Bump semgrep from 1.130.0 to 1.135.0

[dependabot]

Bumps semgrep from 1.130.0 to 1.135.0.

Release notes

Sourced from semgrep's releases.

Release v1.135.0

1.135.0 - 2025-09-03

No significant changes.

Release v1.134.0

1.134.0 - 2025-08-27

Added

• pro: First version of inter-file (whole-program) analysis for Scala. (code-9029)

Release v1.133.0

1.133.0 - 2025-08-22

Added

• Pro: improved prefiltering for interfile rules. This allows the engine to skip interfile rules earlier in the process when we determine they cannot match in a given scan, which should improve performance. (code-8524)
• Semgrep will now display emotional support ascii art and a backtrace, with function names and sometimes files/line #s, when it segfaults, or receives other similar critical signals (pretty-segv)

Fixed

• Pro: Fixed a bug that prevented taint tracking through new in some cases. (code-9047)
• We now substitute metavariables for their values in a deterministic order to ensure keys for match-based IDs are stable. (gh-4459)
• Fixed incorrect YAML parsing of strings like nan as well as some more obscure cases that were interpreted as a float instead of a string. This might affect any area of Semgrep that deals with YAML files containing the string nan. (yaml-float-parsing)

Release v1.132.0

1.132.0 - 2025-08-14

Added

• PHP: When enabling option taint_assume_safe_booleans the return values of boolval, is_bool, and || will be considered safe. When enabling taint_assume_safe_numbers the return values of intval, floatval, +, -, *, / and % will also be considered safe. (php)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.135.0 - 2025-09-03

No significant changes.

1.134.0 - 2025-08-27

Added

• pro: First version of inter-file (whole-program) analysis for Scala. (code-9029)

1.133.0 - 2025-08-22

Added

• Pro: improved prefiltering for interfile rules. This allows the engine to skip interfile rules earlier in the process when we determine they cannot match in a given scan, which should improve performance. (code-8524)
• Semgrep will now display emotional support ascii art and a backtrace, with function names and sometimes files/line #s, when it segfaults, or receives other similar critical signals (pretty-segv)

Fixed

• Pro: Fixed a bug that prevented taint tracking through new in some cases. (code-9047)
• We now substitute metavariables for their values in a deterministic order to ensure keys for match-based IDs are stable. (gh-4459)
• Fixed incorrect YAML parsing of strings like nan as well as some more obscure cases that were interpreted as a float instead of a string. This might affect any area of Semgrep that deals with YAML files containing the string nan. (yaml-float-parsing)

1.132.1 - 2025-08-14

No significant changes.

1.132.0 - 2025-08-14

Added

... (truncated)

Commits

• a81e68d chore: release version 1.135.0
• 8944bb3semgrep/semgrep-proprietary#4567
• d2eb709 feat(mcp): add basic metrics when mcp calls semgrep to scan (semgrep/semgrep-...
• f8f21e2semgrep/semgrep-proprietary#4559
• 0bb9ad0semgrep/semgrep-proprietary#4554
• 75a6979semgrep/semgrep-proprietary#4555
• 7fd4904 fix(UFile): handle interrupted system calls during reads (semgrep/semgrep-pro...
• 4692559 chore(dep-resolution): pipe local-builds flag through to ocaml (semgrep/semgr...
• fdb024bsemgrep/semgrep-proprietary#4488
• 9c8a2fbsemgrep/semgrep-proprietary#4548
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #203.