zizmor: baixar versions anteriors

Sponsorship is appreciated!
Bug Fixes 🐛🔗
- Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Sponsorship is appreciated!
Enhancements 🌱🔗
- The typosquat-uses audit now supports pre-commit config inputs (#2437)
- The self-hosted-runner audit is now significantly more precise (#2350)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
- The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)
- zizmor is now aware of the image_version workflow trigger (#2397)
- The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)
- The cache-poisoning audit is now aware of pnpm/setup (#2409)
- The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)
Many thanks to @ubiratansoares for proposing and implementing this enhancement!
- The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)
- The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)
- zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗
- Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)
Many thanks to @marcalexiei for implementing this improvement!
- Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)
- Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)
- Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)
- Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Sponsorship is appreciated!
Bug Fixes 🐛🔗
- Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)
- Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Sponsorship is appreciated!
New Features 🌈🔗
- New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
Enhancements 🌱🔗
- The impostor-commit audit now supports pre-commit config inputs (#2256)
- The forbidden-uses audit now supports pre-commit config inputs (#2263)
- The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add
Many thanks to @connorshea for proposing and implementing this enhancement!
- The archived-uses audit now supports pre-commit config inputs (#2272)
- The ref-confusion audit now supports pre-commit config inputs (#2274)
- The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)
- The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)
- zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)
Many thanks to @njgudman for proposing and implementing this enhancement!
- The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)
- The unpinned-tools audit now detects usages of extractions/setup-just (#2339)
- The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)
- The archived-uses audit now detects several more archived repositories (#2340)
- The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)
- The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗
- Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)
- Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)
- Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)
- Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)
- Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)
Many thanks to @dmbuil for proposing and implementing this improvement!
- Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)
- Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)
- Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)
- Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)
Many thanks to @potiuk for proposing and implementing this improvement!
- Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)

New Features 🌈🔗
- zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
- New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
- zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗
- The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗
- --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗
- Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
- Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
- Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Security 🔒🔗
- v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.
Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗
- The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)
- The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)
- sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗
- Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#2199)
- Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)
- Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

New Features 🌈🔗
- zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)
Enhancements 🌱🔗
- zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)
- zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗
- Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)
- Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)
- Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

This is a small corrective release for 1.26.0.

New Features 🌈🔗
- New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)
Many thanks to @andrew for proposing and implementing this improvement!
- New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)
Many thanks to @terror for proposing and implementing this improvement!
- New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)
Many thanks to @connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗
- The cache-poisoning audit now detects additional cache disablement heuristics (#2053)
- The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)
- The excessive-permissions audit is now aware of the code-quality permission (#2088)
- The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @v6) (#2127)

Performance Improvements 🚄🔗
- Most online audits are significantly faster, thanks to more precise retry handling (#2036)
Bug Fixes 🐛🔗
- Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)
Many thanks to @fionn for implementing this fix!
- Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)
- Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)
- Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)
- Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)
- Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)
- Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)
- The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748, #2095)

Changes ⚠️🔗
- The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#2054)
- The JSON and SARIF outputs no longer contain a misleading prefix key (#2095)

Bug Fixes 🐛🔗
- Fixed a bug where the unpinned-tools audit would incorrectly flag the aquasecurity/trivy-action action as installing an unpinned tool version, rather than aquasecurity/setup-trivy (#2018)

Bug Fixes 🐛🔗
- Fixed a bug where the cache-poisoning audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#2004)
- Fixed a typo when suggesting --fix flags for findings (#2010)
Many thanks to @0xdea for implementing this fix!
- Fixed a typo in unpinned-tools annotations (#2008)
Many thanks to @martincostello for implementing this fix!
- Fixed a bug where the github-app audit would incorrectly flag some safe uses of actions/create-github-app-token as unsafe (#2011)

New Features 🌈🔗
- zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#1913)
Many thanks to @Proximyst for proposing and implementing this improvement!
- New audit: github-app detects dangerous usages of GitHub App installation tokens (#1926)
- New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#1820)
- zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#1935)
- zizmor's LSP now honors the --persona flag on the CLI (#1943)
- zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#1965)

