Update mise tools

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
chezmoi	tools	minor	2.71.1 → 2.72.0
hk	tools	patch	1.54.0 → 1.54.1
hk-pkl		patch	1.54.0 → 1.54.1
zizmor	tools	minor	1.28.0 → 1.29.0

---

Release Notes

twpayne/chezmoi (chezmoi)

v2.72.0

Compare Source

Changelog

Features

• f81cb32 feat: Fix multiple security vulns thanks to secur0.com
• 1e51cc5 feat: Add shellQuote and shellQuoteList template funcs
• 4249f4f feat: Add gopassCat template function
• a7d91a5 feat: Add debugf template function

Fixes

• 0ad679a fix: Tighten permissions on temporary files
• 4031be1 fix: Ensure HTTP cache dir is private
• ba5a19a fix: Disallow relative paths with /.. suffix
• 1fe7627 fix: Disallow .. in ignore and remove patterns
• 3c9e70b fix: Disallow .. paths in mackup files
• 01b60dd fix: Disallow filenames that resolve to .
• 5cdaf4e fix: Improve handling of untrusted relative paths
• e8a57dc fix: Disallow .. paths in .chezmoiroot
• 76e2ddf fix: Reject negative format-indent-width template directives
• 840f682 fix: Ensure that secret keyring get command always writes a private file
• f7282b8 fix: Ensure that age-keygen always writes a private file
• e7cbe71 fix: Make persistent state directory private by default
• 0d6fc2b fix: Prevent directory escape in tar and rar archives
• 239cc6b fix: Disallow file and dir names that resolve to ..

Documentation

• a331111 docs: Use more robust quoting functions in examples
• 80441a5 docs: Add link to article
• 6cd634d docs: Add link to article

jdx/hk (hk)

v1.54.1

Compare Source

🐛 Bug Fixes

• (builtins) detect extensionless python scripts with ruff by @​jdx in #​1147
• (config) report min_hk_version errors without panicking by @​smasato in #​1143
• (conventional-commit) allow fixup!, squash!, and amend! commit prefixes by @​smasato in #​1142
• (hook) suggest serialization for git index lock failures by @​jdx in #​1140
• (stash) preserve unstaged fixer output by @​jdx in #​1145

🔍 Other Changes

• run perf jobs on bamboo by @​jdx in #​1148

📦️ Dependency Updates

• update anthropics/claude-code-action action to v1.0.183 by @​renovate[bot] in #​1152
• update dependency github:jdx/tak to v0.0.5 by @​renovate[bot] in #​1153
• update jdx/mise-action action to v4.2.3 by @​renovate[bot] in #​1154
• update rust crate pklr to v1.3.0 by @​renovate[bot] in #​1156
• update zizmorcore/zizmor-action action to v0.6.1 by @​renovate[bot] in #​1155
• update rust crate clap_usage to v5 by @​renovate[bot] in #​1157

zizmorcore/zizmor (zizmor)

v1.29.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#​2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#​2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#​2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#​2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#​2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#​2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#​2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#​2234)

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.