security/semgrep-registry
Downloads and runs the public Semgrep packs in tools.semgrep.registry_packs.
Part of the security configuration, at the recommended level. It runs only when gspot check --only security/semgrep-registry names it, per file. It runs semgrep. It needs network access. It skips until you set tools.semgrep.registry_packs.
The registry packs cover the common vulnerability classes, and their license keeps them out of this package.
What to do
Section titled “What to do”Change the code the way the message says, or turn the rule off for a path with gspot ignore security/semgrep-registry --rule <id> --reason "<why>".
Example
Section titled “Example”Code that matches a registry rule reports its upstream ID. Fix the code at that location, then rerun with network access.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore security/semgrep-registry --paths "<glob>" --reason "<why>"gspot ignore security/semgrep-registry --rule <rule> --reason "<why>"A suppression comment is refused; use gspot ignore.