pypi semgrep 1.101.0
Release v1.101.0

22 hours ago

1.101.0 - 2024-12-18

Added

  • Improved pnpm-lock.yaml parsing. (gh-2663)

Changed

Fixed

  • pro: Improved inter-file tracking of tainted global variables. (code-7054)

  • Python (pro-only): Taint now correctly tracks through calls to class methods
    within a class, via the cls parameter.

    So for instance, we would be able to determine a source-to-sink
    vulnerability in the following code snippet:

    class A:
      def foo(self, x):
        sink(x)
    
      @classmethod
      def bar(cls):
        cls.foo(source)
    ``` (saf-1765)
    
  • pro: Fixed bug when generating inter-procedural taint traces, that it could
    cause a call-step to be missing in the trace. (saf-1783)

  • Restored the "rules" field in the SARIF output, even when logged out. (saf-1794)

Don't miss a new semgrep release

NewReleases is sending notifications on new releases.