…-proprietary#2033)

synced from Pro b6398f332c4fc19a2325d649b183ff748770026b

…oprietary#2126)

Refactor the existing lockfile/manifest matching code to allow for easy 
support for pattern based matching in the future. This PR should have 
no effect on functionality.

synced from Pro 6b7f4cd595769643cf32fb91875e923158f33458

semgrep/semgrep-proprietary#2230)

The `FoundDependency` interface recently added a new property
`lockfile_path` in order to support upcoming features. In this PR we
update all parsers to include the lockfile_path.

Related semgrep/semgrep-interfaces#289

synced from Pro 4b259e10dec4076ee9ad81c57cecb967a0ecc1b1

…etary#2251)

Allow the commit to be empty.
Checkout release_branch before release.

synced from OSS 0b46384

Co-authored-by: Andre Kuhlenschmidt <andre@semgrep.com>

synced from Pro d2beac3543a29d303f9b4679d212e4f3b16dc3dd

…grep/semgrep-proprietary#2248)

In preparation for adding function shapes, we want to allow shapes and
signatures types to be mutually recursive.

Initially I thought PR #2192 was enough but because there are `Set`s
involved, making the types mutually recursive is more complicated.

Follows: a85658b30f7 refactor: Merge Taint_shape into Taint_sig (semgrep/semgrep-proprietary#2192)

test plan:
make test

synced from Pro e5a705c3bd3b112b3e2a5cf3cf32a1c4ffabdf1e

This adds a small module that will annotate a list of targets that we're
about to scan with relevant info, and now we will send that off in
traces.

Note that most of this PR is just adding yojson derivers to things. If
we don't like the way I chose to derive some of the edge cases I'm open
to changing them!

## Test plan
```bash
semgrep --pro --trace --config p/default --trace-endpoint semgrep-dev
```
in https://github.com/SigNoz/signoz. relevant trace
[here](https://jaeger-dev2.corp.semgrep.dev/trace/53dd39781d191adb57711cc43f518608?uiFind=b704e985bd5b28c9),
check the `annotated_targets` tag, and hit "copy" not "JSON".

Easiest way to use it is something like pbpaste:
```bash
pbpaste > annotated_targets.json
jq ".[] | select(.stat.textual | not) | .internal_path" annotated_targets.json # get list of non text files
jq "sort_by(.stat.line_count) | .[] | select(.stat.line_count > 4000) | {path: .internal_path, line_count:.stat.line_count}" annotated_targets.json # get list of files w/ line count > 4k
jq ".[] | select(.minified) | .internal_path" annotated_targets.json # get list of minified files
```

tested on elastic search also (>30k targets). Only adds 5s overhead
there. Jaeger is still workable too, and doesn't lag unless manually
exploring the json. Note we will need to wait until @semgrep/infra bumps
some jaeger settings though before traces with >5k targets will actually
be picked up since they're relatively large.

synced from Pro b942b9a1266d7975333a74f03ad1ae3c24def812

…mgrep/semgrep-proprietary#2181)

This PR is a follow-up extension of
semgrep/semgrep-proprietary#2022 and enables
resolving names for interface methods with multiple implementations.

synced from Pro 34e6f3eee95533834423b9a8af9e058d7877a9c9