build(deps-dev): update semgrep requirement from <1.170,>=1.0 to >=1.0,<1.171

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.170.0

1.170.0 - 2026-07-15

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from 600 to 900 seconds, giving large projects more time to resolve dependencies before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages where a qualified name in type position parses as an expression (e.g. Python's types: [a.b.C]) when the metavariable's type is determined by type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

Changelog

Sourced from semgrep's changelog.

1.170.0 - 2026-07-15

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from 600 to 900 seconds, giving large projects more time to resolve dependencies before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages where a qualified name in type position parses as an expression (e.g. Python's types: [a.b.C]) when the metavariable's type is determined by type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

1.169.0 - 2026-07-08

### Infra/Release Changes

• Updated Dart parser to a more recent upstream version. (LANG-579)

... (truncated)

Commits

• bd614ac chore: release 1.170.0
• f3e8812semgrep/semgrep-proprietary#6571
• 2615498 fix(cpp, pro): handle #if 0 splits across syntactic units (semgrep/semgrep-...
• 490e1dc fix: bump OCaml compiler fork for musl signal-stack sizing (ENGINE-2863) (sem...
• 90d5913 fix: add Gc.compact after an ExceededMemoryLimit exception in Memory_limit to...
• aa977b9 feat(cpp, pro): prune statically-dead preprocessor #if branches (semgrep/se...
• c83f9bcsemgrep/semgrep-proprietary#6694
• 75b3783semgrep/semgrep-proprietary#6702
• 74b9404 fix: parse Dockerfile RUN instructions with heredoc syntax (semgrep/semgrep-p...
• 7cbfd85semgrep/semgrep-proprietary#6712
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #9.