[dependabot]

Bumps the pre-commit-hooks group with 2 updates in the / directory: https://github.com/astral-sh/ruff-pre-commit and https://github.com/zizmorcore/zizmor-pre-commit.

Updates https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.17.3

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.17.3

See: https://github.com/astral-sh/ruff/releases/tag/0.17.3

v0.17.2

See: https://github.com/astral-sh/ruff/releases/tag/0.17.2

v0.17.1

See: https://github.com/astral-sh/ruff/releases/tag/0.17.1

v0.17.0

See: https://github.com/astral-sh/ruff/releases/tag/0.17.0

v0.16.10

See: https://github.com/astral-sh/ruff/releases/tag/0.16.10

v0.16.9

See: https://github.com/astral-sh/ruff/releases/tag/0.16.9

v0.16.8

See: https://github.com/astral-sh/ruff/releases/tag/0.16.8

v0.16.7

See: https://github.com/astral-sh/ruff/releases/tag/0.16.7

v0.16.6

See: https://github.com/astral-sh/ruff/releases/tag/0.16.6

v0.16.5

See: https://github.com/astral-sh/ruff/releases/tag/0.16.5

v0.16.4

See: https://github.com/astral-sh/ruff/releases/tag/0.16.4

v0.16.3

See: https://github.com/astral-sh/ruff/releases/tag/0.16.3

v0.16.2

See: https://github.com/astral-sh/ruff/releases/tag/0.16.2

v0.16.1

See: https://github.com/astral-sh/ruff/releases/tag/0.16.1

Commits

• 25bcf95 Mirror: 0.17.3
• f368fb3 Mirror: 0.17.2
• 65a0c46 Use patched certifi bundle for release mirroring (#189)
• 0919ea4 Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-actions group (#188)
• 38bfb07 Mirror: 0.17.1
• 44b5042 Mirror: 0.17.0
• e2053c9 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#184)
• f12be1e Mirror: 0.16.10
• 6089d41 Document adding quarto to types_or for Quarto code fence formatting (#183)
• a56c0b9 Mirror: 0.16.9
• Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.28.0 to 1.31.1

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

... (truncated)

Commits

• c92afdf Mirror: 1.31.1
• d25b2b1 Mirror: 1.31.0
• 04df6d7 chore: drop Python 3.10 support (EOL) (#65)
• fe0957c Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#64)
• de807da Bump the github-actions group with 2 updates (#63)
• fa41207 Mirror: 1.30.1
• 7361a0b fix: include pre-commit files in hook (#59)
• 34c5ce3 Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 in the github-actions group...
• cef8b83 Mirror: 1.30.0
• 2e74fc1 Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the github-actions group (#61)
• Additional commits viewable in compare view