chore(deps): update pre-commit hooks

[homelab-okd]

This PR contains the following updates:

Package	Type	Update	Change
ansible/ansible-lint		minor	v26.6.0 → v26.9.0
ansible/ansible-lint	repository	minor	v26.6.0 → v26.9.0
bridgecrewio/checkov	repository	patch	3.3.9 → 3.3.22
rbubley/mirrors-prettier	repository	patch	v3.9.6 → v3.9.9

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

ansible/ansible-lint (ansible/ansible-lint)

v26.9.0

Compare Source

Features

• feat: support example section in file meta/argument_specs.yml (#​5164) @​berndfinger

Fixes

• fix: resolve short mock modules during syntax check (#​5149) @​shvenkat-rh
• fix: propagate extra_vars to import_playbook syntax check (#​5148) @​shvenkat-rh
• fix: resolve nested include_tasks relative paths (#​5159) @​shvenkat-rh
• fix: resolve include_tasks paths from playbook dir (#​5184) @​shvenkat-rh
• fix: apply profile-level skip list during linting (#​5151) @​shvenkat-rh
• fix: honor warn_list after --fix rewrites task names (#​5085) @​santosh7676
• fix: mock_modules clobbering collections and args false positives (#​5157) @​djdanielsson
• fix: inject plain-name mock roles path regardless of --offline (#​5183) @​shvenkat-rh
• fix: warn users when directory expansion discovers new files (#​5158) @​rockygeekz
• fix: skip auto-fix no-jinja-when on string-embedded jinja (#​5103) @​f1047
• fix: do not warn when Jinja block indent is only trim-marker noise (#​5153) @​DSeaStar
• fix: preserve blank lines after flow collections (#​5178) @​shvenkat-rh
• fix: add validate_argspec to play schema (#​5187) @​sameeralam3127
• fix: use ThreadPoolExecutor for syntax check workers (#​5173) @​rockygeekz
• fix: drop ruamel.yaml.clib (#​5163) @​shvenkat-rh
• fix(deps): upgrade gitpython 3.1.57 to 3.1.59 (#​5152) @​rockygeekz
• fix: upgrade black to >=25.2.0 to address CVE-2026-32274 (#​5166) @​shvenkat-rh
• fix: raise cryptography floor and bump js-yaml for Guardian prod vulns (#​5174) @​rockygeekz

Performance

• perf: cache get_deps_versions() result (#​5113) @​BlackDark

Maintenance

• chore: Add .github/SECURITY.md (#​5165) @​gundalow
• chore(deps): update all dependencies and pep621 (#​5138, #​5154, #​5155, #​5160, #​5161, #​5172, #​5175, #​5176) @​renovate[bot]

What's Changed

• chore(deps): update all dependencies by @​renovate[bot] in #​5138
• fix: resolve short mock modules during syntax check by @​shvenkat-rh in #​5149
• fix(deps): upgrade gitpython 3.1.57 to 3.1.59 by @​rockygeekz in #​5152
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5155
• fix: propagate extra_vars to import_playbook syntax check by @​shvenkat-rh in #​5148
• fix: warn users when directory expansion discovers new files by @​rockygeekz in #​5158
• fix: resolve nested include_tasks relative paths by @​shvenkat-rh in #​5159
• fix: apply profile-level skip list during linting by @​shvenkat-rh in #​5151
• chore(deps): update all dependencies by @​renovate[bot] in #​5154
• chore(deps): update all dependencies by @​renovate[bot] in #​5160
• fix: skip auto-fix no-jinja-when on string-embedded jinja by @​f1047 in #​5103
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5161
• fix: do not warn when Jinja block indent is only trim-marker noise by @​DSeaStar in #​5153
• chore: Add .github/SECURITY.md by @​gundalow in #​5165
• fix: upgrade black to >=25.2.0 to address CVE-2026-32274 by @​shvenkat-rh in #​5166
• Fix/drop ruamel yaml clib fresh by @​shvenkat-rh in #​5163
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5172
• fix: honor warn_list after --fix rewrites task names by @​santosh7676 in #​5085
• feat: support 'example' section in file meta/argument_specs.yml by @​berndfinger in #​5164
• fix: use ThreadPoolExecutor for syntax check workers by @​rockygeekz in #​5173
• fix: mock_modules clobbering collections and args false positives by @​djdanielsson in #​5157
• fix: raise cryptography floor and bump js-yaml for Guardian prod vulns by @​rockygeekz in #​5174
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5176
• chore(deps): update all dependencies by @​renovate[bot] in #​5175
• fix: preserve blank lines after flow collections by @​shvenkat-rh in #​5178
• perf: cache get_deps_versions() result by @​BlackDark in #​5113
• fix: inject plain-name mock roles path regardless of --offline by @​shvenkat-rh in #​5183
• fix: resolve include_tasks paths from playbook dir by @​shvenkat-rh in #​5184
• fix: add validate_argspec to play schema by @​sameeralam3127 in #​5187

