From 2b2d6d746ca3ed6dfac26be331e49fa80a1191ab Mon Sep 17 00:00:00 2001
From: Denys Dovhan <denysdovhan@gmail.com>
Date: Fri, 19 Sep 2025 16:39:50 +0300
Subject: [PATCH 01/80] fix(bgnotify): use lsappinfo, add support for ghostty
 (#13314)

---
 plugins/bgnotify/bgnotify.plugin.zsh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/plugins/bgnotify/bgnotify.plugin.zsh b/plugins/bgnotify/bgnotify.plugin.zsh
index dca8250be..4c1613eed 100644
--- a/plugins/bgnotify/bgnotify.plugin.zsh
+++ b/plugins/bgnotify/bgnotify.plugin.zsh
@@ -60,8 +60,10 @@ function bgnotify_formatted {
 }
 
 function bgnotify_appid {
-  if (( ${+commands[osascript]} )); then
-    osascript -e "tell application id \"$(bgnotify_programid)\"  to get the {id, frontmost, id of front window, visible of front window}" 2>/dev/null
+  if (( ${+commands[lsappinfo]} )); then
+    lsappinfo info -only bundleid "$(lsappinfo front)" | awk -F= '{print $2}' | tr -d '"' 2>/dev/null
+  elif (( ${+commands[osascript]} )); then
+    osascript -e "tell application id \"$(bgnotify_programid)\" to get the {id, frontmost, id of front window, visible of front window}" 2>/dev/null
   elif [[ -n $WAYLAND_DISPLAY ]] && ([[ -n $SWAYSOCK ]] || [[ -n $I3SOCK ]]) && (( ${+commands[swaymsg]} )); then # wayland+sway
     local app_id=$(bgnotify_find_sway_appid)
     [[ -n "$app_id" ]] && echo "$app_id" || echo $EPOCHSECONDS
@@ -108,6 +110,7 @@ function bgnotify_programid {
   case "$TERM_PROGRAM" in
     iTerm.app) echo 'com.googlecode.iterm2' ;;
     Apple_Terminal) echo 'com.apple.terminal' ;;
+    ghostty) echo 'com.mitchellh.ghostty' ;;
   esac
 }
 

From 34d6932b081055901ee95512eae5935a11bb51cd Mon Sep 17 00:00:00 2001
From: Lin <56944601+LinPr@users.noreply.github.com>
Date: Fri, 19 Sep 2025 21:41:21 +0800
Subject: [PATCH 02/80] feat(task): add completion plugin (#13313)

---
 plugins/task/README.md       |  9 +++++++++
 plugins/task/task.plugin.zsh | 14 ++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 plugins/task/README.md
 create mode 100644 plugins/task/task.plugin.zsh

diff --git a/plugins/task/README.md b/plugins/task/README.md
new file mode 100644
index 000000000..606289bcd
--- /dev/null
+++ b/plugins/task/README.md
@@ -0,0 +1,9 @@
+# Buf plugin
+
+This plugin adds completion for [Task CLI](https://taskfile.dev/), a fast, cross-platform build tool inspired by Make, designed for modern workflows.
+
+To use it, add `task` to the plugins array in your zshrc file:
+
+```zsh
+plugins=(... task)
+```
\ No newline at end of file
diff --git a/plugins/task/task.plugin.zsh b/plugins/task/task.plugin.zsh
new file mode 100644
index 000000000..86b21b3cd
--- /dev/null
+++ b/plugins/task/task.plugin.zsh
@@ -0,0 +1,14 @@
+# Autocompletion for the task CLI (task).
+if (( !$+commands[task] )); then
+  return
+fi
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `task`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_task" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _task
+  _comps[task]=_task
+fi
+
+# Generate and load task completion
+task --completion zsh >! "$ZSH_CACHE_DIR/completions/_task" &|
\ No newline at end of file

From d3888251acae61f0ce2c7a780e97a5d2f406bd9f Mon Sep 17 00:00:00 2001
From: Paul Frederiksen <paul@paulfrederiksen.com>
Date: Fri, 19 Sep 2025 06:47:45 -0700
Subject: [PATCH 03/80] fix(check_for_upgrade): ensure compatibility with
 screen (#13302)

Co-authored-by: Paul Frederiksen <pfrederiksen@Pauls-Laptop.local>
---
 tools/check_for_upgrade.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/check_for_upgrade.sh b/tools/check_for_upgrade.sh
index 35391ea70..44dbb7b31 100644
--- a/tools/check_for_upgrade.sh
+++ b/tools/check_for_upgrade.sh
@@ -232,7 +232,7 @@ function handle_update() {
 
     # Ask for confirmation and only update on 'y', 'Y' or Enter
     # Otherwise just show a reminder for how to update
-    echo -n "[oh-my-zsh] Would you like to update? [Y/n] "
+    printf "[oh-my-zsh] Would you like to update? [Y/n] "
     read -r -k 1 option
     [[ "$option" = $'\n' ]] || echo
     case "$option" in
@@ -280,7 +280,7 @@ case "$update_mode" in
           return 0
         elif [[ "$EXIT_STATUS" -ne 0 ]]; then
           print -P "\n%F{red}[oh-my-zsh] There was an error updating:%f"
-          printf "\n${fg[yellow]}%s${reset_color}" "$ERROR"
+          printf "\n${fg[yellow]}%s${reset_color}" "${ERROR}"
           return 0
         fi
       } always {

