dependabot[bot] opened a new pull request, #2946: URL: https://github.com/apache/shiro/pull/2946
Bumps the pre-commit-hooks group with 3 updates in the / directory: [https://github.com/igorshubovych/markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli), [https://github.com/zizmorcore/zizmor-pre-commit](https://github.com/zizmorcore/zizmor-pre-commit) and [https://github.com/python-jsonschema/check-jsonschema](https://github.com/python-jsonschema/check-jsonschema). Updates `https://github.com/igorshubovych/markdownlint-cli` from v0.49.1 to 0.50.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/igorshubovych/markdownlint-cli/releases";>https://github.com/igorshubovych/markdownlint-cli's releases</a>.</em></p> <blockquote> <h2>v0.50.0</h2> <ul> <li>Update <code>markdownlint</code> dependency to <code>0.42.0</code> <ul> <li>Improve <code>MD011</code>/<code>MD018</code>/<code>MD020</code>/<code>MD043</code>/<code>MD051</code>/<code>MD055</code>/<code>MD060</code></li> <li>Add regular expression denial of service protection</li> <li>Add support for reporting issues with front matter</li> <li>Update dependencies</li> </ul> </li> <li>Update all dependencies via <code>Dependabot</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/cbcdc463be5464e25e3e955a511599a67b9b987f";><code>cbcdc46</code></a> Bump version 0.50.0</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/ff6af70e6cc0418b606f4a3d6bfb151c021ee330";><code>ff6af70</code></a> Freshen package-lock.json by deleting and recreating via "npm install".</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/05026021badc96d9670ee33a59938eb63abb6297";><code>0502602</code></a> Bump ava from 8.0.2 to 8.1.0</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/43d3ef1e5848ee4982070a544309f7711812aa46";><code>43d3ef1</code></a> Bump ignore from 7.0.12 to 7.0.13</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/c05789eab74c30f56a7568f3e895cd7ac2c3ce83";><code>c05789e</code></a> Bump js-yaml from 5.4.3 to 5.5.0</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/92d6e138106f5445264bfb23f867b11b06e20101";><code>92d6e13</code></a> Bump markdownlint from 0.41.1 to 0.42.0</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/fb4a7ee5fa944005a06fbb6808d957802759cf64";><code>fb4a7ee</code></a> Bump ava from 8.0.1 to 8.0.2</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/1fc4af407e63c4ce2a6cdd8627a91e53d7762fdf";><code>1fc4af4</code></a> Bump markdown-it from 15.0.2 to 15.0.3</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/364797e8797c1217ba5c41cc3649d40072e9f4cf";><code>364797e</code></a> Bump smol-toml from 1.9.0 to 1.9.1</li> <li><a href="https://github.com/igorshubovych/markdownlint-cli/commit/24967a4ca08fac217cbef9e363ce9630014f04cd";><code>24967a4</code></a> Bump js-yaml from 5.4.2 to 5.4.3</li> <li>Additional commits viewable in <a href="https://github.com/igorshubovych/markdownlint-cli/compare/5b5dddc4fb0f83c3ea1fc5616fa63e115dce83e0...cbcdc463be5464e25e3e955a511599a67b9b987f";>compare view</a></li> </ul> </details> <br /> Updates `https://github.com/zizmorcore/zizmor-pre-commit` from v1.31.1 to 1.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor-pre-commit/releases";>https://github.com/zizmorcore/zizmor-pre-commit's releases</a>.</em></p> <blockquote> <h2>v1.32.0</h2> <p><a href="https://github.com/sponsors/woodruffw/";>Sponsorship is appreciated!