@codacy/tools-opengrep-1 0.6.2 → 0.8.1

package/dist/metadata.js

@@ -23,6 +23,121 @@ __export(metadata_exports, {
   descriptor: () => descriptor
 });
 module.exports = __toCommonJS(metadata_exports);
+
+// src/pattern-mappings.json
+var pattern_mappings_default = {
+  Django: {
+    prefixes: ["Semgrep_python.django."]
+  },
+  Flask: {
+    prefixes: ["Semgrep_python.flask."]
+  },
+  FastAPI: {
+    prefixes: ["Semgrep_python.fastapi."]
+  },
+  SQLAlchemy: {
+    prefixes: ["Semgrep_python.sqlalchemy."]
+  },
+  Express: {
+    prefixes: ["Semgrep_javascript.express."]
+  },
+  React: {
+    prefixes: ["Semgrep_javascript.react.", "Semgrep_typescript.react."]
+  },
+  Angular: {
+    prefixes: ["Semgrep_javascript.angular.", "Semgrep_typescript.angular."]
+  },
+  "Vue.js": {
+    prefixes: ["Semgrep_javascript.vue."]
+  },
+  NestJS: {
+    prefixes: ["Semgrep_typescript.nestjs."]
+  },
+  jQuery: {
+    prefixes: ["Semgrep_javascript.jquery."]
+  },
+  Playwright: {
+    prefixes: ["Semgrep_javascript.playwright."]
+  },
+  "Ruby on Rails": {
+    prefixes: ["Semgrep_ruby.rails."]
+  },
+  Spring: {
+    prefixes: ["Semgrep_java.spring."]
+  },
+  Laravel: {
+    prefixes: ["Semgrep_php.laravel."]
+  },
+  WordPress: {
+    prefixes: ["Semgrep_php.wordpress-plugins."]
+  },
+  "Gorilla Mux": {
+    prefixes: ["Semgrep_go.gorilla."]
+  },
+  GORM: {
+    prefixes: ["Semgrep_go.gorm."]
+  },
+  gRPC: {
+    prefixes: ["Semgrep_go.grpc."]
+  },
+  MongoDB: {
+    prefixes: ["Semgrep_java.mongodb.", "Semgrep_python.pymongo."]
+  },
+  Mongoose: {
+    prefixes: ["Semgrep_python.pymongo."]
+  },
+  i18next: {
+    prefixes: [
+      "Semgrep_typescript.react.portability.i18next.",
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  },
+  "react-intl": {
+    prefixes: [
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  },
+  "vue-i18n": {
+    prefixes: [
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  },
+  Lingui: {
+    prefixes: [
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  },
+  "next-intl": {
+    prefixes: [
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  },
+  "Flask-Babel": {
+    prefixes: [
+      "Semgrep_codacy.cpp.i18n.",
+      "Semgrep_codacy.java.i18n.",
+      "Semgrep_codacy.js.i18n.",
+      "Semgrep_codacy.python.i18n."
+    ]
+  }
+};
+
+// src/metadata.ts
 var descriptor = {
   id: "Semgrep",
   displayName: "Opengrep",
@@ -61,7 +176,8 @@ var descriptor = {
   filePatterns: ["*"],
   supportedOS: ["linux", "darwin"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  frameworkMappings: pattern_mappings_default
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.6.2",
+  "version": "0.8.1",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.6.2"
+    "@codacy/tooling": "0.8.1"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",

package/src/rules.yaml

@@ -1,7 +1,7 @@
 # Auto-generated by fetch-rules.mjs — do not edit manually.
 # Source: semgrep/semgrep-rules@4ccd3b9 + codacy/codacy-opengrep custom rules
-# Generated: 2026-03-26T12:10:30.762Z
-# Rule count: 2237
+# Generated: 2026-05-07T13:33:30.650Z
+# Rule count: 2243
 
