From 33e0aef37813b7f2e7a5b095031128fc1007d19f Mon Sep 17 00:00:00 2001 From: OttNorml <2350859+ottnorml@users.noreply.github.com> Date: Tue, 2 Jun 2026 21:13:04 +0200 Subject: [PATCH 1/4] semgrep: sort inputs, dependencies, and tests Group runtime and check inputs, and sort dependency and test-related lists to make future updates easier to review. --- .../python-modules/semgrep/default.nix | 76 ++++++++++--------- .../python-modules/semgrep/semgrep-core.nix | 3 +- 2 files changed, 42 insertions(+), 37 deletions(-) diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix index 7b5adc161094..0b4f5d0c8382 100644 --- a/pkgs/development/python-modules/semgrep/default.nix +++ b/pkgs/development/python-modules/semgrep/default.nix @@ -1,34 +1,31 @@ { lib, + buildPythonPackage, callPackage, fetchFromGitHub, semgrep-core, - buildPythonPackage, - pytestCheckHook, + # check tools git, + pytestCheckHook, - # python packages + # python runtime dependencies attrs, boltons, click, click-option-group, colorama, defusedxml, - flaky, glom, jsonschema, + mcp, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-requests, opentelemetry-instrumentation-threading, opentelemetry-sdk, - mcp, packaging, peewee, - pytest-freezegun, - pytest-mock, - pytest-snapshot, python-lsp-jsonrpc, requests, rich, @@ -36,10 +33,16 @@ semantic-version, tomli, tqdm, - types-freezegun, typing-extensions, urllib3, wcmatch, + + # python check dependencies + flaky, + pytest-freezegun, + pytest-mock, + pytest-snapshot, + types-freezegun, }: # testing locally post build: @@ -89,30 +92,30 @@ buildPythonPackage rec { dependencies = [ attrs boltons - colorama click click-option-group + colorama + defusedxml glom + jsonschema + mcp + opentelemetry-api + opentelemetry-exporter-otlp-proto-http + opentelemetry-instrumentation-requests + opentelemetry-instrumentation-threading + opentelemetry-sdk + packaging + peewee + python-lsp-jsonrpc requests rich ruamel-yaml semantic-version - tqdm - packaging - jsonschema - wcmatch - mcp - peewee - defusedxml - urllib3 - typing-extensions - python-lsp-jsonrpc tomli - opentelemetry-api - opentelemetry-sdk - opentelemetry-exporter-otlp-proto-http - opentelemetry-instrumentation-requests - opentelemetry-instrumentation-threading + tqdm + typing-extensions + urllib3 + wcmatch ]; doCheck = true; @@ -120,31 +123,32 @@ buildPythonPackage rec { nativeCheckInputs = [ git pytestCheckHook + flaky - pytest-snapshot - pytest-mock pytest-freezegun + pytest-mock + pytest-snapshot types-freezegun ]; disabledTestPaths = [ "tests/default/e2e" - "tests/default/e2e-pysemgrep" "tests/default/e2e-other" + "tests/default/e2e-pysemgrep" "tests/default/mcp" ]; disabledTests = [ - # requires networking - "test_send" - # requires networking - "test_parse_exclude_rules_auto" - # many child tests require networking to download files - "TestConfigLoaderForProducts" - # doesn't start flaky plugin correctly - "test_debug_performance" # requires .git directory "clean_project_url" + # doesn't start flaky plugin correctly + "test_debug_performance" + # requires networking + "test_parse_exclude_rules_auto" + # requires networking + "test_send" + # many child tests require networking to download files + "TestConfigLoaderForProducts" ]; preCheck = '' diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix index 97012ad1912e..b71eecfdcbe4 100644 --- a/pkgs/development/python-modules/semgrep/semgrep-core.nix +++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix @@ -2,8 +2,9 @@ lib, stdenv, fetchPypi, - unzip, + autoPatchelfHook, + unzip, }: let From cdb6a2ee8315e8d6d7e989d30419d0cd8962fef3 