From c1e9748909af0f26dfe45c98b1f5527c790e31c4 Mon Sep 17 00:00:00 2001
From: jayant011797 <jayantismyname@outlook.com>
Date: Fri, 19 Sep 2025 19:21:23 +0530
Subject: [PATCH 04/80] docs(tldr): state that `tldr` should be installed
 separately (#13298)

---
 plugins/tldr/README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/plugins/tldr/README.md b/plugins/tldr/README.md
index fb91d9d1f..03b1dfc73 100644
--- a/plugins/tldr/README.md
+++ b/plugins/tldr/README.md
@@ -13,3 +13,6 @@ plugins=(... tldr)
 | Shortcut                           | Description                                                                |
 |------------------------------------|----------------------------------------------------------------------------|
 | <kbd>Esc</kbd> + tldr              | add tldr before the previous command to see the tldr page for this command |
+
+## Note
+You also need to install ```tldr```.

From c87eb79140ac359cf4f71604ddbf7209e1282939 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Fri, 19 Sep 2025 15:58:21 +0200
Subject: [PATCH 05/80] feat(cli): only allow `omz pr test` on PRs with
 `testers needed` label (#13238)

---
 lib/cli.zsh | 40 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/lib/cli.zsh b/lib/cli.zsh
index 0b144e4e7..a002a5073 100644
--- a/lib/cli.zsh
+++ b/lib/cli.zsh
@@ -621,10 +621,48 @@ function _omz::pr::test {
     done
 
     (( $found )) || {
-      _omz::log error "could not found the ohmyzsh git remote. Aborting..."
+      _omz::log error "could not find the ohmyzsh git remote. Aborting..."
       return 1
     }
 
+    # Check if Pull Request has the "testers needed" label
+    _omz::log info "checking if PR #$1 has the 'testers needed' label..."
+    local pr_json label label_id="MDU6TGFiZWw4NzY1NTkwNA=="
+    pr_json=$(
+      curl -fsSL \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "https://api.github.com/repos/ohmyzsh/ohmyzsh/pulls/$1"
+    )
+
+    if [[ $? -gt 0 || -z "$pr_json" ]]; then
+      _omz::log error "error when trying to fetch PR #$1 from GitHub."
+      return 1
+    fi
+
+    # Check if the label is present with jq or grep
+    if (( $+commands[jq] )); then
+      label="$(command jq ".labels.[] | select(.node_id == \"$label_id\")" <<< "$pr_json")"
+    else
+      label="$(command grep "\"$label_id\"" <<< "$pr_json" 2>/dev/null)"
+    fi
+
+    # If a maintainer hasn't labeled the PR to test, explain the security risk
+    if [[ -z "$label" ]]; then
+      _omz::log warn "PR #$1 does not have the 'testers needed' label. This means that the PR"
+      _omz::log warn "has not been reviewed by a maintainer and may contain malicious code."
+
+      # Ask for explicit confirmation: user needs to type "yes" to continue
+      _omz::log prompt "Do you want to continue testing it? [yes/N] "
+      builtin read -r
+      if [[ "${REPLY:l}" != yes ]]; then
+        _omz::log error "PR test canceled. Please ask a maintainer to review and label the PR."
+        return 1
+      else
+        _omz::log warn "Continuing to check out and test PR #$1. Be careful!"
+      fi
+    fi
+
     # Fetch pull request head
     _omz::log info "fetching PR #$1 to ohmyzsh/pull-$1..."
     command git fetch -f "$remote" refs/pull/$1/head:ohmyzsh/pull-$1 || {

From 7f3d8a34e2d850b51782f0900151413b435296d4 Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Fri, 19 Sep 2025 08:30:10 -0700
Subject: [PATCH 06/80] ci: Harden GitHub Actions [StepSecurity] (#13318)

---
 .github/workflows/dependencies.yml | 11 ++++++++---
 .github/workflows/installer.yml    | 14 ++++++++++++--
 .github/workflows/main.yml         |  7 ++++++-
 .github/workflows/project.yml      |  7 ++++++-
 4 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 11c0ad0ef..3f448fe64 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -13,18 +13,23 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: "3.12"
           cache: "pip"
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 9e933350f..2d1de706a 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -25,8 +25,13 @@ jobs:
           - ubuntu-latest
           - macos-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Set up git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -41,8 +46,13 @@ jobs:
     needs:
       - test
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c49324495..b48a3d32b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -23,8 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Set up git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 8fd4e15d4..ba971db15 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -16,9 +16,14 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}

From ddd77516efb1393af738e57de9522e091c63c5b6 Mon Sep 17 00:00:00 2001
From: Carlo Sala <carlosalag@protonmail.com>
Date: Fri, 19 Sep 2025 17:55:16 +0200
Subject: [PATCH 07/80] ci: add scorecard automatic update (#13319)