 rules:
   - id: ai.csharp.detect-openai.detect-openai
@@ -97024,6 +97024,106 @@ rules:
       impact: MEDIUM
       confidence: LOW
       likelihood: HIGH
+  - id: codacy.python.i18n.no-hardcoded-print-concat
+    severity: WARNING
+    languages:
+      - python
+    pattern-either:
+      - pattern: print("..." + ...)
+      - pattern: print(... + "...")
+    message: >-
+      Avoid hardcoded or concatenated strings in print. Use an i18n translation function (e.g., _("key")) with .format() or f-strings.
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags hardcoded string literals concatenated in print calls to enforce localization
+      technology:
+        - python
+      impact: MEDIUM
+      confidence: LOW
+      likelihood: HIGH
+  - id: codacy.python.i18n.no-hardcoded-strftime
+    severity: WARNING
+    languages:
+      - python
+    pattern: $X.strftime("...")
+    message: >-
+      Avoid hardcoded date format strings in strftime. Use locale.nl_langinfo(locale.D_FMT) or similar locale-aware formatting.
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags hardcoded date format strings passed to strftime to enforce locale-aware date formatting
+      technology:
+        - python
+      impact: MEDIUM
+      confidence: HIGH
+      likelihood: HIGH
+  - id: codacy.python.i18n.no-hardcoded-number-format
+    severity: WARNING
+    languages:
+      - python
+    pattern-regex: ":\\.[0-9]+f"
+    message: >-
+      Avoid using :.Nf format specifiers for user-visible number formatting. Use locale.currency() or locale.format_string() for locale-aware formatting.
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags :.Nf format specifiers in f-strings used for user-visible numbers instead of locale-aware formatting
+      technology:
+        - python
+      impact: MEDIUM
+      confidence: LOW
+      likelihood: HIGH
+  - id: codacy.cpp.i18n.no-hardcoded-cout
+    severity: WARNING
+    languages:
+      - cpp
+    pattern: std::cout << "$MSG"
+    message: >-
+      Avoid hardcoded strings in std::cout. Use a localization function or resource bundle for user-facing output.
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags hardcoded string literals streamed directly to std::cout to enforce localization
+      technology:
+        - cpp
+      impact: MEDIUM
+      confidence: LOW
+      likelihood: HIGH
+  - id: codacy.cpp.i18n.no-hardcoded-strftime
+    severity: WARNING
+    languages:
+      - cpp
+    pattern-either:
+      - pattern: std::strftime($BUF, $SIZE, "$FMT", $TIME);
+      - pattern: strftime($BUF, $SIZE, "$FMT", $TIME);
+    message: >-
+      Avoid hardcoded date format strings in strftime. Use locale-aware date formatting (e.g., std::put_time with a locale-imbued stream).
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags hardcoded date format strings passed to strftime to enforce locale-aware date formatting
+      technology:
+        - cpp
+      impact: MEDIUM
+      confidence: HIGH
+      likelihood: HIGH
+  - id: codacy.cpp.i18n.no-hardcoded-number-format
+    severity: WARNING
+    languages:
+      - cpp
+    pattern: std::setprecision($N)
+    message: >-
+      Avoid using std::setprecision for user-visible number formatting. Imbue the stream with a locale and use std::use_facet<std::numpunct> for locale-aware output.
+    metadata:
+      category: codestyle
+      subcategory: i18n
+      description: Flags std::setprecision used for user-visible number formatting instead of locale-aware alternatives
+      technology:
+        - cpp
+      impact: MEDIUM
+      confidence: LOW
+      likelihood: HIGH
   - id: codacy.bash.security.hard-coded-password
     languages:
       - bash
@@ -97329,7 +97429,7 @@ rules:
       - pattern-either:
           - pattern-regex: "(?i)^(?:(?!--).)*\\b\\w*language\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{2}\\b'?"
           - pattern-regex: "(?i)^(?:(?!--).)*\\b\\w*currency\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{3}\\b'?"
-          - pattern-regex: "(?i)^(?:(?!--).)*\\b(\\w*\\.)?org_id\\b\\s*(=|:=|IN|!=|<>)\\s*(\\(?\\s*'?\\d+'?(,\\s*'?\\d+'?)*\\s*\\)?)?"
+          - pattern-regex: "(?i)^(?:(?!--).)*\\b(\\w*\\.)?org_id\\b\\s*(=|:=|IN|!=|<>)\\s*(\\(?\\s*'?\\d+'?(\\s*,\\s*'?\\d+'?)*\\s*\\)?)"
     paths:
       include:
         - "*.sql"
@@ -97555,7 +97655,7 @@ rules:
   - id: codacy.k8s.ingress.nginx.retirement.ingress-resource
     languages:
       - yaml
-    severity: WARNING
+    severity: ERROR
     message: >
       This Ingress is configured to use the Ingress NGINX controller
       (kubernetes.io/ingress.class: nginx or ingressClassName: nginx).
@@ -97588,7 +97688,7 @@ rules:
       description: >
         Detects Ingress resources configured to use the Ingress NGINX controller.
         Ingress NGINX is scheduled for retirement (no fixes after March 2026).
-      impact: MEDIUM
+      impact: HIGH
       confidence: HIGH
       references:
         - https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
@@ -97596,7 +97696,7 @@ rules:
   - id: codacy.k8s.ingress.nginx.retirement.ingress-class
     languages:
       - yaml
-    severity: WARNING
+    severity: ERROR
     message: >
       This IngressClass is wired to the Ingress NGINX controller
       (spec.controller: k8s.io/ingress-nginx).
@@ -97615,14 +97715,14 @@ rules:
       description: >
         Detects IngressClass objects wired to the Ingress NGINX controller.
         Ingress NGINX is scheduled for retirement (no fixes after March 2026).
-      impact: MEDIUM
+      impact: HIGH
       confidence: HIGH
       references:
         - https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
   - id: codacy.k8s.ingress.nginx.retirement.workload
     languages:
       - yaml
-    severity: WARNING
+    severity: ERROR
     message: >
       This Kubernetes resource is labelled as part of the Ingress NGINX
       controller stack (app.kubernetes.io/name: ingress-nginx).
@@ -97644,7 +97744,7 @@ rules:
       description: >
         Detects Kubernetes resources labelled as part of the Ingress NGINX
         controller stack. Ingress NGINX is scheduled for retirement (no fixes after March 2026).
-      impact: MEDIUM
+      impact: HIGH
       confidence: HIGH
       references:
         - https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/