semgrep 0.6.0

Release v0.6.0

on Python PyPI

Added

• The -j/--jobs flag for specifying number of subprocesses to use to run checks in parallel.
• expression statements will now match by default also return statements

  foo();
  

  will now match

  return foo();

• You can now use regexps for field names:

  var $X = {"=~/[lL]ocation/": $Y};
  

  will now match

  var x = {"Location": 1};

• Add severity to json output and prepend the rule line with it. Color yellow if WARNING, and red if ERROR. e.g. WARNING rule:tests.equivalence-tests
• For languages not allowing the dollar sign in identifiers (e.g., Python),
  semgrep will return an error if your pattern contains an identifier
  starting with a dollar that is actually not considered a metavariable
  (e.g., $x)
• Support top level metadata field in rule.yaml. Entire metadata object is attached to
  all things that match the rule when using json output format.

Changed

• Config files in hidden paths can now be used by explicitly specifying
  the hidden path:

  semgrep --config some/hidden/.directory
  

• Metavariables can now contain digits or _. $USERS_2 is now
  a valid metavariable name. A metavariable must start with a letter
  or _ though.
• Simple calls of the semgrep CLI, such as semgrep --version, are now 60% faster.
• Display autofix suggestion in regular and json output mode.
• Update command line help texts.

Fixed

• Correctly parse f"{foo:,f}" in Python
• Correctly parse Python files where the last line is a comment