[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
zizmor (source)	==1.29.0 → ==1.31.0

---

Release Notes

zizmorcore/zizmor (zizmor)

v1.31.0

Compare Source

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

v1.30.1

Compare Source

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#​2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#​2373)

v1.30.0

Compare Source

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#​2271)
  Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#​2256)

• The forbidden-uses audit now supports pre-commit config inputs (#​2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#​2272)

• The ref-confusion audit now supports pre-commit config inputs (#​2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#​2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#​2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#​2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#​2340)

• The archived-uses audit now detects several more archived repositories (#​2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#​2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#​2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#​2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#​2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#​2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#​2308)

• Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#​2295)

  Many thanks to @​dmbuil for proposing and implementing this improvement!

• Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#​2330)

• Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#​2337)

• Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#​2339)

• Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#​2247)

  Many thanks to @​potiuk for proposing and implementing this improvement!

• Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#​2349)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31bd2da2-64cb-4e47-9f6a-b9a604882996

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Using CPython 3.14.9 interpreter at: /opt/containerbase/tools/python/3.14.9/bin/python3
error: No solution found when resolving dependencies for split (markers: python_full_version == '3.10.*')
  cause: Because the requested Python version (>=3.10, <3.15) does not satisfy Python>=3.11 and zizmor==1.31.0 depends on Python>=3.11, we can conclude that zizmor==1.31.0 cannot be used.
         And because api-template:dev depends on zizmor==1.31.0 and your project requires api-template:dev, we can conclude that your project's requirements are unsatisfiable.

hint: While the active Python version is 3.14, the resolution failed for other Python versions supported by your project. Consider limiting your project's supported Python versions using `requires-python`.

hint: The `requires-python` value (>=3.10, <3.15) includes Python versions that are not supported by your dependencies (e.g., zizmor==1.31.0 only supports >=3.11). Consider using a more restrictive `requires-python` value (like >=3.11).