[dependabot]

Bumps the pre-commit group with 4 updates in the / directory: https://github.com/biomejs/pre-commit, https://github.com/tox-dev/pyproject-fmt, https://github.com/astral-sh/ruff-pre-commit and https://github.com/zizmorcore/zizmor-pre-commit.

Updates https://github.com/biomejs/pre-commit from v2.5.10 to 2.6.3

Commits

• f9fccc9 build(deps): bump @​biomejs/biome to 2.6.3
• 940b640 feat: support markdown and yaml files by default (#134)
• c5c4e2d feat: support markdown and yaml files by default
• 68410eb build(deps): bump @​biomejs/biome to 2.6.2 (#133)
• f323c67 chore(deps): update actions/checkout action to v7 (#114)
• 09d0793 chore(deps): update actions/setup-node action to v7 (#119)
• 7d068e1 chore(deps): update dependabot/fetch-metadata action to v3 (#104)
• fde23ed build(deps): bump @​biomejs/biome to 2.5.15 (#132)
• 5090c1e build(deps): bump @​biomejs/biome to 2.5.15
• 15e565d build(deps): bump @​biomejs/biome to 2.5.14 (#130)
• Additional commits viewable in compare view

Updates https://github.com/tox-dev/pyproject-fmt from v2.28.1 to 2.30.3

Release notes

Sourced from https://github.com/tox-dev/pyproject-fmt's releases.

v2.30.3

What's Changed

• feat(python): default to Python 3.15 by @​gaborbernat in tox-dev/pyproject-fmt#369

Full Changelog: tox-dev/pyproject-fmt@v2.30.2...v2.30.3

v2.30.2

Full Changelog: tox-dev/pyproject-fmt@v2.30.1...v2.30.2

v2.30.1

What's Changed

• 👷 ci: pin ubuntu-26.04 and bump dependencies by @​gaborbernat in tox-dev/pyproject-fmt#368

Full Changelog: tox-dev/pyproject-fmt@v2.30.0...v2.30.1

v2.30.0

Full Changelog: tox-dev/pyproject-fmt@v2.29.4...v2.30.0

v2.29.4

Full Changelog: tox-dev/pyproject-fmt@v2.29.3...v2.29.4

v2.29.3

Full Changelog: tox-dev/pyproject-fmt@v2.29.2...v2.29.3

v2.29.2

... (truncated)

Commits

• 50e0f3a Mirror: 2.30.3
• 9c26649 Mirror: 2.30.3
• 5607d09 feat(python): default to Python 3.15 (#369)
• a50cac6 Mirror: 2.30.2
• 5985c25 Mirror: 2.30.2
• a72ae8e Mirror: 2.30.1
• 89380d9 Mirror: 2.30.1
• 90994db 👷 ci: pin ubuntu-26.04 and bump dependencies (#368)
• 831e544 Mirror: 2.30.0
• dd522cc Mirror: 2.30.0
• Additional commits viewable in compare view

Updates https://github.com/astral-sh/ruff-pre-commit from v0.16.4 to 0.17.3

Release notes

Sourced from https://github.com/astral-sh/ruff-pre-commit's releases.

v0.17.3

See: https://github.com/astral-sh/ruff/releases/tag/0.17.3

v0.17.2

See: https://github.com/astral-sh/ruff/releases/tag/0.17.2

v0.17.1

See: https://github.com/astral-sh/ruff/releases/tag/0.17.1

v0.17.0

See: https://github.com/astral-sh/ruff/releases/tag/0.17.0

v0.16.10

See: https://github.com/astral-sh/ruff/releases/tag/0.16.10

v0.16.9

See: https://github.com/astral-sh/ruff/releases/tag/0.16.9

v0.16.8

See: https://github.com/astral-sh/ruff/releases/tag/0.16.8

v0.16.7

See: https://github.com/astral-sh/ruff/releases/tag/0.16.7

v0.16.6

See: https://github.com/astral-sh/ruff/releases/tag/0.16.6

v0.16.5

See: https://github.com/astral-sh/ruff/releases/tag/0.16.5

Commits

• 25bcf95 Mirror: 0.17.3
• f368fb3 Mirror: 0.17.2
• 65a0c46 Use patched certifi bundle for release mirroring (#189)
• 0919ea4 Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-actions group (#188)
• 38bfb07 Mirror: 0.17.1
• 44b5042 Mirror: 0.17.0
• e2053c9 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#184)
• f12be1e Mirror: 0.16.10
• 6089d41 Document adding quarto to types_or for Quarto code fence formatting (#183)
• a56c0b9 Mirror: 0.16.9
• Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.29.0 to 1.31.1

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

... (truncated)

Commits

• c92afdf Mirror: 1.31.1
• d25b2b1 Mirror: 1.31.0
• 04df6d7 chore: drop Python 3.10 support (EOL) (#65)
• fe0957c Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group (#64)
• de807da Bump the github-actions group with 2 updates (#63)
• fa41207 Mirror: 1.30.1
• 7361a0b fix: include pre-commit files in hook (#59)
• 34c5ce3 Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 in the github-actions group...
• cef8b83 Mirror: 1.30.0
• 2e74fc1 Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the github-actions group (#61)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.43%. Comparing base (f1e74ce) to head (b61ac2f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1245   +/-   ##
=======================================
  Coverage   91.43%   91.43%           
=======================================
  Files          53       53           
  Lines        8395     8395           
=======================================
  Hits         7676     7676           
  Misses        719      719           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ajkswamy]

LGTM