Enhancements🔗
- Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions
- Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions
- Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions
- Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions
- Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions
- tibdex/github-app-token is now recognized as an archived action by archived-uses (#1910)
- The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#1956)
- The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#1965)
- zizmor's SARIF output now provides slightly more detailed finding messages (#1972)
- The archived-uses audit now detects more archived actions (#1978)
- deno is now recognized as a package-ecosystem in dependabot.yml (#1991)

Performance Improvements 🚄🔗
- The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#1998)
Bug Fixes 🐛🔗
- Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#1904)
- Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#1909)
- Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#1944)
- Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#1945)
- Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#1946)
- Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#1962)
- Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#1940)
Many thanks to @reubenwong97 for implementing this fix!
- Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#1976)
- Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#1980)
- Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#1998)

Bug Fixes 🐛🔗
- Fixed a bug where the ref-version-mismatch audit would incorrectly flag some version comments as not containing an appropriate version (#1900)

New Features 🌈🔗
- zizmor now allows users to audit from stdin, by passing zizmor - (#1611)

Enhancements 🌱🔗
- The use-trusted-publishing audit now detects bun publish and bunx npm publish patterns (#1737)
Many thanks to @shaanmajid for proposing and implementing this improvement!
- zizmor's CLI help and usage output now uses a custom color scheme for improved readability (#1747)
- The secrets-outside-env audit is now configurable with an allowlist of secret names that should not be flagged, even when referenced outside of an environment (#1759)
Many thanks to @rmuir for proposing and implementing this improvement!
- The dependabot-cooldown audit now emits a pedantic finding whenever it encounters a cooldown used with a multi-ecosystem-group, as the two do not interact well (#1780)
- Recommend gh release upload as a replacement for svenstaro/upload-release-action in superfluous-actions (#1801)
- Recommend gh issue create as a replacement for dacbd/create-issue-action in superfluous-actions (#1873)
- The obfuscation audit now emits a finding for with: ${{ expr }} clauses cannot be analyzed (#1772)
- zizmor --help is now rendered with option groups for improved readability (#1831)
Many thanks to @deckstose for implementing this improvement!
- zizmor's SARIF output now uses codeflows instead of related locations, improving its rendering behavior on GitHub Advanced Security (#1843)
- The ref-version-mismatch audit now uses a more useful audit description for its findings (#1843)
- The unpinned-images audit now produces more precise findings for image references that are computed through expressions (#1756)
Many thanks to @miketheman for implementing this improvement!
- The ref-version-mismatch audit now detects missing version comments as well (#1849)
Many thanks to @shaanmajid for proposing and implementing this improvement!

Bug Fixes 🐛🔗
- Fixed a bug where the concurrency-limits audit reported findings at the job level instead of the workflow level (#1627)
- Fixed a bug where with: ${{ expr }} clauses would cause a crash. artipacked audit emits a pedantic finding on such clauses. (#1772)
- Fixed a bug where auto-fixes for the template-injection audit would fail to preserve an environment variable's casing (#1766)
- Fixed a bug where the secrets-outside-env audit would incorrectly flag reusable workflows (#1777)
- Fixed a bug where expressions containing Infinity or NaN would fail to parse (#1778)
- Fixed several bugs where some parenthetical forms in expressions would fail to parse (#1779, #1856)
- Fixed a bug where expressions with invalid identifiers (such as -Inf) would be incorrectly accepted (#1794)
- Fixed a bug where the known-vulnerable-actions audit would fail to handle multiple discrete packages in a single advisory (#1810)
- Fixed a bug where the template-injection audit would incorrectly flag needs.*.result as an injection risk in the default persona (#1814)
- Fixed a bug where the unpinned-uses audit would product incorrect auto-fixes for actions with subpaths (#1841)
- Fixed a bug where the ref-version-mismatch audit would fail to produce findings for comments containing nonexistent refs (#1853)
- Fixed a bug where expressions containing NaN would be constant-evaluated incorrectly (#1858)
- Fixed a bug where nix would not be recognized as a package-ecosystem in dependabot.yml (#1867)
- Fixed a bug where the ref-version-mismatch audit would incorrectly parse prerelease version comments (such as # v6-beta), causing some findings to appear unresolvable (#1870)
- Fixed a bug where various string comparisons in expressions did not perfectly match GitHub's own special uppercasing semantics (#1879)
- Fixed a bug where zizmor would incorrectly contact github.com instead of the user's requested --gh-hostname for some online requests (#1874)
- Fixed a bug where the artipacked audit would fail to honor the --no-online-audits flag (#1874)

