From dad66ca77f40369a72c6d512a52f9f6109521f6b Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 18:55:12 -0300
Subject: [PATCH 1/8] update

---
 .pre-commit-config.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6372c6b0f2..ff7cc45f39 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -17,7 +17,7 @@ repos:
       files: requirements-dev.txt
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.20
+  rev: v0.15.21
   hooks:
     - id: ruff
 
@@ -44,10 +44,10 @@ repos:
             .*\.json |
         )$
 
-# - repo: https://github.com/woodruffw/zizmor-pre-commit
-#   rev: v1.11.0
-#   hooks:
-#     - id: zizmor
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.26.1
+  hooks:
+    - id: zizmor
 
 ci:
     autofix_commit_msg: |

From eba673403fc71b43a211a99e4d15f7fd813c1066 Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 18:55:26 -0300
Subject: [PATCH 2/8] fix all zizmor lints

---
 .github/dependabot.yml                      | 11 ++++++++++
 .github/workflows/deploy-docs.yml           | 24 +++++++++++++++------
 .github/workflows/pypi.yml                  | 16 ++++++++++----
 .github/workflows/save_versions.yml         | 14 +++++++++---
 .github/workflows/test_code.yml             | 19 ++++++++++------
 .github/workflows/test_geopandas.yml        | 17 ++++++++++-----
 .github/workflows/test_latest_branca.yml    | 14 +++++++++---
 .github/workflows/test_mypy.yml             | 11 ++++++++--
 .github/workflows/test_selenium.yml         | 16 ++++++++++----
 .github/workflows/test_snapshots.yml        | 20 ++++++++++++-----
 .github/workflows/test_streamlit_folium.yml | 24 +++++++++++++++------
 11 files changed, 141 insertions(+), 45 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7818bef342..441d5c7db2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,14 @@ updates:
       github-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 6116e33631..d536a5ae02 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -1,5 +1,8 @@
 name: Publish Docs
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -24,12 +27,12 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
@@ -45,6 +48,7 @@ jobs:
       run: |
         set -e
         pushd docs
+
         make clean html linkcheck
         popd
 
@@ -55,7 +59,7 @@ jobs:
 
     - name: Create PR
       if: ${{ github.event_name == 'release' }}
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
       with:
         commit-message: "docs: Update switcher.json for ${{ github.ref_name }}"
         title: "docs: Update switcher.json for ${{ github.ref_name }}"
@@ -63,29 +67,37 @@ jobs:
         branch: "docs/update-switcher-${{ github.ref_name }}"
         base: "main"
         labels: "documentation"
+      permissions:
+        actions: write
 
     - name: Publish to Github Pages on main
       if: ${{ github.ref == 'refs/heads/main' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
         destination_dir: dev
         keep_files: false
+      permissions:
+        actions: write
 
     - name: Publish to Github Pages on release (versioned)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
         destination_dir: ${{ github.ref_name }}
+      permissions:
+        actions: write
 
     - name: Publish to Github Pages on release (latest)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
         destination_dir: latest
         keep_files: false
+      permissions:
+        actions: write
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 748dc8a287..38acfd9b01 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -1,5 +1,8 @@
 name: Publish to PyPI
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -19,17 +22,20 @@ jobs:
   packages:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1   # v6.3.0
       with:
         python-version: "3.x"
 
     - name: Get tags
       run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
 
-
     - name: Install build tools
       run: |
         python -m pip install --upgrade pip wheel build twine
@@ -48,7 +54,9 @@ jobs:
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@v1.14.0
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
       with:
         user: __token__
         password: ${{ secrets.PYPI_PASSWORD }}
+    permissions:
+      actions: write
diff --git a/.github/workflows/save_versions.yml b/.github/workflows/save_versions.yml
index 6707572337..39376047de 100644
--- a/.github/workflows/save_versions.yml
+++ b/.github/workflows/save_versions.yml
@@ -1,5 +1,8 @@
 name: Save package versions
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -12,10 +15,13 @@ jobs:
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -36,8 +42,10 @@ jobs:
 
