## New Features 🌈[🔗](https://docs.zizmor.sh/release-notes/#new-features)


zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#1913)
Many thanks to @Proximyst for proposing and implementing this improvement!


New audit: github-app detects dangerous usages of GitHub App installation tokens (#1926)


New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#1820)


zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#1935)


zizmor's LSP now honors the --persona flag on the CLI (#1943)


zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#1965)


Enhancements🔗


Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions


Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions


Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions


Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions


Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions


tibdex/github-app-token is now recognized as an archived action by archived-uses (#1910)


The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#1956)


The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#1965)


zizmor's SARIF output now provides slightly more detailed finding messages (#1972)


The archived-uses audit now detects more archived actions (#1978)


deno is now recognized as a package-ecosystem in dependabot.yml (#1991)


Performance Improvements 🚄🔗


The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#1998)

Bug Fixes 🐛🔗


Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#1904)


Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#1909)


Fixed a bug where the unpinned-images audit would miss images defined in container:  clauses (#1944)


Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#1945)


Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#1946)


Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#1962)


Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#1940)
Many thanks to @reubenwong97 for implementing this fix!


Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#1976)


Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#1980)


Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#1998)

View the full release notes at https://github.com/zizmorcore/zizmor/releases/tag/v1.25.0.