dependabot[bot] opened a new pull request, #16600: URL: https://github.com/apache/lucene/pull/16600
Bumps [zizmor](https://github.com/zizmorcore/zizmor) from 1.28.0 to 1.29.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor/releases";>zizmor's releases</a>.</em></p> <blockquote> <h2>v1.29.0</h2> <h2>New Features 🌈<a href="https://docs.zizmor.sh/release-notes/#new-features";>🔗</a></h2> <ul> <li> <p>zizmor now has <strong>experimental</strong> support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2209";>#2209</a>)</p> </li> <li> <p>New audit: <a href="https://docs.zizmor.sh/audits/#insecure-url-scheme";>insecure-url-scheme</a> detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2228";>#2228</a>)</p> </li> <li> <p>zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. <code>uses: $/foo/bar</code> instead of a manual checkout and <code>uses: ./foo/bar</code> (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2248";>#2248</a>)</p> </li> </ul> <h2>Changes ⚠️<a href="https://docs.zizmor.sh/release-notes/#changes";>🔗</a></h2> <ul> <li>The <a href="https://docs.zizmor.sh/audits/#unpinned-uses";>unpinned-uses</a> and <a href="https://docs.zizmor.sh/audits/#unpinned-images";>unpinned-images</a> audits have been separated more cleanly: <a href="https://docs.zizmor.sh/audits/#unpinned-uses";>unpinned-uses</a> is now principally responsible for Git-style <code>uses:</code> clauses, whereas <a href="https://docs.zizmor.sh/audits/#unpinned-images";>unpinned-images</a> is now responsible for <code>docker://</code>-style <code>uses:</code> clauses (in addition to already checking other image references) (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2222";>#2222</a>)</li> </ul> <h2>Removals 🌅<a href="https://docs.zizmor.sh/release-notes/#removals";>🔗</a></h2> <ul> <li><code>--collect=workflows-only</code> and <code>--collect=actions-only</code> have been fully removed. Use <code>--collect=workflows</code> and <code>--collect=actions</code> for the replacement behavior (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2242";>#2242</a>)</li> </ul> <h2>Bug Fixes 🐛<a href="https://docs.zizmor.sh/release-notes/#bug-fixes";>🔗</a></h2> <ul> <li> <p>Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<!-- raw HTML omitted -->.outputs.<!-- raw HTML omitted --> value for being a non-string (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2220";>#2220</a>)</p> </li> <li> <p>Fixed a bug where the <a href="https://docs.zizmor.sh/audits/#github-app";>github-app</a> audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2227";>#2227</a>)</p> </li> <li> <p>Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2234";>#2234</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md";>zizmor's changelog</a>.</em></p> <blockquote> <h2>1.29.0</h2> <h3>New Features 🌈</h3> <ul> <li> <p>zizmor now has <strong>experimental</strong> support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2209";>#2209</a>)</p> </li> <li> <p><strong>New audit</strong>: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2228";>#2228</a>)</p> </li> <li> <p>zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. <code>#!yaml uses: $/foo/bar</code> instead of a manual checkout and <code>#!yaml uses: ./foo/bar</code> (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2248";>#2248</a>)</p> </li> </ul> <h3>Changes ⚠️</h3> <ul> <li>The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style <code>#!yaml uses:</code> clauses, whereas [unpinned-images] is now responsible for <code>docker://</code>-style <code>#!yaml uses:</code> clauses (in addition to already checking other image references) (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2222";>#2222</a>)</li> </ul> <h3>Removals 🌅</h3> <ul> <li><code>--collect=workflows-only</code> and <code>--collect=actions-only</code> have been fully removed. Use <code>--collect=workflows</code> and <code>--collect=actions</code> for the replacement behavior (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2242";>#2242</a>)</li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li> <p>Fixed a bug where <code>zizmor</code> would reject a valid workflow definition for containing a literal <code>jobs.<job>.outputs.<name></code> value for being a non-string (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2220";>#2220</a>)</p> </li> <li> <p>Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a <code>#!yaml repositories:</code> key, despite requesting organization-level-only permissions (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2227";>#2227</a>)</p> </li> <li> <p>Fixed a class of bugs where <code>zizmor</code> would discover the user's configuration in unintuitive ways. When auditing from a Git repository, <code>zizmor</code> now uses the repository root to discover configuration consistently (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2234";>#2234</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zizmorcore/zizmor/commit/3c116961091b50bd1a08ffefe916469d4d90093c";><code>3c11696</code></a> zizmor 1.29.0 (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2251";>#2251</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/876f448fd3d55bb9eee337c4a6f5dc650b0dadbc";><code>876f448</code></a> Bump trophies (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2250";>#2250</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/3e92c0ad3f30e8cc48806f76fbea6390f3070a04";><code>3e92c0a</code></a> Remove old deprecated <code>--collect</code> modes (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2242";>#2242</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/35ab77bcacadcca3cdfb6d66364067518ac4ce86";><code>35ab77b</code></a> Support self-repository syntax for local uses (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2249";>#2249</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/6ea55f583ef6681a59b1c180950e47861a3c0293";><code>6ea55f5</code></a> chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2241";>#2241</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/a56362ca512595839709c637f4429e64de38b08e";><code>a56362c</code></a> chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2240";>#2240</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/80b80f3c3722e740b6c4e476c45794985ea119d6";><code>80b80f3</code></a> Bump zensical, fixup anchor IDs (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2239";>#2239</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/dce14692e06fb4a7ceaf664e3fdf64e09588b504";><code>dce1469</code></a> Bump trophies (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2238";>#2238</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/fd487f46957a9228140ebab46fa3442ef13c9a33";><code>fd487f4</code></a> chore(deps): bump the github-actions group with 4 updates (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2236";>#2236</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor/commit/ab59a28378c7ff430e78c3ef9795d7e28732b983";><code>ab59a28</code></a> chore(deps): bump the cargo group with 11 updates (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2237";>#2237</a>)</li> <li>Additional commits viewable in <a href="https://github.com/zizmorcore/zizmor/compare/v1.28.0...v1.29.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
