This is an automated email from the ASF dual-hosted git repository.
kou pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-erlang.git
The following commit(s) were added to refs/heads/main by this push:
new bffec07 chore: bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1
(#123)
bffec07 is described below
commit bffec07998bde5af5fbc25e50e5bfd9dfa80fae9
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Fri Oct 23 22:58:33 2026 +0900
chore: bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#123)
Bumps
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action)
from 0.6.4 to 0.7.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases";>zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.7.1</h2>
<h1>zizmor changes</h1>
<h2>Bug Fixes 🐛🔗</h2>
<ul>
<li>Fixed a regression in 1.31.0 where some ignore
comments/configurations would no longer apply to the dangerous-triggers
audit</li>
</ul>
<h1>action changes</h1>
<p>The default version of zizmor is now 1.31.1.</p>
<h2>What's Changed</h2>
<ul>
<li>Sync zizmor versions by <a
href="https://github.com/github-actions";><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/178";>zizmorcore/zizmor-action#178</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1";>https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1</a></p>
<h2>v0.7.0</h2>
<p><a href="https://github.com/sponsors/woodruffw/";>Sponsorship is
appreciated!</a></p>
<h1>zizmor notes</h1>
<h2>Enhancements 🌱<a
href="https://docs.zizmor.sh/release-notes/#enhancements";>🔗</a></h2>
<ul>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#typosquat-uses";>typosquat-uses</a>
audit now supports pre-commit config inputs (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2437";>#2437</a>)</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#self-hosted-runner";>self-hosted-runner</a>
audit is now significantly more precise (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2350";>#2350</a>)</p>
<p>Many thanks to <a
href="https://github.com/ubiratansoares";><code>@ubiratansoares</code></a>
for proposing and implementing this enhancement!</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#dangerous-triggers";>dangerous-triggers</a>
audit now considers the issue_comment trigger fundamentally dangerous
(<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2396";>#2396</a>)</p>
</li>
<li>
<p>zizmor is now aware of the image_version workflow trigger (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2397";>#2397</a>)</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#dangerous-triggers";>dangerous-triggers</a>
audit now produces more precise finding/diagnostic spans (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2402";>#2402</a>)</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#cache-poisoning";>cache-poisoning</a>
audit is now aware of <a
href="https://github.com/pnpm/setup";>pnpm/setup</a> (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2409";>#2409</a>)</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#unpinned-images";>unpinned-images</a>
audit now produces more precise findings when the user's workflow
contains an indirect matrix (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2395";>#2395</a>)</p>
<p>Many thanks to <a
href="https://github.com/ubiratansoares";><code>@ubiratansoares</code></a>
for proposing and implementing this enhancement!</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#cache-poisoning";>cache-poisoning</a>
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2418";>#2418</a>)</p>
</li>
<li>
<p>The <a
href="https://docs.zizmor.sh/audits/#cache-poisoning";>cache-poisoning</a>
audit now flags usages of cache-mode: write and cache-mode: write-only
with dangerous triggers, i.e. triggers that give an attacker privileged
code execution (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2426";>#2426</a>)</p>
</li>
<li>
<p>zizmor now uses a tree-sitter grammar for PowerShell that's more
precise/capable of capturing more non-trivial PowerShell expressions (<a
href="https://redirect.github.com/zizmorcore/zizmor/issues/2444";>#2444</a>)</p>
</li>
</ul>
<h2>Bug Fixes 🐛<a
href="https://docs.zizmor.sh/release-notes/#bug-fixes";>🔗</a></h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e";><code>85b2b9f</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/178";>#178</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/38c745a43764dcc8bcfd364e8295870e252e957c";><code>38c745a</code></a>
README: bump pins (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/177";>#177</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/f9597c869b2e67095f9b527070297a13a6efe928";><code>f9597c8</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/175";>#175</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2181e51ed8d58b9304e4a561374bb36d5599af3a";><code>2181e51</code></a>
Bump sync-zizmor-versions.py to Python 3.11 for locking (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/174";>#174</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/27d989be9329e6cff7f80baf450ca83bf4c94898";><code>27d989b</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/173";>#173</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/a91218c45134530ecc7aefc3eec3f997a279ad37";><code>a91218c</code></a>
Bootstrap zizmor without Docker (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/169";>#169</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/ee3f1bf153a9caa7d162d7324ef8314ec3f91862";><code>ee3f1bf</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/170";>#170</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/8eacaa5f3f72b6638f4f87c3f66113bbc0f363dd";><code>8eacaa5</code></a>
README: bump pins (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/167";>#167</a>)</li>
<li>See full diff in <a
href="https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e";>compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/github-actions-check.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/github-actions-check.yml
b/.github/workflows/github-actions-check.yml
index 672d5e9..460cb31 100644
--- a/.github/workflows/github-actions-check.yml
+++ b/.github/workflows/github-actions-check.yml
@@ -54,6 +54,6 @@ jobs:
with:
persist-credentials: false
- - uses:
zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+ - uses:
zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
with:
advanced-security: false