     - name: Save versions.txt
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: versions.txt
         path: /tmp/versions.txt
         fail-on-empty: false
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_code.yml b/.github/workflows/test_code.yml
index 3576d503ec..b2ab39c112 100644
--- a/.github/workflows/test_code.yml
+++ b/.github/workflows/test_code.yml
@@ -1,5 +1,8 @@
 name: Code Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -13,20 +16,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        python-version: ["3.9", "3.13"]
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        python-version: [ "3.10", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
-        micromamba-version: '2.6.0-0'
         environment-name: TEST
         create-args: >-
           python=${{ matrix.python-version }}
@@ -48,8 +53,10 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-code-${{ matrix.os }}-${{ matrix.python-version }}
         path: .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_geopandas.yml b/.github/workflows/test_geopandas.yml
index ebef22fa8e..d5924df023 100644
--- a/.github/workflows/test_geopandas.yml
+++ b/.github/workflows/test_geopandas.yml
@@ -1,5 +1,8 @@
 name: Geopandas tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -17,14 +20,14 @@ jobs:
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
-        # needed to get the correct version number for Folium
         fetch-depth: 0
+        persist-credentials: false
         path: folium
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -32,8 +35,10 @@ jobs:
           --file folium/requirements.txt
 
     - name: Checkout Geopandas
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
+        fetch-depth: 0
+        persist-credentials: false
         repository: geopandas/geopandas
         path: geopandas
 
@@ -54,9 +59,11 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-geopandas
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_latest_branca.yml b/.github/workflows/test_latest_branca.yml
index 5adaa9e678..c399c2d72f 100644
--- a/.github/workflows/test_latest_branca.yml
+++ b/.github/workflows/test_latest_branca.yml
@@ -1,5 +1,8 @@
 name: Code Tests with Latest branca
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +19,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -38,9 +44,11 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-branca
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_mypy.yml b/.github/workflows/test_mypy.yml
index e3cd97af5e..f4ab8f3f19 100644
--- a/.github/workflows/test_mypy.yml
+++ b/.github/workflows/test_mypy.yml
@@ -1,5 +1,9 @@
 name: Mypy type hint checks
 
+# no permissions by default
+permissions: {}
+
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +20,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml
index 1703560e0c..a340972c2f 100644
--- a/.github/workflows/test_selenium.yml
+++ b/.github/workflows/test_selenium.yml
@@ -1,5 +1,8 @@
 name: Selenium Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -13,17 +16,20 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ "3.9", "3.13" ]
+        python-version: [ "3.9", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -39,9 +45,11 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-selenium-${{ matrix.python-version }}
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_snapshots.yml b/.github/workflows/test_snapshots.yml
index fc915ddc2f..69572bc9c3 100644
--- a/.github/workflows/test_snapshots.yml
+++ b/.github/workflows/test_snapshots.yml
@@ -1,5 +1,8 @@
 name: Run Snapshot Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -15,10 +18,13 @@ jobs:
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -40,25 +46,29 @@ jobs:
 
     - name: Surface failing tests
       if: always()
-      uses: pmeier/pytest-results-action@main
+      uses: pmeier/pytest-results-action@fdc7f18d9934e38aca411ca9557e6577bd25ca9c  # v0.9.0
       with:
         path: test-results.xml
         fail-on-empty: false
 
     - name: Upload screenshots
       if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: screenshots
         path: |
           /tmp/screenshot_*_*.png
           /tmp/folium_map_*.html
+      permissions:
+        actions: write
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-snapshots
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_streamlit_folium.yml b/.github/workflows/test_streamlit_folium.yml
index ffa20e6b65..55b2336d47 100644
--- a/.github/workflows/test_streamlit_folium.yml
+++ b/.github/workflows/test_streamlit_folium.yml
@@ -1,5 +1,8 @@
 name: Run Streamlit Folium Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -17,19 +20,24 @@ jobs:
 
     steps:
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1   # v6.3.0
       with:
-        python-version: '3.13'
+        python-version: "3.14"
 
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
     - name: Checkout Streamlit Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
+        fetch-depth: 0
+        persist-credentials: false
         repository: randyzwitch/streamlit-folium
         ref: master
         path: streamlit_folium  # Checkout into a subdirectory
@@ -68,15 +76,17 @@ jobs:
 
     - name: Surface failing tests
       if: always()
-      uses: pmeier/pytest-results-action@main
+      uses: pmeier/pytest-results-action@fdc7f18d9934e38aca411ca9557e6577bd25ca9c  # v0.9.0
       with:
         path: streamlit_folium/test-results.xml
         fail-on-empty: false
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-streamlit-folium
         path: |
           .coverage*
+      permissions:
+        actions: write

From 4a46b718f1a70ccd6ddc894288f415d53cf138fb Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 18:55:44 -0300
Subject: [PATCH 3/8] skip trusted publishers b/c we cannot active it on this
 org

---
 zizmor.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 zizmor.yml

diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 0000000000..89934bb69a
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  use-trusted-publishing:
+    ignore:
+      - pypi.yml:57:7

From 8059451bb643031a1c822afc90ca1ca80c4aa13d Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 19:13:57 -0300
Subject: [PATCH 4/8] fix yaml lints

