build(deps): bump semgrep from 1.178.0 to 1.179.0 in /.github

[dependabot]

Bumps semgrep from 1.178.0 to 1.179.0.

Release notes

Sourced from semgrep's releases.

Release v1.179.0

1.179.0 - 2026-10-01

### Added

• Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

• Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

• c grammar update (v0.24.2):

  • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

  (c-v0.24.2)

• cpp grammar update (v0.23.4):

  • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
  • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
  • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
  • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
  • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
  • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

  (cpp-v0.23.4)

• Update the html grammar to v0.23.2. (html-v0.23.2)

• r grammar update (v1.3.0):

  • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
  • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
  • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
  • R parsing preserves else branches placed on a new line within braced expressions.
  • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
  • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

  (r-v1.3.0)

• sfapex grammar update (v2.3):

  • Apex target parsing now supports null-coalescing expressions using ??, preserving both operands.
  • Apex target parsing now supports DML operations with explicit as user and as system security modes, retaining the mode, operation targets, and optional upsert key.
  • Apex target parsing now supports numeric package-version expressions such as Package.Version.1.2.
  • Apex target parsing now recognizes the webservice modifier and annotations with empty argument lists.
  • Apex target parsing now accepts whitespace within relational and shift operators, including compound shift assignments.
  • Embedded SOQL parsing in Apex now supports dotted TYPEOF operands, functions such as convertTimezone, and HAVING comparisons on grouped fields.
  • Apex target parsing now supports multiple top-level method declarations followed by executable statements in anonymous Apex.
  • Apex parsing now preserves native java: qualifiers on types and supports java:-prefixed field-access expressions.
  • Apex patterns now distinguish safe navigation (?.) from ordinary field and method access (.).

  (sfapex-v2.3)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.179.0 - 2026-10-01

### Added

• Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

• Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

• c grammar update (v0.24.2):

  • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

  (c-v0.24.2)

• cpp grammar update (v0.23.4):

  • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
  • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
  • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
  • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
  • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
  • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

  (cpp-v0.23.4)

• Update the html grammar to v0.23.2. (html-v0.23.2)

• r grammar update (v1.3.0):

  • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
  • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
  • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
  • R parsing preserves else branches placed on a new line within braced expressions.
  • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
  • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

  (r-v1.3.0)

• sfapex grammar update (v2.3):

  • Apex target parsing now supports null-coalescing expressions using ??, preserving both operands.
  • Apex target parsing now supports DML operations with explicit as user and as system security modes, retaining the mode, operation targets, and optional upsert key.
  • Apex target parsing now supports numeric package-version expressions such as Package.Version.1.2.
  • Apex target parsing now recognizes the webservice modifier and annotations with empty argument lists.
  • Apex target parsing now accepts whitespace within relational and shift operators, including compound shift assignments.
  • Embedded SOQL parsing in Apex now supports dotted TYPEOF operands, functions such as convertTimezone, and HAVING comparisons on grouped fields.
  • Apex target parsing now supports multiple top-level method declarations followed by executable statements in anonymous Apex.
  • Apex parsing now preserves native java: qualifiers on types and supports java:-prefixed field-access expressions.
  • Apex patterns now distinguish safe navigation (?.) from ordinary field and method access (.).

  (sfapex-v2.3)

### Fixed

... (truncated)

Commits

• fed9646 chore: release 1.179.0
• a8fc986 fix(deps): bump pyjwt pin from ~=2.13.0 to >=2.15.0,<3 (semgrep/semgrep-propr...
• 313161c chore(ci): point semgrep-compare trigger at new Argo Workflows hostname (semg...
• b1b7d76semgrep/semgrep-proprietary#7139
• 01c5bebsemgrep/semgrep-proprietary#7135
• 5e3db32semgrep/semgrep-proprietary#7150
• 3133459semgrep/semgrep-proprietary#7157
• e44447b test: disable automatic maintenance in temporary Git repositories (semgrep/se...
• 5b7f795semgrep/semgrep-proprietary#7155
• 2260e46 feat(lockfile-parsers): Add supply chain parser for bun.lock (semgrep/semgrep...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)