chore(deps): bump semgrep from 1.151.0 to 1.155.0

[dependabot]

Bumps semgrep from 1.151.0 to 1.155.0.

Release notes

Sourced from semgrep's releases.

Release v1.155.0

1.155.0 - 2026-03-11

### Added

• Added support for (agentic) hooks in Windsurf. (windsurf-hooks)
• scala: Improved support for Scala 3's optional braces. (LANG-218)
• Added PowerShell language support (beta) with parsing and pattern matching (lang-233)

### Changed

• Removed the experimental and undocumented command semgrep install-ci. (osemgrep-install-ci)

• Migrate from publishing a single Linux wheel with the platform tag musllinux_1_0_<arch>.manylinux2014_<arch> to publishing two separate wheels:

  • A wheel with the platform tag musllinux_1_0_
  • A wheel with the platform tag manylinux2014_

  (pypi-linux-tag)

### Fixed

• When performing parallel operations over a small number of input items, the engine no longer spawns more OCaml domains than we have items to process. This assists with resource utilisation. (engine-2588)
• Fixed: Prevent SessionStart hook crash when inject-secure-defaults receives empty stdin (JSONDecodeError). (engine-2592)
• Semgrep secret validation now times out after 30 seconds instead of 15 minutes. Additionally this timeout is configurable via the --secrets-timeout flag. (engine-2593)
• Fixed permission errors during lockfileless Java (Gradle) dependency resolution by invoking gradlew via sh when the executable bit is not set (gh-5747)

Release v1.154.0

1.154.0 - 2026-03-04

### Fixed

• Fix crash on Windows when running semgrep ci with --debug and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when --debug was active. (ENGINE-2491)
• Changed default memory policy from "eager" to "balanced". Scan times should noticably improve; however, scans may use 5-10% additional memory. If running in a resource-constrained environment, consider setting the memory policy back to "aggressive". (engine-2055)
• When Semgrep decides which files to scan (targeting), it can take a long time (over 5 minutes) on very large repos (> 10k files). Semgrep will now parallelize this work according to the number of jobs passed (-j) (engine-2512)
• Fixed a performance issues where passing many scannign roots on the command line (e.g. semgrep scan $(git ls-files '*.py')) caused one semgrep-core subprocess to be spawned per file. Roots that are not directories are now handled directly in Python without any subprocess overhead. (gh-11404)
• Scala: Restored parse rate after mistaken bug introduced by implicit block parsing fix (lang-215)

Release v1.153.0

1.153.0 - 2026-02-25

### Added

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.155.0 - 2026-03-11

### Added

• Added support for (agentic) hooks in Windsurf. (windsurf-hooks)
• scala: Improved support for Scala 3's optional braces. (LANG-218)
• Added PowerShell language support (beta) with parsing and pattern matching (lang-233)

### Changed

• Removed the experimental and undocumented command semgrep install-ci. (osemgrep-install-ci)

• Migrate from publishing a single Linux wheel with the platform tag musllinux_1_0_<arch>.manylinux2014_<arch> to publishing two separate wheels:

  • A wheel with the platform tag musllinux_1_0_
  • A wheel with the platform tag manylinux2014_

  (pypi-linux-tag)

### Fixed

• When performing parallel operations over a small number of input items, the engine no longer spawns more OCaml domains than we have items to process. This assists with resource utilisation. (engine-2588)
• Fixed: Prevent SessionStart hook crash when inject-secure-defaults receives empty stdin (JSONDecodeError). (engine-2592)
• Semgrep secret validation now times out after 30 seconds instead of 15 minutes. Additionally this timeout is configurable via the --secrets-timeout flag. (engine-2593)
• Fixed permission errors during lockfileless Java (Gradle) dependency resolution by invoking gradlew via sh when the executable bit is not set (gh-5747)

1.154.0 - 2026-03-04

### Fixed

• Fix crash on Windows when running semgrep ci with --debug and no blocking findings. The Windows subprocess path incorrectly raised an exception for all pysemgrep exit codes (including 0), which was silently swallowed in normal mode but propagated as a fatal error when --debug was active. (ENGINE-2491)
• Changed default memory policy from "eager" to "balanced". Scan times should noticably improve; however, scans may use 5-10% additional memory. If running in a resource-constrained environment, consider setting the memory policy back to "aggressive". (engine-2055)
• When Semgrep decides which files to scan (targeting), it can take a long time (over 5 minutes) on very large repos (> 10k files). Semgrep will now parallelize this work according to the number of jobs passed (-j) (engine-2512)
• Fixed a performance issues where passing many scannign roots on the command line (e.g. semgrep scan $(git ls-files '*.py')) caused one semgrep-core subprocess to be spawned per file. Roots that are not directories are now handled directly in Python without any subprocess overhead. (gh-11404)
• Scala: Restored parse rate after mistaken bug introduced by implicit block parsing fix (lang-215)

1.153.0 - 2026-02-25

### Added

• Semgrep core is now optimized with flambda (flambda)

... (truncated)

Commits

• 7288ea8 chore: release version 1.155.0
• 916980bsemgrep/semgrep-proprietary#5815
• 7aa0d8f feat: default to v2 create_scan_and_config endpoints (semgrep/semgrep-proprie...
• 6f9a248 Concurrent.map: do not spawn more domains than input items (semgrep/semgrep-p...
• 342674bsemgrep/semgrep-proprietary#5808
• 226c3de fix: fix test that tests on cli/srcsemgrep/semgrep-proprietary#5793
• af4f92d chore(tracing): add let%trace_result macro to trace errors for result types (...
• b48e1cdsemgrep/semgrep-proprietary#5797
• 9627b2esemgrep/semgrep-proprietary#5763
• 05da6fasemgrep/semgrep-proprietary#5791
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1334.