Update mise tools#40
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.7.0→1.7.11.25.2→1.26.1Release Notes
afadesigns/zshellcheck (github:afadesigns/zshellcheck)
v1.7.1Compare Source
Changelog
0d7743cchore(deps): bump the github-actions group across 1 directory with 4 updates (#1409)a020bd0chore: release v1.7.1 (#1429)1f89474ci: bump codeql-action to v4.36.2 (#1412)dba12baci: correct stale action-pin version comments (#1411)34ddb3cfix: ZC1044 skips cd= variable assignment (#1420)510c16afix: ZC1075 skips bare expansions of arrays (#1422)536ec51fix: ZC1075 skips flag-led expansions (#1421)c646a5afix: ZC1075 skips width-pad and typeset arrays (#1423)3a4e06dfix: ZC1098 skips the eval "$@" dispatch idiom (#1418)7356cbdfix: ZC1188 gives direction-aware PATH advice (#1419)36b392efix: absorb glued quote tail in assignment RHS (#1425)64d9058fix: drop false positives in ZC1043 (#1417)e245917fix: drop false positives in ZC1097 and ZC1049 (#1416)a55b590fix: lint inside logical-chain compound bodies (#1426)c961834fix: parse command-position assignments correctly (#1427)23d0627fix: retire ZC1104, duplicate of ZC1188 (#1424)221dda0fix: stop auto-fixes emitting broken code (#1415)zizmorcore/zizmor (zizmor)
v1.26.1Compare Source
This is a small corrective release for 1.26.0.
v1.26.0Compare Source
New Features 🌈🔗
New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)
Many thanks to @andrew for proposing and implementing this improvement!
New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)
Many thanks to @terror for proposing and implementing this improvement!
New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)
Many thanks to @connorshea for proposing and implementing this improvement!
Enhancements 🌱🔗
The cache-poisoning audit now detects additional cache disablement heuristics (#2053)
The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)
The excessive-permissions audit is now aware of the code-quality permission (#2088)
The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @v6) (#2127)
Performance Improvements 🚄🔗
Most online audits are significantly faster, thanks to more precise retry handling (#2036)
Bug Fixes 🐛🔗
Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)
Many thanks to @fionn for implementing this fix!
Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)
Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)
Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)
Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)
Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)
Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)
The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748, #2095)
Changes⚠️ 🔗
The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#2054)
The JSON and SARIF outputs no longer contain a misleading prefix key (#2095)
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.