Bump semgrep from 1.130.0 to 1.138.0

[dependabot]

Bumps semgrep from 1.130.0 to 1.138.0.

Release notes

Sourced from semgrep's releases.

Release v1.138.0

1.138.0 - 2025-09-25

Added

• pro: scala: Method dispatching through traits (code-9092)

Changed

• Pro: additionally improved prefiltering for taint rules, especially when using taint labels. This allows for the generation of more specific conditions than the previously released version (v1.133.0). (code-9097)

Fixed

• pro: python: Fix resolution of implicit namespace modules (code-9008)
• We now filter SEMGREP_APP_TOKEN from any request made to non semgrep URLs passed to -f/-c/--config during config/rules fetching. (gh-11016)
• Typescript: Made it so that the pattern var $X = $FUNC($REQ, $RES, ...) {...} no longer fails to parse. (saf-2159)
• pro: improved performance of tsconfig.json matching for Typescript projects that contain multiple tsconfig.jsons. (saf-2163)
• Semgrep no longer fails to validate a config when a rule lang is capitalized (Introduced 1.137.0) (saf-2247)

Release v1.137.0

1.137.0 - 2025-09-17

Added

• pro: typescript: Improved name resolution for destructuring parameters. (code-9088)
• Added a new semgrep mcp subcommand, which runs the Semgrep MCP server, which previously used to live at https://github.com/semgrep/mcp. That repository will be deprecated as of this release, and future MCP contributions / issues should go into this repo. (saf-2239)

Changed

• Update semgrep-interfaces to only accept valid lanugage keys for editor (PR-4600)

Fixed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.138.0 - 2025-09-25

Added

• pro: scala: Method dispatching through traits (code-9092)

Changed

• Pro: additionally improved prefiltering for taint rules, especially when using taint labels. This allows for the generation of more specific conditions than the previously released version (v1.133.0). (code-9097)

Fixed

• pro: python: Fix resolution of implicit namespace modules (code-9008)
• We now filter SEMGREP_APP_TOKEN from any request made to non semgrep URLs passed to -f/-c/--config during config/rules fetching. (gh-11016)
• Typescript: Made it so that the pattern var $X = $FUNC($REQ, $RES, ...) {...} no longer fails to parse. (saf-2159)
• pro: improved performance of tsconfig.json matching for Typescript projects that contain multiple tsconfig.jsons. (saf-2163)
• Semgrep no longer fails to validate a config when a rule lang is capitalized (Introduced 1.137.0) (saf-2247)

1.137.0 - 2025-09-17

Added

• pro: typescript: Improved name resolution for destructuring parameters. (code-9088)
• Added a new semgrep mcp subcommand, which runs the Semgrep MCP server, which previously used to live at https://github.com/semgrep/mcp. That repository will be deprecated as of this release, and future MCP contributions / issues should go into this repo. (saf-2239)

Changed

• Update semgrep-interfaces to only accept valid lanugage keys for editor (PR-4600)
• The minimum Python version for Semgrep is now 3.10. We are dropping support for Python 3.9.

Fixed

... (truncated)

Commits

• 319175c chore: release version 1.138.0
• 3789552semgrep/semgrep-proprietary#4724
• 8b3eb6d fix: README permalinks and pre-commit inconsistent (semgrep/semgrep-proprieta...
• 3d1f43d fix: use our fork of OCaml for larger thread stacks (semgrep/semgrep-propriet...
• db20dc3semgrep/semgrep-proprietary#4694
• d7f31c9 fix(mcp): fix failing test test_local_scansemgrep/semgrep-proprietary#4719
• 9eb25f6 fix: add checks for preconditions before running ddprof (semgrep/semgrep-pr...
• 5d48a12semgrep/semgrep-proprietary#4717
• cb0ae5asemgrep/semgrep-proprietary#4604
• 078d25fsemgrep/semgrep-proprietary#4711
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #212.