[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps https://github.com/zizmorcore/zizmor-pre-commit from v1.30.1 to 1.31.1. This release includes the previously tagged commit.

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Commits

• c92afdf Mirror: 1.31.1
• d25b2b1 Mirror: 1.31.0
• 04df6d7 chore: drop Python 3.10 support (EOL) (#65)
• fe0957c Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#64)
• de807da Bump the github-actions group with 2 updates (#63)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pullfrog]

ℹ️ No critical issues — one docs line goes stale.

Reviewed changes

Reviewed the single-file Dependabot bump of the zizmor pre-commit hook.

• .pre-commit-config.yaml: moves the zizmorcore/zizmor-pre-commit pin from v1.30.1 to v1.31.1, keeping the full-SHA rev: plus # frozen: comment form. Upstream's only 1.31.1 note is a fix for a 1.31.0 regression where some ignore comments no longer applied to dangerous-triggers. This repo's suppressions are bot-conditions and dependabot-cooldown, so the regression doesn't touch them. I couldn't run zizmor 1.31.1 here to confirm it adds no new findings on the workflows, so CI is the check.

ℹ️ design/prek.md tool versions go stale

design/prek.md:31 records zizmor 1.30.1 as the verified version, and that line isn't in this diff. No test asserts it, so it will disagree with the config once this merges.

Technical details

# Stale zizmor version in design/prek.md

## Affected sites
- design/prek.md:31 — `Tools [V, 2026-10-08]: prek 0.5.5, actionlint 1.7.12, zizmor 1.30.1.` no longer matches `.pre-commit-config.yaml:48` (`v1.31.1`).

## Required outcome
- The Tools line names zizmor 1.31.1 with a `[V]` date no later than the `STATE.md` `Last updated` stamp, or the PR notes that the owner will update it.

## Open questions for the human (optional)
- The eight `templates/pre-commit/<stack>/.pre-commit-config.yaml` files (bun-web, content, homebrew, python, rust, shell, special, zig) still pin `v1.30.1`. Dependabot bumps one directory per PR, so they lag by design. `AGENTS.md` asks for step-end tool version checks, so the Tools line may belong to whichever PR bumps the templates.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}