build(deps-dev): update semgrep requirement from <1.170,>=1.0 to >=1.0,<1.176

[dependabot]

Updates the requirements on semgrep to permit the latest version.

Release notes

Sourced from semgrep's releases.

Release v1.175.0

1.175.0 - 2026-08-26

### Changed

• Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

Changelog

Sourced from semgrep's changelog.

1.175.0 - 2026-08-26

### Changed

• Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

1.174.0 - 2026-08-20

### Added

• Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

• Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped subprojects. (SC-3830)

1.173.0 - 2026-08-12

### Added

• semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha)
• Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)

### Changed

• File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos. (ENGINE-2854)
• Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time and improving parsing throughput. (ENGINE-2920)
• Updated the Solidity parser for newer language features (transient storage, named mapping parameters, layout at, assembly flags, global using-directives, EVM Cancun builtins) and corrected ternary/?: vs member-access precedence. (LANG-207)
• Pro: Unsupported patterns in case expressions are now handled more robustly, with improved error recovery during taint analysis — branch bodies are no longer dropped from the dataflow intermediate language when a pattern can't be compiled. Pattern matching in statement position also now benefits from the same compilation as expression position. (LANG-598)
• Improved performance in highly parallel scans with many target files, running on systems using the musl libc implementation. (pcre2-match-data-reuse)

### Fixed

• When the internal semgrep-core RPC subprocess is terminated by a signal (for example an out-of-memory kill or a segfault), Semgrep now logs a clear error naming the signal, instead of the misleading "Expected a number, got ''"

... (truncated)

Commits

• 7963c5a chore: release 1.175.0
• 90bb06d chore: restructure hashtbl multi-binding call sites (semgrep/semgrep-propriet...
• 252b2ab chore: update slack action to v2+ chat.postMessage API (semgrep/semgrep-propr...
• cb3a4aesemgrep/semgrep-proprietary#6921
• 2fb3e42semgrep/semgrep-proprietary#6916
• f89eb9esemgrep/semgrep-proprietary#6898
• 09998aasemgrep/semgrep-proprietary#6857
• 520c044semgrep/semgrep-proprietary#6912
• bc6c914semgrep/semgrep-proprietary#6679
• a0c13f3semgrep/semgrep-proprietary#6915
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #19.