[sticky-gecko]

This PR contains the following updates:

Package	Update	Change
zizmor	minor	1.27.0 → 1.28.0

---

Release Notes

zizmorcore/zizmor (zizmor)

v1.28.0

Compare Source

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#​2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[greptile-apps]

Greptile Summary

This PR updates the pinned zizmor tool version used by mise. The main changes are:

• Bumps zizmor from 1.27.0 to 1.28.0 in .mise/config.toml.
• Refreshes the matching zizmor entry in .mise/mise.lock.
• Keeps the lock entry configured for GitHub attestations across supported platforms.

Confidence Score: 5/5

Safe to merge with minimal risk.

The change is limited to mise tool metadata and does not alter runtime code or workflow logic.

No files require special attention.

T-Rex Logs

What T-Rex did

• T-Rex attempted a mise-based zizmor audit for zizmor 1.28.0 and was blocked because mise was not found.
• T-Rex attempted a direct zizmor audit; it was blocked because zizmor was not found.
• T-Rex attempted a GitHub release lookup for v1.28.0; the lookup was blocked by HTTP 404.
• A fallback sanity command was run, and it passed, including npm install, asset generation, and go test ./....

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.mise/config.toml	Updates the pinned zizmor tool version from 1.27.0 to 1.28.0; no issues found.
.mise/mise.lock	Refreshes the zizmor lock entry for 1.28.0 using GitHub attestations; no issues found.

_{Reviews (1): Last reviewed commit: "chore(mise): Update tool zizmor (1.27.0 ..." | Re-trigger Greptile}