ci(deps): bump the pre-commit-all group with 2 updates

[dependabot]

Bumps the pre-commit-all group with 2 updates: https://github.com/commitizen-tools/commitizen and https://github.com/gitguardian/ggshield.

Updates https://github.com/commitizen-tools/commitizen from v4.16.5 to 4.17.0

Release notes

Sourced from https://github.com/commitizen-tools/commitizen's releases.

v4.17.0 (2026-07-29)

Feat

• cmd/version: add support for --next USE_GIT_COMMITS

Fix

• robuster agents
• version: remove next from exclusive group
• bump: use correct type for calling changelog

Changelog

Sourced from https://github.com/commitizen-tools/commitizen's changelog.

v4.13.9 (2026-02-25)

Fix

• avoid raising an exception when a change_type is not defined (#1879)

v4.13.8 (2026-02-18)

Fix

• config: fix contains_commitizen_section failing for completely empty files

v4.13.7 (2026-02-09)

Fix

• provider: use encoding settings in config (#1857)

v4.13.6 (2026-02-07)

Fix

• bump: preserve existing changelog header when changelog_merge_prerelease is used with cz bump --changelog (#1850)

v4.13.5 (2026-02-05)

Fix

• changelog: add incremental parameter to changelog generation (#1808)

v4.13.4 (2026-02-04)

Fix

• pre-commit-hooks: correct rev-range syntax in commitizen-branch (#1841)

v4.13.3 (2026-02-04)

Refactor

• version_schemes: shorten generate_prerelease (#1838)

v4.13.2 (2026-02-03)

Refactor

• simplify code with pathlib Path object (#1840)
• tags: extract version resolution method (#1839)

v4.13.1 (2026-02-03)

... (truncated)

Commits

• 93c7b51 bump: version 4.16.5 → 4.17.0
• e0de830 feat(cmd/version): add support for --next USE_GIT_COMMITS
• 9423859 fix: robuster agents
• acd8bce fix(version): remove next from exclusive group
• 653bf67 fix(bump): use correct type for calling changelog
• 19f3b36 build(deps-dev): update uv-build requirement from <0.12,>=0.9.17 to >=0.9.17,...
• 6f50f4b ci(deps): bump gitpython from 3.1.52 to 3.1.54 (#2038)
• 542e7a5 ci(deps): bump pymdown-extensions from 10.21.3 to 11.0 (#2037)
• d1766ae ci(deps): bump gitpython from 3.1.50 to 3.1.52 (#2035)
• f087597 ci(deps): bump actions/labeler from 6 to 7 (#2034)
• Additional commits viewable in compare view

Updates https://github.com/gitguardian/ggshield from v1.52.2 to 1.53.0

Release notes

Sourced from https://github.com/gitguardian/ggshield's releases.

1.53.0

Added

• ggshield ai discover --activity now also collects raw AI-agent activity (transcript lines / database rows) from Claude Code, Codex, Cursor, Copilot CLI and VSCode and ships it to GitGuardian, which scans the content and strips secrets server-side. This is an experimental feature.

• ggshield now officially supports Python 3.13: it is covered by the CI test matrix, advertised through the trove classifiers, and pip install ggshield works on a Python 3.13 interpreter.

• AI discovery now sends whether hooks are installed globally, per agent.

• ggshield machine setup sets up all of this machine's ggshield protections in one idempotent command: the AI hook for every detected AI coding assistant, the global git pre-commit/pre-push hooks, and a honeytoken. Each protection is on by default; drop one with --no-ai-hooks / --no-git-hooks / --no-honeytokens. Narrow which assistants get the AI hook with --agent / --exclude-agent. Replaces running ggshield install -t <assistant> once per agent.

• ggshield machine setup now installs git hooks machine-wide (for every user) when run as root or with the new --system flag, instead of only for the invoking user. This makes MDM/fleet deployments work as expected: a single root-run machine setup sets git's system core.hooksPath, so every user on the machine is covered. Without root (and without --system) it keeps installing per-user as before.

• ggshield machine doctor checks that this machine's ggshield protections are correctly set up: the AI hooks and git hooks are installed, the GitGuardian token is reachable and carries the scopes the configured protections need (scan, plus honeytokens:write and — when the machine_scan plugin is installed — endpoints:send, both of which require a Business or Enterprise plan), and that the plugin's native scanner loads. It is read-only, prints a specific fix for each failed check, and exits non-zero if any check fails, so it can gate an MDM rollout.

