chore(deps): update dependency zizmorcore/zizmor to v1.25.2

[renovate]

This PR contains the following updates:

Package	Update	Change
zizmorcore/zizmor	minor	v1.22.0 → v1.25.2

---

Release Notes

zizmorcore/zizmor (zizmorcore/zizmor)

v1.25.2

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the unpinned-tools audit would incorrectly flag the aquasecurity/trivy-action action as installing an unpinned tool version, rather than aquasecurity/setup-trivy (#​2018)

v1.25.1

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the cache-poisoning audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#​2004)

• Fixed a typo when suggesting --fix flags for findings (#​2010)

  Many thanks to @​0xdea for implementing this fix!

• Fixed a typo in unpinned-tools annotations (#​2008)

  Many thanks to @​martincostello for implementing this fix!

• Fixed a bug where the github-app audit would incorrectly flag some safe uses of actions/create-github-app-token as unsafe (#​2011)

v1.25.0

Compare Source

New Features 🌈🔗

• zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#​1913)

  Many thanks to @​Proximyst for proposing and implementing this improvement!

• New audit: github-app detects dangerous usages of GitHub App installation tokens (#​1926)

• New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#​1820)

• zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#​1935)

• zizmor's LSP now honors the --persona flag on the CLI (#​1943)

• zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#​1965)

Enhancements🔗

• Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions

• Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions

• Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions

• tibdex/github-app-token is now recognized as an archived action by archived-uses (#​1910)

• The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#​1956)

• The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#​1965)

• zizmor's SARIF output now provides slightly more detailed finding messages (#​1972)

• The archived-uses audit now detects more archived actions (#​1978)

• deno is now recognized as a package-ecosystem in dependabot.yml (#​1991)

Performance Improvements 🚄🔗

• The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#​1998)
  Bug Fixes 🐛🔗

• Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#​1904)

• Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#​1909)

• Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#​1944)

• Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#​1945)

• Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#​1946)

• Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#​1962)

• Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#​1940)

  Many thanks to @​reubenwong97 for implementing this fix!

• Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#​1976)

• Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#​1980)

• Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#​1998)

v1.24.1

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the ref-version-mismatch audit would incorrectly flag some version comments as not containing an appropriate version (#​1900)

v1.24.0

Compare Source

New Features 🌈🔗

• zizmor now allows users to audit from stdin, by passing zizmor - (#​1611)

Enhancements 🌱🔗

• The use-trusted-publishing audit now detects bun publish and bunx npm publish patterns (#​1737)

  Many thanks to @​shaanmajid for proposing and implementing this improvement!

• zizmor's CLI help and usage output now uses a custom color scheme for improved readability (#​1747)

• The secrets-outside-env audit is now configurable with an allowlist of secret names that should not be flagged, even when referenced outside of an environment (#​1759)

  Many thanks to @​rmuir for proposing and implementing this improvement!

• The dependabot-cooldown audit now emits a pedantic finding whenever it encounters a cooldown used with a multi-ecosystem-group, as the two do not interact well (#​1780)

• Recommend gh release upload as a replacement for svenstaro/upload-release-action in superfluous-actions (#​1801)

• Recommend gh issue create as a replacement for dacbd/create-issue-action in superfluous-actions (#​1873)

• The obfuscation audit now emits a finding for with: ${{ expr }} clauses cannot be analyzed (#​1772)

• zizmor --help is now rendered with option groups for improved readability (#​1831)

  Many thanks to @​deckstose for implementing this improvement!

• zizmor's SARIF output now uses codeflows instead of related locations, improving its rendering behavior on GitHub Advanced Security (#​1843)

• The ref-version-mismatch audit now uses a more useful audit description for its findings (#​1843)

• The unpinned-images audit now produces more precise findings for image references that are computed through expressions (#​1756)

  Many thanks to @​miketheman for implementing this improvement!

• The ref-version-mismatch audit now detects missing version comments as well (#​1849)

  Many thanks to @​shaanmajid for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the concurrency-limits audit reported findings at the job level instead of the workflow level (#​1627)

• Fixed a bug where with: ${{ expr }} clauses would cause a crash. artipacked audit emits a pedantic finding on such clauses. (#​1772)

• Fixed a bug where auto-fixes for the template-injection audit would fail to preserve an environment variable's casing (#​1766)

• Fixed a bug where the secrets-outside-env audit would incorrectly flag reusable workflows (#​1777)

• Fixed a bug where expressions containing Infinity or NaN would fail to parse (#​1778)

• Fixed several bugs where some parenthetical forms in expressions would fail to parse (#​1779, #​1856)

• Fixed a bug where expressions with invalid identifiers (such as -Inf) would be incorrectly accepted (#​1794)

• Fixed a bug where the known-vulnerable-actions audit would fail to handle multiple discrete packages in a single advisory (#​1810)

• Fixed a bug where the template-injection audit would incorrectly flag needs.*.result as an injection risk in the default persona (#​1814)

