Looking in links: /tmp/semgrep-offline-check/semgrep-offline/wheels Processing ./wheels/annotated_types-0.8.0-py3-none-any.whl Processing ./wheels/anyio-4.15.1-py3-none-any.whl Processing ./wheels/attrs-26.1.0-py3-none-any.whl Processing ./wheels/boltons-21.0.0-py2.py3-none-any.whl Processing ./wheels/bracex-3.0.1-py3-none-any.whl Processing ./wheels/certifi-2026.7.22-py3-none-any.whl Processing ./wheels/cffi-2.1.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl Processing ./wheels/charset_normalizer-3.5.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl Processing ./wheels/click_option_group-0.5.9-py3-none-any.whl Processing ./wheels/click-8.4.2-py3-none-any.whl Processing ./wheels/colorama-0.4.6-py2.py3-none-any.whl Processing ./wheels/cryptography-50.0.1-cp311-abi3-manylinux_2_34_x86_64.whl Processing ./wheels/exceptiongroup-1.2.2-py3-none-any.whl Processing ./wheels/face-26.0.1-py3-none-any.whl Processing ./wheels/glom-25.12.0-py3-none-any.whl Processing ./wheels/googleapis_common_protos-1.75.3-py3-none-any.whl Processing ./wheels/h11-0.16.0-py3-none-any.whl Processing ./wheels/httpcore-1.0.9-py3-none-any.whl Processing ./wheels/httpx_sse-0.4.3-py3-none-any.whl Processing ./wheels/httpx-0.28.1-py3-none-any.whl Processing ./wheels/idna-3.19-py3-none-any.whl Processing ./wheels/importlib_metadata-8.7.1-py3-none-any.whl Processing ./wheels/jsonschema_specifications-2025.9.1-py3-none-any.whl Processing ./wheels/jsonschema-4.25.1-py3-none-any.whl Processing ./wheels/markdown_it_py-4.2.0-py3-none-any.whl Processing ./wheels/mcp-1.29.0-py3-none-any.whl Processing ./wheels/mdurl-0.1.2-py3-none-any.whl Processing ./wheels/opentelemetry_api-1.37.0-py3-none-any.whl Processing ./wheels/opentelemetry_exporter_otlp_proto_common-1.37.0-py3-none-any.whl Processing ./wheels/opentelemetry_exporter_otlp_proto_http-1.37.0-py3-none-any.whl Processing ./wheels/opentelemetry_instrumentation_requests-0.58b0-py3-none-any.whl Processing ./wheels/opentelemetry_instrumentation_threading-0.58b0-py3-none-any.whl Processing ./wheels/opentelemetry_instrumentation-0.58b0-py3-none-any.whl Processing ./wheels/opentelemetry_proto-1.37.0-py3-none-any.whl Processing ./wheels/opentelemetry_sdk-1.37.0-py3-none-any.whl Processing ./wheels/opentelemetry_semantic_conventions-0.58b0-py3-none-any.whl Processing ./wheels/opentelemetry_util_http-0.58b0-py3-none-any.whl Processing ./wheels/packaging-26.3-py3-none-any.whl Processing ./wheels/peewee-3.19.0-py3-none-any.whl Processing ./wheels/pip-26.2.1-py3-none-any.whl Processing ./wheels/protobuf-6.33.6-cp39-abi3-manylinux2014_x86_64.whl Processing ./wheels/pycparser-3.0-py3-none-any.whl Processing ./wheels/pydantic_settings-2.15.0-py3-none-any.whl Processing ./wheels/pydantic-2.13.5-py3-none-any.whl Processing ./wheels/pydantic_core-2.46.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl Processing ./wheels/pygments-2.21.0-py3-none-any.whl Processing ./wheels/pyjwt-2.13.0-py3-none-any.whl Processing ./wheels/python_dotenv-1.2.3-py3-none-any.whl Processing ./wheels/python_multipart-0.0.32-py3-none-any.whl Processing ./wheels/referencing-0.37.0-py3-none-any.whl Processing ./wheels/requests-2.34.2-py3-none-any.whl Processing ./wheels/rich-15.0.0-py3-none-any.whl Processing ./wheels/rpds_py-2026.6.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl Processing ./wheels/ruamel_yaml_clib-0.2.15-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl Processing ./wheels/ruamel_yaml-0.19.1-py3-none-any.whl Processing ./wheels/semantic_version-2.10.0-py2.py3-none-any.whl Processing ./wheels/semgrep-1.177.0-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_x86_64.whl Processing ./wheels/sse_starlette-3.4.11-py3-none-any.whl Processing ./wheels/starlette-1.6.0-py3-none-any.whl Processing ./wheels/tomli-2.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl Processing ./wheels/typing_inspection-0.4.4-py3-none-any.whl Processing ./wheels/typing_extensions-4.16.0-py3-none-any.whl Processing ./wheels/urllib3-2.7.0-py3-none-any.whl Processing ./wheels/uvicorn-0.53.0-py3-none-any.whl Processing ./wheels/wcmatch-8.5.2-py3-none-any.whl Processing ./wheels/wrapt-1.17.3-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl Processing ./wheels/zipp-4.1.0-py3-none-any.whl Installing collected packages: peewee, boltons, zipp, wrapt, urllib3, typing_extensions, tomli, semantic-version, ruamel.yaml.clib, ruamel.yaml, rpds-py, python-multipart, python-dotenv, PyJWT, Pygments, pycparser, protobuf, pip, packaging, opentelemetry-util-http, mdurl, idna, httpx-sse, h11, face, exceptiongroup, colorama, click, charset-normalizer, certifi, bracex, attrs, annotated-types, wcmatch, uvicorn, typing-inspection, requests, referencing, pydantic_core, opentelemetry-proto, markdown-it-py, importlib_metadata, httpcore, googleapis-common-protos, glom, click-option-group, cffi, anyio, starlette, rich, pydantic, opentelemetry-exporter-otlp-proto-common, opentelemetry-api, jsonschema-specifications, httpx, cryptography, sse-starlette, pydantic-settings, opentelemetry-semantic-conventions, jsonschema, opentelemetry-sdk, opentelemetry-instrumentation, mcp, opentelemetry-instrumentation-threading, opentelemetry-instrumentation-requests, opentelemetry-exporter-otlp-proto-http, semgrep