Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 27, 2025

Bumps zizmorcore/zizmor from 1.12.1 to 1.16.0.

Release notes

Sourced from zizmorcore/zizmor's releases.

v1.16.0

New Features 🌈🔗

Performance Improvements 🚄🔗

  • zizmor's online mode is now significantly (40% to over 95%) faster on common workloads, thanks to a combination of caching improvements and conversion of GitHub API requests into Git remote lookups (#1257)

    Many thanks to @​Bo98 for implementing these improvements!

Enhancements 🌱🔗

  • When running in --fix mode and all fixes are successfully applied, zizmor now has similar exit code behavior as the --no-exit-codes and --format=sarif flags (#1242)

    Many thanks to @​cnaples79 for implementing this improvement!

  • The dependabot-cooldown audit now supports auto-fixes for many findings (#1229)

    Many thanks to @​mostafa for implementing this improvement!

  • The dependabot-execution audit now supports auto-fixes for many findings (#1229)

    Many thanks to @​mostafa for implementing this improvement!

  • zizmor now has limited, experimental support for handling inputs that contain YAML anchors (#1266)

v1.15.2

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

v1.15.1

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail to parse Dependabot configuration files due to missing support for some package ecosystems (#1240)

v1.15.0

This release comes with support for auditing Dependabot configuration files! Like with composite action definition auditing (introduced in v1.0.0), Dependabot configuration auditing is enabled by default but can be disabled as part of input collection.

To complement this new functionality, this release comes with two new audits: dependabot-execution and dependabot-cooldown.

New Features 🌈🔗

  • New audit: dependabot-execution detects Dependabot configurations that allow insecure external code execution (#1220)

  • New audit: dependabot-cooldown detects Dependabot configurations that do not include cooldown settings, or that set an insufficient cooldown (#1223)

... (truncated)

Changelog

Sourced from zizmorcore/zizmor's changelog.

1.16.0

New Features 🌈

  • New audit: [concurrency-limits] detects insufficient concurrency limits in workflows (#1227)

    Many thanks to @​jwallwork23 for proposing and implementing this audit!

Performance Improvements 🚄

  • zizmor's online mode is now significantly (40% to over 95%) faster on common workloads, thanks to a combination of caching improvements and conversion of GitHub API requests into Git remote lookups (#1257)

    Many thanks to @​Bo98 for implementing these improvements!

Enhancements 🌱

  • When running in --fix mode and all fixes are successfully applied, zizmor now has similar [exit code] behavior as the --no-exit-codes and --format=sarif flags (#1242)

    Many thanks to @​cnaples79 for implementing this improvement!

  • The [dependabot-cooldown] audit now supports auto-fixes for many findings (#1229)

    Many thanks to @​mostafa for implementing this improvement!

  • The [dependabot-execution] audit now supports auto-fixes for many findings (#1229)

    Many thanks to @​mostafa for implementing this improvement!

  • zizmor now has limited, experimental support for handling inputs that contain YAML anchors (#1266)

1.15.2

Bug Fixes 🐛

  • Fixed a bug where zizmor would fail to parse some Dependabot configuration files due to missing support for some schedule formats (#1247)

1.15.1

Bug Fixes 🐛

  • Fixed a bug where zizmor would fail to parse Dependabot configuration files

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [zizmorcore/zizmor](https://github.com/zizmorcore/zizmor) from 1.12.1 to 1.16.0.
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.12.1...v1.16.0)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file docker_compose Pull requests that update docker_compose code labels Oct 27, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 3, 2025

Superseded by #24096.

@dependabot dependabot bot closed this Nov 3, 2025
@dependabot dependabot bot deleted the dependabot/docker_compose/zizmorcore/zizmor-1.16.0 branch November 3, 2025 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file docker_compose Pull requests that update docker_compose code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant