Update all dependencies (#463) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jackdewinter/pymarkdown](https://redirect.github.com/jackdewinter/pymarkdown) | repository | patch | `v0.9.39` β `v0.9.40` | | [tiobe/tics-github-action](https://redirect.github.com/tiobe/tics-github-action) | action | major | `v3.12.0` β `v4.0.0` | | [zizmorcore/zizmor-pre-commit](https://redirect.github.com/zizmorcore/zizmor-pre-commit) | repository | minor | `v1.29.0` β `v1.30.1` | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>jackdewinter/pymarkdown (jackdewinter/pymarkdown)</summary> ### [`v0.9.40`](https://redirect.github.com/jackdewinter/pymarkdown/releases/tag/v0.9.40): Version 0.9.40 - 2026-09-13 [Compare Source](https://redirect.github.com/jackdewinter/pymarkdown/compare/v0.9.39...v0.9.40) Following last release's focus on cementing our documentation and rule plugins, this release adds support for six missing rules and includes a complete overhaul of the rule plugin documentation. Reachable from the main [Rules Page](https://pymarkdown.readthedocs.io/en/latest/rules/), each individual rule page now includes multiple examples that trigger the rule alongside examples that don't. Our team verified all of these by hand, and we'll continue updating them to keep them current. Please check out the new rules and documentation and let us know if you find any issues! ##### Added - [Issue 1650](https://redirect.github.com/jackdewinter/pymarkdown/issues/1650) - Rules for Md049 (consistent emphasis) and Md050 (consistent strong emphasis) - [Issue 1652](https://redirect.github.com/jackdewinter/pymarkdown/issues/1652) - Rule for Md051 (valid local link fragments) - [Issue 1656](https://redirect.github.com/jackdewinter/pymarkdown/issues/1656) - Rule for Md059 (descriptive-link-text) - [Issue 1658](https://redirect.github.com/jackdewinter/pymarkdown/issues/1658) - Rule for Md053 (link-image-reference-definitions) - [Issue 1660](https://redirect.github.com/jackdewinter/pymarkdown/issues/1660) - Rule for Md054 (link-image-style) - [Issue 1669](https://redirect.github.com/jackdewinter/pymarkdown/issues/1669) - Rule for Md060 (table-column-style) ##### Fixed - [Issue 1639](https://redirect.github.com/jackdewinter/pymarkdown/issues/1639) - `extensions` and `plugins` commands were not case insensitive - [Issue 1684](https://redirect.github.com/jackdewinter/pymarkdown/issues/1684) - Rule Plugin MD011 was not handling tables properly. - [Issue 1685](https://redirect.github.com/jackdewinter/pymarkdown/issues/1685) - Rule Plugin MD011 was not reporting reversed links properly on lines that have more than one link/reverse-link. - [Issue 1686](https://redirect.github.com/jackdewinter/pymarkdown/issues/1686) - Rule Plugin MD011 was not reporting multiple failures on the same line ##### Changed - [Issue 1681](https://redirect.github.com/jackdewinter/pymarkdown/issues/1681) - Extensive updating of Rule Plugins docs </details> <details> <summary>tiobe/tics-github-action (tiobe/tics-github-action)</summary> ### [`v4.0.0`](https://redirect.github.com/tiobe/tics-github-action/releases/tag/v4.0.0): Version 4.0.0 [Compare Source](https://redirect.github.com/tiobe/tics-github-action/compare/v3.12.0...v4.0.0) <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### Features - RM-37983: Converted action to ESM and updated to Node 24 by [@​janssen-tiobe](https://redirect.github.com/janssen-tiobe) in [#​530](https://redirect.github.com/tiobe/tics-github-action/pull/530) **Full Changelog**: <https://github.com/tiobe/tics-github-action/compare/v3.12.0...v4.0.0> </details> <details> <summary>zizmorcore/zizmor-pre-commit (zizmorcore/zizmor-pre-commit)</summary> ### [`v1.30.1`](https://redirect.github.com/zizmorcore/zizmor-pre-commit/releases/tag/v1.30.1) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-pre-commit/compare/v1.30.0...v1.30.1) [Sponsorship is appreciated!](https://redirect.github.com/sponsors/woodruffw/) #### Bug Fixes π[π](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix ([#​2363](https://redirect.github.com/zizmorcore/zizmor/issues/2363)) - Fixed a bug where [self-repository](https://docs.zizmor.sh/audits/#self-repository) auto-fixes were incorrectly marked as "safe" instead of "unsafe" ([#​2373](https://redirect.github.com/zizmorcore/zizmor/issues/2373)) ### [`v1.30.0`](https://redirect.github.com/zizmorcore/zizmor-pre-commit/releases/tag/v1.30.0) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-pre-commit/compare/v1.29.0...v1.30.0) [Sponsorship is appreciated!](https://redirect.github.com/sponsors/woodruffw/) #### New Features π[π](https://docs.zizmor.sh/release-notes/#new-features) - New audit: [self-repository](https://docs.zizmor.sh/audits/#self-repository) detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead ([#​2271](https://redirect.github.com/zizmorcore/zizmor/issues/2271)) Enhancements π±[π](https://docs.zizmor.sh/release-notes/#enhancements) - The [impostor-commit](https://docs.zizmor.sh/audits/#impostor-commit) audit now supports pre-commit config inputs ([#​2256](https://redirect.github.com/zizmorcore/zizmor/issues/2256)) - The [forbidden-uses](https://docs.zizmor.sh/audits/#forbidden-uses) audit now supports pre-commit config inputs ([#​2263](https://redirect.github.com/zizmorcore/zizmor/issues/2263)) - The [adhoc-packages](https://docs.zizmor.sh/audits/#adhoc-packages) audit now detects more ad-hoc package management patterns, including bundle add and yarn add Many thanks to [@​connorshea](https://redirect.github.com/connorshea) for proposing and implementing this enhancement! - The [archived-uses](https://docs.zizmor.sh/audits/#archived-uses) audit now supports pre-commit config inputs ([#​2272](https://redirect.github.com/zizmorcore/zizmor/issues/2272)) - The [ref-confusion](https://docs.zizmor.sh/audits/#ref-confusion) audit now supports pre-commit config inputs ([#​2274](https://redirect.github.com/zizmorcore/zizmor/issues/2274)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit now produces more detailed and more precise diagnostics ([#​2330](https://redirect.github.com/zizmorcore/zizmor/issues/2330)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit now handles and exposes auto-fixes in a more general manner ([#​2332](https://redirect.github.com/zizmorcore/zizmor/issues/2332)) - zizmor now recognizes [sethvargo/ratchet](https://redirect.github.com/sethvargo/ratchet) version comments when evaluating ref pinning ([#​2319](https://redirect.github.com/zizmorcore/zizmor/issues/2319)) Many thanks to [@​njgudman](https://redirect.github.com/njgudman) for proposing and implementing this enhancement! - The [unpinned-tools](https://docs.zizmor.sh/audits/#unpinned-tools) audit now produces more detailed and more precise diagnostics ([#​2339](https://redirect.github.com/zizmorcore/zizmor/issues/2339)) - The [unpinned-tools](https://docs.zizmor.sh/audits/#unpinned-tools) audit now detects usages of [extractions/setup-just](https://redirect.github.com/extractions/setup-just) ([#​2339](https://redirect.github.com/zizmorcore/zizmor/issues/2339)) - The [unpinned-tools](https://docs.zizmor.sh/audits/#unpinned-tools) audit now detects usages of [extractions/setup-crate](https://redirect.github.com/extractions/setup-crate) ([#​2340](https://redirect.github.com/zizmorcore/zizmor/issues/2340)) - The [archived-uses](https://docs.zizmor.sh/audits/#archived-uses) audit now detects several more archived repositories ([#​2340](https://redirect.github.com/zizmorcore/zizmor/issues/2340)) - The [ref-version-mismatch](https://docs.zizmor.sh/audits/#ref-version-mismatch) audit now supports uses: that reference reusable workflows ([#​2344](https://redirect.github.com/zizmorcore/zizmor/issues/2344)) - The [stale-action-refs](https://docs.zizmor.sh/audits/#stale-action-refs) audit now supports uses: that reference reusable workflows ([#​2345](https://redirect.github.com/zizmorcore/zizmor/issues/2345)) #### Bug Fixes π[π](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section ([#​2259](https://redirect.github.com/zizmorcore/zizmor/issues/2259)) - Fixed a bug where the [unpinned-uses](https://docs.zizmor.sh/audits/#unpinned-uses) audit would fail to honor ignore comments within the same step scope ([#​2289](https://redirect.github.com/zizmorcore/zizmor/issues/2289)) - Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition ([#​2300](https://redirect.github.com/zizmorcore/zizmor/issues/2300)) - Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude ([#​2308](https://redirect.github.com/zizmorcore/zizmor/issues/2308)) - Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations ([#​2295](https://redirect.github.com/zizmorcore/zizmor/issues/2295)) Many thanks to [@​dmbuil](https://redirect.github.com/dmbuil) for proposing and implementing this improvement! - Fixed a bug where the [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit would incorrectly flag newer [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) versions that disable caching behavior automatically ([#​2330](https://redirect.github.com/zizmorcore/zizmor/issues/2330)) - Fixed a bug where the [ref-version-mismatch](https://docs.zizmor.sh/audits/#ref-version-mismatch) audit would produce a misleading diagnostic when an action has overlapping branch and tag names ([#​2337](https://redirect.github.com/zizmorcore/zizmor/issues/2337)) - Fixed a bug where the [artipacked](https://docs.zizmor.sh/audits/#artipacked) audit would incorrectly flag the with: clauses of unrelated actions ([#​2339](https://redirect.github.com/zizmorcore/zizmor/issues/2339)) - Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag ([#​2247](https://redirect.github.com/zizmorcore/zizmor/issues/2247)) Many thanks to [@​potiuk](https://redirect.github.com/potiuk) for proposing and implementing this improvement! - Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions ([#​2349](https://redirect.github.com/zizmorcore/zizmor/issues/2349)) </details> --- ### Configuration π **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/wlcs). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTAzLjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->