Skip to content

Bump the lint-tools group across 1 directory with 2 updates - #150

Merged
PDowney merged 1 commit into
mainfrom
dependabot/pip/dot-github/lint-tools-601fa647f8
Oct 28, 2026
Merged

Bump the lint-tools group across 1 directory with 2 updates#150
PDowney merged 1 commit into
mainfrom
dependabot/pip/dot-github/lint-tools-601fa647f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the lint-tools group with 2 updates in the /.github directory: ruff and zizmor.

Updates ruff from 0.17.0 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates zizmor from 1.30.1 to 1.31.1

Release notes

Sourced from zizmor's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#2437)

  • The self-hosted-runner audit is now significantly more precise (#2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Changelog

Sourced from zizmor's changelog.

1.31.1

Bug Fixes 🐛

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the [dangerous-triggers] audit (#2450)

1.31.0

Enhancements 🌱

  • The [typosquat-uses] audit now supports pre-commit config inputs (#2437)

  • The [self-hosted-runner] audit is now significantly more precise (#2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The [dangerous-triggers] audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The [dangerous-triggers] audit now produces more precise finding/diagnostic spans (#2402)

  • The [cache-poisoning] audit is now aware of @​pnpm/setup (#2409)

  • The [unpinned-images] audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The [cache-poisoning] audit is now aware of GitHub's new #!yaml cache-mode: setting, and will skip any findings that would occur when a job has an effective #!yaml cache-mode: none (#2418)

  • The [cache-poisoning] audit now flags usages of #!yaml cache-mode: write and #!yaml cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛

  • Fixed a class of false positives/imprecisions in [adhoc-packages] that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees

... (truncated)

Commits

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Thanks for contributing to EngineScript Site Optimizer!

Before we review:

  • Have you tested your changes with WordPress 7.0+?
  • Are your changes compatible with PHP 8.2+?
  • Have you followed WordPress coding standards?
  • Did you update the CHANGELOG.md if needed?

Security Reminder
This plugin stores per-site settings and emits browser resource hints, so please ensure:

  • All user input is properly sanitized
  • All output is properly escaped
  • No security vulnerabilities are introduced

We'll review your PR soon.

@codacy-production

codacy-production Bot commented Oct 19, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@PDowney

PDowney commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
Bump the lint-tools group across 1 directory with 2 updates
c9dd009 
Bumps the lint-tools group with 2 updates in the /.github directory: [ruff](https://github.com/astral-sh/ruff) and [zizmor](https://github.com/zizmorcore/zizmor).


Updates `ruff` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.2)

Updates `zizmor` from 1.30.1 to 1.31.1
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.30.1...v1.31.1)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: lint-tools
- dependency-name: zizmor
  dependency-version: 1.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: lint-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the lint-tools group in /.github with 2 updates Bump the lint-tools group across 1 directory with 2 updates Oct 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/lint-tools-601fa647f8 branch from 6967ec0 to c9dd009 Compare October 28, 2026 05:05
@PDowney
PDowney merged commit 4fd0228 into main Oct 28, 2026
23 checks passed
@github-actions
github-actions Bot deleted the dependabot/pip/dot-github/lint-tools-601fa647f8 branch October 28, 2026 05:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated automation dependencies maintenance testing

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PDowney