Security 🔒🔗
-
v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.
Many thanks to @shaanmajid for finding and reporting this vulnerability.
Enhancements 🌱🔗
-
The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)
-
The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)
-
sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)
Bug Fixes 🐛🔗
-
Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#2199)
-
Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)
-
Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)