Update semgrep requirement from ~=1.48.0 to ~=1.49.0

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.49.0

1.49.0 - 2023-11-15

Added

• Added support in Ruby, Julia, and Rust to match implicit return statement inside functions.

  For example:

  return 0

  can now match 0 in

  function f()
    0
  end

  This matching is enabled by default and can be disabled with the rule option implicit_return. (gh-8408)

• Pro engine supports constant propagation of numbers defined via macro in C++ (gh-9221)

• taint-mode: The by-side-effect option for taint sources (only) now accepts a third value only (besides true and false). Setting by-side-effect: only will define a taint source that only propagates by side effect. This option should allow (ab)using taint-mode for writing some typestate rules.

  For example, this taint rule:

  pattern-sources:
    - by-side-effect: only
      patterns:
      - pattern: lock($L)
      - focus-metavariable: $L
  pattern-sanitizers:
    - by-side-effect: true
      patterns:
      - pattern: unlock($L)
      - focus-metavariable: $L
  pattern-sinks:
    - pattern: lock($L)

  will match the second lock(x) in this code:

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.49.0 - 2023-11-15

Added

• Added support in Ruby, Julia, and Rust to match implicit return statement inside functions.

  For example:

  return 0

  can now match 0 in

  function f()
    0
  end

  This matching is enabled by default and can be disabled with the rule option implicit_return. (gh-8408)

• Pro engine supports constant propagation of numbers defined via macro in C++ (gh-9221)

• taint-mode: The by-side-effect option for taint sources (only) now accepts a third value only (besides true and false). Setting by-side-effect: only will define a taint source that only propagates by side effect. This option should allow (ab)using taint-mode for writing some typestate rules.

  For example, this taint rule:

  pattern-sources:
    - by-side-effect: only
      patterns:
        - pattern: lock($L)
        - focus-metavariable: $L
  pattern-sanitizers:
    - by-side-effect: true
      patterns:
        - pattern: unlock($L)
        - focus-metavariable: $L
  pattern-sinks:
    - pattern: lock($L)

  will match the second lock(x) in this code:

  lock(x) # no finding
  lock(x) # finding

... (truncated)

Commits

• 51c0c6e chore: Bump version to 1.49.0
• d8e6a36 Update js snapshot and disable "Test Login" in js (#9261)
• 0ec2b95 Not suppressing errors leads to failure, not success (#9256)
• cc20da1 fix(tests): Disable failing js test (#9253)
• 7d03a36 chore(metrics): report languages where we requested the interfile engine (#9211)
• ec23a6f chore: fix hanging LS test (#9254)
• e8ec2e6 --config policy uses new cli endpoint (#9225)
• eeba40c devops: Add semgrep-comparison trigger to tests (#9251)
• 933a4cd devops: Refactor trigger-semgrep-comparison-argo GHA WF to use jsonnet (#9243)
• a6f1af3 devops: Add build and push steps for perf benchmark container (#9239)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

Merging #136 (6c3835d) into main (98dc6c8) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #136   +/-   ##
=======================================
  Coverage   96.29%   96.29%           
=======================================
  Files          64       64           
  Lines        2697     2697           
=======================================
  Hits         2597     2597           
  Misses        100      100