TEST-INFRA: [dependency-security] Update semgrep to the latest version #1725

New issue

Open

opened 2026-04-02 23:36:19 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:36:19 +00:00

Owner

Metadata

Branch: chore/update-semgrep-latest-version
Commit Message: chore(deps): update semgrep from 1.60.0 to 1.157.0
Milestone: v3.7.0
Parent Epic: #1678

Background and Context

The semgrep package is outdated. The current pinned version is 1.60.0, and the latest available version is 1.157.0. This represents a significant version jump of ~97 minor releases. Semgrep is the project's primary static analysis and security scanning tool, used in the CI pipeline to enforce security checks on every commit. Running an outdated version means the project may be missing critical new security rules, bug fixes, and performance improvements introduced in the intervening releases.

Keeping security tooling up to date is essential to ensure the CI pipeline provides accurate and comprehensive security coverage, and to avoid false negatives from stale rule sets.

Current Behavior

pyproject.toml pins semgrep at version 1.60.0. The CI pipeline runs security scans using this outdated version, potentially missing security rules and improvements introduced in versions 1.61.0 through 1.157.0.

Expected Behavior

pyproject.toml specifies semgrep>=1.157.0. The uv.lock file is updated to reflect the new resolved version. The CI pipeline runs security scans using the latest semgrep version, and all existing tests continue to pass without regressions.

Acceptance Criteria

pyproject.toml is updated so that the semgrep dependency constraint resolves to >=1.157.0.
uv.lock is regenerated and reflects the updated semgrep version.
All nox sessions pass (including security scanning, linting, type checking, and all test suites).
No regressions are introduced by the semgrep version upgrade.
CI pipeline passes successfully end-to-end.

Supporting Information

Current version: 1.60.0
Latest version: 1.157.0
Semgrep changelog: https://github.com/semgrep/semgrep/releases
Related tooling: semgrep is invoked via the project's nox security session

Subtasks

Update the semgrep dependency constraint in pyproject.toml to semgrep>=1.157.0
Run uv pip sync (or uv lock && uv sync) to regenerate uv.lock with the updated version
Run the full nox test suite (nox) to verify no breaking changes are introduced by the new semgrep version
Verify the security scanning nox session passes with the updated semgrep version
Verify coverage >= 97% via nox -s coverage_report
Update CHANGELOG with an entry for this dependency update
Run nox (all default sessions) and fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (chore(deps): update semgrep from 1.60.0 to 1.157.0), followed by a blank line, then additional lines providing relevant implementation details.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (chore/update-semgrep-latest-version).
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `chore/update-semgrep-latest-version` - **Commit Message**: `chore(deps): update semgrep from 1.60.0 to 1.157.0` - **Milestone**: v3.7.0 - **Parent Epic**: #1678 ## Background and Context The `semgrep` package is outdated. The current pinned version is `1.60.0`, and the latest available version is `1.157.0`. This represents a significant version jump of ~97 minor releases. Semgrep is the project's primary static analysis and security scanning tool, used in the CI pipeline to enforce security checks on every commit. Running an outdated version means the project may be missing critical new security rules, bug fixes, and performance improvements introduced in the intervening releases. Keeping security tooling up to date is essential to ensure the CI pipeline provides accurate and comprehensive security coverage, and to avoid false negatives from stale rule sets. ## Current Behavior `pyproject.toml` pins `semgrep` at version `1.60.0`. The CI pipeline runs security scans using this outdated version, potentially missing security rules and improvements introduced in versions `1.61.0` through `1.157.0`. ## Expected Behavior `pyproject.toml` specifies `semgrep>=1.157.0`. The `uv.lock` file is updated to reflect the new resolved version. The CI pipeline runs security scans using the latest semgrep version, and all existing tests continue to pass without regressions. ## Acceptance Criteria - `pyproject.toml` is updated so that the `semgrep` dependency constraint resolves to `>=1.157.0`. - `uv.lock` is regenerated and reflects the updated semgrep version. - All nox sessions pass (including security scanning, linting, type checking, and all test suites). - No regressions are introduced by the semgrep version upgrade. - CI pipeline passes successfully end-to-end. ## Supporting Information - Current version: `1.60.0` - Latest version: `1.157.0` - Semgrep changelog: https://github.com/semgrep/semgrep/releases - Related tooling: semgrep is invoked via the project's nox security session ## Subtasks - [ ] Update the `semgrep` dependency constraint in `pyproject.toml` to `semgrep>=1.157.0` - [ ] Run `uv pip sync` (or `uv lock && uv sync`) to regenerate `uv.lock` with the updated version - [ ] Run the full nox test suite (`nox`) to verify no breaking changes are introduced by the new semgrep version - [ ] Verify the security scanning nox session passes with the updated semgrep version - [ ] Verify coverage >= 97% via `nox -s coverage_report` - [ ] Update `CHANGELOG` with an entry for this dependency update - [ ] Run `nox` (all default sessions) and fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`chore(deps): update semgrep from 1.60.0 to 1.157.0`), followed by a blank line, then additional lines providing relevant implementation details. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`chore/update-semgrep-latest-version`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-02 23:39:13 +00:00

freemo commented

2026-04-02 23:42:22 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: MoSCoW/Could Have — CI/test infrastructure improvement. Could Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: MoSCoW/Could Have — CI/test infrastructure improvement. Could Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added the

MoSCoW

Could have

label

2026-04-02 23:42:22 +00:00

freemo added a new dependency

2026-04-02 23:47:06 +00:00

#1678 Epic: CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing