Update Dependencies for pre-commit - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
betterleaks/betterleaks	repository	patch	v1.8.0 → v1.8.1
zizmorcore/zizmor-pre-commit	repository	minor	v1.29.0 → v1.30.1

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.8.1

Compare Source

What's New

Wow two big releases in a day!

1. Added a validate command to let you re-validate findings without doing a rescan:

# Revalidate a known credential without running detection
printf '%s\n' "$GITHUB_TOKEN" | betterleaks validate --rule-id github-pat

# Print only its status (for example, VALID)
printf '%s\n' "$GITHUB_TOKEN" | betterleaks validate --rule-id github-pat --simple

2. OOM issue fixed by @​gpflaum

Changelog

• 5eab483 clone strings before saving in findings, so fragment.Raw can be released (#​308) Thank you @​gpflaum!
• 1c1db0d quick update
• 8173e62 validate cmd (#​277)

zizmorcore/zizmor-pre-commit (zizmorcore/zizmor-pre-commit)

v1.30.1

Compare Source

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#​2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#​2373)

v1.30.0

Compare Source

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#​2271)
  Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#​2256)

• The forbidden-uses audit now supports pre-commit config inputs (#​2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#​2272)

• The ref-confusion audit now supports pre-commit config inputs (#​2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#​2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#​2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#​2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#​2340)

• The archived-uses audit now detects several more archived repositories (#​2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#​2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#​2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#​2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#​2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#​2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#​2308)

• Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#​2295)

  Many thanks to @​dmbuil for proposing and implementing this improvement!

• Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#​2330)

• Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#​2337)

• Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#​2339)

• Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#​2247)

  Many thanks to @​potiuk for proposing and implementing this improvement!

• Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#​2349)

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • Between 12:00 AM and 05:59 AM, on day 1 of the month (* 0-5 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	1		0		0	0.06s
✅ ACTION	zizmor	1		0		0	0.8s
✅ ANSIBLE	ansible-lint	yes		no		no	16.47s
✅ COPYPASTE	jscpd	yes		no		no	0.82s
✅ MARKDOWN	markdownlint	1		0		0	0.55s
✅ MARKDOWN	markdown-table-formatter	2		0		0	0.23s
✅ REPOSITORY	betterleaks	yes		no		no	0.98s
✅ REPOSITORY	checkov	yes		no		no	23.03s
✅ REPOSITORY	git_diff	yes		no		no	0.01s
✅ REPOSITORY	grype	yes		no		no	74.42s
✅ REPOSITORY	osv-scanner	yes		no		no	0.62s
✅ REPOSITORY	secretlint	yes		no		no	1.42s
✅ REPOSITORY	syft	yes		no		no	2.64s
✅ REPOSITORY	trivy	yes		no		no	13.99s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.17s
✅ REPOSITORY	trufflehog	yes		no		no	3.83s
✅ YAML	prettier	25		0		0	0.91s
✅ YAML	v8r	25		0		0	12.98s
✅ YAML	yamllint	25		0		0	0.69s

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository