Bump semgrep from 0.91.0 to 1.55.2 in /dependencies/python

[dependabot]

Bumps semgrep from 0.91.0 to 1.55.2.

Release notes

Sourced from semgrep's releases.

Release v1.55.2

1.55.2 - 2024-01-05

Fixed

• taint-mode: Semgrep was missing some sources occurring inside type expressions, for example:

  char *p = new char[source(x)];
  sink(x);

  Now, if x is tainted by side-effect, Semgrep will check x inside the type expression char[...] and record it as tainting, and generate a finding for sink(x). (pa-3313)

• taint-mode: C/C++: Sanitization by side-effect was not working correctly for ptr->fld l-values. In particular, if ptr is tainted, and then ptr->fld is sanitized, Semgrep will now correctly consider ptr->fld as clean. (pa-3328)

Release v1.55.1

1.55.1 - 2024-01-04

Fixed

• Honor temporary folder specified via the TMPDIR environment variable (or equivalent on Windows) in some instances where it used to be hardcoded as /tmp. (gh-9534)
• Fix pipfile manifest parser error (sc-1084)

Release v1.54.1

1.54.1 - 2023-12-20

No significant changes.

Release v1.54.0

1.54.0 - 2023-12-19

Added

• Pro only: taint-mode: In a function/method call, it is now possible to arbitrarily propagate taint between arguments and the callee. For example in C, one can propagate taint from the second argument of strcat to the first, that is,

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.55.2 - 2024-01-05

Fixed

• taint-mode: Semgrep was missing some sources occurring inside type expressions, for example:

  char *p = new char[source(x)];
  sink(x);

  Now, if x is tainted by side-effect, Semgrep will check x inside the type expression char[...] and record it as tainting, and generate a finding for sink(x). (pa-3313)

• taint-mode: C/C++: Sanitization by side-effect was not working correctly for ptr->fld l-values. In particular, if ptr is tainted, and then ptr->fld is sanitized, Semgrep will now correctly consider ptr->fld as clean. (pa-3328)

1.55.1 - 2024-01-04

Fixed

• Honor temporary folder specified via the TMPDIR environment variable (or equivalent on Windows) in some instances where it used to be hardcoded as /tmp. (gh-9534)
• Fix pipfile manifest parser error (sc-1084)

1.55.0 - 2024-01-02

Changed

• The rule option commutative_compop has been renamed to symmetric_eq. It is deprecated and will be removed after the 1.60.0 release. (gh-9496)

1.54.3 - 2023-12-22

Added

... (truncated)

Commits

• 3e347d7 chore: Bump version to 1.55.2
• a48e231 Factorize get_token_steps in .jsonnet (#9549)
• d02c388 Merge pull request #9541 from semgrep/release-1.55.1
• 0aee59f Factorize test-pro-rules with check-semgrep-pro (#9548)
• c15f706 simplify release.jsonnet, remove useless intermediate inputs job (#9547)
• a9e9972 tainting: Check expressions occurring inside types (#9512)
• 6bb58aa Fix release-homebrew.jsonnet (#9545)
• 7739a7b tainting: C/C++: Correctly check taint for ptr->fld l-values (#9514)
• 2378927 New release-homebrew.jsonnet (#9543)
• 4510cc9 feat: Use function for tree sitter parser line,col -> bytepos conversion (#9542)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1515.