amorfo77/json
1
0 Fork 0
mirror of https://github.com/nlohmann/json.git synced 2026-10-24 14:58:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bump Semgrep to 1.182.1 and allow two unfixable advisories

Browse Source 
Semgrep 1.168.0 pins pyjwt~=2.13.0, which dependency-review flags
(GHSA-ffc3-869f-jxw9 and 14 more). Semgrep 1.182.1 requires
pyjwt>=2.15.0; the lock file now has pyjwt 2.15.1, mcp 1.29.0 and
click 8.4.2.

Semgrep 1.182.1 still pins mcp==1.29.0 (GHSA-84m7-p3x7-pcfv) and
opentelemetry-api~=1.37.0 (GHSA-xcq7-p3pf-p88h). Neither code path is
used by `semgrep scan` in CI, so dependency-review allows both until
Semgrep lifts its pins.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
This commit is contained in:
Niels Lohmann committed 2026-10-23 17:14:25 +02:00
1 parent d1235cecc9
commit 8fb114e45f
3 files changed
+29 -19
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/requirements/semgrep.in
+1 -1
View File
@@ -1 +1 @@
semgrep==1.168.0
semgrep==1.182.1