Skip to content

build(deps): bump the test-and-lint-dependencies group with 2 updates #991

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 22, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 21, 2025

Bumps the test-and-lint-dependencies group with 2 updates: ruff and zizmor.

Updates ruff from 0.11.5 to 0.11.6

Release notes

Sourced from ruff's releases.

0.11.6

Release Notes

Preview features

  • Avoid adding whitespace to the end of a docstring after an escaped quote (#17216)
  • [airflow] Extract AIR311 from AIR301 rules (AIR301, AIR311) (#17310, #17422)

Bug fixes

  • Raise syntax error when \ is at end of file (#17409)

Contributors

Install ruff 0.11.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/ruff/releases/download/0.11.6/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/ruff/releases/download/0.11.6/ruff-installer.ps1 | iex"

Download ruff 0.11.6

File Platform Checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.11.6

Preview features

  • Avoid adding whitespace to the end of a docstring after an escaped quote (#17216)
  • [airflow] Extract AIR311 from AIR301 rules (AIR301, AIR311) (#17310, #17422)

Bug fixes

  • Raise syntax error when \ is at end of file (#17409)
Commits

Updates zizmor from 1.5.2 to 1.6.0

Release notes

Sourced from zizmor's releases.

v1.6.0

See https://woodruffw.github.io/zizmor/release-notes/#v160 for full release notes.

Changelog

Sourced from zizmor's changelog.

v1.6.0

New Features 🌈

  • New audit: The [forbidden-uses] audit is a configurable audit that allows allow- or denylisting of entire orgs, repos, or specific action patterns. This audit must be configured; by default it has no effect (#664)

    Many thanks to @​Holzhaus for proposing and initiating this new audit!

  • zizmor now supports --format=github as an output format. This format produces check annotations via GitHub workflow commands, e.g. ::warning and ::error. See the Output formats documentation for more information on annotations, including key limitations (#634)

  • The [unpinned-uses] audit has been completely rewritten, with two key changes:

    • The audit now has configurable policies that give users more control over the audit's behavior. In particular, users can now define policies that mirror their actual threat model, such as trusting their own GitHub organizations while leaving others untrusted.
    • The audit's default policy is more precise and conservative: official GitHub actions (e.g. those under actions/* and similar) are allowed to be pinned by branch or tag, but all other actions are required to be pinned by SHA. This is a change from the previous policy, which was to only flag completely unpinned actions by default.

    Many thanks to @​Holzhaus for motivating this change! (#663, #574)

Improvements 🌱

  • The SARIF output format now marks each rule as a "security" rule, which helps GitHub's presentation of the results (#631)
  • The [template-injection] audit is now performs dataflow analysis to determine whether contexts actually expand in an unsafe manner, making it significantly more accurate (#640)
  • The [cache-poisoning] audit is now aware of @​jdx/mise-action (#645)
  • The [cache-poisoning] audit is now significantly more accurate when analyzing workflows that use @​docker/setup-buildx-action (#644)
  • --format=json is now an alias for --format=json-v1, enabling future JSON formats. The policy for the --format=json alias is documented under Output formats - JSON (#657)
  • Configuration file loading is now stricter, and produces a more useful error message when the configuration file is invalid (#663)

Bug Fixes 🐛

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the test-and-lint-dependencies group with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [zizmor](https://github.com/woodruffw/zizmor).


Updates `ruff` from 0.11.5 to 0.11.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.11.5...0.11.6)

Updates `zizmor` from 1.5.2 to 1.6.0
- [Release notes](https://github.com/woodruffw/zizmor/releases)
- [Changelog](https://github.com/woodruffw/zizmor/blob/main/docs/release-notes.md)
- [Commits](woodruffw/zizmor@v1.5.2...v1.6.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.11.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-and-lint-dependencies
- dependency-name: zizmor
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-and-lint-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 21, 2025
@jku jku merged commit 9cc1108 into main Apr 22, 2025
20 checks passed
@dependabot dependabot bot deleted the dependabot/pip/test-and-lint-dependencies-b11e8444e9 branch April 22, 2025 08:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant