From 3692a5affbb571b25ccd7955a243aaf55ab8ffab Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Wed, 2 Sep 2026 08:33:27 +0200
Subject: [PATCH] Take the two pins the index has published past [#224]

`go run . pins` refused on the default branch because the workflow audit and
the static analysis engine were both behind what PyPI publishes, and the
comparison runs weekly on a schedule, so the refusal stood for two days with
nothing that would clear it but a change to this file.

    go run . pins
      zizmor: BEHIND, pinned 1.29.0, pypi says 1.30.0
      semgrep: BEHIND, pinned 1.174.0, pypi says 1.176.0
      4 pin(s) declared, 4 compared, 2 behind, 0 unresolved.

Run 2026-09-02 at 6541274, elided for length.

What this prevents is the drift each `why` field names: a workflow audit that
has stopped understanding the syntax it audits, and a rule engine release that
turns a pattern which refuses something into one that refuses nothing, both of
which leave every run green. Neither pin carries a checksum, because the
resolver compares against what the index publishes rather than against the
wheel, which is what those two entries already say.

The bump is written by hand rather than by a run of the comparison, which
reports and never writes: a machine that rewrote a version and its checksum in
one commit has proved nothing about the bytes it just trusted.
---
 pins.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pins.json b/pins.json
index 17cd3a9..c567c4b 100644
--- a/pins.json
+++ b/pins.json
@@ -13,7 +13,7 @@
     "id": "zizmor",
     "registry": "pypi",
     "name": "zizmor",
-    "version": "1.29.0",
+    "version": "1.30.0",
     "checksum": "",
     "reads": [".github/workflows/zizmor.yml"],
     "repeats": [],
@@ -23,7 +23,7 @@
     "id": "semgrep",
     "registry": "pypi",
     "name": "semgrep",
-    "version": "1.174.0",
+    "version": "1.176.0",
     "checksum": "",
     "reads": [".github/workflows/semgrep.yml"],
     "repeats": [],