[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
aqua:aquasecurity/trivy	tools	minor	0.75.0 → 0.76.0	0.76.1
aqua:cli/cli	tools	patch	2.102.0 → 2.102.1	2.103.2 (+2)
npm:socket	tools	minor	1.8.2 → 1.9.1	1.10.1 (+1)
pipx:semgrep (changelog)	tools	minor	1.180.0 → 1.182.0	1.182.1

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.76.0: v0.76.0

Compare Source

⚡ Highlights ⚡

👉 aquasecurity/trivy#11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

cli/cli (aqua:cli/cli)

v2.102.1: GitHub CLI 2.102.1

Compare Source

What's Changed

Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: cli/cli@v2.102.0...v2.102.1

SocketDev/socket-cli (npm:socket)

v1.9.1: v1.9.1

Compare Source

What's Changed

• fix(fix): list Yarn classic under --allow-overrides by @​mtorp in fix(fix): list Yarn classic under --allow-overrides SocketDev/socket-cli#1635
• upgrading coana to version 15.12.11 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.11 SocketDev/socket-cli#1636
• chore(release): 1.9.1 by @​socket-release-bot[bot] in chore(release): 1.9.1 SocketDev/socket-cli#1637

Full Changelog: SocketDev/socket-cli@v1.9.0...v1.9.1

v1.9.0: v1.9.0

Compare Source

What's Changed

• fix(api): show the Socket API's error message on failed requests by @​BarrensZeppelin in fix(api): show the Socket API's error message on failed requests SocketDev/socket-cli#1627
• refactor: pin the Coana CLI version in the source by @​BarrensZeppelin in refactor: pin the Coana CLI version in the source SocketDev/socket-cli#1628
• feat: launch the Coana CLI from GCS instead of npm by @​BarrensZeppelin in feat: launch the Coana CLI from GCS instead of npm SocketDev/socket-cli#1629
• refactor(dlx): drop the force option and range detection by @​BarrensZeppelin in refactor(dlx): drop the force option and range detection SocketDev/socket-cli#1630
• upgrading coana to version 15.12.10 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.10 SocketDev/socket-cli#1633
• chore(release): 1.9.0 by @​socket-release-bot[bot] in chore(release): 1.9.0 SocketDev/socket-cli#1634

Full Changelog: SocketDev/socket-cli@v1.8.4...v1.9.0

v1.8.4: v1.8.4

Compare Source

What's Changed

• fix(fix): exit 5 when computed fixes go unapplied by @​mtorp in fix(fix): exit 5 when computed fixes go unapplied SocketDev/socket-cli#1624
• upgrading coana to version 15.12.9 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.9 SocketDev/socket-cli#1625
• chore(release): 1.8.4 by @​socket-release-bot[bot] in chore(release): 1.8.4 SocketDev/socket-cli#1626

Full Changelog: SocketDev/socket-cli@v1.8.3...v1.8.4

v1.8.3: v1.8.3

Compare Source

What's Changed

• fix(manifest): cover recursive build roots by build file, not directory by @​jfblaa in fix(manifest): cover recursive build roots by build file, not directory SocketDev/socket-cli#1620
• upgrading coana to version 15.12.8 by @​socket-pr-bot[bot] in upgrading coana to version 15.12.8 SocketDev/socket-cli#1622
• chore(release): 1.8.3 by @​socket-release-bot[bot] in chore(release): 1.8.3 SocketDev/socket-cli#1623

Full Changelog: SocketDev/socket-cli@v1.8.2...v1.8.3

semgrep/semgrep (pipx:semgrep)

v1.182.0: Release v1.182.0

Compare Source

1.182.0 - 2026-10-20

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @​class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

v1.181.0: Release v1.181.0

Compare Source

1.181.0 - 2026-10-14

### Changed

• semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)

• Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)

• pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)

• go grammar update (v0.23.4):

  • Go target parsing now supports composite type-set constraints and shorthand union constraints on type parameters, preserving underlying-type markers and all union members. Literal generic rule-pattern syntax remains unchanged.
  • Go target parsing now supports embedded generic struct fields, including pointer and package-qualified embeddings, while retaining their type arguments.
  • Go target parsing now supports standalone generic function instantiations with multiple or composite type arguments, such as Pair[int, string] and Identity[[]int], including qualified function names.
  • Go target parsing now accepts Unicode decimal digits after the first character of an identifier, including Arabic-Indic and Devanagari digits.

  (go-v0.23.4)

• Hack grammar update:

  • Hack target parsing now supports capability lists on functions, methods, function types, lambdas, and anonymous functions, including empty lists and context-dependent capabilities.
  • Hack target parsing now supports context constants with capability bounds or initializers, preserving the distinction between super bounds, as bounds, and assigned capabilities. Unbounded abstract context constants retain their existing representation limitation.
  • Hack target parsing now supports concrete and abstract enum classes with typed members, plus qualified and unqualified enum class labels.
  • Hack target parsing now supports function and static-method references with empty or explicit type arguments, such as foo<> and MyClass::bar.
  • Hack target parsing now preserves type arguments on calls and constructors such as foo(), $obj->bar(...), and new MyClass(...), matching other languages' typed-call representation.
  • Hack target parsing now supports expression-tree literals such as Example1 + 2, preserving the visitor and body text. Embedded DSL bodies remain opaque rather than being parsed as Hack expressions.
  • Hack target parsing now supports file-level attributes such as <<file: SomeAttribute(...)>>, preserving attribute names and arguments.
  • Hack target parsing now supports internal visibility on methods and properties, keeping it distinct from public, protected, and private visibility.
  • Hack target parsing now accepts namespace-relative names such as namespace\run() and include/require member names in piped expressions.

  (hack-1a7ded90288189746c54861ac144ede97df95081)

### Fixed

• pro: Historical secrets scanning no longer aborts when preparatory git gc
  fails. (SCRT-982-historical-gc-nonfatal)
• Supply Chain: lockfileless Gradle resolution now tells the dependency graph
  plugin where to write its report, so builds that relocate their build
  directory resolve instead of failing. When the plugin writes no report, the
  scan reports a resolution error that includes the Gradle log instead of
  crashing on the missing file. (code-9953)
• Supply Chain: lockfileless Gradle and Maven scans now report incomplete
  dependency resolution when dependencies or transitive metadata cannot be
  resolved. Registry HTTP failures include the affected URL when available. (sc-3358)

### Infra/Release Changes

• Forward optional job context when registering CLI scans. (SMS-3333)