New Contributors

• @​shvenkat-rh made their first contribution in #​5149
• @​f1047 made their first contribution in #​5103
• @​DSeaStar made their first contribution in #​5153
• @​berndfinger made their first contribution in #​5164
• @​BlackDark made their first contribution in #​5113
• @​sameeralam3127 made their first contribution in #​5187

Full Changelog: ansible/ansible-lint@v26.8.0...v26.9.0

v26.8.0

Compare Source

What's Changed

• Fix/sonarcloud unbounded recursion complexity by @​sathyapramod in #​5098
• feat: honor ANSIBLE_VAULT_PASSWORD_FILE for vault decryption by @​JohnLahr in #​5019
• fix: jinja[spacing] rule creating invalid syntax for minus modifiers by @​Dotify71 in #​5102
• chore(deps): update all dependencies by @​renovate[bot] in #​5081
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5082
• fix: remove stale words from cspell dictionary by @​rockygeekz in #​5109
• chore(deps): bump schemas npm packages for Dependabot CVEs by @​sudhirverma in #​5114
• fix(security): update dependencies [SECURITY] by @​renovate[bot] in #​5111
• fix: address SonarCloud new code violations by @​sudhirverma in #​5116
• chore(deps): update all dependencies by @​renovate[bot] in #​5121
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5122
• fix(deps): exclude ansible-core 2.17.x (CVE-2026-11332) by @​rockygeekz in #​5123
• fix: expose ansible-galaxy on the uv tool-install path by @​jeffcpullen in #​5124
• fix: var-naming for register projections by @​0xTaoZ in #​5110
• chore: Adding OpenWrt 25.12 as platform by @​sscheib in #​5132
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5134
• chore(deps): update all dependencies by @​renovate[bot] in #​5133
• fix: add timeout to release-check urlopen() call by @​cooperlees in #​5128
• fix: respect ANSIBLE_HOME env var for cache dir selection (#​5806) by @​Jkhall81 in #​5105
• fix: deduplicate ANSIBLE_HOME isolation check by @​rockygeekz in #​5140
• fix(security): update dependencies [SECURITY] by @​renovate[bot] in #​5141
• fix: do not require role prefix for ansible_ connection variables by @​Sanjays2402 in #​5130
• Adding missing FreeBSD versions. by @​jmpalacios in #​5143
• chore(deps): update all dependencies pep621 by @​renovate[bot] in #​5139
• fix: prepend runtime cache dir to collections paths (#​5137) by @​rockygeekz in #​5145

New Contributors

• @​sathyapramod made their first contribution in #​5098
• @​JohnLahr made their first contribution in #​5019
• @​jeffcpullen made their first contribution in #​5124
• @​0xTaoZ made their first contribution in #​5110
• @​cooperlees made their first contribution in #​5128
• @​Sanjays2402 made their first contribution in #​5130
• @​jmpalacios made their first contribution in #​5143

Full Changelog: ansible/ansible-lint@v26.6.0...v26.8.0

bridgecrewio/checkov (bridgecrewio/checkov)

v3.3.22

Compare Source

v3.3.21

Compare Source

Bug Fix

• terraform_json: handle HCL JSON array and single-dict block formats in parser - #​7707

v3.3.20

Compare Source

Bug Fix

• terraform_plan: skip resources being removed from state ('forget' action) - #​7676

v3.3.19

Compare Source

Feature

• terraform: add CKV_AWS_394 for unconstrained aws_availability_zones data source - #​7658

v3.3.18

Compare Source

v3.3.17

Compare Source

Bug Fix

• general: honour scope.provider for platform-downloaded custom po… - #​7677

v3.3.16

Compare Source

Bug Fix

• terraform: Added current Azure Terraform resources and taggable resources as of hashicorp/azurerm provider version 4.81 - #​7652

v3.3.15

Compare Source

Bug Fix

• sca: match CVE suppressions case-insensitively - #​7659
• sca: match CvesAccounts suppressions on unprefixed account ids - #​7660

v3.3.14

Compare Source

v3.3.13

Compare Source

Bug Fix

• kubernetes: Fix K8S suppressions annotations - #​7651

v3.3.12

Compare Source

Bug Fix

• sca: correct Windows path handling in image referencer - #​7650

v3.3.11

Compare Source

v3.3.10

Compare Source

rbubley/mirrors-prettier (rbubley/mirrors-prettier)

v3.9.9

Compare Source

v3.9.8

Compare Source

v3.9.7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.