chore(deps): bump semgrep from 1.113.0 to 1.133.0

[dependabot]

Bumps semgrep from 1.113.0 to 1.133.0.

Release notes

Sourced from semgrep's releases.

Release v1.133.0

1.133.0 - 2025-08-22

Added

• Pro: improved prefiltering for interfile rules. This allows the engine to skip interfile rules earlier in the process when we determine they cannot match in a given scan, which should improve performance. (code-8524)
• Semgrep will now display emotional support ascii art and a backtrace, with function names and sometimes files/line #s, when it segfaults, or receives other similar critical signals (pretty-segv)

Fixed

• Pro: Fixed a bug that prevented taint tracking through new in some cases. (code-9047)
• We now substitute metavariables for their values in a deterministic order to ensure keys for match-based IDs are stable. (gh-4459)
• Fixed incorrect YAML parsing of strings like nan as well as some more obscure cases that were interpreted as a float instead of a string. This might affect any area of Semgrep that deals with YAML files containing the string nan. (yaml-float-parsing)

Release v1.132.0

1.132.0 - 2025-08-14

Added

• PHP: When enabling option taint_assume_safe_booleans the return values of boolval, is_bool, and || will be considered safe. When enabling taint_assume_safe_numbers the return values of intval, floatval, +, -, *, / and % will also be considered safe. (php)
• When performing secrets validation, the amount of time that the HTTP request took to complete will now be visible in the debug logs. (#2130)
• Introduces a timeout to internal HTTP requests, to prevent remote endpoints from indefinitely hanging the engine. (#4295)

Changed

• Pro scans will no longer attempt to parse tsconfig files for non-typescript scans. (gh-4407)

Fixed

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.133.0 - 2025-08-22

Added

• Pro: improved prefiltering for interfile rules. This allows the engine to skip interfile rules earlier in the process when we determine they cannot match in a given scan, which should improve performance. (code-8524)
• Semgrep will now display emotional support ascii art and a backtrace, with function names and sometimes files/line #s, when it segfaults, or receives other similar critical signals (pretty-segv)

Fixed

• Pro: Fixed a bug that prevented taint tracking through new in some cases. (code-9047)
• We now substitute metavariables for their values in a deterministic order to ensure keys for match-based IDs are stable. (gh-4459)
• Fixed incorrect YAML parsing of strings like nan as well as some more obscure cases that were interpreted as a float instead of a string. This might affect any area of Semgrep that deals with YAML files containing the string nan. (yaml-float-parsing)

1.132.1 - 2025-08-14

No significant changes.

1.132.0 - 2025-08-14

Added

• PHP: When enabling option taint_assume_safe_booleans the return values of boolval, is_bool, and || will be considered safe. When enabling taint_assume_safe_numbers the return values of intval, floatval, +, -, *, / and % will also be considered safe. (php)
• When performing secrets validation, the amount of time that the HTTP request took to complete will now be visible in the debug logs. (#2130)
• Introduces a timeout to internal HTTP requests, to prevent remote endpoints from indefinitely hanging the engine. (#4295)

Changed

• Pro scans will no longer attempt to parse tsconfig files for non-typescript scans. (gh-4407)

... (truncated)

Commits

• 763730c chore: release version 1.133.0
• 789a233semgrep/semgrep-proprietary#4512
• a31f844semgrep/semgrep-proprietary#4508
• 54ac525 Cron - update semgrep-rules and semgrep-rules-pro submodules (semgrep/semgrep...
• 09f49b4semgrep/semgrep-proprietary#4222
• 7af08aesemgrep/semgrep-proprietary#4238
• d53ca8fsemgrep/semgrep-proprietary#4433
• e0a15a9semgrep/semgrep-proprietary#4226
• b7b2174 fix(multicore): secrets baseline scans should consume x_eio (semgrep/semgrep-...
• 07859e8semgrep/semgrep-proprietary#4236
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1167.