Repository navigation
Update pre-commit dependencies - #815
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #815 +/- ##
==========================================
- Coverage 97.26% 97.22% -0.04%
==========================================
Files 3 3
Lines 7859 7859
==========================================
- Hits 7644 7641 -3
- Misses 215 218 +3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.25→v0.27v0.15.20→v0.17.2v0.17.3==0.15.0→==0.17.30.37.4→0.38.20.39.0==2026.8.15→==2026.10.232026.10.30(+2)v1.26.1→v1.31.1Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
abravalheri/validate-pyproject
v0.27Compare Source
What's Changed
New Contributors
Full Changelog: abravalheri/validate-pyproject@0.26...v0.26
v0.26Compare Source
============
808partially dynamic metadata by :user:henryiii(:pr:
314)are identical by :user:
henryiii(:pr:303)SchemaStorecompatibility by supporting relative schema URLs by:user:
henryiii(:pr:306)validate_pyproject.multi_schemaentrypoints by :user:
henryiii(:pr:318):user:
henryiii(:pr:319)astral-sh/ruff-pre-commit
v0.17.2Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.17.2
v0.17.1Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.17.1
v0.17.0Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.17.0
v0.16.10Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.10
v0.16.9Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.9
v0.16.8Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.8
v0.16.7Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.7
v0.16.6Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.6
v0.16.5Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.5
v0.16.4Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.4
v0.16.3Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.3
v0.16.2Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.2
v0.16.1Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.1
v0.16.0Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.16.0
v0.15.22Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.15.22
v0.15.21Compare Source
See: https://github.com/astral-sh/ruff/releases/tag/0.15.21
dpranke/pyjson5 (json5)
v0.17.3Compare Source
v0.16.0Compare Source
python-jsonschema/check-jsonschema
v0.38.2Compare Source
clickdeclared as a dependencyv0.38.1Compare Source
compose-spec, dependabot, github-actions, github-workflows, gitlab-ci, mergify,
renovate, taskfile, travis, woodpecker-ci (2026-09-20)
check-jsonschemanow has a logo. Thanks toMylah Birdie <https://www.instagram.com/mylahbirdie>__!v0.38.0Compare Source
compose-spec, dependabot, gitlab-ci, mergify, readthedocs, renovate, taskfile,
woodpecker-ci (2026-08-08)
check-github-workflows-require-timeoutpre-commit hook forrequiring
timeout-minuteson all GitHub Workflow jobs. (:issue:639)henryiii/validate-pyproject-schema-store (validate-pyproject-schema-store)
v2026.10.23Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.22...2026.10.23
v2026.10.22Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.21...2026.10.22
v2026.10.21Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.17...2026.10.21
v2026.10.17Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.12...2026.10.17
v2026.10.12Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.11...2026.10.12
v2026.10.11Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.10...2026.10.11
v2026.10.10Compare Source
What's Changed
Full Changelog: henryiii/validate-pyproject-schema-store@2026.10.06...2026.10.10
v2026.10.6Compare Source
v2026.10.2Compare Source
v2026.9.30Compare Source
v2026.9.25Compare Source
v2026.9.24Compare Source
v2026.9.19Compare Source
v2026.9.17Compare Source
v2026.9.11Compare Source
v2026.9.8Compare Source
v2026.9.4Compare Source
v2026.8.29Compare Source
v2026.8.28Compare Source
woodruffw/zizmor-pre-commit
v1.31.1Compare Source
Sponsorship is appreciated!
Bug Fixes 🐛🔗
v1.31.0Compare Source
Sponsorship is appreciated!
Enhancements 🌱🔗
The typosquat-uses audit now supports pre-commit config inputs (#2437)
The self-hosted-runner audit is now significantly more precise (#2350)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)
zizmor is now aware of the image_version workflow trigger (#2397)
The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)
The cache-poisoning audit is now aware of pnpm/setup (#2409)
The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)
The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)
zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)
Bug Fixes 🐛🔗
Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)
Many thanks to @marcalexiei for implementing this improvement!
Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)
Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)
Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)
Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)
v1.30.1Compare Source
Sponsorship is appreciated!
Bug Fixes 🐛🔗
Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)
Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)
v1.30.0Compare Source
Sponsorship is appreciated!
New Features 🌈🔗
New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
Enhancements 🌱🔗
The impostor-commit audit now supports pre-commit config inputs (#2256)
The forbidden-uses audit now supports pre-commit config inputs (#2263)
The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add
Many thanks to @connorshea for proposing and implementing this enhancement!
The archived-uses audit now supports pre-commit config inputs (#2272)
The ref-confusion audit now supports pre-commit config inputs (#2274)
The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)
The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)
zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)
Many thanks to @njgudman for proposing and implementing this enhancement!
The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)
The unpinned-tools audit now detects usages of extractions/setup-just (#2339)
The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)
The archived-uses audit now detects several more archived repositories (#2340)
The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)
The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)
Bug Fixes 🐛🔗
Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)
Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)
Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)
Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)
Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)
Many thanks to @dmbuil for proposing and implementing this improvement!
Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)
Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)
Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)
Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)
Many thanks to @potiuk for proposing and implementing this improvement!
Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)
v1.29.0Compare Source
New Features 🌈🔗
zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g.
uses: $/foo/barinstead of a manual checkout anduses: ./foo/bar(#2248)Changes⚠️ 🔗
uses:clauses, whereas unpinned-images is now responsible fordocker://-styleuses:clauses (in addition to already checking other image references) (#2222)Removals 🌅🔗
--collect=workflows-onlyand--collect=actions-onlyhave been fully removed. Use--collect=workflowsand--collect=actionsfor the replacement behavior (#2242)Bug Fixes 🐛🔗
Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
v1.28.0Compare Source
See: https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0
v1.27.0Compare Source
See: https://github.com/zizmorcore/zizmor/releases/tag/v1.27.0
Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.