---
 .github/workflows/scorecard.yml | 65 +++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 000000000..5654fb74b
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,65 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches: ["master"]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+      # To allow GraphQL ListCommits to work
+      issues: read
+      pull-requests: read
+      # To detect SAST tools
+      checks: read
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        with:
+          sarif_file: results.sarif

From b428e3177022a5d2c026a670ff9df64fcb704ec2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 10:50:42 +0200
Subject: [PATCH 08/80] chore(deps): bump actions/checkout from 4.3.0 to 5.0.0
 (#13323)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5654fb74b..49b21cbd9 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 

From 58cba614652ce8115138fef5c7d80c8a0c0a58f4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 22 Sep 2025 10:50:59 +0200
Subject: [PATCH 09/80] chore(deps): bump ossf/scorecard-action from 2.4.0 to
 2.4.2 (#13322)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 49b21cbd9..c366b95bc 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif

From 763aab3271f4bbe3b41caabd28088b7fb31abae4 Mon Sep 17 00:00:00 2001
From: Christian Kilmer <109920997+ChristianKilmer@users.noreply.github.com>
Date: Tue, 23 Sep 2025 05:57:21 -0400
Subject: [PATCH 10/80] fix(command-not-found): support latest homebrew
 (#13327)

Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
---
 plugins/command-not-found/command-not-found.plugin.zsh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/plugins/command-not-found/command-not-found.plugin.zsh b/plugins/command-not-found/command-not-found.plugin.zsh
index c741e18a2..85d778004 100644
--- a/plugins/command-not-found/command-not-found.plugin.zsh
+++ b/plugins/command-not-found/command-not-found.plugin.zsh
@@ -4,6 +4,10 @@ for file (
   # Arch Linux. Must have pkgfile installed: https://wiki.archlinux.org/index.php/Pkgfile#Command_not_found
   /usr/share/doc/pkgfile/command-not-found.zsh
   # Homebrew: https://github.com/Homebrew/homebrew-command-not-found
+  /opt/homebrew/Library/Homebrew/command-not-found/handler.sh
+  /usr/local/Homebrew/Library/Homebrew/command-not-found/handler.sh
+  /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/command-not-found/handler.sh
+	# Old homebrew implementation
   /opt/homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh
   /usr/local/Homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh
   /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew-command-not-found/handler.sh

From 6d5482ef59d1a3ae3b40b4583317ebe802f81447 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Sat, 27 Sep 2025 15:56:46 +0200
Subject: [PATCH 11/80] chore: remove obsolete gitpod integration (#13334)

---
 .gitpod.Dockerfile | 5 -----
 .gitpod.yml        | 9 ---------
 README.md          | 1 -
 3 files changed, 15 deletions(-)
 delete mode 100644 .gitpod.Dockerfile
 delete mode 100644 .gitpod.yml

diff --git a/.gitpod.Dockerfile b/.gitpod.Dockerfile
deleted file mode 100644
index b35c80dfb..000000000
--- a/.gitpod.Dockerfile
+++ /dev/null
@@ -1,5 +0,0 @@
-FROM gitpod/workspace-full
-
-RUN sudo apt-get update && \
-    sudo apt-get install -y zsh && \
-    sudo rm -rf /var/lib/apt/lists/*
diff --git a/.gitpod.yml b/.gitpod.yml
deleted file mode 100644
index ccc57242c..000000000
--- a/.gitpod.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-image:
-  file: .gitpod.Dockerfile
-
-tasks:
-  - init: |
-      export EDITOR="command gp open -w" VISUAL="command gp open -w"
-      cp -f /workspace/ohmyzsh/templates/zshrc.zsh-template ~/.zshrc
-      ln -sf /workspace/ohmyzsh ~/.oh-my-zsh
-    command: exec zsh
diff --git a/README.md b/README.md
index 7f57ed55e..55bfa0c5a 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,6 @@ Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 [![X (formerly Twitter) Follow](https://img.shields.io/twitter/follow/ohmyzsh?label=%40ohmyzsh&logo=x&style=flat)](https://twitter.com/intent/follow?screen_name=ohmyzsh)
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/111169632522566717?label=%40ohmyzsh&domain=https%3A%2F%2Fmstdn.social&logo=mastodon&style=flat)](https://mstdn.social/@ohmyzsh)
 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)
-[![Gitpod ready](https://img.shields.io/badge/Gitpod-ready-blue?logo=gitpod)](https://gitpod.io/#https://github.com/ohmyzsh/ohmyzsh)
 
 <details>
 <summary>Table of Contents</summary>

From 242e2faa51675494cbfa78a81f3ff47d81039863 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Sat, 27 Sep 2025 20:00:50 +0200
Subject: [PATCH 12/80] ci: improve security in project.yml workflow (#13329)

There is no inherent security vulnerability in the workflow, but there were
certain practices that increased latent risk. In this commit, we:

- Explicitly bind app token for each step that needs it, instead of setting it for
  all steps after "Store app token"
- Refactor "classify" step, to not rely on files passed around, and instead uses
  only awk script.
- Remove all instances of template injection within `run` scripts. There was nothing
  dangerous, but the practice is unsafe.
- Sanitize all unwanted characters from PR plugin and theme names.

