build(deps-dev): update semgrep requirement from <1.170,>=1.0 to >=1.0,<1.174

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.173.0

1.173.0 - 2026-08-12

### Added

• semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha)
• Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)

### Changed

• File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos. (ENGINE-2854)
• Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time and improving parsing throughput. (ENGINE-2920)
• Updated the Solidity parser for newer language features (transient storage, named mapping parameters, layout at, assembly flags, global using-directives, EVM Cancun builtins) and corrected ternary/?: vs member-access precedence. (LANG-207)
• Pro: Unsupported patterns in case expressions are now handled more robustly, with improved error recovery during taint analysis — branch bodies are no longer dropped from the dataflow intermediate language when a pattern can't be compiled. Pattern matching in statement position also now benefits from the same compilation as expression position. (LANG-598)
• Improved performance in highly parallel scans with many target files, running on systems using the musl libc implementation. (pcre2-match-data-reuse)

### Fixed

• When the internal semgrep-core RPC subprocess is terminated by a signal (for example an out-of-memory kill or a segfault), Semgrep now logs a clear error naming the signal, instead of the misleading "Expected a number, got ''" message. When debug logging is enabled, the tail of the subprocess's stderr is included as well. (rpc-subprocess-death-diagnostics)
• A target file whose path filtering failed was silently omitted from the scan, appearing in neither the results nor the list of skipped targets. Such paths are now retried, and any that still fail are reported as skipped targets so they show up in the scan report. (ENGINE-2854)
• Fixed a bug where a capture-group metavariable-regex or a binding-introducing metavariable-pattern would emit a duplicate finding on the same range whose message still contained the raw metavariable (e.g. a hash $ALG was detected) instead of the substituted value. Only the correctly-substituted finding is now reported. (ENGINE-2932)
• Fixed fully-qualified name resolution for Rust symbols imported via a braced grouped use with a nested path (e.g. use a::b::C). It was wrongly being resolved as b::a::C. (LANG-234)
• Fixed an issue where MCP mode could fail to scan UTF-8 files containing multibyte characters, including Japanese text, on systems using a non-UTF-8 locale such as cp932. Files are now read as UTF-8, with undecodable bytes replaced so a single unusual file does not fail the entire scan. (gdn-168)

Changelog

Sourced from semgrep's changelog.

1.173.0 - 2026-08-12

### Added

• semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha)
• Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)

### Changed

• File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos. (ENGINE-2854)
• Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time and improving parsing throughput. (ENGINE-2920)
• Updated the Solidity parser for newer language features (transient storage, named mapping parameters, layout at, assembly flags, global using-directives, EVM Cancun builtins) and corrected ternary/?: vs member-access precedence. (LANG-207)
• Pro: Unsupported patterns in case expressions are now handled more robustly, with improved error recovery during taint analysis — branch bodies are no longer dropped from the dataflow intermediate language when a pattern can't be compiled. Pattern matching in statement position also now benefits from the same compilation as expression position. (LANG-598)
• Improved performance in highly parallel scans with many target files, running on systems using the musl libc implementation. (pcre2-match-data-reuse)

### Fixed

• When the internal semgrep-core RPC subprocess is terminated by a signal (for example an out-of-memory kill or a segfault), Semgrep now logs a clear error naming the signal, instead of the misleading "Expected a number, got ''" message. When debug logging is enabled, the tail of the subprocess's stderr is included as well. (rpc-subprocess-death-diagnostics)
• A target file whose path filtering failed was silently omitted from the scan, appearing in neither the results nor the list of skipped targets. Such paths are now retried, and any that still fail are reported as skipped targets so they show up in the scan report. (ENGINE-2854)
• Fixed a bug where a capture-group metavariable-regex or a binding-introducing metavariable-pattern would emit a duplicate finding on the same range whose message still contained the raw metavariable (e.g. a hash $ALG was detected) instead of the substituted value. Only the correctly-substituted finding is now reported. (ENGINE-2932)
• Fixed fully-qualified name resolution for Rust symbols imported via a braced grouped use with a nested path (e.g. use a::b::C). It was wrongly being resolved as b::a::C. (LANG-234)
• Fixed an issue where MCP mode could fail to scan UTF-8 files containing multibyte characters, including Japanese text, on systems using a non-UTF-8 locale such as cp932. Files are now read as UTF-8, with undecodable bytes replaced so a single unusual file does not fail the entire scan. (gdn-168)

1.172.0 - 2026-07-28

### Added

... (truncated)

Commits

• abce3b5 chore: release 1.173.0
• cc97b5c fix: drop duplicate finding with unsubstituted metavariable (ENGINE-2932) (se...
• f66f2da fix(mcp): pin encoding and use replace to handle errors (semgrep/semgrep-prop...
• 0e77f5bsemgrep/semgrep-proprietary#6675
• 91b9124 feat(core): show git commit sha in semgrep-core -version (semgrep/semgrep-pro...
• 9c77cff rule sharding: partition by bytes instead of worker count (semgrep/semgrep-pr...
• 4fadea6 feat: add memory policy keeping caches in memory (semgrep/semgrep-proprietary...
• b49f5ffsemgrep/semgrep-proprietary#6858
• 41bbcf8semgrep/semgrep-proprietary#6814
• 53df56b perf(parallelism): opt-in chunking for Concurrent.map (semgrep/semgrep-propri...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)