[dependabot]

Bumps https://github.com/zizmorcore/zizmor-pre-commit from v1.30.1 to 1.31.1. This release includes the previously tagged commit.

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Commits

• c92afdf Mirror: 1.31.1
• d25b2b1 Mirror: 1.31.0
• 04df6d7 chore: drop Python 3.10 support (EOL) (#65)
• fe0957c Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#64)
• de807da Bump the github-actions group with 2 updates (#63)
• See full diff in compare view

[pullfrog]

ℹ️ No critical issues — the bump itself is clean; one follow-up note on the version line in the design doc.

Reviewed changes

Reviewed the single-file Dependabot bump of the zizmor pre-commit pin.

• zizmor-pre-commit pin — templates/pre-commit/content/.pre-commit-config.yaml moves from frozen v1.30.1 to v1.31.1 (c92afdf…, the upstream "Mirror: 1.31.1" commit). The frozen-SHA plus # frozen: vX.Y.Z comment format matches design/prek.md rule 4.4. The release only fixes a 1.31.0 regression in dangerous-triggers ignore handling.

ℹ️ design/prek.md still records zizmor 1.30.1

design/prek.md:31 says Tools [V, 2026-10-08]: … zizmor 1.30.1. This PR moves the Content baseline to 1.31.1, but the other seven templates/pre-commit/* configs and the root .pre-commit-config.yaml still pin v1.30.1. Dependabot's /templates/pre-commit/* entry should open a PR per directory, so the templates will likely converge on their own. Until then the line is true only for the pins that haven't moved. Nothing in tools/ asserts the version, so no test or guard will catch the drift.

Technical details

# Keep the zizmor version line in step with the pins

## Affected sites
- `design/prek.md:31` — `zizmor 1.30.1` with a `[V, 2026-10-08]` tag.
- `templates/pre-commit/{bun-web,homebrew,python,rust,shell,special,zig}/.pre-commit-config.yaml` and root `.pre-commit-config.yaml` — still `# frozen: v1.30.1`.

## Required outcome
- Once all pins have moved to 1.31.1, the Tools line reads `zizmor 1.31.1` with a fresh `[V, date]` tag (and the version matches what `prek` actually runs).
- Don't merge a partial state as final: if the sibling Dependabot PRs aren't merged together, the Content baseline and the other templates diverge in zizmor version.

## Open questions for the human
- Whether to land this PR alone (Dependabot auto-merge) and fix the doc line when the last pin moves, or hold until the sibling PRs are open. I couldn't check for sibling PRs from this checkout.

Nitpicks

• The .pre-commit-config.yaml change itself is correct. I couldn't verify from the checkout that c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f is the commit tagged v1.31.1 upstream; the PR body's compare link and commit list name it as "Mirror: 1.31.1".

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}

[pullfrog]

ℹ️ No critical issues — the pin bump is clean; the one earlier note on design/prek.md still applies.

Reviewed changes

Reviewed the delta since the prior pullfrog review (a34975f). The new head is a rebase onto current main, and the PR diff is unchanged.

• zizmor-pre-commit pin — templates/pre-commit/content/.pre-commit-config.yaml:49 still moves from frozen v1.30.1 to v1.31.1 (c92afdf…). The frozen-SHA plus # frozen: vX.Y.Z format is intact.

ℹ️ design/prek.md will record zizmor 1.30.1 after every pin has moved

main now pins v1.31.1 in the root .pre-commit-config.yaml and in the bun-web, homebrew, python, rust, shell, special and zig template configs. This PR moves the last one, content. After it merges, no config pins 1.30.1, but design/prek.md:31 still says Tools [V, 2026-10-08]: … zizmor 1.30.1. No test or guard checks that line, so nothing will flag it.

Technical details

# Update the zizmor version in the prek Tools line

## Affected sites
- `design/prek.md:31` — `zizmor 1.30.1` under a `[V, 2026-10-08]` tag; every `.pre-commit-config.yaml` in the repo will pin `v1.31.1` once this PR merges.

## Required outcome
- The Tools line reads `zizmor 1.31.1` with a fresh `[V, date]` tag, either in this PR or in a follow-up. `STATE.md` `Last updated` must stay at or past that date.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}