References: W2M1-06 W2M1-07
---
 .github/workflows/project.yml | 64 +++++++++++++++++++----------------
 1 file changed, 34 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index ba971db15..e6da2cbe5 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -20,17 +20,15 @@ jobs:
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
-
       - name: Authenticate as @ohmyzsh
         id: generate-token
         uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
-      - name: Store app token
-        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> "$GITHUB_ENV"
       - name: Read project data
         env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           ORGANIZATION: ohmyzsh
           PROJECT_NUMBER: "1"
         run: |
@@ -53,14 +51,14 @@ jobs:
             }' -f org=$ORGANIZATION -F number=$PROJECT_NUMBER > project_data.json
 
           # Parse project data
-          cat >> $GITHUB_ENV <<EOF
+          cat >> "$GITHUB_ENV" <<EOF
           PROJECT_ID=$(jq '.data.organization.projectV2.id' project_data.json)
           PLUGIN_FIELD_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name == "Plugin") | .id' project_data.json)
           THEME_FIELD_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name == "Theme") | .id' project_data.json)
           EOF
-
       - name: Add to project
         env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           ISSUE_OR_PR_ID: ${{ github.event.issue.node_id || github.event.pull_request.node_id }}
         run: |
           item_id="$(gh api graphql -f query='
@@ -71,45 +69,51 @@ jobs:
                 }
               }
             }
-          ' -f project=$PROJECT_ID -f content=$ISSUE_OR_PR_ID --jq '.data.addProjectV2ItemById.item.id')"
+          ' -f project="$PROJECT_ID" -f content="$ISSUE_OR_PR_ID" --jq '.data.addProjectV2ItemById.item.id')"
 
           echo "ITEM_ID=$item_id" >> $GITHUB_ENV
-
       - name: Classify Pull Request
         if: github.event_name == 'pull_request_target'
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          touch plugins.list themes.list
-
-          gh pr view ${{ github.event.pull_request.number }} \
-            --repo ${{ github.repository }} \
+          # Get the list of modified files in the PR, and extract plugins and themes
+          gh pr view "$PR_NUMBER" \
+            --repo "$GITHUB_REPOSITORY" \
             --json files --jq '.files.[].path' | awk -F/ '
+            BEGIN {
+              plugins = 0
+              themes = 0
+            }
             /^plugins\// {
-              plugins[$2] = 1
+              if (plugin == $2) next
+              plugin = $2
+              plugins++
             }
             /^themes\// {
               gsub(/\.zsh-theme$/, "", $2)
-              themes[$2] = 1
+              if (theme == $2) next
+              theme = $2
+              themes++
             }
             END {
-              for (plugin in plugins) {
-                print plugin >> "plugins.list"
+              # plugin and theme are values controlled by the PR author
+              # so we should sanitize them before using anywhere else
+              if (plugins == 1) {
+                gsub(/[^a-zA-Z0-9._-]/, "", plugin)
+                print "PLUGIN=" plugin
               }
-              for (theme in themes) {
-                print theme >> "themes.list"
+              if (themes == 1) {
+                gsub(/[^a-zA-Z0-9._-]/, "", theme)
+                print "THEME=" theme
               }
             }
-          '
-          # If only one plugin is modified, add it to the plugin field
-          if [[ $(wc -l < plugins.list) = 1 ]]; then
-            echo "PLUGIN=$(cat plugins.list)" >> $GITHUB_ENV
-          fi
-          # If only one theme is modified, add it to the theme field
-          if [[ $(wc -l < themes.list) = 1 ]]; then
-            echo "THEME=$(cat themes.list)" >> $GITHUB_ENV
-          fi
-
+          ' >> "$GITHUB_ENV"
       - name: Fill Pull Request fields in project
         if: github.event_name == 'pull_request_target'
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           gh api graphql -f query='
             mutation (
@@ -145,7 +149,7 @@ jobs:
                 }
               }
             }
-          ' -f project=$PROJECT_ID -f item=$ITEM_ID \
-            -f plugin_field=$PLUGIN_FIELD_ID -f plugin_value=$PLUGIN \
-            -f theme_field=$THEME_FIELD_ID -f theme_value=$THEME \
+          ' -f project="$PROJECT_ID" -f item="$ITEM_ID" \
+            -f plugin_field="$PLUGIN_FIELD_ID" -f plugin_value="$PLUGIN" \
+            -f theme_field="$THEME_FIELD_ID" -f theme_value="$THEME" \
             --silent

From e7528a5b373568591b0ba4f5c0fe1b552c0d6874 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Sep 2025 08:27:53 +0200
Subject: [PATCH 13/80] chore(deps): bump github/codeql-action from 3.30.3 to
 3.30.5 (#13336)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c366b95bc..e6ff44e4a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
         with:
           sarif_file: results.sarif

