Semgrep 1.168.0 pins pyjwt~=2.13.0, which dependency-review flags
(GHSA-ffc3-869f-jxw9 and 14 more). Semgrep 1.182.1 requires
pyjwt>=2.15.0; the lock file now has pyjwt 2.15.1, mcp 1.29.0 and
click 8.4.2.
Semgrep 1.182.1 still pins mcp==1.29.0 (GHSA-84m7-p3x7-pcfv) and
opentelemetry-api~=1.37.0 (GHSA-xcq7-p3pf-p88h). Neither code path is
used by `semgrep scan` in CI, so dependency-review allows both until
Semgrep lifts its pins.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Niels Lohmann
8fb114e45f