Open
Conversation
renovate
bot
requested review from
andrecsilva,
clavedeluna and
drdavella
as code owners
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
69ba220 to
d038471
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
ced2fc2 to
5247aed
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
3f35a32 to
dc98e5f
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
98a2fa1 to
5ad5d2c
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
556cee3 to
a4b20f7
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
a4b20f7 to
aaa8d88
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
98b1d4b to
09df190
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
182e262 to
e56752d
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
ea8501e to
5afdc9f
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
5afdc9f to
51d85ec
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
>=7.12,<7.13→>=7.13,<7.14~=4.25.0→~=4.26.0~=2.10.0→~=2.12.1>=1.144,<1.145→>=1.156,<1.157~=0.13.0→~=0.14.0==3.2.1.20250809→==3.2.1.20260312Release Notes
coveragepy/coveragepy (coverage)
v7.13.5Compare Source
Fix:
issue 2138_ describes a memory leak that happened when repeatedlyusing the Coverage API with in-memory data. This is now fixed.
Fix: the markdown-formatted coverage report didn't fully escape special
characters in file paths (
issue 2141). This would be very unlikely tocause a problem, but now it's done properly, thanks to
Ellie Ayla <pull 2142_>.Fix: the C extension wouldn't build on VS2019, but now it does (
issue 2145_)... _issue 2138: #2138
.. _issue 2141: #2141
.. _pull 2142: #2142
.. _issue 2145: #2145
.. _changes_7-13-4:
v7.13.4Compare Source
Fix: the third-party code fix in 7.13.3 required examining the parent
directories where coverage was run. In the unusual situation that one of the
parent directories is unreadable, a PermissionError would occur, as
described in
issue 2129_. This is now fixed.Fix: in test suites that change sys.path, coverage.py could fail with
"RuntimeError: Set changed size during iteration" as described and fixed in
pull 2130_. Thanks, Noah Fatsi.We now publish ppc64le wheels, thanks to
Pankhudi Jain <pull 2121_>_... _pull 2121: #2121
.. _issue 2129: #2129
.. _pull 2130: #2130
.. _changes_7-13-3:
v7.13.3Compare Source
been, slowing down test execution. This happened with layered virtual
environments such as uv sometimes makes. The problem is fixed, closing
issue 2082_. Now any directory on sys.path that is inside a virtualenv isconsidered third-party code.
.. _issue 2082: #2082
.. _changes_7-13-2:
v7.13.2Compare Source
Fix: when Python is installed via symlinks, for example with Homebrew, the
standard library files could be incorrectly included in coverage reports.
This is now fixed, closing
issue 2115_.Fix: if a data file is created with no read permissions, the combine step
would fail completely. Now a warning is issued and the file is skipped.
Closes
issue 2117_... _issue 2115: #2115
.. _issue 2117: #2117
.. _changes_7-13-1:
v7.13.1Compare Source
Added: the JSON report now includes a
"start_line"key for function andclass regions, indicating the first line of the region in the source. Closes
issue 2110_.Added: The
debug datacommand now takes file names as arguments on thecommand line, so you can inspect specific data files without needing to set
the
COVERAGE_FILEenvironment variable.Fix: the JSON report used to report module docstrings as executed lines,
which no other report did, as described in
issue 2105_. This is now fixed,thanks to Jianrong Zhao.
Fix: coverage.py uses a more disciplined approach to detecting where
third-party code is installed, and avoids measuring it. This shouldn't change
any behavior. If you find that it does, please get in touch.
Performance: data files that will be combined now record their hash as part
of the file name. This lets us skip duplicate data more quickly, speeding the
combining step.
