From 2974a2dcf9e0efc2101d51cea93af715cc85bb66 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 19:35:35 +0000
Subject: [PATCH 1/2] [pre-commit.ci] pre-commit autoupdate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

updates:
- [github.com/astral-sh/ruff-pre-commit: v0.15.14 → v0.15.18](https://github.com/astral-sh/ruff-pre-commit/compare/v0.15.14...v0.15.18)
- [github.com/gitleaks/gitleaks: v8.30.1 → v8.30.0](https://github.com/gitleaks/gitleaks/compare/v8.30.1...v8.30.0)
---
 .pre-commit-config.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 87689e5..e8ccc45 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -14,7 +14,7 @@ repos:
       - id: check-yaml
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.14
+    rev: v0.15.18
     hooks:
       - id: ruff
       - id: ruff-format
@@ -22,7 +22,7 @@ repos:
   # Secret scan before push (the "general git" pre-push hook). gitleaks uses the
   # repo-root .gitleaks.toml. Runs on pre-push so it gates what leaves the machine.
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: v8.30.0
     hooks:
       - id: gitleaks
         stages: [pre-push]

From 1ed15f33515e656f652327eb170a36b069907b9e Mon Sep 17 00:00:00 2001
From: Shay Palachy <shaypal5@users.noreply.github.com>
Date: Tue, 23 Jun 2026 13:59:36 +0300
Subject: [PATCH 2/2] ci: keep gitleaks pinned at v8.30.1 (autoupdate proposed
 a downgrade)

The pre-commit.ci autoupdate bumped ruff (good) but tried to downgrade gitleaks
v8.30.1 -> v8.30.0, which would desync the pin used by .gitleaks.toml, the CI
install, and the setup-denbust-state-job composite action. Keep 8.30.1; take the
ruff bump.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e8ccc45..4ce30a4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -22,7 +22,7 @@ repos:
   # Secret scan before push (the "general git" pre-push hook). gitleaks uses the
   # repo-root .gitleaks.toml. Runs on pre-push so it gates what leaves the machine.
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: v8.30.1
     hooks:
       - id: gitleaks
         stages: [pre-push]