Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package zizmor for openSUSE:Factory checked in at 2026-09-17 16:59:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zizmor (Old) and /work/SRC/openSUSE:Factory/.zizmor.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zizmor" Thu Sep 17 16:59:53 2026 rev:39 rq:1378514 version:1.30.1 Changes: -------- --- /work/SRC/openSUSE:Factory/zizmor/zizmor.changes 2026-08-03 17:18:46.337821611 +0200 +++ /work/SRC/openSUSE:Factory/.zizmor.new.383539/zizmor.changes 2026-09-17 16:59:55.150372060 +0200 @@ -1,0 +2,91 @@ +Thu Sep 17 05:17:52 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.30.1: + * Bug Fixes + - Fixed a bug where zizmor would crash on pre-commit inputs + that reference a GitHub URL with an explicit .git suffix + (#2363) + - Fixed a bug where self-repository auto-fixes were incorrectly + marked as "safe" instead of "unsafe" (#2373) + * Dependencies + - chore(deps): bump the cargo group with 3 updates (#2355) + - chore(deps): bump the github-actions group with 3 updates + (#2356) + - chore(deps-dev): bump zensical from 0.0.53 to 0.0.57 in the + uv group (#2357) +- Update to version 1.30.0: + * New Features + - New audit: self-repository detects usages of the old + "workspace-relative" form for local reusable workflows and + actions and recommends the new "self-repository" form instead + (#2271) + * Enhancements + - The impostor-commit audit now supports pre-commit config + inputs (#2256) + - The forbidden-uses audit now supports pre-commit config + inputs (#2263) + - The adhoc-packages audit now detects more ad-hoc package + management patterns, including bundle add and yarn add + - The archived-uses audit now supports pre-commit config inputs + (#2272) + - The ref-confusion audit now supports pre-commit config inputs + (#2274) + - The cache-poisoning audit now produces more detailed and more + precise diagnostics (#2330) + - The cache-poisoning audit now handles and exposes auto-fixes + in a more general manner (#2332) + - zizmor now recognizes sethvargo/ratchet version comments when + evaluating ref pinning (#2319) + - The unpinned-tools audit now produces more detailed and more + precise diagnostics (#2339) + - The unpinned-tools audit now detects usages of + extractions/setup-just (#2339) + - The unpinned-tools audit now detects usages of + extractions/setup-crate (#2340) + - The archived-uses audit now detects several more archived + repositories (#2340) + - The ref-version-mismatch audit now supports uses: that + reference reusable workflows (#2344) + - The stale-action-refs audit now supports uses: that reference + reusable workflows (#2345) + * Bug Fixes + - Fixed a bug where zizmor would reject a + .pre-commit-config.yml input containing a prek-specific + builtin section (#2259) + - Fixed a bug where the unpinned-uses audit would fail to honor + ignore comments within the same step scope (#2289) + - Fixed a bug where zizmor would reject a dependabot.yml + containing a goproxy-server registry definition (#2300) + - Fixed a bug where zizmor would reject pre-commit + configurations containing prek-specific glob patterns in + files or exclude (#2308) + - Fixed a handful of unsound patch bugs when performing YAML + add and/or replace operations (#2295) + - Fixed a bug where the cache-poisoning audit would incorrectly + flag newer astral-sh/setup-uv versions that disable caching + behavior automatically (#2330) + - Fixed a bug where the ref-version-mismatch audit would + produce a misleading diagnostic when an action has + overlapping branch and tag names (#2337) + - Fixed a bug where the artipacked audit would incorrectly flag + the with: clauses of unrelated actions (#2339) + - Fixed a class of bugs where zizmor would incorrectly match an + action's commit to a sibling action's tag (#2247) + - Fixed a bug where zizmor would crash on deeply nested GitHub + Actions expressions (#2349) + * Dependencies + - chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 + (#2338) + - chore(deps): bump the cargo group with 3 updates (#2334) + - chore(deps): bump the cargo group with 5 updates (#2313) + - chore(deps-dev): bump zensical from 0.0.52 to 0.0.53 in the + uv group (#2314) + - chore(deps): bump the cargo group across 1 directory with 9 + updates (#2305) + - chore(deps-dev): bump zensical from 0.0.51 to 0.0.52 in the + uv group (#2293) + - chore(deps): bump jsonschema from 0.48.5 to 0.49.1 in the + cargo group (#2265) + - chore(deps-dev): bump the uv group with 3 updates (#2267) + +------------------------------------------------------------------- Old: ---- zizmor-1.29.0.obscpio New: ---- zizmor-1.30.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zizmor.spec ++++++ --- /var/tmp/diff_new_pack.1UoXtN/_old 2026-09-17 16:59:56.792440872 +0200 +++ /var/tmp/diff_new_pack.1UoXtN/_new 2026-09-17 16:59:56.794440956 +0200 @@ -17,7 +17,7 @@ Name: zizmor -Version: 1.29.0 +Version: 1.30.1 Release: 0 Summary: A static analysis tool for GitHub Actions License: MIT ++++++ _service ++++++ --- /var/tmp/diff_new_pack.1UoXtN/_old 2026-09-17 16:59:56.847443177 +0200 +++ /var/tmp/diff_new_pack.1UoXtN/_new 2026-09-17 16:59:56.851443344 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/v1.29.0</param> + <param name="revision">refs/tags/v1.30.1</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.1UoXtN/_old 2026-09-17 16:59:56.875444350 +0200 +++ /var/tmp/diff_new_pack.1UoXtN/_new 2026-09-17 16:59:56.879444518 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/woodruffw/zizmor</param> <param name="changesrevision">597db4d7dc5730bdc1370197bf5678a5ca028abb</param></service><service name="tar_scm"> <param name="url">https://github.com/zizmorcore/zizmor.git</param> - <param name="changesrevision">3c116961091b50bd1a08ffefe916469d4d90093c</param></service></servicedata> + <param name="changesrevision">99a054ed9283c90abdd2d5b9fb5101d27dde9783</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/zizmor/vendor.tar.zst /work/SRC/openSUSE:Factory/.zizmor.new.383539/vendor.tar.zst differ: char 7, line 1 ++++++ zizmor-1.29.0.obscpio -> zizmor-1.30.1.obscpio ++++++ ++++ 20903 lines of diff (skipped) ++++++ zizmor.obsinfo ++++++ --- /var/tmp/diff_new_pack.1UoXtN/_old 2026-09-17 16:59:57.450468447 +0200 +++ /var/tmp/diff_new_pack.1UoXtN/_new 2026-09-17 16:59:57.456468698 +0200 @@ -1,5 +1,5 @@ name: zizmor -version: 1.29.0 -mtime: 1785617589 -commit: 3c116961091b50bd1a08ffefe916469d4d90093c +version: 1.30.1 +mtime: 1788930776 +commit: 99a054ed9283c90abdd2d5b9fb5101d27dde9783
