Skip to content

Bump the pre-commit-hooks group with 3 updates - #79

Merged
d33bs merged 1 commit into
mainfrom
dependabot/pre_commit/pre-commit-hooks-304e3be835
Nov 2, 2026
Merged

Bump the pre-commit-hooks group with 3 updates#79
d33bs merged 1 commit into
mainfrom
dependabot/pre_commit/pre-commit-hooks-304e3be835

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the pre-commit-hooks group with 3 updates: https://github.com/tox-dev/pyproject-fmt, https://github.com/astral-sh/ruff-pre-commit and https://github.com/zizmorcore/zizmor-pre-commit.

Updates https://github.com/tox-dev/pyproject-fmt from v2.29.4 to 2.30.3

Release notes

Sourced from https://github.com/tox-dev/pyproject-fmt's releases.

v2.30.3

What's Changed

Full Changelog: tox-dev/pyproject-fmt@v2.30.2...v2.30.3

v2.30.2

Full Changelog: tox-dev/pyproject-fmt@v2.30.1...v2.30.2

v2.30.1

What's Changed

Full Changelog: tox-dev/pyproject-fmt@v2.30.0...v2.30.1

v2.30.0

Full Changelog: tox-dev/pyproject-fmt@v2.29.4...v2.30.0

Commits

Updates https://github.com/astral-sh/ruff-pre-commit from v0.16.8 to 0.17.2

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.17.2

See: https://github.com/astral-sh/ruff/releases/tag/0.17.2

v0.17.1

See: https://github.com/astral-sh/ruff/releases/tag/0.17.1

v0.17.0

See: https://github.com/astral-sh/ruff/releases/tag/0.17.0

v0.16.10

See: https://github.com/astral-sh/ruff/releases/tag/0.16.10

v0.16.9

See: https://github.com/astral-sh/ruff/releases/tag/0.16.9

Commits
  • f368fb3 Mirror: 0.17.2
  • 65a0c46 Use patched certifi bundle for release mirroring (#189)
  • 0919ea4 Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-actions group (#188)
  • 38bfb07 Mirror: 0.17.1
  • 44b5042 Mirror: 0.17.0
  • e2053c9 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#184)
  • f12be1e Mirror: 0.16.10
  • 6089d41 Document adding quarto to types_or for Quarto code fence formatting (#183)
  • a56c0b9 Mirror: 0.16.9
  • 1b18dc6 authorize astral-sh/ruff to dispatch the sync workflow (#182)
  • Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.30.1 to 1.31.1

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#2437)

  • The self-hosted-runner audit is now significantly more precise (#2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the pre-commit-hooks group with 3 updates
8c7ea41 
Bumps the pre-commit-hooks group with 3 updates: [https://github.com/tox-dev/pyproject-fmt](https://github.com/tox-dev/pyproject-fmt), [https://github.com/astral-sh/ruff-pre-commit](https://github.com/astral-sh/ruff-pre-commit) and [https://github.com/zizmorcore/zizmor-pre-commit](https://github.com/zizmorcore/zizmor-pre-commit).


Updates `https://github.com/tox-dev/pyproject-fmt` from v2.29.4 to 2.30.3
- [Release notes](https://github.com/tox-dev/pyproject-fmt/releases)
- [Commits](tox-dev/pyproject-fmt@v2.29.4...v2.30.3)

Updates `https://github.com/astral-sh/ruff-pre-commit` from v0.16.8 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff-pre-commit/releases)
- [Commits](astral-sh/ruff-pre-commit@v0.16.8...v0.17.2)

Updates `https://github.com/zizmorcore/zizmor-pre-commit` from v1.30.1 to 1.31.1
- [Release notes](https://github.com/zizmorcore/zizmor-pre-commit/releases)
- [Commits](zizmorcore/zizmor-pre-commit@v1.30.1...v1.31.1)

---
updated-dependencies:
- dependency-name: https://github.com/tox-dev/pyproject-fmt
  dependency-version: 2.30.3
  dependency-type: direct:production
  dependency-group: pre-commit-hooks
- dependency-name: https://github.com/astral-sh/ruff-pre-commit
  dependency-version: 0.17.2
  dependency-type: direct:production
  dependency-group: pre-commit-hooks
- dependency-name: https://github.com/zizmorcore/zizmor-pre-commit
  dependency-version: 1.31.1
  dependency-type: direct:production
  dependency-group: pre-commit-hooks
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file pre_commit Pull requests that update pre_commit code labels Nov 1, 2026
@dependabot
dependabot Bot requested a review from d33bs as a code owner November 1, 2026 13:14
d33bs
d33bs approved these changes Nov 2, 2026
View reviewed changes

@d33bs d33bs left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low-risk pre-commit-hooks group bump (pyproject-fmt, ruff, zizmor minor version bumps only). CI green across all jobs.

@d33bs
d33bs merged commit 96f23dc into main Nov 2, 2026
9 checks passed
@dependabot
dependabot Bot deleted the dependabot/pre_commit/pre-commit-hooks-304e3be835 branch November 2, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@d33bs d33bs d33bs approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pre_commit Pull requests that update pre_commit code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@d33bs