[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
aqua:aquasecurity/trivy	tools	patch	0.76.1 → 0.76.2
npm:socket	tools	minor	1.13.1 → 1.14.1
pipx:semgrep (changelog)	tools	minor	1.183.0 → 1.184.0	1.185.0

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.76.2: v0.76.2

Compare Source

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

• Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
• golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
• github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

• 3f6334d223b52188324af3b9923b4249cd206652 release: v0.76.2 [release/v0.76] (#11552)
• 1cabe83c11ffed6e984ab46be8886e1e01516ead fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
• be08de47d0d76fca7e992c0f47fbcf7853f8a713 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
• a8537d389cbd0fa215eddfddc27150fc7bc82a6c fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
• ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)

SocketDev/socket-cli (npm:socket)

v1.14.1: v1.14.1

Compare Source

What's Changed

• upgrading coana to version 15.14.2 by @​socket-pr-bot[bot] in upgrading coana to version 15.14.2 SocketDev/socket-cli#1702
• chore(release): 1.14.1 by @​socket-release-bot[bot] in chore(release): 1.14.1 SocketDev/socket-cli#1703

Full Changelog: SocketDev/socket-cli@v1.14.0...v1.14.1

v1.14.0: v1.14.0

Compare Source

What's Changed

• fix(scan): make every discovered ecosystem facts-only under --dynamic-sbom-inference by @​jfblaa in fix(scan): make every discovered ecosystem facts-only under --dynamic-sbom-inference SocketDev/socket-cli#1696
• feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystems use Socket facts by @​jfblaa in feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystems use Socket facts SocketDev/socket-cli#1697
• chore(release): 1.14.0 by @​socket-release-bot[bot] in chore(release): 1.14.0 SocketDev/socket-cli#1699

Full Changelog: SocketDev/socket-cli@v1.13.1...v1.14.0

semgrep/semgrep (pipx:semgrep)

v1.184.0: Release v1.184.0

Compare Source

1.184.0 - 2026-11-05

### Added

• PHP: Improved virtual call resolution for basic trait composition. (CODE-9176)
• Supply Chain: a requirements.txt dependency declared as a version range (litellm>=1.10) or with no version (flask) now produces a finding for every advisory whose affected versions overlap the declared range, in both the Python and native resolvers. Such a finding has no single installed version to confirm, so it needs review. A range line next to a pinned copy of the same package produces no finding of its own, since the pinned copy names the installed version. (SC-4243)
• Set SEMGREP_LOG_JSON_FILE to emit structured execution events with scan metadata alongside existing text output. (SMS-3670)

### Changed

• Scans are slightly faster. The dataflow analyses build the name of each variable with a plain string join, and no longer with Printf and Format. On 6 open-source repos, the scan time was a median of 3% lower, with identical findings. (dataflow-variable-keys)

• go grammar update (v0.25.0):

  • Go source parsing now supports generic type aliases, preserving type parameters, constraints, and alias semantics. Existing alias patterns can match these declarations; spelling generic parameter lists in rule patterns remains unsupported.
  • Go correctly parses unnamed map parameters and results in mixed signatures such as ([]string, int, map[int]int, error), allowing function patterns to match those signatures.
  • Go correctly represents chained indexing such as table[key][next] as nested index expressions, restoring matches for nested-index patterns.

  (go-v0.25.0)

### Fixed

• Semgrep no longer logs credentials embedded in a proxy URL (for example
  HTTPS_PROXY=http://user:password@​proxy:8080) when it reports the configured
  proxy settings. (proxy-log-redact-userinfo)
• Logs and traces no longer include snippets of the scanned source code when a
  file fails to parse. Parsing exceptions now report the file, line, column, and
  the length of the unexpected text instead. Dependency resolution errors for
  malformed lockfiles are reported the same way. (redact-source-in-telemetry)
• pro: Reduced peak memory for large projects (CODE-10136)
• Supply Chain: the yarn v1 lockfile parser no longer reports a package named
  "dependencies" with an empty version when a blank line precedes the
  dependencies block of an entry, and it now keeps that entry's dependency
  edges. Entries without a version line are reported as parser errors instead
  of dependencies with an empty version. (SC-4214)
• Gradle module attribution now works for modules whose logical project name
  does not match their directory (a renamed include or a remapped
  projectDir in settings.gradle). The resolver's init script reports each
  project's actual build file, and dependencies are attributed to that file
  instead of falling back to the root manifest. (SC-4327)
• semgrep ci --no-suppress-errors with --allow-local-builds: when dependency resolution fails and the scan exits with code 2, the reason is now also in the errors of the JSON output (one entry per resolver error or lockfile parse error of each failed subproject, or a generic entry if none was reported; resolver errors include the failed command and the end of its output, with common credential shapes such as URL credentials and Authorization headers redacted), not only in the log. Previously the JSON had no error, so pipelines that read it could not tell why the scan failed. (SC-4348)