Docs: added a section explaining more about what is considered a missing
branch and how it is reported: :ref:
branch_explain, as requested inissue 1597. Thanks toAyisha Mohammed <pull 2092_>.Tests: the test suite misunderstood what core was being tested if
COVERAGE_COREwasn't set on 3.14+. This is now fixed, closingissue 2109_... _issue 1597: #1597
.. _pull 2092: #2092
.. _issue 2105: #2105
.. _issue 2109: #2109
.. _issue 2110: #2110
.. _changes_7-13-0:
v7.13.0Compare Source
Feature: coverage.py now supports :file:
.coveragerc.tomlconfigurationfiles. These files use TOML syntax and take priority over
:file:
pyproject.tomlbut lower priority than :file:.coveragercfiles.Closes
issue 1643_ thanks toOlena Yefymenko <pull 1952_>_.Fix: we now include a permanent .pth file which is installed with the code,
fixing
issue 2084. In 7.12.1b1 this was done incorrectly: it didn't workwhen using the source wheel (
py3-none-any). This is now fixed. Thanks,Henry Schreiner <pull 2100_>.Deprecated: when coverage.py is installed, it creates three command entry
points:
coverage,coverage3, andcoverage-3.10(if installed forPython 3.10). The second and third of these are not needed and will
eventually be removed. They still work for now, but print a message about
their deprecation.
.. _issue 1643: #1643
.. _pull 1952: #1952
.. _pull 2100: #2100
.. _changes_7-12-1b1:
python-jsonschema/jsonschema (jsonschema)
v4.26.0Compare Source
=======
urllib.request(#1416).jpadilla/pyjwt (pyjwt)
v2.12.1Compare Source
Changed
Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in
#​975 <https://github.com/jpadilla/pyjwt/pull/975>__Use
Sequencefor parameter types rather thanListwhere applicable by @imnotjames in#​970 <https://github.com/jpadilla/pyjwt/pull/970>__Add JWK support to JWT encode by @luhn in
#​979 <https://github.com/jpadilla/pyjwt/pull/979>__Encoding and decoding payloads using the
nonealgorithm by @jpadilla in#c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>__Before:
.. code-block:: pycon
After:
.. code-block:: pycon
Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in
#​1005 <https://github.com/jpadilla/pyjwt/pull/1005>__Refactor project configuration files from
setup.cfgtopyproject.tomlby @cleder in#​995 <https://github.com/jpadilla/pyjwt/pull/995>__Ruff linter and formatter changes by @gagandeepp in
#​1001 <https://github.com/jpadilla/pyjwt/pull/1001>__Drop support for Python 3.8 (EOL) by @kkirsche in
#​1007 <https://github.com/jpadilla/pyjwt/pull/1007>__Fixed
#​972 <https://github.com/jpadilla/pyjwt/pull/972>__#​973 <https://github.com/jpadilla/pyjwt/pull/973>__#​992 <https://github.com/jpadilla/pyjwt/pull/992>__#​980 <https://github.com/jpadilla/pyjwt/pull/980>__#​993 <https://github.com/jpadilla/pyjwt/pull/993>__pyproject.tomlinpre-commitby @cleder in#​1002 <https://github.com/jpadilla/pyjwt/pull/1002>__#​1003 <https://github.com/jpadilla/pyjwt/pull/1003>__v2.12.0Compare Source
Security
What's Changed
New Contributors
Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0
v2.11.0Compare Source
Fixed
semgrep/semgrep (semgrep)
v1.156.0Compare Source
### Changed
### Fixed
semgrep ciwhen run in a git repo with no remote origin set (gh-11342)v1.155.0Compare Source
### Added
### Changed
Removed the experimental and undocumented command
semgrep install-ci. (osemgrep-install-ci)Migrate from publishing a single Linux wheel with the platform tag
musllinux_1_0_<arch>.manylinux2014_<arch>to publishing two separate wheels:(pypi-linux-tag)
### Fixed
engine no longer spawns more OCaml domains than we have items to process. This
assists with resource utilisation. (engine-2588)
--secrets-timeoutflag. (engine-2593)v1.154.0### Fixed
semgrep ciwith--debugand no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when--debugwas active. (ENGINE-2491)noticably improve; however, scans may use 5-10% additional memory. If running
in a resource-constrained environment, consider setting the memory policy back
to "aggressive". (engine-2055)
-j) (engine-2512)line (e.g.
semgrep scan $(git ls-files '*.py')) caused one semgrep-coresubprocess to be spawned per file. Roots that are not directories are now
handled directly in Python without any subprocess overhead. (gh-11404)
v1.153.0Compare Source
### Added
for-yield(LANG-193)### Fixed
be considered at the same scope, e.g.
