[dependabot]

Bumps yamlpath from 1.27.0 to 1.31.0.

Release notes

Sourced from yamlpath's releases.

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

v1.30.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

... (truncated)

Changelog

Sourced from yamlpath's changelog.

1.31.0

Enhancements 🌱

• The [typosquat-uses] audit now supports pre-commit config inputs (#2437)

• The [self-hosted-runner] audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The [dangerous-triggers] audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The [dangerous-triggers] audit now produces more precise finding/diagnostic spans (#2402)

• The [cache-poisoning] audit is now aware of @​pnpm/setup (#2409)

• The [unpinned-images] audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The [cache-poisoning] audit is now aware of GitHub's new #!yaml cache-mode: setting, and will skip any findings that would occur when a job has an effective #!yaml cache-mode: none (#2418)

• The [cache-poisoning] audit now flags usages of #!yaml cache-mode: write and #!yaml cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛

• Fixed a class of false positives/imprecisions in [adhoc-packages] that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the [ref-version-mismatch] audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version

... (truncated)

Commits

• e2b4dfb Switch to woodruffw-trough-tree-sitter-powershell (#2444)
• 1779f43 typosquat-uses: support pre-commit inputs (#2437)
• 2bdf17b [BOT] update context capabilities (#2438)
• 23c65c5 Factor integration test helpers into zizmor-dev (#2429)
• 5694101 Improve diff snapshots (#2428)
• 39a097c cache-poisoning: also flag writes with dangerous triggers (#2426)
• 8478e51 Model cache-mode for workflows and jobs (#2418)
• e966565 Refactor Trigger (#2414)
• d4b6ec7 Handle prek's extension to (default_)language_version (#2413)
• 3f912c7 feat: cache-poisoning: add pnpm setup to cache aware actions (#2409)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)