Update semgrep requirement from ~=1.46.0 to ~=1.48.0

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.48.0

1.48.0 - 2023-11-06

Added

• Matching: Matches with the same range but bindings in different locations will now no longer deduplicate.

  For instance, the pattern $FUNC(..., $A, ...) would produce only one match on the target file:

  foo(true, true)
  

  because you would have two matches to the range of the call, and both bindings of $A would be to true.

  Now, the deduplication logic sees that the bindings of $A are in different places, and thus should not be considered the same, and produce two matches. (pa-3230)

Fixed

• Fixed out of bounds list access error in Cargo.lock parser (sc-1072)
• Secrets: metadata overrides specified in validators were incorrectly applied on top of one another (on a per-rule basis), so that only the last was applied. Each update is now correctly applied independently to each finding based on the rule's validators. (scrt-231)

Changelog

Sourced from semgrep's changelog.

1.48.0 - 2023-11-06

Added

• Matching: Matches with the same range but bindings in different locations will now no longer deduplicate.

  For instance, the pattern $FUNC(..., $A, ...) would produce only one match on the target file:

  foo(true, true)
  

  because you would have two matches to the range of the call, and both bindings of $A would be to true.

  Now, the deduplication logic sees that the bindings of $A are in different places, and thus should not be considered the same, and produce two matches. (pa-3230)

Fixed

• Fixed out of bounds list access error in Cargo.lock parser (sc-1072)
• Secrets: metadata overrides specified in validators were incorrectly applied on top of one another (on a per-rule basis), so that only the last was applied. Each update is now correctly applied independently to each finding based on the rule's validators. (scrt-231)

1.47.0 - 2023-11-01

Added

• taint-mode: Added a Boolean exact option to sources and sanitizers to make matching stricter (default is false).

  If you specify a source such as foo(...), and Semgrep encounters foo(x), by default foo(x), foo, and x, will all be considered tainted. If you add exact: true to the source specification, then only foo(x) will be regarded as tainted, that is the "exact" match for the specification. The same applies to "exact" sanitizers. (gh-5897)

• Added sg alias for semgrep binary which is functionally equivalent to

  alias sg="/opt/homebrew/bin/semgrep"

  with one fewer step. (gh-9117)

• secrets: Added independent targeting from other semgrep products.

  This change allows Secrets to scan all tracked files. In particular, those ignored

... (truncated)

Commits

• 21cefb5 chore: Bump version to 1.48.0
• 741939d Release Version 1.47.0 (#9136)
• ef0bbb2 cleanup: split Parse_rule.ml in 3 (#9163)
• ec4e92a fix(ls): gracefully handle unauthorized token (#9157)
• 225283c Cron - update semgrep-rules (#9161)
• d126212 refactor: move yaml_to_generic.ml out of src/parsing in languages/ (#9162)
• c2686b4 pad: switch to .codemapignore instead of skip_list for codemap (#9160)
• 39a94f2 ojsonnet: rename Eval_jsonnet to Eval_jsonnet_subst (#9159)
• 128c583 chore: Fix release process to avoid malformed Python wheels (#9153)
• c9b15a6 ojsonnet: cleanup (#9154)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

Merging #117 (f9ca47c) into main (0307600) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #117   +/-   ##
=======================================
  Coverage   95.96%   95.96%           
=======================================
  Files          64       64           
  Lines        2630     2630           
=======================================
  Hits         2524     2524           
  Misses        106      106