From 9ac3b895d426dfdd000b8ae884a8bf9d42840839 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Sep 2025 08:31:23 +0200
Subject: [PATCH 14/80] chore(deps): bump pyyaml in
 /.github/workflows/dependencies (#13337)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index 7388ed765..441426dcf 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -1,7 +1,7 @@
 certifi==2025.8.3
 charset-normalizer==3.4.3
 idna==3.10
-PyYAML==6.0.2
+PyYAML==6.0.3
 requests==2.32.5
 semver==3.0.4
 urllib3==2.5.0

From 1237525b23abf2ad785c7ed434093a11261c71b0 Mon Sep 17 00:00:00 2001
From: DE SILVA T R R <IT22236296@my.sliit.lk>
Date: Mon, 29 Sep 2025 12:02:18 +0530
Subject: [PATCH 15/80] docs(common-aliases): fix tar.gz command (#13332)

---
 plugins/common-aliases/README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/plugins/common-aliases/README.md b/plugins/common-aliases/README.md
index 1417c3056..79e3d0d0f 100644
--- a/plugins/common-aliases/README.md
+++ b/plugins/common-aliases/README.md
@@ -114,13 +114,13 @@ that file will be open with `acroread`.
 
 ### Listing files inside a packed file
 
-| Alias  | Command    | Description                       |
-| ------ | ---------- | --------------------------------- |
-| zip    | `unzip -l` | Lists files inside a .zip file    |
-| rar    | `unrar l`  | Lists files inside a .rar file    |
-| tar    | `tar tf`   | Lists files inside a .tar file    |
-| tar.gz | `echo`     | Lists files inside a .tar.gz file |
-| ace    | `unace l`  | Lists files inside a .ace file    |
+| Alias  | Command      | Description                       |
+| ------ | ------------ | --------------------------------- |
+| zip    | `unzip -l`   | Lists files inside a .zip file    |
+| rar    | `unrar l`    | Lists files inside a .rar file    |
+| tar    | `tar tf`     | Lists files inside a .tar file    |
+| tar.gz | `tar -ztf`   | Lists files inside a .tar.gz file |
+| ace    | `unace l`    | Lists files inside a .ace file    |
 
 ### Some other features
 

From d57775d89e15687b87eef990b864492d6c973238 Mon Sep 17 00:00:00 2001
From: Carlo Sala <carlosalag@protonmail.com>
Date: Mon, 29 Sep 2025 08:41:24 +0200
Subject: [PATCH 16/80] fix(git): replace `whatchanged` with `log` (#13338)

Closes #13333
---
 plugins/git/README.md      | 4 ++--
 plugins/git/git.plugin.zsh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/plugins/git/README.md b/plugins/git/README.md
index edddc8cd8..0ecbea7b6 100644
--- a/plugins/git/README.md
+++ b/plugins/git/README.md
@@ -91,7 +91,7 @@ plugins=(... git)
 | `gdnolock`             | `git diff $@ ":(exclude)package-lock.json" ":(exclude)\*.lock"`                                                                 |
 | `gdt`                  | `git diff-tree --no-commit-id --name-only -r`                                                                                   |
 | `gf`                   | `git fetch`                                                                                                                     |
-| `gfa`                  | `git fetch --all --tags --prune`                                                                                                       |
+| `gfa`                  | `git fetch --all --tags --prune`                                                                                                |
 | `gfo`                  | `git fetch origin`                                                                                                              |
 | `gg`                   | `git gui citool`                                                                                                                |
 | `gga`                  | `git gui citool --amend`                                                                                                        |
@@ -213,7 +213,7 @@ plugins=(... git)
 | `gtv`                  | `git tag \| sort -V`                                                                                                            |
 | `gignore`              | `git update-index --assume-unchanged`                                                                                           |
 | `gunignore`            | `git update-index --no-assume-unchanged`                                                                                        |
-| `gwch`                 | `git whatchanged -p --abbrev-commit --pretty=medium`                                                                            |
+| `gwch`                 | `git log --patch --abbrev-commit --pretty=medium --raw`                                                                         |
 | `gwt`                  | `git worktree`                                                                                                                  |
 | `gwtls`                | `git worktree list`                                                                                                             |
 | `gwtmv`                | `git worktree move`                                                                                                             |
diff --git a/plugins/git/git.plugin.zsh b/plugins/git/git.plugin.zsh
index 830c18939..adca1c3c5 100644
--- a/plugins/git/git.plugin.zsh
+++ b/plugins/git/git.plugin.zsh
@@ -409,7 +409,7 @@ alias gts='git tag --sign'
 alias gtv='git tag | sort -V'
 alias gignore='git update-index --assume-unchanged'
 alias gunignore='git update-index --no-assume-unchanged'
-alias gwch='git whatchanged -p --abbrev-commit --pretty=medium'
+alias gwch='git log --patch --abbrev-commit --pretty=medium --raw'
 alias gwt='git worktree'
 alias gwta='git worktree add'
 alias gwtls='git worktree list'

From 1210973cbc978097adfa8f31becf5fe4e2acce99 Mon Sep 17 00:00:00 2001
From: Ardeshir Nahavandi Fard <68429735+Vonarian@users.noreply.github.com>
Date: Sun, 5 Oct 2025 10:46:44 +0330
Subject: [PATCH 17/80] fix(flutter): fix captured keyboard during completion
 generation (#13350)

