build(deps): bump semgrep from 1.179.0 to 1.180.0

[dependabot]

Bumps semgrep from 1.179.0 to 1.180.0.

Release notes

Sourced from semgrep's releases.

Release v1.180.0

1.180.0 - 2026-10-07

### Added

• Promoted Dart to GA maturity. Pattern matching for Dart now supports type inference for typed declarations (id_type propagation), boolean operator typing (&&/|| as bool), alias-aware import equivalence (a pattern like http.get(...) matches code that imports package:http/http.dart under any local alias), method-chain ellipsis (obj.foo(). ... .bar()), multi-statement patterns (e.g. $V = get(); ...; eval($V);), and class-body ellipsis (class $X { ... }). (dart-ga-types-equivalences)

### Changed

• Removed support for the QL language (the CodeQL query language): --lang ql and the ql language key in rules, and parsing of .ql and .qll targets, are no longer available. (remove-ql)

### Fixed

• Traced scans using the default parallelism mode no longer hang when the telemetry endpoint is unresponsive or unreachable. (CODE-9946)
• Updated the bundled anyio (4.12.1 to 4.14.2) and urllib3 (2.6.3 to 2.8.0) dependencies to versions with fixes for known security advisories. (deps-anyio-urllib3)

Changelog

Sourced from semgrep's changelog.

1.180.0 - 2026-10-07

### Added

• Promoted Dart to GA maturity. Pattern matching for Dart now supports type inference for typed declarations (id_type propagation), boolean operator typing (&&/|| as bool), alias-aware import equivalence (a pattern like http.get(...) matches code that imports package:http/http.dart under any local alias), method-chain ellipsis (obj.foo(). ... .bar()), multi-statement patterns (e.g. $V = get(); ...; eval($V);), and class-body ellipsis (class $X { ... }). (dart-ga-types-equivalences)

### Changed

• Removed support for the QL language (the CodeQL query language): --lang ql and the ql language key in rules, and parsing of .ql and .qll targets, are no longer available. (remove-ql)

### Fixed

• Traced scans using the default parallelism mode no longer hang when the telemetry endpoint is unresponsive or unreachable. (CODE-9946)
• Updated the bundled anyio (4.12.1 to 4.14.2) and urllib3 (2.6.3 to 2.8.0) dependencies to versions with fixes for known security advisories. (deps-anyio-urllib3)

Commits

• a35fe83 chore: release 1.180.0
• b253ccb metrics: add scan.args.secretssemgrep/semgrep-proprietary#7189
• d4ca45fsemgrep/semgrep-proprietary#7188
• 4802833semgrep/semgrep-proprietary#7166
• 84f4256 test: re-apply disabling automatic maintenance in temporary Git repositories ...
• 0d4e9b1 feat(dart): promote to GA with type/import equivalences (semgrep/semgrep-prop...
• 2cb9a3dsemgrep/semgrep-proprietary#7185
• 5809414semgrep/semgrep-proprietary#7124
• c9ebd1a fix: import OSS commits through destination LFS filters (semgrep/semgrep-prop...
• 3a2e378semgrep/semgrep-proprietary#7179
• Additional commits viewable in compare view

[dependabot]

Looks like semgrep is no longer being updated by Dependabot, so this is no longer needed.