</a></p> <h2>New Features π<a href="https://docs.zizmor.sh/release-notes/#new-features";>π</a></h2> <ul> <li>zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see <a href="https://docs.zizmor.sh/usage/#workflow-lockfiles";>the limitations documentation</a> for more information about the current implementation and its limitations (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2463";>#2463</a>)</li> </ul> <h2>Enhancements π±<a href="https://docs.zizmor.sh/release-notes/#enhancements";>π</a></h2> <ul> <li> <p>zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the <a href="https://docs.zizmor.sh/usage/#input-collection";>input collection</a> documentation for more information. (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2454";>#2454</a>)</p> </li> <li> <p>zizmor's LSP now honors the didChangeWorkspaceFolders event (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2461";>#2461</a>)</p> </li> <li> <p>zizmor's LSP now audits pre-commit inputs (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2485";>#2485</a>)</p> </li> <li> <p>zizmor now provides Windows ARM64 wheels on PyPI (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2424";>#2424</a>)</p> <p>Many thanks to <a href="https://github.com/ndabas";><code>@βndabas</code></a> for proposing and implementing this improvement!</p> </li> </ul> <h2>Bug Fixes π<a href="https://docs.zizmor.sh/release-notes/#bug-fixes";>π</a></h2> <ul> <li> <p>Fixed a bug where the <a href="https://docs.zizmor.sh/audits/#bot-conditions";>bot-conditions</a> audit did not properly flag if: condition of jobs that call a reusable workflow (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2457";>#2457</a>)</p> </li> <li> <p>Fixed a bug where the <a href="https://docs.zizmor.sh/audits/#obfuscation";>obfuscation</a> audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2483";>#2483</a>)</p> </li> <li> <p>Fixed a bug where the <a href="https://docs.zizmor.sh/audits/#template-injection";>template-injection</a> audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2495";>#2495</a>)</p> </li> <li> <p>Fixed a bug where the <a href="https://docs.zizmor.sh/audits/#template-injection";>template-injection</a> audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2504";>#2504</a>)</p> </li> <li> <p>Fixed a class of bugs in the <a href="https://docs.zizmor.sh/audits/#obfuscation";>obfuscation</a> audit where a constant-reducible subexpression would not be replaced with a contextually correct form (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2483";>#2483</a>)</p> </li> <li> <p>Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2485";>#2485</a>)</p> </li> <li> <p>Fixed a bug where zizmor would not honor some ignore comments for the <a href="https://docs.zizmor.sh/audits/#stale-action-refs";>stale-action-refs</a> audit (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2494";>#2494</a>)</p> </li> <li> <p>Fixed a bug where zizmor would not honor some ignore comments for the <a href="https://docs.zizmor.sh/audits/#ref-version-mismatch";>ref-version-mismatch</a> audit (<a href="https://redirect.github.com/zizmorcore/zizmor/issues/2494";>#2494</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zizmorcore/zizmor-pre-commit/commit/06a39750ec31860bb44f2acf67182c40016cd1e7";><code>06a3975</code></a> Mirror: 1.32.0</li> <li>See full diff in <a href="https://github.com/zizmorcore/zizmor-pre-commit/compare/c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f...06a39750ec31860bb44f2acf67182c40016cd1e7";>compare view</a></li> </ul> </details> <br /> Updates `https://github.com/python-jsonschema/check-jsonschema` from 0.38.2 to 0.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-jsonschema/check-jsonschema/releases";>https://github.com/python-jsonschema/check-jsonschema's releases</a>.</em></p> <blockquote> <h2>0.39.0</h2> <ul> <li>Update vendored schemas: bitbucket-pipelines, buildkite, circle-ci, citation-file-format, compose-spec, dependabot, gitlab-ci, meltano, mergify, renovate, snapcraft, woodpecker-ci (2026-10-25)</li> <li>Added support for Python 3.15 .</li> <li>Removed support for Python 3.10 .</li> <li>The build backend has been updated from setuptools to flit.</li> <li>When running with a builtin schema, <code>check-jsonschema</code> will now skip the metaschema check as an optimization.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-jsonschema/check-jsonschema/blob/main/CHANGELOG.rst";>https://github.com/python-jsonschema/check-jsonschema's changelog</a>.