Describe the bug
Semgrep when run in docker under the :latest tag prints out:
$ docker run -v "${PWD}:/src" returntocorp/semgrep --config=go-config2.yml test/golang
A new version of Semgrep is available. Please see https://github.com/returntocorp/semgrep#upgrading for more information.
To Reproduce
As described in https://notes.eatonphil.com/static-analysis-with-semgrep.html
Expected behavior
Semgrep should realize the docker tag is latest or develop and not print that there is a new version.
What is the priority of the bug to you?
P2
I suspect this is because your latest tag is out of date. Note that docker run does not try to pull latest. E.g.
$ docker run returntocorp/semgrep --version
0.24.0
$ echo 'print(5 == 5)' | docker run -i returntocorp/semgrep --pattern '$X == $X' --lang python -
A new version of Semgrep is available. Please see https://github.com/returntocorp/semgrep#upgrading for more information.
/tmp/tmpz19einpg
1:print(5 == 5)
ran 1 rules on 1 files: 1 findings
$ docker pull returntocorp/semgrep:latest
latest: Pulling from returntocorp/semgrep
...
Digest: sha256:203eefa7fef3d85e9313fd322642a78ee030188876122a0e7521fdc5c4d199c3
Status: Downloaded newer image for returntocorp/semgrep:latest
docker.io/returntocorp/semgrep:latest
$ docker run returntocorp/semgrep --version
0.35.0
$ echo 'print(5 == 5)' | docker run -i returntocorp/semgrep --pattern '$X == $X' --lang python -
/tmp/tmpeop0cv5_
1:print(5 == 5)
ran 1 rules on 1 files: 1 findings
So, if you're running via Docker, the message is correctly telling you to visit https://github.com/returntocorp/semgrep#upgrading, which suggests running docker pull returntocorp/semgrep:latest.
Closing this out, let me know if the above description wasn't the issue.