---
 .github/workflows/deploy-docs.yml           | 11 -----------
 .github/workflows/save_versions.yml         |  4 ++--
 .github/workflows/test_code.yml             |  5 +++--
 .github/workflows/test_geopandas.yml        |  5 +++--
 .github/workflows/test_selenium.yml         |  5 +++--
 .github/workflows/test_snapshots.yml        |  6 ++----
 .github/workflows/test_streamlit_folium.yml |  4 ++--
 7 files changed, 15 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index d536a5ae02..fb5c865d45 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -1,8 +1,5 @@
 name: Publish Docs
 
-# no permissions by default
-permissions: {}
-
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -67,8 +64,6 @@ jobs:
         branch: "docs/update-switcher-${{ github.ref_name }}"
         base: "main"
         labels: "documentation"
-      permissions:
-        actions: write
 
     - name: Publish to Github Pages on main
       if: ${{ github.ref == 'refs/heads/main' }}
@@ -78,8 +73,6 @@ jobs:
         publish_dir: docs/_build/html/
         destination_dir: dev
         keep_files: false
-      permissions:
-        actions: write
 
     - name: Publish to Github Pages on release (versioned)
       if: ${{ github.event_name == 'release' }}
@@ -88,8 +81,6 @@ jobs:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
         destination_dir: ${{ github.ref_name }}
-      permissions:
-        actions: write
 
     - name: Publish to Github Pages on release (latest)
       if: ${{ github.event_name == 'release' }}
@@ -99,5 +90,3 @@ jobs:
         publish_dir: docs/_build/html/
         destination_dir: latest
         keep_files: false
-      permissions:
-        actions: write
diff --git a/.github/workflows/save_versions.yml b/.github/workflows/save_versions.yml
index 39376047de..b5f9414a83 100644
--- a/.github/workflows/save_versions.yml
+++ b/.github/workflows/save_versions.yml
@@ -12,6 +12,8 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
 
     steps:
     - name: Checkout Folium
@@ -47,5 +49,3 @@ jobs:
         name: versions.txt
         path: /tmp/versions.txt
         fail-on-empty: false
-      permissions:
-        actions: write
diff --git a/.github/workflows/test_code.yml b/.github/workflows/test_code.yml
index b2ab39c112..1374e6928b 100644
--- a/.github/workflows/test_code.yml
+++ b/.github/workflows/test_code.yml
@@ -14,6 +14,9 @@ on:
 jobs:
   run:
     runs-on: ${{ matrix.os }}
+    permissions:
+      actions: write
+
     strategy:
       matrix:
         os: [ ubuntu-latest, windows-latest, macos-latest ]
@@ -58,5 +61,3 @@ jobs:
         name: coverage-test-code-${{ matrix.os }}-${{ matrix.python-version }}
         path: .coverage*
         include-hidden-files: true
-      permissions:
-        actions: write
diff --git a/.github/workflows/test_geopandas.yml b/.github/workflows/test_geopandas.yml
index d5924df023..cb0b9d6dd6 100644
--- a/.github/workflows/test_geopandas.yml
+++ b/.github/workflows/test_geopandas.yml
@@ -14,6 +14,9 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+
     defaults:
       run:
         shell: bash -l {0}
@@ -65,5 +68,3 @@ jobs:
         path: |
           .coverage*
         include-hidden-files: true
-      permissions:
-        actions: write
diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml
index a340972c2f..4b8fc88370 100644
--- a/.github/workflows/test_selenium.yml
+++ b/.github/workflows/test_selenium.yml
@@ -21,6 +21,8 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -51,5 +53,4 @@ jobs:
         path: |
           .coverage*
         include-hidden-files: true
-      permissions:
-        actions: write
+
diff --git a/.github/workflows/test_snapshots.yml b/.github/workflows/test_snapshots.yml
index 69572bc9c3..1bcfccfd9f 100644
--- a/.github/workflows/test_snapshots.yml
+++ b/.github/workflows/test_snapshots.yml
@@ -15,6 +15,8 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
     - name: Checkout Folium
@@ -59,8 +61,6 @@ jobs:
         path: |
           /tmp/screenshot_*_*.png
           /tmp/folium_map_*.html
-      permissions:
-        actions: write
 
     - name: Upload coverage
       if: always()
@@ -70,5 +70,3 @@ jobs:
         path: |
           .coverage*
         include-hidden-files: true
-      permissions:
-        actions: write
diff --git a/.github/workflows/test_streamlit_folium.yml b/.github/workflows/test_streamlit_folium.yml
index 55b2336d47..304340b94a 100644
--- a/.github/workflows/test_streamlit_folium.yml
+++ b/.github/workflows/test_streamlit_folium.yml
@@ -17,6 +17,8 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
     - name: Set up Python
@@ -88,5 +90,3 @@ jobs:
         name: coverage-test-streamlit-folium
         path: |
           .coverage*
-      permissions:
-        actions: write

