chore(deps): bump semgrep from 1.113.0 to 1.149.0

[dependabot]

Bumps semgrep from 1.113.0 to 1.149.0.

Release notes

Sourced from semgrep's releases.

Release v1.149.0

1.149.0 - 2026-01-21

Added

• Added a warning in --debug mode when a user runs a parallel scan with a larger value for -j/--jobs than the number of CPUs we detect the host has made available to Semgrep. Additionally, a suggested starting value for -j/--jobs is reported to give the user a place to start tuning their scan. (saf-2474)
• Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)

Changed

• The MCP server no longer supports SSE transport. (saf-2462)

Fixed

• pro: Improved virtual method resolution in Java (code-9210)
• pro: Improved virtual method resolution in Scala (code-9212)
• Improve performance of scan planning, a part of the Python CLI, by reducing the cost of re-hashing Target objects. Performance should improve on large repo scans proportionally to the number of files in the repo. (gh-5407)
• semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)

Release v1.148.0

1.148.0 - 2026-01-14

Added

• Performance: subproject discovery in Supply Chain scans is no longer significantly slowed down by the presence of Git-untracked files resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

• pro: Improved virtual method resolution in Java (code-9174)
• pro: Improved handling of parse errors during inter-file analysis. Now, these errors should be adequately reported back to users and in the JSON output. (code-9216)
• Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
• Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.149.0 - 2026-01-21

Added

• Added a warning in --debug mode when a user runs a parallel scan with a larger value for -j/--jobs than the number of CPUs we detect the host has made available to Semgrep. Additionally, a suggested starting value for -j/--jobs is reported to give the user a place to start tuning their scan. (saf-2474)
• Upload symbol analysis on a per-subproject basis during supply chain scans. (sc-3038)

Changed

• The MCP server no longer supports SSE transport. (saf-2462)

Fixed

• pro: Improved virtual method resolution in Java (code-9210)
• pro: Improved virtual method resolution in Scala (code-9212)
• Improve performance of scan planning, a part of the Python CLI, by reducing the cost of re-hashing Target objects. Performance should improve on large repo scans proportionally to the number of files in the repo. (gh-5407)
• semgrep ci no longer applies autofixes to disk, even when the "Suggest autofixes" toggle in the app is enabled. (saf-2446)

1.148.0 - 2026-01-14

Added

• Performance: subproject discovery in Supply Chain scans is no longer significantly slowed down by the presence of Git-untracked files resulting in faster diff scans in such cases. (sc-subproject-speedup)

Fixed

• pro: Improved virtual method resolution in Java (code-9174)
• pro: Improved handling of parse errors during inter-file analysis. Now, these errors should be adequately reported back to users and in the JSON output. (code-9216)
• Dataflow now accounts for Python for/else and while/else loops. (gh-8405)
• Fix rare "bad file descriptor" when performing Git operations on Windows (saf-2358)

... (truncated)

Commits

• 50257f6 chore: release version 1.149.0
• c8c60d5semgrep/semgrep-proprietary#5423
• 2a8672d chore: remove toxsemgrep/semgrep-proprietary#5421
• 23c3421 chore: don't version semgrep.opam/OSS/dune-project. (semgrep/semgrep-prop...
• b91705a fix(ci): Update setup-ocaml action for Cygwin issue (semgrep/semgrep-propriet...
• 203b28d fix(ci): fix jsonnet templating s.t env isn't at job-level (semgrep/semgrep-p...
• 1a1017d fix(ci): Fix benchmarking regression PR comment (semgrep/semgrep-proprietary#...
• b7584b8 feat(perf): cache Targetsemgrep/semgrep-proprietary#5407
• 7e33fcfsemgrep/semgrep-proprietary#5382
• e922050 Cron - update semgrep-rules and semgrep-rules-pro submodules (semgrep/semgrep...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like semgrep is up-to-date now, so this is no longer needed.