• Scan requests now include Machine-Id and Machine-Username headers

• AI scan requests now include the agent name in the headers sent to the scan route.

• ggshield machine doctor now detects when a higher-precedence git core.hooksPath (a repo-local or user-global one, e.g. Husky or lefthook) shadows the ggshield git hook. Git uses only the most-specific core.hooksPath, so such an override silently bypasses ggshield's system/global hook — doctor reports it as a failed "Git hook precedence" check (per repo) instead of giving a false sense of coverage.

• ggshield machine setup warns at install time when a core.hooksPath override takes precedence in the current context, so its git hook would be shadowed there.

• New --filename-only flag for ggshield secret scan: when set, only the file name (not its full path) is sent to GitGuardian, so incidents record just the filename (e.g. config.py instead of src/app/config.py). Recursive scanning still works.

• Plugins can now be installed machine-wide. Running ggshield plugin install or ggshield plugin enable as root writes to a shared system location so every user on the machine can load the plugin; non-root installs stay per-user as before. A user can still disable an admin-enabled plugin for themselves.

• install.sh now offers to add the install dir to your PATH itself when it's missing, instead of only printing instructions: it detects bash, zsh, fish, and (independent of $SHELL) Nushell and PowerShell on Linux when installed, and updates the matching shell profile. Prompted with a default of yes, silent under -y, skippable with the new --no-modify-path. uninstall.sh reverses the edit.

Changed

• Documented the install script at the top of the README's Installation section, with the curl | bash (Linux/macOS) and irm | iex / curl (Windows) one-liners and a pointer to scripts/install/README.md for the full options and uninstall.

• The documented curl | bash install/uninstall one-liners no longer pass the redundant --proto '=https' and --tlsv1.2 flags: the URLs are already https:// and GitHub serves only TLS 1.2+, so they added nothing (-sSfL, including -f, is kept).

• The README marks the install script as the recommended install method and shows an example that authenticates against the EU workspace or a self-hosted instance.

• ggshield auth login now requests the ai-discover:send scope by default, enabling upload of AI discovery data to GitGuardian without requiring --scopes ai-discover:send explicitly.

• Documented the Windows MSI installer in the README's Windows installation section, with the release-page download and msiexec install command.

• The Linux/macOS install script now prints shell-specific guidance, as a visible warning, when ggshield won't be callable yet: either ~/.local/bin is not on your PATH, or an older ggshield install shadows the new one. In both cases it gives the exact line to add for your shell (zsh/bash/fish/other) plus a reminder to restart your terminal, shown at the end of the run instead of a generic note buried mid-install.

• The install-scripts README documents -y/--yes and bash -s -- --purge -y for unattended uninstall.

• Relaxed the upper version bounds of several dependencies (click, oauthlib, python-dotenv, pyyaml, requests and marshmallow-dataclass) from the next minor release to the next major. This lets ggshield be installed alongside projects that require newer versions of these packages (for example click 8.2+) and lets users pull in dependency security fixes without waiting for a new ggshield release.

• ggshield machine doctor now also verifies the token carries the

... (truncated)

Changelog

Sourced from https://github.com/gitguardian/ggshield's changelog.

1.53.0 — 2026-07-28

Added

• ggshield ai discover --activity now also collects raw AI-agent activity (transcript lines / database rows) from Claude Code, Codex, Cursor, Copilot CLI and VSCode and ships it to GitGuardian, which scans the content and strips secrets server-side. This is an experimental feature.

• ggshield now officially supports Python 3.13: it is covered by the CI test matrix, advertised through the trove classifiers, and pip install ggshield works on a Python 3.13 interpreter.

• AI discovery now sends whether hooks are installed globally, per agent.

• ggshield machine setup sets up all of this machine's ggshield protections in one idempotent command: the AI hook for every detected AI coding assistant, the global git pre-commit/pre-push hooks, and a honeytoken. Each protection is on by default; drop one with --no-ai-hooks / --no-git-hooks / --no-honeytokens. Narrow which assistants get the AI hook with --agent / --exclude-agent. Replaces running ggshield install -t <assistant> once per agent.

• ggshield machine setup now installs git hooks machine-wide (for every user) when run as root or with the new --system flag, instead of only for the invoking user. This makes MDM/fleet deployments work as expected: a single root-run machine setup sets git's system core.hooksPath, so every user on the machine is covered. Without root (and without --system) it keeps installing per-user as before.

