[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps https://github.com/zizmorcore/zizmor-pre-commit from v1.30.1 to 1.31.1. This release includes the previously tagged commit.

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Commits

• c92afdf Mirror: 1.31.1
• d25b2b1 Mirror: 1.31.0
• 04df6d7 chore: drop Python 3.10 support (EOL) (#65)
• fe0957c Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#64)
• de807da Bump the github-actions group with 2 updates (#63)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pullfrog]

ℹ️ No defects in the diff — one follow-up to track so the zizmor pins don't stay split.

Reviewed changes

Reviewed the single-line pin bump in the Bun web pre-commit template against its upstream release.

• templates/pre-commit/bun-web/.pre-commit-config.yaml — zizmorcore/zizmor-pre-commit moves from fa41207… (v1.30.1) to c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f (v1.31.1). The new SHA matches the Mirror: 1.31.1 commit listed in the PR body, and the # frozen: comment is consistent with design/prek.md rule 4.4.

ℹ️ zizmor pin is now split across templates and design/prek.md still records 1.30.1

Merging this alone leaves bun-web on v1.31.1 while the root .pre-commit-config.yaml and the content, homebrew, python, rust, shell, special and zig templates stay on v1.30.1. design/prek.md also records zizmor 1.30.1 as the verified tool version. The pre-commit Dependabot entry lists / and /templates/pre-commit/* as separate directories, so sibling PRs should follow. Until they land, the templates don't agree.

Technical details

# zizmor pin drift after a per-directory Dependabot bump

## Affected sites
- `.pre-commit-config.yaml:48` — still `fa412071…  # frozen: v1.30.1`
- `templates/pre-commit/{content,homebrew,python,rust,shell,special,zig}/.pre-commit-config.yaml:43` (`content` at `:49`) — still `v1.30.1`
- `design/prek.md:31` — `Tools [V, 2026-10-08] … zizmor 1.30.1`

## Required outcome
- All zizmor pins end on the same release, and the `Tools` line in `design/prek.md` reflects the version actually verified.
- `prek-A2` (zizmor still accepts `queue` and the `bot-conditions` and `dependabot-cooldown` suppressions on a linter bump) is checked against 1.31.1 before the `Tools` line is changed. 1.31.0 touched the `dangerous-triggers` audit, so the root repo's own workflows are the first thing to re-run.

## Open questions for the human
- Merge each sibling PR as it arrives, or hold this one until the others are green so the `Tools` line moves once?

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}