Mon Sep 17 00:00:00 2001 From: OttNorml <2350859+ottnorml@users.noreply.github.com> Date: Tue, 2 Jun 2026 21:14:02 +0200 Subject: [PATCH 2/4] semgrep: remove unused callPackage binding --- pkgs/development/python-modules/semgrep/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix index 0b4f5d0c8382..3b799e87c004 100644 --- a/pkgs/development/python-modules/semgrep/default.nix +++ b/pkgs/development/python-modules/semgrep/default.nix @@ -1,7 +1,6 @@ { lib, buildPythonPackage, - callPackage, fetchFromGitHub, semgrep-core, From 208a63107cc9ffce018b0b53eef00da566a2da0b Mon Sep 17 00:00:00 2001 From: OttNorml <2350859+ottnorml@users.noreply.github.com> Date: Tue, 2 Jun 2026 20:55:18 +0200 Subject: [PATCH 3/4] semgrep: add pytest plugins used by checks Add requests-mock and pytest-asyncio to nativeCheckInputs. The enabled upstream checks use the requests_mock fixture, and the pytest configuration references asyncio_mode. --- pkgs/development/python-modules/semgrep/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix index 3b799e87c004..69df6e0beeb5 100644 --- a/pkgs/development/python-modules/semgrep/default.nix +++ b/pkgs/development/python-modules/semgrep/default.nix @@ -38,9 +38,11 @@ # python check dependencies flaky, + pytest-asyncio, pytest-freezegun, pytest-mock, pytest-snapshot, + requests-mock, types-freezegun, }: @@ -124,9 +126,11 @@ buildPythonPackage rec { pytestCheckHook flaky + pytest-asyncio pytest-freezegun pytest-mock pytest-snapshot + requests-mock types-freezegun ]; From 5937d558e1a67aef34c190e24613ea31eb4fc659 Mon Sep 17 00:00:00 2001 From: OttNorml <2350859+ottnorml@users.noreply.github.com> Date: Tue, 2 Jun 2026 20:57:13 +0200 Subject: [PATCH 4/4] semgrep: 1.161.0 -> 1.164.0 Changelog: https://github.com/semgrep/semgrep/blob/v1.164.0/CHANGELOG.md --- .../python-modules/semgrep/common.nix | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix index e6b1ef643199..cd5ff594de3c 100644 --- a/pkgs/development/python-modules/semgrep/common.nix +++ b/pkgs/development/python-modules/semgrep/common.nix @@ -1,9 +1,9 @@ { lib }: rec { - version = "1.161.0"; + version = "1.164.0"; - srcHash = "sha256-WvvEn5PUEXgwtYd72IuEljHUxcJRJh7uHzNLFqaVEbc="; + srcHash = "sha256-ced287/jH+as/1rGBOfoZ06UuQ1sf1YI4AMHbHrtnHU="; # This tag is used to select the correct wheel from PyPI. # It is updated by the update.sh script. @@ -17,8 +17,8 @@ rec { "cli/src/semgrep/semgrep_interfaces" = { owner = "semgrep"; repo = "semgrep-interfaces"; - rev = "8a09b2ed5838118f0ecc45305eb9d956aabcd700"; - hash = "sha256-jWv0/DADhYmBGJdMpxX8Rq2KQ2wlYIrJGGeYikcskOM="; + rev = "f4a74a03e8ec3dd368b96101648a3210e03fa61e"; + hash = "sha256-dy+oOB0QmZjMpTYINSPIjzhpN6d/45DaajqumKIYxC4="; }; }; @@ -28,20 +28,20 @@ rec { # on github releases core = { x86_64-linux = { - platform = "manylinux_2_35_x86_64"; - hash = "sha256-ioIlfWVDSPlCUPQQcB8RJNxwoMQzhGGsxe5xPhAbDZ0="; + platform = "manylinux_2_34_x86_64"; + hash = "sha256-dFrlzhvvfJsDyStDHRdMpu54AaXioEfGSsIQTH5pUvs="; }; aarch64-linux = { - platform = "manylinux_2_35_aarch64"; - hash = "sha256-yDFnKdVIgt7eFNcWb0za9hdJJ7BYldEoiK46D0eRx4U="; + platform = "manylinux_2_34_aarch64"; + hash = "sha256-N24E9xOyRO7pXopRs+gSQM2nwHE214GfcntcoH7H7Kk="; }; x86_64-darwin = { platform = "macosx_10_14_x86_64"; - hash = "sha256-NFBo32ZfO0h0KunOaWefWRnyuu1XkYku5RTxOpCfWWQ="; + hash = "sha256-O0kSaWou5GeoVo1UMP4J2m4RAQOQUqA+YG3PaOvjfAo="; }; aarch64-darwin = { platform = "macosx_11_0_arm64"; - hash = "sha256-H51DqX94yMqbwvDrlIa3D64hBtvYAvelK7HLnVj588g="; + hash = "sha256-AsKxA5Wmy3NEQJ0kS6ylE33d0W86e9F494aiIkwyrcA="; }; };