</em></p> <blockquote> <p>.. Unlike other docs, the changelog is incorporated into a sphinx doc site in .. which we want to use sphinx-issues to generate links. .. As a result, it's maintained as ReST doc, not markdown.</p> <h1>CHANGELOG</h1> <h2>Unreleased</h2> <p>.. vendor-insert-here</p> <ul> <li>Update vendored schemas: mergify, renovate (2026-11-01)</li> </ul> <h2>0.39.0</h2> <ul> <li>Update vendored schemas: bitbucket-pipelines, buildkite, circle-ci, citation-file-format, compose-spec, dependabot, gitlab-ci, meltano, mergify, renovate, snapcraft, woodpecker-ci (2026-10-25)</li> <li>Added support for Python 3.15 .</li> <li>Removed support for Python 3.10 .</li> <li>The build backend has been updated from setuptools to flit.</li> <li>When running with a builtin schema, <code>check-jsonschema</code> will now skip the metaschema check as an optimization.</li> </ul> <h2>0.38.2</h2> <ul> <li>Update the version of <code>click</code> declared as a dependency</li> </ul> <h2>0.38.1</h2> <ul> <li>Update vendored schemas: bitbucket-pipelines, buildkite, changie, circle-ci, compose-spec, dependabot, github-actions, github-workflows, gitlab-ci, mergify, renovate, taskfile, travis, woodpecker-ci (2026-09-20)</li> <li><code>check-jsonschema</code> now has a logo. Thanks to <code>Mylah Birdie <https://www.instagram.com/mylahbirdie></code>__!</li> </ul> <h2>0.38.0</h2> <ul> <li>Update vendored schemas: bitbucket-pipelines, buildkite, circle-ci, codecov, compose-spec, dependabot, gitlab-ci, mergify, readthedocs, renovate, taskfile, woodpecker-ci (2026-08-08)</li> <li>Add a dedicated <code>check-github-workflows-require-timeout</code> pre-commit hook for requiring <code>timeout-minutes</code> on all GitHub Workflow jobs. (:issue:<code>639</code>)</li> </ul> <p>0.37.4</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/a76b92851fc9eede9f9bc4073eb55202f34eb0df";><code>a76b928</code></a> Bump version for release</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/1833f75a2d3aa51d283bccaf23cca30edf3f140d";><code>1833f75</code></a> Merge pull request <a href="https://redirect.github.com/python-jsonschema/check-jsonschema/issues/742";>#742</a> from sirosen/update-gha</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/6624fe0618f6134ccadd1f45be3f483ba0f1bf29";><code>6624fe0</code></a> Merge pull request <a href="https://redirect.github.com/python-jsonschema/check-jsonschema/issues/741";>#741</a> from sirosen/add-pre-commit-checks</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/3aacb203032f1a0d42b5d1cb1ed19da8cdeef53c";><code>3aacb20</code></a> Convert GHA usage to use parallel steps + uv</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/9077b461fff045b33e41dae504a48d092e43bbf6";><code>9077b46</code></a> Run pinact to pin actions</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/dd92c61b8cb453454f7e7b0a132c7d9ebdb189c8";><code>dd92c61</code></a> Add pre-commit validators to tox and CI</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/fc79edad221b72f37a91ab4fc5e52e8d2315c9db";><code>fc79eda</code></a> Add helptext options to justfile</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/02ebb99beb90182f0f7824df454d698928e58ae1";><code>02ebb99</code></a> Update <code>uv run</code> usage</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/c573dcd2e0197fcc2089ba19926eb131582d9126";><code>c573dcd</code></a> Merge pull request <a href="https://redirect.github.com/python-jsonschema/check-jsonschema/issues/740";>#740</a> from sirosen/add-funding-config</li> <li><a href="https://github.com/python-jsonschema/check-jsonschema/commit/1afd688ef60e0d4ec993e733a4ed206a38268056";><code>1afd688</code></a> Add a github funding config</li> <li>Additional commits viewable in <a href="https://github.com/python-jsonschema/check-jsonschema/compare/0494aa7fa1314e98913a41227d8f0a515b2c1049...a76b92851fc9eede9f9bc4073eb55202f34eb0df";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