• ggshield machine doctor checks that this machine's ggshield protections are correctly set up: the AI hooks and git hooks are installed, the GitGuardian token is reachable and carries the scopes the configured protections need (scan, plus honeytokens:write and — when the machine_scan plugin is installed — endpoints:send, both of which require a Business or Enterprise plan), and that the plugin's native scanner loads. It is read-only, prints a specific fix for each failed check, and exits non-zero if any check fails, so it can gate an MDM rollout.

• Scan requests now include Machine-Id and Machine-Username headers

• AI scan requests now include the agent name in the headers sent to the scan route.

• ggshield machine doctor now detects when a higher-precedence git core.hooksPath (a repo-local or user-global one, e.g. Husky or lefthook) shadows the ggshield git hook. Git uses only the most-specific core.hooksPath, so such an override silently bypasses ggshield's system/global hook — doctor reports it as a failed "Git hook precedence" check (per repo) instead of giving a false sense of coverage.

• ggshield machine setup warns at install time when a core.hooksPath override takes precedence in the current context, so its git hook would be shadowed there.

• New --filename-only flag for ggshield secret scan: when set, only the file name (not its full path) is sent to GitGuardian, so incidents record just the filename (e.g. config.py instead of src/app/config.py). Recursive scanning still works.

• Plugins can now be installed machine-wide. Running ggshield plugin install or ggshield plugin enable as root writes to a shared system location so every user on the machine can load the plugin; non-root installs stay per-user as before. A user can still disable an admin-enabled plugin for themselves.

• install.sh now offers to add the install dir to your PATH itself when it's missing, instead of only printing instructions: it detects bash, zsh, fish, and (independent of $SHELL) Nushell and PowerShell on Linux when installed, and updates the matching shell profile. Prompted with a default of yes, silent under -y, skippable with the new --no-modify-path. uninstall.sh reverses the edit.

Changed

• Documented the install script at the top of the README's Installation section, with the curl | bash (Linux/macOS) and irm | iex / curl (Windows) one-liners and a pointer to scripts/install/README.md for the full options and uninstall.

• The documented curl | bash install/uninstall one-liners no longer pass the redundant --proto '=https' and --tlsv1.2 flags: the URLs are already https:// and GitHub serves only TLS 1.2+, so they added nothing (-sSfL, including -f, is kept).

• The README marks the install script as the recommended install method and shows an example that authenticates against the EU workspace or a self-hosted instance.

• ggshield auth login now requests the ai-discover:send scope by default, enabling upload of AI discovery data to GitGuardian without requiring --scopes ai-discover:send explicitly.

• Documented the Windows MSI installer in the README's Windows installation section, with the release-page download and msiexec install command.

• The Linux/macOS install script now prints shell-specific guidance, as a visible warning, when ggshield won't be callable yet: either ~/.local/bin is not on your PATH, or an older ggshield install shadows the new one. In both cases it gives the exact line to add for your shell (zsh/bash/fish/other) plus a reminder to restart your terminal, shown at the end of the run instead of a generic note buried mid-install.

• The install-scripts README documents -y/--yes and bash -s -- --purge -y for unattended uninstall.

• Relaxed the upper version bounds of several dependencies (click, oauthlib, python-dotenv, pyyaml, requests and marshmallow-dataclass) from the next minor release to the next major. This lets ggshield be installed alongside projects that require newer versions of these packages (for example click 8.2+) and lets users pull in dependency security fixes without waiting for a new ggshield release.

... (truncated)

Commits

• faa02e4 Merge pull request #1368 from GitGuardian/ctourriere/fix_tag_workflow_downstr...
• 72d4ef1 ci: point tag workflow at the renamed downstream workflow
• b583173 chore(release): 1.53.0
• 8b3aff9 Merge pull request #1367 from GitGuardian/ctourriere/fix_api_status_workspace...
• 1ca4d24 test(api-status): stop pinning workspace id and scopes to recorded values
• a082603 Merge pull request #1366 from GitGuardian/ctourriere/bump_py_gitguardian_1_33_1
• e7b2507 chore: update py-gitguardian to use pypi release
• 4f2027a Merge pull request #1335 from GitGuardian/ctourriere/END-643/machine-wide-plu...
• fa4e242 Merge branch 'main' into ctourriere/END-643/machine-wide-plugins
• 7947d10 Merge pull request #1354 from GitGuardian/perf/defer-plugin-signature-imports
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions