04s
✅ PYTHON	black	215	0	0	0	5.11s
✅ PYTHON	flake8	215		0	0	2.03s
✅ PYTHON	isort	215	0	0	0	1.38s
✅ PYTHON	mypy	215		0	0	12.77s
✅ PYTHON	pylint	215		0	0	22.74s
✅ PYTHON	ruff	215	0	0	0	0.7s
✅ REPOSITORY	checkov	yes		no	no	35.67s
✅ REPOSITORY	git_diff	yes		no	no	0.8s
⚠️ REPOSITORY	grype	yes		27	no	29.53s
✅ REPOSITORY	secretlint	yes		no	no	9.51s
✅ REPOSITORY	syft	yes		no	no	1.79s
✅ REPOSITORY	trivy	yes		no	no	11.22s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.62s
⚠️ REPOSITORY	trufflehog	yes		1	no	58.26s
✅ SPELL	cspell	718		0	0	13.15s
⚠️ SPELL	lychee	349		30	0	39.42s
✅ XML	xmllint	3	0	0	0	1.16s
✅ YAML	prettier	160	0	0	0	3.54s
✅ YAML	v8r	103		0	0	22.87s
✅ YAML	yamllint	161		0	0	2.85s

See detailed report in MegaLinter reports