chore(deps): update semgrep to the latest

[behnazh-w]

Summary

Update semgrep to the latest version and remove the ignored advisories found in its dependencies. This PR also improves some of the tests that would fail on Python 3.14.

[jenstroeger]

I noticed that create_engine() is called in different places for local instances of SQLA’s Engine though it should be a single global instance for the application’s lifetime, see also docs here and here. Similarly, I think the test fixture macaron_db_session() could use context managers for its session.

[behnazh-w]

I noticed that create_engine() is called in different places for local instances of SQLA’s Engine though it should be a single global instance for the application’s lifetime

We have three main CLI commands that need their own engines, but for the duration of a command, we only create one engine. The three CLI commands that are run independently are analyze, verify-policy, and gen-build-spec.

Similarly, I think the test fixture macaron_db_session() could use context managers for its session.

Yes, we could improve that in a future PR perhaps.

[jenstroeger]

Interesting, you’re not using pylint’s code-style checker so you didn’t get the tip to change these into

with closing(con := sqlite3.connect(DB_PATH)), con:
    ...