Changes ⚠️🔗
- The secrets-outside-env audit now only flags findings with the 'aud

Bug Fixes 🐛🔗
- Fixed a bug where zizmor would error if given both a GH_TOKEN and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the environment (#1724)

New Features 🌈🔗
- New audit: secrets-outside-env detects usage of the secrets context in jobs that don't have a corresponding environment (#1599)
- New audit: superfluous-actions detects usage of actions that perform operations already provided by GitHub's own runner images (#1618)
Enhancements 🌱🔗
- zizmor's LSP mode is now configuration-aware, and will load configuration files relative to workspace roots (#1555)
- zizmor now reads the GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN (#1566)
- zizmor now supports inputs that contain duplicated anchor names (#1575)
- zizmor now flags missing cooldowns on opentofu ecosystem definitions in Dependabot (again) (#1586)
- zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
- The SARIF output format now adds zizmor/confidence, zizmor/persona and zizmor/severity to the properties of findings (#1656)
- Added awalsh128/cache-apt-pkgs-action as a cache-aware action to the cache-poisoning audit (#1708)
Changes ⚠️🔗
- SARIF categories have been regraded. zizmor's "medium" is changed from SARIF's "warning" to "low" (#1635)
Bug Fixes 🐛🔗
- Fixed a bug where zizmor would crash on uses: clauses containing non-significant whitespace while performing the unpinned-uses audit (#1544)
- Fixed a bug in yamlpath where sequences containing anchors were splatted instead of being properly nested (#1557)
Many thanks to @DarkaMaul for implementing this fix!
- Fixed a bug in yamlpath where anchor prefixes in sequences and mapping were not stripped during path queries (#1562)
- Fixed a bug where "merge into" autofixes would produce incorrect patches in the presence of multi-byte Unicode characters (#1581)
Many thanks to @ManuelLerchnerQC for implementing this fix!
- Fixed a bug where the template-injection audit would produce duplicated pedantic-only findings (#1589)
- Fixed a bug where the obfuscation audit would produce incorrect autofixes for a subset of constant-reducible expressions (#1597)
- Fixed a bug where the obfuscation audit would fail to apply fixes to a subset of inputs with leading whitespace (#1597)
- Fixed a bug where the concurrency-limits audit would incorrectly flag reusable-only workflows as needing a concurrency: key (#1620)
- Fixed a bug where the known-vulnerable-actions audit would fail when applying some fixes (#1640)
Many thanks to @reubenwong97 for implementing this fix!
- Fixed a bug where the pre-commit ecosystem was not recognized in Dependabot configuration files (#1637)
- Fixed a bug where the template-injection audit would incorrectly flag github.triggering_actor as an injection risk in the default persona (#1645)
- Fixed a bug where zizmor's expression parser did not correctly handle number literals in GitHub Actions expressions (#1625)
- Fixed a bug where the template-injection audit would crash on some forms of multi-line expressions (#1669)
- Fixed a bug where deserialization of a workflow containing fractional minutes would fail (#1675)
- Fixed a bug where deserialization of a workflow where a workflow_run with a scalar types would fail (#1676)
- Fixed a bug where zizmor would crash on workflows containing bare numeric values in if: conditions (#1683)
- Fixed a bug where GitHub Actions expression string comparisons were not case-insensitive (#1687)

Changes ⚠️🔗
- The misfeature audit now only shows non-"well known" #!/yaml shell: findings when running with the "auditor" persona (#1532)
Bug Fixes 🐛🔗
- Fixed a bug where inputs containing CRLF line endings were not patched correctly by the unpinned-uses audit (#1536)

