unstale

pypi / zizmor

zizmor

What changed in zizmor 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

1 security3 behavior and defaults4 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

zizmor 18 changes

Security 1

  • The audit flags cache-mode write and write-only when used with dangerous triggers.

    1.31.0release notes

Behavior and default changes 3

  • zizmor now recognizes the image_version workflow trigger.

    1.31.0release notes

  • PowerShell parsing is more precise and can capture more non-trivial expressions.

    1.31.0release notes

  • zizmor now handles pre-commit inputs using prek extensions to language_version and default_language_version.

    1.31.0release notes

Fixes and other changes 4

  • Ignore comments and configurations apply again to the dangerous-triggers audit after a regression in 1.31.0.

    1.31.1release notes

  • The audit recognizes GitHub's cache-mode setting and skips findings when a job's effective cache-mode is none.

    1.31.0release notes

  • Configuration-file discovery relative to a repo root now honors Git submodules and worktrees.

    1.31.0release notes

  • zizmor no longer crashes on pre-commit inputs that reference a GitHub URL with an explicit .git suffix.

    1.30.1release notes