---
 plugins/flutter/flutter.plugin.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/flutter/flutter.plugin.zsh b/plugins/flutter/flutter.plugin.zsh
index 44d196cd4..5e853b78f 100644
--- a/plugins/flutter/flutter.plugin.zsh
+++ b/plugins/flutter/flutter.plugin.zsh
@@ -26,4 +26,4 @@ if [[ ! -f "$ZSH_CACHE_DIR/completions/_flutter" ]]; then
   _comps[flutter]=_flutter
 fi
 
-flutter zsh-completion >| "$ZSH_CACHE_DIR/completions/_flutter" &|
\ No newline at end of file
+flutter zsh-completion < /dev/null >| "$ZSH_CACHE_DIR/completions/_flutter" &|
\ No newline at end of file

From 182dfdf210f961f141903fdd36f65350bcedc904 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 09:21:34 +0200
Subject: [PATCH 18/80] chore(deps): bump ossf/scorecard-action from 2.4.2 to
 2.4.3 (#13352)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e6ff44e4a..31c420581 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

From d4cb4f249c365ba921840f1a4279ffd55d09e9a3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 09:21:45 +0200
Subject: [PATCH 19/80] chore(deps): bump certifi in
 /.github/workflows/dependencies (#13353)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index 441426dcf..0531f9f0a 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -1,4 +1,4 @@
-certifi==2025.8.3
+certifi==2025.10.5
 charset-normalizer==3.4.3
 idna==3.10
 PyYAML==6.0.3

From c6482fa5be724e9504c6ffe92203440e4c3239b5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 09:21:58 +0200
Subject: [PATCH 20/80] chore(deps): bump github/codeql-action from 3.30.5 to
 3.30.6 (#13351)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 31c420581..cfaa5f03e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
         with:
           sarif_file: results.sarif

From 853680fd621a8907338e0eee080dc6cf754408bf Mon Sep 17 00:00:00 2001
From: Paul Frederiksen <paul@paulfrederiksen.com>
Date: Thu, 9 Oct 2025 03:52:09 -0700
Subject: [PATCH 21/80] fix(history-substring-search): honor `CASE_SENSITIVE`
 variable (#13360)

---
 .../history-substring-search.zsh                         | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/plugins/history-substring-search/history-substring-search.zsh b/plugins/history-substring-search/history-substring-search.zsh
index 9f0e0b0d5..db516f580 100644
--- a/plugins/history-substring-search/history-substring-search.zsh
+++ b/plugins/history-substring-search/history-substring-search.zsh
@@ -45,7 +45,14 @@
 
 : ${HISTORY_SUBSTRING_SEARCH_HIGHLIGHT_FOUND='bg=magenta,fg=white,bold'}
 : ${HISTORY_SUBSTRING_SEARCH_HIGHLIGHT_NOT_FOUND='bg=red,fg=white,bold'}
-: ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
+
+# Respect CASE_SENSITIVE setting for case sensitivity
+if [[ "$CASE_SENSITIVE" = true ]]; then
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS=''}
+else
+  : ${HISTORY_SUBSTRING_SEARCH_GLOBBING_FLAGS='i'}
+fi
+
 : ${HISTORY_SUBSTRING_SEARCH_ENSURE_UNIQUE=''}
 : ${HISTORY_SUBSTRING_SEARCH_FUZZY=''}
 : ${HISTORY_SUBSTRING_SEARCH_PREFIXED=''}

From c5f64018fffbffe6624690e929b6ff745514336b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 11:57:33 +0200
Subject: [PATCH 22/80] chore(deps): bump github/codeql-action from 3.30.6 to
 4.30.8 (#13364)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cfaa5f03e..7f1769540 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
+        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
         with:
           sarif_file: results.sarif

From d1c04d8a33f9127d03b69617c5367db5ceebc8a7 Mon Sep 17 00:00:00 2001
From: Oleg Atamanenko <oleg.atamanenko@gmail.com>
Date: Wed, 15 Oct 2025 02:13:54 -0700
Subject: [PATCH 23/80] chore(task): fix error in README (#13367)

---
 plugins/task/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/task/README.md b/plugins/task/README.md
index 606289bcd..4ef931c03 100644
--- a/plugins/task/README.md
+++ b/plugins/task/README.md
@@ -1,4 +1,4 @@
-# Buf plugin
+# Task plugin
 
 This plugin adds completion for [Task CLI](https://taskfile.dev/), a fast, cross-platform build tool inspired by Make, designed for modern workflows.
 

