mirrors/zizmor
1
0
Fork 0
mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

feat: new audit: dependabot-cooldown (#1223)
Some checks failed
CI / Test site build (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Build source distribution (push) Has been cancelled
Details
CI / Test (push) Has been cancelled
Details
Benchmark baseline / Continuous Benchmarking with Bencher (push) Has been cancelled
Details
CI / Lint (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Build Linux wheels (manylinux) (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Build macOS wheels (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Build Linux wheels (musllinux) (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Build Windows wheels (push) Has been cancelled
Details
Deploy zizmor documentation site 🌐 / Deploy zizmor documentation to GitHub Pages 🌐 (push) Has been cancelled
Details
GitHub Actions Security Analysis with zizmor 🌈 / Run zizmor 🌈 (push) Has been cancelled
Details
CI / All tests pass (push) Has been cancelled
Details
zizmor wheel builds for PyPI 🐍 / Release (push) Has been cancelled
Details

Browse source
This commit is contained in:
William Woodruff 2025-10-07 21:02:24 -04:00 • committed by GitHub
parent 62655cb7c1
commit 76c1b19008
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
13 changed files with 292 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/release-notes.md
View file

@ -9,6 +9,24 @@ of `zizmor`.
## Next (UNRELEASED)
This release comes with support for auditing
[Dependabot](https://docs.github.com/en/code-security/dependabot) configuration
files! Like with composite action definition auditing (introduced in
[v1.0.0](#v100)), Dependabot configuration auditing is **enabled by default**
but can be disabled as part of input collection.
To complement this new functionality, this release comes with two new audits:
[dependabot-execution] and [dependabot-cooldown].
### New Features 🌈
* **New audit**: [dependabot-execution] detects Dependabot configurations
that allow insecure external code execution (#1220)
* **New audit**: [dependabot-cooldown] detects Dependabot configurations
that do not include cooldown settings, or that set an insufficient
cooldown (#1223)
### Performance Improvements 🚄
* `zizmor` now uses `jemalloc` as its default allocator on non-MSVC targets,
@ -33,6 +51,9 @@ of `zizmor`.
* `zizmor` is now more resilient to sporadic request failures when performing
GitHub API requests (#1219)
* `--collect=dependabot-only` is now supported as a collection option,
allowing users to audit only Dependabot configuration files (#1215)
### Bug Fixes 🐛
* Fixed a bug where `zizmor` would fail instead of analyzing single-file
@ -1109,3 +1130,5 @@ This is one of `zizmor`'s bigger recent releases! Key enhancements include:
[known-vulnerable-actions]: ./audits.md#known-vulnerable-actions
[undocumented-permissions]: ./audits.md#undocumented-permissions
[ref-version-mismatch]: ./audits.md#ref-version-mismatch
[dependabot-execution]: ./audits.md#dependabot-execution
[dependabot-cooldown]: ./audits.md#dependabot-cooldown