Bump zizmor from 1.27.0 to 1.29.0

[dependabot]

Bumps zizmor from 1.27.0 to 1.29.0.

Release notes

Sourced from zizmor's releases.

v1.29.0

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

v1.28.0

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

Changelog

Sourced from zizmor's changelog.

1.29.0

New Features 🌈

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and #!yaml uses: ./foo/bar (#2248)

Changes ⚠️

• The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses, whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)

• Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a #!yaml repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

1.28.0

Security 🔒

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

... (truncated)

Commits

• 3c11696 zizmor 1.29.0 (#2251)
• 876f448 Bump trophies (#2250)
• 3e92c0a Remove old deprecated --collect modes (#2242)
• 35ab77b Support self-repository syntax for local uses (#2249)
• 6ea55f5 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#2241)
• a56362c chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 (#2240)
• 80b80f3 Bump zensical, fixup anchor IDs (#2239)
• dce1469 Bump trophies (#2238)
• fd487f4 chore(deps): bump the github-actions group with 4 updates (#2236)
• ab59a28 chore(deps): bump the cargo group with 11 updates (#2237)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)