)]}'
{
  "commit": "8fb114e45f74c48ba095e0ad82f6a8964307491d",
  "tree": "10d006ef4b68b21e832868c0f6f68515a55c977d",
  "parents": [
    "d1235cecc9f7d2f2a33228362ce096ac7e990130"
  ],
  "author": {
    "name": "Niels Lohmann",
    "email": "mail@nlohmann.me",
    "time": "Fri Oct 23 17:14:25 2026 +0200"
  },
  "committer": {
    "name": "Niels Lohmann",
    "email": "mail@nlohmann.me",
    "time": "Fri Oct 23 17:14:25 2026 +0200"
  },
  "message": "Bump Semgrep to 1.182.1 and allow two unfixable advisories\n\nSemgrep 1.168.0 pins pyjwt~\u003d2.13.0, which dependency-review flags\n(GHSA-ffc3-869f-jxw9 and 14 more). Semgrep 1.182.1 requires\npyjwt\u003e\u003d2.15.0; the lock file now has pyjwt 2.15.1, mcp 1.29.0 and\nclick 8.4.2.\n\nSemgrep 1.182.1 still pins mcp\u003d\u003d1.29.0 (GHSA-84m7-p3x7-pcfv) and\nopentelemetry-api~\u003d1.37.0 (GHSA-xcq7-p3pf-p88h). Neither code path is\nused by `semgrep scan` in CI, so dependency-review allows both until\nSemgrep lifts its pins.\n\nSigned-off-by: Niels Lohmann \u003cmail@nlohmann.me\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "215827a28f56f8462fd7c6387dd25feeaa9751a6",
      "old_mode": 33188,
      "old_path": ".github/requirements/semgrep.in",
      "new_id": "798380bae225a1d2781724b4bf587f6ee8891d89",
      "new_mode": 33188,
      "new_path": ".github/requirements/semgrep.in"
    },
    {
      "type": "modify",
      "old_id": "735cf15893a96dd2a5c67c5e96b661a1b1c546ea",
      "old_mode": 33188,
      "old_path": ".github/requirements/semgrep.txt",
      "new_id": "9a1e57efc9bc05a975a581e6cb1238140d6b4ed1",
      "new_mode": 33188,
      "new_path": ".github/requirements/semgrep.txt"
    },
    {
      "type": "modify",
      "old_id": "333546437b71f2104c66e79847da469d9c3e9940",
      "old_mode": 33188,
      "old_path": ".github/workflows/dependency-review.yml",
      "new_id": "4e373554a7f41fd80b6247f1df80ff5bd9a6fa5a",
      "new_mode": 33188,
      "new_path": ".github/workflows/dependency-review.yml"
    }
  ]
}