Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Sourced from zizmor's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

• Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Sourced from zizmor's changelog.

1.32.0

New Features 🌈

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the [input collection] documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛

• Fixed a bug where the [bot-conditions] audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the [obfuscation] audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the [obfuscation] audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for

... (truncated)

• 21bd300 Prep zizmor 1.32 (#2518)
• fbf8d0c zizmor 1.32.0-rc2 (#2512)
• 0894555 Add Windows ARM64 builds (#2424)
• df7baf8 Attempt to unify input collection/classification (#2511)
• 0e931de Make remote collection root-aware (#2510)
• d38f643 Generalize exception logic in dangerous-triggers (#2506)
• 2658f19 fix: follow case() arguments in expression dataflow (#2504)
• 3028713 Bump crater snapshots (#2505)
• e7355ca Add a TODO (#2501)
• 788a4ee fix: follow fromJSON arguments in expression dataflow (#2495)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions