Keep a single "semgrep==" line so Dependabot bumps Semgrep itself, but
let pip resolve its transitive dependencies instead of locking them by
hash.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
The hash-pinned requirements-semgrep.txt kept breaking: Semgrep pins its
own dependencies to exact or compatible-release versions, so Dependabot
bumps of any of them (importlib-metadata, exceptiongroup, jsonschema,
peewee, wcmatch, wrapt, ...) made the job fail with ResolutionImpossible.
Install the latest Semgrep with pip instead, remove the lock file and the
Dependabot ignore list that tried to work around it.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
The Dependabot bump to 10.1.0 (#6059) conflicts with the pinned
opentelemetry-api 1.37.0 (importlib-metadata<8.8.0), so the Semgrep job
failed with ResolutionImpossible. Ignore importlib-metadata in Dependabot
since semgrep pins it indirectly.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Regenerate the hash-pinned requirements file. This raises the transitive
pins pyjwt 2.13.0 -> 2.15.1 and mcp 1.23.3 -> 1.29.0 (also click 8.1.8 ->
8.4.2, new structlog 26.1.0), closing 18 of the 23 open Dependabot alerts.
The remaining alerts cannot be fixed until Semgrep relaxes its pins:
mcp needs 1.30.0 (Semgrep pins mcp==1.29.0) and opentelemetry-api needs
1.45.1 (Semgrep pins ~=1.37.0).
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Install Semgrep from a new hash-pinned requirements file in
cmake/requirements (covered by Dependabot) instead of a version-only
"pip install semgrep==1.168.0", and pass --require-hashes to the astyle
and natvis installs in check_amalgamation.yml, whose requirements files
got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies
code-scanning alerts for semgrep.yml and check_amalgamation.yml.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Add sha256 hashes for every release file to the requirements of the
astyle and natvis tools, and install Meson in the ubuntu workflow from a
new hashed requirements file with --require-hashes instead of an
unpinned "pip install meson". pip verifies all installs from these files
once they contain hashes, including the ones of the Makefile and
cmake/ci.cmake. Addresses the Scorecard Pinned-Dependencies alerts for
ubuntu.yml; the check_amalgamation.yml flags follow once develop has the
hashes.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Cppcheck 2.20 rejects invocations of unknown function-like macros in #if
conditions instead of evaluating them as 0. default_defines.hpp expands
the Hedley macros to the compiler's feature-test operators (__has_attribute
etc.), so define them as 0 in a generated include file.
It also reports a false bufferAccessOutOfBounds in the float overload of
float_from_bits, sizing the parameter as the double overload's; use the
size of the source instead (equal by the static_assert).
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Niels Lohmann
dependabot[bot]