chore(deps): bump github/codeql-action/upload-sarif (#13913)

Bumps the gha-minor group with 1 update: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/dependabot.yml

@@ -6,9 +6,23 @@ updates:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      gha-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: "pip"
     directory: "/.github/workflows/dependencies"
     schedule:
       interval: "weekly"
       day: "sunday"
     labels: []
+    groups:
+      py-minor:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/dependencies.yml

@@ -16,12 +16,12 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
@@ -31,7 +31,7 @@ jobs:
           client-id: ${{ secrets.OHMYZSH_CLIENT_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip"

.github/workflows/dependencies/requirements.txt

@@ -1,6 +1,6 @@
-certifi==2026.4.22
+certifi==2026.7.22
-charset-normalizer==3.4.7
+charset-normalizer==3.4.9
-idna==3.15
+idna==3.18
 PyYAML==6.0.3
 requests==2.34.2
 semver==3.0.4

.github/workflows/installer.yml

@@ -26,12 +26,12 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -47,12 +47,12 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy

.github/workflows/main.yml

@@ -24,12 +24,12 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,17 +36,17 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

plugins/bundler/README.md

@@ -22,7 +22,8 @@ plugins=(... bundler)
 | `bo`   | `bundle open`     | Opens the source directory for a gem in your bundle      |
 | `bout` | `bundle outdated` | List installed gems with newer versions available        |
 | `bp`   | `bundle package`  | Package your needed .gem files into your application     |
-| `bu`   | `bundle update --all` | Update your gems to the latest available versions    |
+| `bu`   | `bundle update`   | Update your gems to the latest available versions          |
+| `bua`  | `bundle update --all` | Update all gems to the latest available versions      |
 
 ## Gem wrapper
 

plugins/bundler/bundler.plugin.zsh

@@ -9,7 +9,8 @@ alias bl="bundle list"
 alias bo="bundle open"
 alias bout="bundle outdated"
 alias bp="bundle package"
-alias bu="bundle update --all"
+alias bu="bundle update"
+alias bua="bundle update --all"
 
 ## Gem wrapper
 

plugins/flutter/README.md

@@ -13,16 +13,20 @@ plugins=(... flutter)
 | Alias      | Command                 | Description                                                                |
 | :--------- | :---------------------- | :------------------------------------------------------------------------- |
 | `fl`       | `flutter`               | Shorthand for flutter command                                              |
+| `fla`      | `flutter analyze`       | Analyzes flutter code                                                      |
 | `flattach` | `flutter attach`        | Attaches flutter to a running flutter application with enabled observatory |
 | `flb`      | `flutter build`         | Build flutter application                                                  |
-| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `flc`      | `flutter clean`         | Cleans flutter project                                                     |
-| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
+| `flchnl`   | `flutter channel`       | Switches flutter channel (requires input of desired channel)               |
 | `fldoc`    | `flutter doctor`        | Runs flutter doctor                                                        |
-| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
+| `fldvcs`   | `flutter devices`       | List connected devices (if any)                                            |
 | `flget`    | `flutter pub get`       | Installs dependencies                                                      |
+| `fll`      | `flutter logs`          | Shows flutter logs                                                         |
+| `flpu`     | `flutter pub upgrade`   | Upgrades dependencies                                                      |
+| `flpub`    | `flutter pub`           | Shorthand for flutter pub command                                          |
 | `flr`      | `flutter run`           | Runs flutter app                                                           |
 | `flrd`     | `flutter run --debug`   | Runs flutter app in debug mode (default mode)                              |
 | `flrp`     | `flutter run --profile` | Runs flutter app in profile mode                                           |
 | `flrr`     | `flutter run --release` | Runs flutter app in release mode                                           |
+| `flt`      | `flutter test`          | Runs flutter tests                                                         |
 | `flupgrd`  | `flutter upgrade`       | Upgrades flutter version depending on the current channel                  |

plugins/flutter/flutter.plugin.zsh

@@ -1,16 +1,20 @@
 alias fl="flutter"
+alias fla="flutter analyze"
 alias flattach="flutter attach"
 alias flb="flutter build"
-alias flchnl="flutter channel"
 alias flc="flutter clean"
-alias fldvcs="flutter devices"
+alias flchnl="flutter channel"
 alias fldoc="flutter doctor"
-alias flpub="flutter pub"
+alias fldvcs="flutter devices"
 alias flget="flutter pub get"
+alias fll="flutter logs"
+alias flpu="flutter pub upgrade"
+alias flpub="flutter pub"
 alias flr="flutter run"
 alias flrd="flutter run --debug"
 alias flrp="flutter run --profile"
 alias flrr="flutter run --release"
+alias flt="flutter test"
 alias flupgrd="flutter upgrade"
 
