We hardened zizmor's GitHub Actions static analyzer (opens in new tab)

In March 2026, attackers exploited a pull_request_target misconfiguration in the for the full timeline). in September 2025, a small but high-value slice of the ecosystem started writing workflows that zizmor could only analyze on a best-effort basis. Over the past three months, Trail of Bits collaborated with the zizmor maintainers to bring zizmor’s anchor support up to full coverage. First, we fixed parsing bugs that caused crashes, produced wrong-location findings, and silently mishandled a...