From 064f0c1d0adbe5a4a4a239eab452f80ad0a7ee20 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 11:28:57 +0300
Subject: [PATCH 24/80] chore(deps): bump idna in
 /.github/workflows/dependencies (#13377)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index 0531f9f0a..d6757a0f6 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -1,6 +1,6 @@
 certifi==2025.10.5
 charset-normalizer==3.4.3
-idna==3.10
+idna==3.11
 PyYAML==6.0.3
 requests==2.32.5
 semver==3.0.4

From 1672a12704798353725a5d559acc3917adb0075e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 11:29:15 +0300
Subject: [PATCH 25/80] chore(deps): bump github/codeql-action from 4.30.8 to
 4.30.9 (#13376)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7f1769540..d2e0ff01b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         with:
           sarif_file: results.sarif

From 8337a07400cbdb1123df51ddd88fb4cf349c30b1 Mon Sep 17 00:00:00 2001
From: Olexandr88 <radole1203@gmail.com>
Date: Tue, 21 Oct 2025 11:32:28 +0300
Subject: [PATCH 26/80] chore: update license year (#13369)

---
 LICENSE.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE.txt b/LICENSE.txt
index 2d7ca6f52..a1366bdbc 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2009-2022 Robby Russell and contributors (https://github.com/ohmyzsh/ohmyzsh/contributors)
+Copyright (c) 2009-2025 Robby Russell and contributors (https://github.com/ohmyzsh/ohmyzsh/contributors)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

From ac9258296117df625ba69d8e3cd1fe4883062c2b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 11:33:03 +0300
Subject: [PATCH 27/80] chore(deps): bump charset-normalizer in
 /.github/workflows/dependencies (#13378)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index d6757a0f6..cc8b0a28f 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -1,5 +1,5 @@
 certifi==2025.10.5
-charset-normalizer==3.4.3
+charset-normalizer==3.4.4
 idna==3.11
 PyYAML==6.0.3
 requests==2.32.5

From caba9ae0347b5b52b65bccc27ff420cb77b71720 Mon Sep 17 00:00:00 2001
From: Florian <florian.pabler@icloud.com>
Date: Tue, 21 Oct 2025 10:42:04 +0200
Subject: [PATCH 28/80] fix(ssh): use `grep -E` instead of `egrep` (#13380)

---
 plugins/ssh/ssh.plugin.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/ssh/ssh.plugin.zsh b/plugins/ssh/ssh.plugin.zsh
index b5b050536..24ad88028 100644
--- a/plugins/ssh/ssh.plugin.zsh
+++ b/plugins/ssh/ssh.plugin.zsh
@@ -5,7 +5,7 @@
 _ssh_configfile="$HOME/.ssh/config"
 if [[ -f "$_ssh_configfile" ]]; then
   _ssh_hosts=($(
-    egrep '^Host.*' "$_ssh_configfile" |\
+    grep -E '^Host.*' "$_ssh_configfile" |\
     awk '{for (i=2; i<=NF; i++) print $i}' |\
     sort |\
     uniq |\

From f1934d2c769e43d87fd6b2138bed90ed6b1455fe Mon Sep 17 00:00:00 2001
From: hanskr <hanskr@gmail.com>
Date: Tue, 21 Oct 2025 10:48:56 +0200
Subject: [PATCH 29/80] fix(git): improve ggu, ggl, gp, ggfl, ggp functions
 (#13370)

Co-authored-by: Hans Kristian Kismul <hans.kristian.kismul@finn.no>
---
 plugins/git/git.plugin.zsh | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/plugins/git/git.plugin.zsh b/plugins/git/git.plugin.zsh
index adca1c3c5..a0052891a 100644
--- a/plugins/git/git.plugin.zsh
+++ b/plugins/git/git.plugin.zsh
@@ -280,10 +280,11 @@ alias gpra='git pull --rebase --autostash'
 alias gprav='git pull --rebase --autostash -v'
 
 function ggu() {
-  [[ "$#" != 1 ]] && local b="$(git_current_branch)"
-  git pull --rebase origin "${b:=$1}"
+  local b
+  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  git pull --rebase origin "${b:-$1}"
 }
-compdef _git ggu=git-checkout
+compdef _git ggu=git-pull
 
 alias gprom='git pull --rebase origin $(git_main_branch)'
 alias gpromi='git pull --rebase=interactive origin $(git_main_branch)'
@@ -295,11 +296,12 @@ function ggl() {
   if [[ "$#" != 0 ]] && [[ "$#" != 1 ]]; then
     git pull origin "${*}"
   else
-    [[ "$#" == 0 ]] && local b="$(git_current_branch)"
-    git pull origin "${b:=$1}"
+    local b
+    [[ "$#" == 0 ]] && b="$(git_current_branch)"
+    git pull origin "${b:-$1}"
   fi
 }
-compdef _git ggl=git-checkout
+compdef _git ggl=git-pull
 
 alias gluc='git pull upstream $(git_current_branch)'
 alias glum='git pull upstream $(git_main_branch)'
@@ -307,10 +309,11 @@ alias gp='git push'
 alias gpd='git push --dry-run'
 
 function ggf() {
-  [[ "$#" != 1 ]] && local b="$(git_current_branch)"
-  git push --force origin "${b:=$1}"
+  local b
+  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  git push --force origin "${b:-$1}"
 }
-compdef _git ggf=git-checkout
+compdef _git ggf=git-push
 
 alias gpf!='git push --force'
 is-at-least 2.30 "$git_version" \
@@ -318,10 +321,11 @@ is-at-least 2.30 "$git_version" \
   || alias gpf='git push --force-with-lease'
 
