# What changed in zizmor

> 8 changes in zizmor 1 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/pypi/zizmor/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## zizmor 1

### Security

- The audit flags cache-mode write and write-only when used with dangerous triggers. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)

### Behavior and default changes

- zizmor now recognizes the image_version workflow trigger. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)
- PowerShell parsing is more precise and can capture more non-trivial expressions. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)
- zizmor now handles pre-commit inputs using prek extensions to language_version and default_language_version. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)

### Fixes and other changes

- Ignore comments and configurations apply again to the dangerous-triggers audit after a regression in 1.31.0. (1.31.1) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.1)
- The audit recognizes GitHub's cache-mode setting and skips findings when a job's effective cache-mode is none. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)
- Configuration-file discovery relative to a repo root now honors Git submodules and worktrees. (1.31.0) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.31.0)
- zizmor no longer crashes on pre-commit inputs that reference a GitHub URL with an explicit .git suffix. (1.30.1) — [release notes](https://github.com/zizmorcore/zizmor/releases/tag/v1.30.1)