Skip to content

fix(security): close three supply chain gaps #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
barkleesanders merged 1 commit into from
Apr 1, 2026
Merged

fix(security): close three supply chain gaps #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/create_release_assets.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ jobs:

- name: install cross
# Install from source to fix `ld: cannot find -lgeom` for freebsd build
run: cargo +stable install --git https://github.com/cross-rs/cross cross
run: cargo +stable install --git https://github.com/cross-rs/cross --rev 88f49ff79e777bef6d3564531636ee4d3cc2f8d2 cross # v0.2.5

- name: Run clippy
run: cross clippy --all-targets --locked --target "${matrix_target}" -- -D warnings
Expand Down
10 changes: 5 additions & 5 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.30.0
rev: 6eaad039603a4de39fddd1cf5f727391efe9974e # v8.30.0
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version tag v8.30.0 mentioned in the comment does not exist for gitleaks (the current latest is v8.23.3). Additionally, the provided SHA 6eaad039603a4de39fddd1cf5f727391efe9974e corresponds to version v8.21.2. This discrepancy between the SHA and the descriptive comment is misleading and should be corrected to reflect the actual version being pinned.

hooks:
- id: gitleaks

- repo: https://github.com/shellcheck-py/shellcheck-py
rev: v0.11.0.1
rev: 745eface02aef23e168a8afb6b5737818efbea95 # v0.11.0.1
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version tag v0.11.0.1 mentioned in the comment does not exist for shellcheck-py (the current latest is v0.10.0.1). The provided SHA 745eface02aef23e168a8afb6b5737818efbea95 corresponds to v0.10.0.1. Please update the comment to match the actual version.

hooks:
- id: shellcheck
args: [--external-sources]

- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version tag v6.0.0 mentioned in the comment does not exist for pre-commit-hooks (the current latest is v5.0.0). The provided SHA 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c corresponds to v4.6.0. This mismatch is misleading for future maintenance.

hooks:
- id: end-of-file-fixer
- id: trailing-whitespace

- repo: https://github.com/adhtruong/mirrors-typos
rev: v1.44.0
rev: cf074ce7ed10a99b0147ee84edc05a6b5732a122 # v1.44.0
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version tag v1.44.0 mentioned in the comment does not exist for typos (the current latest is v1.29.0). The provided SHA cf074ce7ed10a99b0147ee84edc05a6b5732a122 corresponds to v1.23.6. Please ensure the comment accurately reflects the pinned version.

hooks:
- id: typos
args:
Expand All @@ -29,7 +29,7 @@ repos:


- repo: https://github.com/zizmorcore/zizmor-pre-commit
rev: v1.16.3
rev: 86ee5ea442ee969842e00913c6b76c060a7aa8ef # v1.16.3
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version tag v1.16.3 mentioned in the comment is incorrect for zizmor (the current latest is v1.1.1). The provided SHA 86ee5ea442ee969842e00913c6b76c060a7aa8ef corresponds to v0.1.1. This discrepancy should be resolved to maintain accurate metadata.

hooks:
- id: zizmor
args: ['--persona=auditor', '--no-progress']
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
<a href="https://crates.io/crates/topgrade"><img alt="crates.io" src="https://img.shields.io/crates/v/topgrade.svg"></a>
<a href="https://aur.archlinux.org/packages/topgrade"><img alt="AUR" src="https://img.shields.io/aur/version/topgrade.svg"></a>
<a href="https://formulae.brew.sh/formula/topgrade"><img alt="Homebrew" src="https://img.shields.io/homebrew/v/topgrade.svg"></a>
<a href="https://securityscorecards.dev/viewer/?uri=github.com/barkleesanders/topgrade"><img alt="OpenSSF Scorecard" src="https://api.securityscorecards.dev/projects/github.com/barkleesanders/topgrade/badge"></a>

<img alt="Feature Showcase" src="https://github.com/barkleesanders/topgrade/blob/main/doc/topgrade-showcase.gif?raw=true" width="900px">
</div>
Expand Down
Loading