From 0a4178090869531f8de8a382620a282f856bd469 Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 19:19:32 -0300
Subject: [PATCH 5/8] fix 2 more lints

---
 .github/workflows/deploy-docs.yml   | 1 +
 .github/workflows/test_selenium.yml | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index fb5c865d45..cfa35cb8df 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -27,6 +27,7 @@ jobs:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
       uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml
index 4b8fc88370..5f4e6ff7ec 100644
--- a/.github/workflows/test_selenium.yml
+++ b/.github/workflows/test_selenium.yml
@@ -53,4 +53,3 @@ jobs:
         path: |
           .coverage*
         include-hidden-files: true
-

From 1fc4312185828950d65fe7b5cda10c503a6ab543 Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 19:19:38 -0300
Subject: [PATCH 6/8] add another skip

---
 zizmor.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zizmor.yml b/zizmor.yml
index 89934bb69a..23d1af2129 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -1,4 +1,7 @@
 rules:
+  template-injection:
+    ignore:
+      - deploy-docs.yml:56:54
   use-trusted-publishing:
     ignore:
       - pypi.yml:57:7

From 729f40b2417c62cf680806b1a0d5a887803b2547 Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 20:12:20 -0300
Subject: [PATCH 7/8] use trusted publishers

---
 .github/workflows/pypi.yml | 18 ++++++++----------
 zizmor.yml                 |  3 ---
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 38acfd9b01..a69940af99 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -1,8 +1,5 @@
 name: Publish to PyPI
 
-# no permissions by default
-permissions: {}
-
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -21,11 +18,17 @@ defaults:
 jobs:
   packages:
     runs-on: ubuntu-latest
-    steps:
+    environment:
+      name: pypi
+      url: https://pypi.org/p/folium/
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
 
+    steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
-        fetch-depth: 0
+        # Should be enough for setuptools-scm
+        fetch-depth: 100
         persist-credentials: false
 
     - name: Set up Python
@@ -55,8 +58,3 @@ jobs:
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
       uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
-    permissions:
-      actions: write
diff --git a/zizmor.yml b/zizmor.yml
index 23d1af2129..ea769d2070 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -2,6 +2,3 @@ rules:
   template-injection:
     ignore:
       - deploy-docs.yml:56:54
-  use-trusted-publishing:
-    ignore:
-      - pypi.yml:57:7

From ead0c5506234c6014db0964f2a9d5df6d4ca9107 Mon Sep 17 00:00:00 2001
From: Filipe Fernandes <ocefpaf@gmail.com>
Date: Mon, 13 Jul 2026 20:20:16 -0300
Subject: [PATCH 8/8] fix last lint

---
 .github/workflows/deploy-docs.yml | 12 +++++++-----
 zizmor.yml                        |  4 ----
 2 files changed, 7 insertions(+), 9 deletions(-)
 delete mode 100644 zizmor.yml

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index cfa35cb8df..0ffcffe71a 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -22,6 +22,8 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    env:
+      REF_NAME: ${{ github.ref_name }}
 
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -53,16 +55,16 @@ jobs:
     - name: Update switcher and latest version
       if: ${{ github.event_name == 'release' }}
       run: |
-        python docs/update_switcher.py --version ${{ github.ref_name }}
+        python docs/update_switcher.py --version $REF_NAME
 
     - name: Create PR
       if: ${{ github.event_name == 'release' }}
       uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
       with:
-        commit-message: "docs: Update switcher.json for ${{ github.ref_name }}"
-        title: "docs: Update switcher.json for ${{ github.ref_name }}"
+        commit-message: "docs: Update switcher.json for $REF_NAME"
+        title: "docs: Update switcher.json for $REF_NAME"
         body: "This PR updates the switcher.json file."
-        branch: "docs/update-switcher-${{ github.ref_name }}"
+        branch: "docs/update-switcher-$REF_NAME"
         base: "main"
         labels: "documentation"
 
@@ -81,7 +83,7 @@ jobs:
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
-        destination_dir: ${{ github.ref_name }}
+        destination_dir: $REF_NAME
 
     - name: Publish to Github Pages on release (latest)
       if: ${{ github.event_name == 'release' }}
diff --git a/zizmor.yml b/zizmor.yml
deleted file mode 100644
index ea769d2070..0000000000
--- a/zizmor.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-rules:
-  template-injection:
-    ignore:
-      - deploy-docs.yml:56:54