1.152.0 - 2026-02-17
### Added
Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of
--allow-local-buildsdependency resolution via the environment variableSEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)Memory management policies
A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the
--x-mem-policyCLI flag for the pro engine; this flag is unused inthe OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)
Allows case insensitive string comparisons using lower() and upper() like this:
(gh-11502)
Blocking findings that are outputted in the CI output are now labelled as such. (#4394)
### Changed
is reached. (code-9224)
### Fixed
reduce FPs in some cases. (code-9220)
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)
1.151.0 - 2026-02-04
Added
Fixed
glomto at least version23.3, which includes a fix to aSyntaxWarningwarning log. (gh-11460)
1.150.0 - 2026-01-29
Added
Changed
pipenvtouvfor./clipackage management (uv)Fixed
-alphain1.2.3-alpha. (sc-3001)1.149.0 - 2026-01-21
Added
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Changed
Fixed
the cost of re-hashing
Targetobjects. Performance should improve onlarge repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep cino longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)1.148.0 - 2026-01-14
Added
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)
Fixed
errors should be adequately reported back to users and in the JSON output. (code-9216)
1.147.0 - 2026-01-07
Added
gradle*.lockfileare now supported. Previously, only lockfiles named exactlygradle.lockfilewere supported. (SC-2999)semgrep loginnow supports a--forceflag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use--forcetoo. (saf-2392)Fixed
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)
1.146.0 - 2025-12-17
Added
record-file-editandstop-cli-scansemgrep mcp flags (cursor-hooks)skipped_pathsfield to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)semgrep ci. (sc-2927)Changed
mcppython-sdk from1.16.0to1.23.3(mcp-version)analysis in
semgrep ciregardless of app settings is now possible with--x-enable-transitive-reachability(or--x-tr)and
--x-disable-transitive-reachability. (tr-flags)Fixed
1.145.2 - 2025-12-12
No significant changes.
1.145.1 - 2025-12-11
No significant changes.
1.145.0 - 2025-12-04
Added
Changed
Fixed
let ... inexpressions in OCaml is now reported. Previously, the location of theletwas omitted. This is mainly relevant for autofix. (ocaml-let)Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
1.144.1 - 2025-12-04
Fixed
1.144.0 - 2025-11-19
Fixed
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
1.143.3 - 2025-11-25
No significant changes.
1.143.2 - 2025-11-25
Fixed
1.143.1 - 2025-11-14
Fixed
1.143.0 - 2025-11-12
Added
more instances. (code-9141)
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the
--x-parmapCLI flag, and this deprecates the--x-eioflag (since it is now the default behaviour). (saf-2271)
-k/ --hookflag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)Fixed
semgrep scanorsemgrep ci, the progress bar now always ends at 100%. (SAF-2079)analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
accurately match the () type in a
typedeclaration. (gh-11283)1.142.0 - 2025-10-30
Added
matchexpressions in Scala. In examples liketainttox. (code-9085)case $M -> ... :? ... +& test +& ... => ...patterns. (code-9131)Fixed
--allow-local-buildsis passed. (SC-2899)v1.152.0Compare Source
### Added
for-yield(LANG-193)### Fixed
be considered at the same scope, e.g.