Attempting uninstall: pip Found existing installation: pip 22.3.1 Uninstalling pip-22.3.1: Successfully uninstalled pip-22.3.1 Successfully installed PyJWT-2.13.0 Pygments-2.21.0 annotated-types-0.8.0 anyio-4.15.1 attrs-26.1.0 boltons-21.0.0 bracex-3.0.1 certifi-2026.7.22 cffi-2.1.1 charset-normalizer-3.5.1 click-8.4.2 click-option-group-0.5.9 colorama-0.4.6 cryptography-50.0.1 exceptiongroup-1.2.2 face-26.0.1 glom-25.12.0 googleapis-common-protos-1.75.3 h11-0.16.0 httpcore-1.0.9 httpx-0.28.1 httpx-sse-0.4.3 idna-3.19 importlib_metadata-8.7.1 jsonschema-4.25.1 jsonschema-specifications-2025.9.1 markdown-it-py-4.2.0 mcp-1.29.0 mdurl-0.1.2 opentelemetry-api-1.37.0 opentelemetry-exporter-otlp-proto-common-1.37.0 opentelemetry-exporter-otlp-proto-http-1.37.0 opentelemetry-instrumentation-0.58b0 opentelemetry-instrumentation-requests-0.58b0 opentelemetry-instrumentation-threading-0.58b0 opentelemetry-proto-1.37.0 opentelemetry-sdk-1.37.0 opentelemetry-semantic-conventions-0.58b0 opentelemetry-util-http-0.58b0 packaging-26.3 peewee-3.19.0 pip-26.2.1 protobuf-6.33.6 pycparser-3.0 pydantic-2.13.5 pydantic-settings-2.15.0 pydantic_core-2.46.5 python-dotenv-1.2.3 python-multipart-0.0.32 referencing-0.37.0 requests-2.34.2 rich-15.0.0 rpds-py-2026.6.3 ruamel.yaml-0.19.1 ruamel.yaml.clib-0.2.15 semantic-version-2.10.0 semgrep-1.177.0 sse-starlette-3.4.11 starlette-1.6.0 tomli-2.4.1 typing-inspection-0.4.4 typing_extensions-4.16.0 urllib3-2.7.0 uvicorn-0.53.0 wcmatch-8.5.2 wrapt-1.17.3 zipp-4.1.0 No broken requirements found. 1.177.0 Installed. Add to PATH: export PATH="/tmp/semgrep-offline-check/semgrep-offline/bin:$PATH" Rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.php.wordpress-plugins.security.audit.wp-file-inclusion-audit contains an include pattern ''**/wp-content/plugins/**/*.php'' that will soon be interpreted as '/'**/wp-content/plugins/**/*.php'' to comply with the Semgrepignore v2 and Gitignore specifications. To make this pattern permanently unanchored, edit rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.php.wordpress-plugins.security.audit.wp-file-inclusion-audit and change it to '**/'**/wp-content/plugins/**/*.php''. To confirm the anchored behavior and avoid this warning, change it to '/'**/wp-content/plugins/**/*.php''. Rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.yaml.github-actions.security.audit.third-party-action-not-pinned-to-commit-sha contains an include pattern '.github/workflows' that will soon be interpreted as '/.github/workflows' to comply with the Semgrepignore v2 and Gitignore specifications. To make this pattern permanently unanchored, edit rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.yaml.github-actions.security.audit.third-party-action-not-pinned-to-commit-sha and change it to '**/.github/workflows'. To confirm the anchored behavior and avoid this warning, change it to '/.github/workflows'. ┌─────────────┐ │ Scan Status │ └─────────────┘ Scanning 1 file tracked by git with 2124 Code rules: Language Rules Files Origin Rules ───────────────────────────── ──────────────── python 423 1 Custom 2124 238 1 Rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.php.wordpress-plugins.security.audit.wp-file-inclusion-audit contains an include pattern ''**/wp-content/plugins/**/*.php'' that will soon be interpreted as '/'**/wp-content/plugins/**/*.php'' to comply with the Semgrepignore v2 and Gitignore specifications. To make this pattern permanently unanchored, edit rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.php.wordpress-plugins.security.audit.wp-file-inclusion-audit and change it to '**/'**/wp-content/plugins/**/*.php''. To confirm the anchored behavior and avoid this warning, change it to '/'**/wp-content/plugins/**/*.php''. Rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.yaml.github-actions.security.audit.third-party-action-not-pinned-to-commit-sha contains an include pattern '.github/workflows' that will soon be interpreted as '/.github/workflows' to comply with the Semgrepignore v2 and Gitignore specifications. To make this pattern permanently unanchored, edit rule tmp.semgrep-offline-check.semgrep-offline.rules.scan.yaml.github-actions.security.audit.third-party-action-not-pinned-to-commit-sha and change it to '**/.github/workflows'. To confirm the anchored behavior and avoid this warning, change it to '/.github/workflows'. ┌──────────────┐ │ Scan Summary │ └──────────────┘ ✅ Scan completed successfully. • Findings: 1 (1 blocking) • Rules run: 661 • Targets scanned: 1 • Parsed lines: ~100.0% • No ignore information available Ran 661 rules on 1 file: 1 finding.