chore(deps): bump semgrep to a buildable version

[rennf93]

Problem

uv sync --extra dev against guard-agent master currently fails while building semgrep==0.86.3:

error: Failed to build `semgrep==0.86.3`
  cause: The build backend returned an error
  cause: Call to `setuptools.build_meta:__legacy__.get_requires_for_build_wheel` failed (exit status: 1)
         Exception: Could not find 'semgrep-core' executable, tried 'SEMGREP_CORE_BIN' and system 'semgrep-core'
hint: `semgrep` (v0.86.3) was included because `guard-agent[dev]` (v3.1.0) depends on `semgrep`

Reproduced on clean reruns of guard-core PR #130's ecosystem-gate consumer jobs (both consumer-test (guard-agent, ...) and consumer-test-latest-release (guard-agent, ...) fail at the uv sync --extra dev step, ~30-45s in): https://github.com/rennf93/guard-core/actions/runs/36649744556/job/109684783430. guard-agent's own ci.yml and scheduled-lint use the same uv sync --extra dev shape, so they are equally exposed.

Root cause

• guard-agent intentionally does not commit uv.lock (gitignored), so every CI run resolves fresh.
• The dev extra includes both fastapi and semgrep unpinned. With current PyPI metadata, fresh universal resolution (requires-python >=3.10,<3.15) hits a conflict between newer semgrep's dependency chain (the mcp era, semgrep >=1.80) and fastapi's pins, and uv's backtracker prefers walking semgrep down. With the full dev extra it walks all the way to 0.86.3, whose sdist setup.py aborts unless a system semgrep-core binary exists. No wheel exists for that vintage on modern platforms, so the build always fails.
• Minimal repro outside the repo: dev extras of ["semgrep", "fastapi"] with requires-python = ">=3.10,<3.15" resolves semgrep to 1.79.0 (pre-mcp); adding the rest of the dev extras drags it to 0.86.3. ["semgrep>=1.100,<2", "fastapi"] resolves to 1.178.0 immediately.

Fix

Pin the dev dependency to "semgrep>=1.100,<2" (with a comment explaining why). Resolution now lands on semgrep 1.178.0 (wheel release, cp310-cp314, all CI platforms), so no sdist build ever happens.

Verification

• uv lock resolves 190 packages, semgrep 1.178.0, no backtracking.
• Fresh clone of this branch (no lockfile, exact consumer shape): uv sync --extra dev succeeds; uv run semgrep --version prints 1.178.0 (verified under both the default interpreter and --python 3.10).
• Full suite green: REDIS_URL=redis://localhost:6379 uv run pytest -q -> 529 passed, 2 skipped, 100% coverage (also re-run under --python 3.10 in the fresh clone: 529 passed, 2 skipped).

Impact on guard-core#130

guard-core#130's failing consumer-test (guard-agent, ...) and consumer-test-latest-release (guard-agent, ...) jobs install guard-agent[dev] from this repo's default branch and fail in uv sync --extra dev at exactly this build. Once this PR merges to master, those jobs resolve semgrep 1.178.0 from a wheel and clear on the next ecosystem-gate run (re-running them before the merge would still fail, since the gate clones master).

Summary by CodeRabbit

• Chores
  • Constrained the Semgrep version used in development.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: aad8b38d-2200-4f77-a80b-67e68e3cd61a

📥 Commits

Reviewing files that changed from the base of the PR and between 29bcf0a and 4b6b846.

📒 Files selected for processing (1)

• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The dev optional dependency now constrains Semgrep to versions >=1.100 and <2, replacing the unbounded requirement.

Changes

Semgrep dependency constraint

Layer / File(s)	Summary
Set Semgrep version bounds pyproject.toml	The dev optional dependency changes from unbounded semgrep to semgrep>=1.100,<2.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 4b6b8

The development dependency change appears mergeable with normal CI checks; the observed CI resolution uses Semgrep 1.178.

Architecture Summary

Architecture risk: 🔵 Low · up to 4b6b8

The change affects 1 system.

Changed systems: pyproject.toml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — pyproject.toml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in pyproject.toml: The development dependency changes from unconstrained semgrep to semgrep>=1.100,<2; comments describe the lower and upper bounds and a resolution/build issue.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the main change: constraining Semgrep to a buildable dependency version for development installs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}