New Features 🌈🔗
- New audit: misfeature detects usage of GitHub Actions features that are considered "misfeatures." (#1517)
Enhancements 🌱🔗
- zizmor now uses exit code 3 to signal an audit that has failed because no input files were collected. See the exit code documentation for details (#1515)
- The unpinned-uses audit now supports auto-fixes for many findings (#1525)
Changes ⚠️🔗
- The obfuscation audit no longer flags shell: cmd. That check has been moved to the new misfeature audit. Users may need to update their ignore comments and/or configuration (#1517)
Bug Fixes 🐛🔗
- The unpinned-uses audit now flags reusable workflows that are unpinned, in addition to actions (#1509)
Many thanks to @johnbillion for implementing this fix!

Enhancements 🌱🔗
- The excessive-permissions audit is now aware of the artifact-metadata and models permissions (#1461)
- The cache-poisoning audit is now aware of the ramsey/composer-install action (#1489)
- The unpinned-images audit is now significantly more precise in the presence of matrix references, e.g. image: ${{ matrix.image }} (#1482)
Changes ⚠️🔗
- The default policy for the unpinned-uses audit has changed from allowing ref-pinning for first-party actions (those under actions/* and similar) to requiring hash-pinning. This makes the default policy more strict, as well as more consistent across the actions ecosystem.
Users who with to retain the old (permissive policy) for first-party actions may configure it explicitly in their zizmor.yml:
zizmor.yml
rules:
unpinned-uses:
config:
policies:
actions/*: ref-pin
github/*: ref-pin
dependabot/*: ref-pin
Bug Fixes 🐛🔗
- The dependabot-cooldown audit no longer flags missing cooldowns on ecosystems that don't (yet) support cooldowns, such as opentofu (#1480)
- Fixed a false positive in the cache-poisoning audit where zizmor would treat empty strings (e.g. cache: '') as enabling rather than disabling caching (#1482)
- Fixed two gaps in the use-trusted-publishing audit's detection of common yarn publishing commands (#1495)
Miscellaneous 🛠🔗
- zizmor's configuration now has an official JSON schema that will be available via SchemaStore soon!
Many thanks to @kiwamizamurai for implementing this improvement!

New Features 🌈🔗
- New audit: archived-uses detects usages of archived repositories in uses: clauses (#1411)
Enhancements 🌱🔗
- The use-trusted-publishing audit now detects additional publishing command patterns, including common "wrapped" patterns like bundle exec gem publish (#1394)
- zizmor now produces better error messages on a handful of error cases involving invalid input files. Specifically, a subset of syntax and schema errors now produce more detailed and actionable error messages (#1396)
- The use-trusted-publishing audit now detects additional publishing command patterns, including uv run ..., uvx ..., and poetry publish (#1402)
- zizmor now produces more useful and less ambiguous spans for many findings, particularly those from the anonymous-definition audit (#1416)
- zizmor now discovers configuration files named zizmor.yaml, in addition to zizmor.yml (#1431)
- zizmor now produces a more useful error message when input collection yields no inputs (#1439)
- The --render-links flag now allows users to control zizmor's OSC 8 terminal link rendering behavior. This is particularly useful in environments that advertise themselves as terminals but fail to correctly render or ignore OSC 8 links (#1454)
Performance Improvements 🚄🔗
- The [impostor-commit] audit is now significantly faster on true positives, making true positive detection virtually as fast as true negative detection. In practice, true positive runs are over 100 times faster than before (#1429)
Bug Fixes 🐛🔗
- Fixed a bug where the obfuscation audit would crash if it encountered a CMD shell that was defined outside of the current step block (i.e. as a job or workflow default) (#1418)
- Fixed a bug where the opentofu ecosystem was not recognized in Dependabot configuration files (#1452)
- --color=always no longer implies --render-links=always, as some environments (like GitHub Actions) support ANSI color codes but fail to handle OSC escapes gracefully (#1454)