• Fixed a bug where the unpinned-uses audit would product incorrect auto-fixes for actions with subpaths (#​1841)

• Fixed a bug where the ref-version-mismatch audit would fail to produce findings for comments containing nonexistent refs (#​1853)

• Fixed a bug where expressions containing NaN would be constant-evaluated incorrectly (#​1858)

• Fixed a bug where nix would not be recognized as a package-ecosystem in dependabot.yml (#​1867)

• Fixed a bug where the ref-version-mismatch audit would incorrectly parse prerelease version comments (such as # v6-beta), causing some findings to appear unresolvable (#​1870)

• Fixed a bug where various string comparisons in expressions did not perfectly match GitHub's own special uppercasing semantics (#​1879)

• Fixed a bug where zizmor would incorrectly contact github.com instead of the user's requested --gh-hostname for some online requests (#​1874)

• Fixed a bug where the artipacked audit would fail to honor the --no-online-audits flag (#​1874)

Changes ⚠️🔗

• The secrets-outside-env audit now only flags findings with the 'auditor' persona, due to numerous false positives and negatives caused by GitHub's platform limitations (primarily around interactions between environment secrets and reusable workflows) (#​1777)

• zizmor's handling of GitHub Actions expressions has been made stricter, and now rejects unknown functions and function calls with incorrect arities (#​1823, #​1826)

• The superfluous-actions audit now uses the "pedantic" persona for some findings along with a medium or low confidence marker to signal when a action may not be easily replaced with built-in functionality (#​1822, #​1859)

• The unpinned-uses audit no longer suggests auto-fixes for Git references that don't look like version tags, such as main (#​1860)

• The template-injection audit now considers more "URL-shaped" contexts to be fully attacker-controllable, rather than partially controllable (#​1868)

v1.23.1

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would error if given both a GH_TOKEN and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the environment (#​1724)

v1.23.0

Compare Source

New Features 🌈🔗

• New audit: secrets-outside-env detects usage of the secrets context in jobs that don't have a corresponding environment (#​1599)

• New audit: superfluous-actions detects usage of actions that perform operations already provided by GitHub's own runner images (#​1618)

Enhancements 🌱🔗

• zizmor's LSP mode is now configuration-aware, and will load configuration files relative to workspace roots (#​1555)

• zizmor now reads the GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN (#​1566)

• zizmor now supports inputs that contain duplicated anchor names (#​1575)

• zizmor now flags missing cooldowns on opentofu ecosystem definitions in Dependabot (again) (#​1586)

• zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#​1641)

• The SARIF output format now adds zizmor/confidence, zizmor/persona and zizmor/severity to the properties of findings (#​1656)

• Added awalsh128/cache-apt-pkgs-action as a cache-aware action to the cache-poisoning audit (#​1708)

Changes ⚠️🔗

• SARIF categories have been regraded. zizmor's "medium" is changed from SARIF's "warning" to "low" (#​1635)
  Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on uses: clauses containing non-significant whitespace while performing the unpinned-uses audit (#​1544)

• Fixed a bug in yamlpath where sequences containing anchors were splatted instead of being properly nested (#​1557)

  Many thanks to @​DarkaMaul for implementing this fix!

• Fixed a bug in yamlpath where anchor prefixes in sequences and mapping were not stripped during path queries (#​1562)

• Fixed a bug where "merge into" autofixes would produce incorrect patches in the presence of multi-byte Unicode characters (#​1581)

  Many thanks to @​ManuelLerchnerQC for implementing this fix!

• Fixed a bug where the template-injection audit would produce duplicated pedantic-only findings (#​1589)

• Fixed a bug where the obfuscation audit would produce incorrect autofixes for a subset of constant-reducible expressions (#​1597)

• Fixed a bug where the obfuscation audit would fail to apply fixes to a subset of inputs with leading whitespace (#​1597)

• Fixed a bug where the concurrency-limits audit would incorrectly flag reusable-only workflows as needing a concurrency: key (#​1620)

• Fixed a bug where the known-vulnerable-actions audit would fail when applying some fixes (#​1640)

  Many thanks to @​reubenwong97 for implementing this fix!

• Fixed a bug where the pre-commit ecosystem was not recognized in Dependabot configuration files (#​1637)

• Fixed a bug where the template-injection audit would incorrectly flag github.triggering_actor as an injection risk in the default persona (#​1645)

• Fixed a bug where zizmor's expression parser did not correctly handle number literals in GitHub Actions expressions (#​1625)

• Fixed a bug where the template-injection audit would crash on some forms of multi-line expressions (#​1669)

• Fixed a bug where deserialization of a workflow containing fractional minutes would fail (#​1675)

• Fixed a bug where deserialization of a workflow where a workflow_run with a scalar types would fail (#​1676)

• Fixed a bug where zizmor would crash on workflows containing bare numeric values in if: conditions (#​1683)

• Fixed a bug where GitHub Actions expression string comparisons were not case-insensitive (#​1687)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.