diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix
index 7b5adc161094..0b4f5d0c8382 100644
--- a/pkgs/development/python-modules/semgrep/default.nix
+++ b/pkgs/development/python-modules/semgrep/default.nix
@@ -1,34 +1,31 @@
 {
   lib,
+  buildPythonPackage,
   callPackage,
   fetchFromGitHub,
   semgrep-core,
-  buildPythonPackage,
 
-  pytestCheckHook,
+  # check tools
   git,
+  pytestCheckHook,
 
-  # python packages
+  # python runtime dependencies
   attrs,
   boltons,
   click,
   click-option-group,
   colorama,
   defusedxml,
-  flaky,
   glom,
   jsonschema,
+  mcp,
   opentelemetry-api,
   opentelemetry-exporter-otlp-proto-http,
   opentelemetry-instrumentation-requests,
   opentelemetry-instrumentation-threading,
   opentelemetry-sdk,
-  mcp,
   packaging,
   peewee,
-  pytest-freezegun,
-  pytest-mock,
-  pytest-snapshot,
   python-lsp-jsonrpc,
   requests,
   rich,
@@ -36,10 +33,16 @@
   semantic-version,
   tomli,
   tqdm,
-  types-freezegun,
   typing-extensions,
   urllib3,
   wcmatch,
+
+  # python check dependencies
+  flaky,
+  pytest-freezegun,
+  pytest-mock,
+  pytest-snapshot,
+  types-freezegun,
 }:
 
 # testing locally post build:
@@ -89,30 +92,30 @@ buildPythonPackage rec {
   dependencies = [
     attrs
     boltons
-    colorama
     click
     click-option-group
+    colorama
+    defusedxml
     glom
+    jsonschema
+    mcp
+    opentelemetry-api
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-requests
+    opentelemetry-instrumentation-threading
+    opentelemetry-sdk
+    packaging
+    peewee
+    python-lsp-jsonrpc
     requests
     rich
     ruamel-yaml
     semantic-version
-    tqdm
-    packaging
-    jsonschema
-    wcmatch
-    mcp
-    peewee
-    defusedxml
-    urllib3
-    typing-extensions
-    python-lsp-jsonrpc
     tomli
-    opentelemetry-api
-    opentelemetry-sdk
-    opentelemetry-exporter-otlp-proto-http
-    opentelemetry-instrumentation-requests
-    opentelemetry-instrumentation-threading
+    tqdm
+    typing-extensions
+    urllib3
+    wcmatch
   ];
 
   doCheck = true;
@@ -120,31 +123,32 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     git
     pytestCheckHook
+
     flaky
-    pytest-snapshot
-    pytest-mock
     pytest-freezegun
+    pytest-mock
+    pytest-snapshot
     types-freezegun
   ];
 
   disabledTestPaths = [
     "tests/default/e2e"
-    "tests/default/e2e-pysemgrep"
     "tests/default/e2e-other"
+    "tests/default/e2e-pysemgrep"
     "tests/default/mcp"
   ];
 
   disabledTests = [
-    # requires networking
-    "test_send"
-    # requires networking
-    "test_parse_exclude_rules_auto"
-    # many child tests require networking to download files
-    "TestConfigLoaderForProducts"
-    # doesn't start flaky plugin correctly
-    "test_debug_performance"
     # requires .git directory
     "clean_project_url"
+    # doesn't start flaky plugin correctly
+    "test_debug_performance"
+    # requires networking
+    "test_parse_exclude_rules_auto"
+    # requires networking
+    "test_send"
+    # many child tests require networking to download files
+    "TestConfigLoaderForProducts"
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index 97012ad1912e..b71eecfdcbe4 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -2,8 +2,9 @@
   lib,
   stdenv,
   fetchPypi,
-  unzip,
+
   autoPatchelfHook,
+  unzip,
 }:
 
 let