 # COMPLETION FUNCTION

plugins/git/README.md

@@ -45,7 +45,7 @@ plugins=(... git)
 | `gbgD`                 | `LANG=C git branch --no-color -vv \| grep ": gone\]" \| cut -c 3- \| awk '"'"'{print $1}'"'"' \| xargs git branch -D`           |
 | `gbm`                  | `git branch --move`                                                                                                             |
 | `gbnm`                 | `git branch --no-merged`                                                                                                        |
-| `gbr`                  | `git branch --remote`                                                                                                           |
+| `gbr`                  | `git branch --remotes`                                                                                                          |
 | `ggsup`                | `git branch --set-upstream-to=origin/$(git_current_branch)`                                                                     |
 | `gbg`                  | `LANG=C git branch -vv \| grep ": gone\]"`                                                                                      |
 | `gco`                  | `git checkout`                                                                                                                  |

plugins/git/git.plugin.zsh

@@ -153,7 +153,7 @@ alias gbgd='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk
 alias gbgD='LANG=C git branch --no-color -vv | grep ": gone\]" | cut -c 3- | awk '"'"'{print $1}'"'"' | xargs git branch -D'
 alias gbm='git branch --move'
 alias gbnm='git branch --no-merged'
-alias gbr='git branch --remote'
+alias gbr='git branch --remotes'
 alias ggsup='git branch --set-upstream-to=origin/$(git_current_branch)'
 alias gbg='LANG=C git branch -vv | grep ": gone\]"'
 alias gco='git checkout'

plugins/pm2/_pm2

@@ -314,7 +314,7 @@ _pm2_subcommands() {
 (( $+functions[_pm2_id_names] )) ||
 _pm2_id_names() {
   local app_list=$(pm2 list -m)
-  local -a names=(${(@f)"$(echo $app_list | awk '/^\+---/{sub("+--- ", ""); print}')"})
+  local -a names=(${(@f)"$(echo $app_list | awk '/^\+---/{sub("\\+--- ", ""); print}')"})
   local -a ids=(${(@f)"$(echo $app_list | awk '/^pm2 id/{sub("pm2 id :", ""); print}')"})
 
   if (( ${#ids} > 0 )); then

plugins/rails/README.md

@@ -24,11 +24,12 @@ plugins=(... rails)
 | `rdm`   | `rails db:migrate`               | Run pending db migrations                              |
 | `rdmd`  | `rails db:migrate:down`          | Undo specific db migration                             |
 | `rdmr`  | `rails db:migrate:redo`          | Redo specific db migration                             |
+| `rdmrs` | `rails db:migrate:reset`         | Delete the database and set it up again from scratch.  |
 | `rdms`  | `rails db:migrate:status`        | Show current db migration status                       |
 | `rdmtc` | `rails db:migrate db:test:clone` | Run pending migrations and clone db into test database |
 | `rdmu`  | `rails db:migrate:up`            | Run specific db migration                              |
 | `rdr`   | `rails db:rollback`              | Roll back the last migration                           |
-| `rdrs`  | `rails db:reset`                 | Delete the database and set it up again                |
+| `rdrs`  | `rails db:reset`                 | Delete the database and set it up again from schema.   |
 | `rds`   | `rails db:seed`                  | Seed the database                                      |
 | `rdsl`  | `rails db:schema:load`           | Load the database schema                               |
 | `rdtc`  | `rails db:test:clone`            | Clone the database into the test database              |

