Bump the pre-commit-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the pre-commit-dependencies group with 2 updates in the / directory: https://github.com/astral-sh/uv-pre-commit and https://github.com/zizmorcore/zizmor-pre-commit.

Updates https://github.com/astral-sh/uv-pre-commit from 0.11.24 to 0.12.6

Release notes

Sourced from https://github.com/astral-sh/uv-pre-commit's releases.

0.12.6

See: https://github.com/astral-sh/uv/releases/tag/0.12.6

Commits

• 856f551 Mirror: 0.12.6
• b84c4a0 Mirror: 0.12.5
• 7253e23 Mirror: 0.12.4
• 8d582f5 Mirror: 0.12.3
• e805244 Mirror: 0.12.2
• 8ff2449 Mirror: 0.12.1
• 5900cba Mirror: 0.12.0
• e0db454 Mirror: 0.11.33
• e3e6ef7 Mirror: 0.11.32
• 69e5d7b Mirror: 0.11.31
• Additional commits viewable in compare view

Updates https://github.com/zizmorcore/zizmor-pre-commit from v1.26.1 to 1.29.0

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.29.0

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Commits

• 451b56a Mirror: 1.29.0
• c7cc406 Use upstream zizmor release notes for releases (#51)
• 8f87f00 Bump the github-actions group with 3 updates (#54)
• 067260d Mirror: 1.28.0
• 7d511af Bump astral-sh/setup-uv from 8.3.0 to 8.3.2 in the github-actions group (#53)
• e2dd91c Update issue templates
• 64a97fb Mirror: 1.27.0
• 9463fa8 Bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the github-actions group (#52)
• 3a8eeb3 Bump actions/setup-python in the github-actions group (#50)
• fe4aa69 Clean up issue templates
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.29%. Comparing base (6a20dd4) to head (fb796af).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #166   +/-   ##
=======================================
  Coverage   88.29%   88.29%           
=======================================
  Files           3        3           
  Lines          94       94           
=======================================
  Hits           83       83           
  Misses         11       11           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing dependabot/pre_commit/pre-commit-dependencies-52dab32eaa (fb796af) with main (6a20dd4)}