[renovate-rancher]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go	uses-with	minor	1.26 → 1.27	1.27.3
rancher/renovate-config	action	digest	e79860b → a9a7bf7
updatecli/updatecli-action	action	minor	v3.6.0 → v3.9.0	v3.10.0
zizmorcore/zizmor-action	action	minor	v0.6.3 → v0.7.1	v0.8.0

---

Release Notes

actions/go-versions (go)

v1.27.2: 1.27.2

Compare Source

Go 1.27.2

v1.27.1: 1.27.1

Compare Source

Go 1.27.1

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

updatecli/updatecli-action (updatecli/updatecli-action)

v3.9.0: 🌈

Compare Source

Changes

• Bump "eslint" package version @​updateclibot[bot] (#​1053)
• deps(github/action): bump all dependencies @​updateclibot[bot] (#​1203)
• deps: update updatecli version to v0.122.1 @​updateclibot[bot] (#​1204)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1202)
• deps(github/action): bump all dependencies @​updateclibot[bot] (#​1174)

🚀 Features

• feat: Various improvements @​olblak (#​1208)

🧰 Maintenance

• deps: bump Updatecli GH action to v0.122.1 @​updateclibot[bot] (#​1205)
• install Updatecli gha workflows v0.122.1 @​updateclibot[bot] (#​1207)

Contributors

@​olblak, @​updateclibot[bot] and updateclibot

v3.8.0: 🌈

Compare Source

Changes

• deps: update updatecli version to v0.122.0 @​updateclibot[bot] (#​1197)
• Bump "jest" package version @​updateclibot[bot] (#​1195)
• Bump "js-yaml" package version @​updateclibot[bot] (#​1196)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1194)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1191)

🧰 Maintenance

• deps: bump Updatecli GH action to v0.122.0 @​updateclibot[bot] (#​1198)
• install Updatecli gha workflows v0.122.0 @​updateclibot[bot] (#​1199)
• install Updatecli gha workflows v0.121.0 @​updateclibot[bot] (#​1193)

Contributors

@​updateclibot[bot] and updateclibot

v3.7.0: 🌈

Compare Source

Changes

• doc: update documentation @​olblak (#​1167)
• deps: update updatecli version to v0.121.0 @​updateclibot[bot] (#​1185)
• deps(updatecli/policies): bump all policies @​updateclibot[bot] (#​1169)
• Bump "jest" package version @​updateclibot[bot] (#​1181)
• Bump "eslint-plugin-jest" package version @​updateclibot[bot] (#​1180)
• Bump "eslint-plugin-jest" package version @​updateclibot[bot] (#​1171)
• Bump "js-yaml" package version @​updateclibot[bot] (#​1172)
• Bump "jest" package version @​updateclibot[bot] (#​1173)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1170)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1162)
• Bump "eslint-plugin-jest" package version @​updateclibot[bot] (#​1163)
• Bump "js-yaml" package version @​updateclibot[bot] (#​1164)
• chore: configure Updatecli workflows in YAML filec @​olblak (#​1161)
• Bump "eslint-plugin-jest" package version @​updateclibot[bot] (#​1159)
• Bump "js-yaml" package version @​updateclibot[bot] (#​1160)
• Bump "@​types/node" package version @​updateclibot[bot] (#​1158)

🧰 Maintenance

• deps: bump Updatecli GH action to v0.121.0 @​updateclibot[bot] (#​1186)
• install Updatecli gha workflows v0.120.1 @​updateclibot[bot] (#​1166)

Contributors

@​olblak, @​updateclibot[bot] and updateclibot

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in #​178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

• Bootstrap zizmor without Docker by @​potiuk in #​169
• Bump sync-zizmor-versions.py to Python 3.11 for locking by @​woodruffw in #​174
• Sync zizmor versions by @​github-actions[bot] in #​175

New Contributors

• @​potiuk made their first contribution in #​169

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

v0.6.4

Compare Source

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1301

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.