plugins/rails/_rails

@@ -214,6 +214,7 @@ _rails_subcommands() {
       "db\:migrate[Migrate the database]"
       "db\:migrate\:down[Run the 'down' for a given migration VERSION]"
       "db\:migrate\:redo[Roll back the database one migration and re-migrate up]"
+      "db\:migrate\:reset[Drop and recreate all databases from scratch for the current environment]"
       "db\:migrate\:status[Display status of migrations]"
       "db\:migrate\:up[Run the 'up' for a given migration VERSION]"
       "db\:prepare[Run setup if database does not exist, or run migrations if it does]"

plugins/rails/rails.plugin.zsh

@@ -52,6 +52,7 @@ alias rdd='rails db:drop'
 alias rdm='rails db:migrate'
 alias rdmd='rails db:migrate:down'
 alias rdmr='rails db:migrate:redo'
+alias rdmrs='rails db:migrate:reset'
 alias rdms='rails db:migrate:status'
 alias rdmtc='rails db:migrate db:test:clone'
 alias rdmu='rails db:migrate:up'

plugins/ufw/README.md

@@ -16,3 +16,4 @@ Some of the commands include:
 * `deny <port>/<optional: protocol>` add deny rule
 * `disable` disables the firewall
 * `enable` enables the firewall
+* `route` add route rule

plugins/ufw/_ufw

@@ -31,6 +31,7 @@ _1st_arguments=(
   'reject:add reject rule'
   'reload:reloads firewall'
   'reset:reset firewall'
+  'route:add route rule'
   'show:show firewall report'
   'status:show firewall status'
   'version:display version information'
@@ -43,6 +44,7 @@ _arguments -C \
   '1:: :->cmds' \
   '2:: :->subcmds' \
   '3:: :->subsubcmds' \
+  '4:: :->subsubsubcmds' \
 && return 0
 
 local rules
@@ -83,6 +85,17 @@ case "$state" in
           'raw' 'builtins' 'before-rules' 'user-rules' 'after-rules' 'logging-rules' 'listening' 'added' \
         && ret=0
         ;;
+      (route)
+        _values 'route' \
+          'delete[delete route rule]' \
+          'insert[insert route rule at NUM]' \
+          'prepend[prepend route rule]' \
+          'allow[add allow route rule]' \
+          'deny[add deny route rule]' \
+          'reject[add reject route rule]' \
+          'limit[add limit route rule]' \
+        && ret=0
+        ;;
       (delete)
         rules="$(_ufw_delete_rules)"
         if [[ -n "$rules" ]] ; then
@@ -109,6 +122,37 @@ case "$state" in
           'incoming' 'outgoing' \
         && ret=0
         ;;
+      (route)
+        case "$line[2]" in
+          (delete|prepend)
+            _values 'route-action' \
+              'allow[route allow rule]' \
+              'deny[route deny rule]' \
+              'reject[route reject rule]' \
+              'limit[route limit rule]' \
+            && ret=0
+            ;;
+          (insert)
+            _message 'route rule number'
+            ;;
+        esac
+        ;;
+    esac
+    ;;
+  (subsubsubcmds)
+    case "$line[1]" in
+      (route)
+        case "$line[2]" in
+          (insert)
+            _values 'route-action' \
+              'allow[route allow rule]' \
+              'deny[route deny rule]' \
+              'reject[route reject rule]' \
+              'limit[route limit rule]' \
+            && ret=0
+            ;;
+        esac
+        ;;
     esac
 esac
 

themes/josh.zsh-theme

@@ -10,6 +10,7 @@ function josh_prompt {
   prompt=" "
 
   branch=$(git_current_branch)
+  branch="${branch//\%/%%}"
   ruby_version=$(ruby_prompt_info)
   path_size=${#PWD}
   branch_size=${#branch}
@@ -31,7 +32,7 @@ function josh_prompt {
     prompt=" $prompt"
   done
 
-  prompt="%{%F{green}%}$PWD$prompt%{%F{red}%}$(ruby_prompt_info)%{$reset_color%} ${branch//\%/%%}"
+  prompt="%{%F{green}%}$PWD$prompt%{%F{red}%}$(ruby_prompt_info)%{$reset_color%} ${branch}"
 
   echo $prompt
 }