1.152.0 - 2026-02-17
### Added
Hooks (for both Claude Code and Cursor) now pull custom rules from the registry (custom-rules-hooks)
Turned on DNS rebinding protection for the MCP server (dns-check)
Environment variables can now be passed to third-party package managers invoked as part of
--allow-local-buildsdependency resolution via the environment variableSEMGREP_LOCAL_BUILD_ENV, which accepts a JSON object with string keys and string values. (SC-3163)Memory management policies
A memory policy defines how OCaml's garbage collector should be configured for
a scan. There are two initial policies: "aggressive", the current behaviour,
which trades longer scan times for lower memory use, and "balanced", which
finds a middle ground between reclaiming heap memory in short order while
limiting how often the garbage collector runs. The policy can be configured
via the
--x-mem-policyCLI flag for the pro engine; this flag is unused inthe OSS engine. (engine-2055)
Added experimental support for the OpenFGA authorization language. Thanks to Alex Useche (@hex0punk) for the contribution! (gh-11347)
Allows case insensitive string comparisons using lower() and upper() like this:
(gh-11502)
Blocking findings that are outputted in the CI output are now labelled as such. (#4394)
### Changed
is reached. (code-9224)
### Fixed
reduce FPs in some cases. (code-9220)
longer period of time before retrying the request, to spread out requests
during periods of app instability. (engine-2550)
1.151.0 - 2026-02-04
Added
Fixed
glomto at least version23.3, which includes a fix to aSyntaxWarningwarning log. (gh-11460)
1.150.0 - 2026-01-29
Added
Changed
pipenvtouvfor./clipackage management (uv)Fixed
-alphain1.2.3-alpha. (sc-3001)1.149.0 - 2026-01-21
Added
value for -j/--jobs than the number of CPUs we detect the host has made
available to Semgrep. Additionally, a suggested starting value for -j/--jobs
is reported to give the user a place to start tuning their scan. (saf-2474)
Changed
Fixed
the cost of re-hashing
Targetobjects. Performance should improve onlarge repo scans proportionally to the number of files in the repo. (gh-5407)
semgrep cino longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)1.148.0 - 2026-01-14
Added
significantly slowed down by the presence of Git-untracked files
resulting in faster diff scans in such cases. (sc-subproject-speedup)
Fixed
errors should be adequately reported back to users and in the JSON output. (code-9216)
1.147.0 - 2026-01-07
Added
gradle*.lockfileare now supported. Previously, only lockfiles named exactlygradle.lockfilewere supported. (SC-2999)semgrep loginnow supports a--forceflag, which ignores existing tokens and starts a new login session. The MCP setup workflow has been updated to use--forcetoo. (saf-2392)Fixed
findings were always equivalent, but not guaranteed to be exactly the same
(e.g. metavariable bindings could differ). Depending on the rule and target code,
this could cause findings' fingerprints to change from one scan to another, thus
leading to finding flakiness and "cycling" in Semgrep App. Note that when
upgrading to this Semgrep version, you may see different (but equivalent) findings
wrt your current Semgrep version in the first scan, one more time. However, in
subsequent scans/upgrades, this problem should go away or at least be greatly
reduced. (saf-2304)
1.146.0 - 2025-12-17
Added
record-file-editandstop-cli-scansemgrep mcp flags (cursor-hooks)skipped_pathsfield to CI scan results to report files that failed to scan due to errors (timeout, OOM, etc.), preventing the app from incorrectly marking findings in those files as fixed (gh-5122)semgrep ci. (sc-2927)Changed
mcppython-sdk from1.16.0to1.23.3(mcp-version)analysis in
semgrep ciregardless of app settings is now possible with--x-enable-transitive-reachability(or--x-tr)and
--x-disable-transitive-reachability. (tr-flags)Fixed
1.145.2 - 2025-12-12
No significant changes.
1.145.1 - 2025-12-11
No significant changes.
1.145.0 - 2025-12-04
Added
Changed
Fixed
let ... inexpressions in OCaml is now reported. Previously, the location of theletwas omitted. This is mainly relevant for autofix. (ocaml-let)Semgrep's managed scanning environment are not emitted if a scan runs outside
that environment. (saf-2321)
1.144.1 - 2025-12-04
Fixed
1.144.0 - 2025-11-19
Fixed
available CPUs on the system is polled as part of a heuristic to determine how
many threads should be spawned. (gh-4952)
1.143.3 - 2025-11-25
No significant changes.
1.143.2 - 2025-11-25
Fixed
1.143.1 - 2025-11-14
Fixed
1.143.0 - 2025-11-12
Added
more instances. (code-9141)
domains, rather than the legacy fork-join approach. Users can opt into the
legacy method with the
--x-parmapCLI flag, and this deprecates the--x-eioflag (since it is now the default behaviour). (saf-2271)
-k/ --hookflag to enable Semgrep scans via Claude Code Agent post-tool hooks (saf-2279)Fixed
semgrep scanorsemgrep ci, the progress bar now always ends at 100%. (SAF-2079)analysis (e.g., some branches being misordered, especially when matching
multiple variables against non-integer literal patterns). (code-9144)
accurately match the () type in a
typedeclaration. (gh-11283)1.142.0 - 2025-10-30
Added
matchexpressions in Scala. In examples liketainttox. (code-9085)case $M -> ... :? ... +& test +& ... => ...patterns. (code-9131)Fixed
--allow-local-buildsis passed. (SC-2899)v1.151.0Compare Source
### Added
for-yield(LANG-193)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.