 function ggfl() {
-  [[ "$#" != 1 ]] && local b="$(git_current_branch)"
-  git push --force-with-lease origin "${b:=$1}"
+  local b
+  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  git push --force-with-lease origin "${b:-$1}"
 }
-compdef _git ggfl=git-checkout
+compdef _git ggfl=git-push
 
 alias gpsup='git push --set-upstream origin $(git_current_branch)'
 is-at-least 2.30 "$git_version" \
@@ -336,11 +340,12 @@ function ggp() {
   if [[ "$#" != 0 ]] && [[ "$#" != 1 ]]; then
     git push origin "${*}"
   else
-    [[ "$#" == 0 ]] && local b="$(git_current_branch)"
-    git push origin "${b:=$1}"
+    local b
+    [[ "$#" == 0 ]] && b="$(git_current_branch)"
+    git push origin "${b:-$1}"
   fi
 }
-compdef _git ggp=git-checkout
+compdef _git ggp=git-push
 
 alias gpu='git push upstream'
 alias grb='git rebase'

From bd295c014f47ac2462d6145f87ae627ae765860f Mon Sep 17 00:00:00 2001
From: Jeconias Santos <jeconiass2009@hotmail.com>
Date: Wed, 22 Oct 2025 14:12:22 -0300
Subject: [PATCH 30/80] feat(terraform): add aliases for workspace management
 (#12845)

---
 plugins/terraform/README.md            | 3 +++
 plugins/terraform/terraform.plugin.zsh | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/plugins/terraform/README.md b/plugins/terraform/README.md
index 6c139ac51..48fdae282 100644
--- a/plugins/terraform/README.md
+++ b/plugins/terraform/README.md
@@ -35,6 +35,9 @@ plugins=(... terraform)
 | `tfs`   | `terraform state`                      |
 | `tft`   | `terraform test`                       |
 | `tfsh`  | `terraform show`                       |
+| `tfw`   | `terraform workspace`                  |
+| `tfwl`  | `terraform workspace list`             |
+| `tfws`  | `terraform workspace select`           |
 
 ## Prompt function
 
diff --git a/plugins/terraform/terraform.plugin.zsh b/plugins/terraform/terraform.plugin.zsh
index 0982fa193..b0054d56a 100644
--- a/plugins/terraform/terraform.plugin.zsh
+++ b/plugins/terraform/terraform.plugin.zsh
@@ -33,3 +33,6 @@ alias tfv='terraform validate'
 alias tfs='terraform state'
 alias tft='terraform test'
 alias tfsh='terraform show'
+alias tfw='terraform workspace'
+alias tfwl='terraform workspace list'
+alias tfws='terraform workspace select'

From 38423b4b5ce1ebbcded814642706a5fc300eadda Mon Sep 17 00:00:00 2001
From: Carlo Sala <carlosalag@protonmail.com>
Date: Thu, 23 Oct 2025 05:16:17 -0700
Subject: [PATCH 31/80] ci(deps): ensure push permissions are available
 (#13389)

---
 .github/workflows/dependencies.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 3f448fe64..be54fdf41 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -5,7 +5,7 @@ on:
     - cron: "0 6 * * 0"
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   check:

From 55aa4c40e235cceb458689182e8e13f6cd99ca69 Mon Sep 17 00:00:00 2001
From: "ohmyzsh[bot]" <54982679+ohmyzsh[bot]@users.noreply.github.com>
Date: Thu, 23 Oct 2025 05:23:50 -0700
Subject: [PATCH 32/80] feat(gradle): update to d51199b5 (#13390)

Co-authored-by: ohmyzsh[bot] <54982679+ohmyzsh[bot]@users.noreply.github.com>
---
 .github/dependencies.yml |   2 +-
 plugins/gradle/_gradle   | 349 +++++++++++++++++++++++----------------
 2 files changed, 211 insertions(+), 140 deletions(-)

diff --git a/.github/dependencies.yml b/.github/dependencies.yml
index b67a4c7ed..8e01a3548 100644
--- a/.github/dependencies.yml
+++ b/.github/dependencies.yml
@@ -12,7 +12,7 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: 25da917cf5a88f3e58f05be3868a7b2748c8afe6
+    version: d51199b54e5b6d7b5a6e37d8a3badc3df7efd8ee
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete
diff --git a/plugins/gradle/_gradle b/plugins/gradle/_gradle
index ca13fd0b0..369cbc140 100644
--- a/plugins/gradle/_gradle
+++ b/plugins/gradle/_gradle
@@ -19,18 +19,18 @@ __gradle-init-cache-dir() {
 }
 
 __gradle-set-settings-file() {
-    # In order of precedence: --settings-file=filename, settings.gradle, settings.gradle.kts
+    # In order of precedence: settings.gradle, settings.gradle.kts
 
     local default_gradle_settings_file="$project_root_dir/settings.gradle"
     if [[ ! -f $default_gradle_settings_file ]]; then
       default_gradle_settings_file="$project_root_dir/settings.gradle.kts"
     fi
-    gradle_settings_file=${${(v)opt_args[(i)-c|--settings-file]}:-$default_gradle_settings_file}
+    gradle_settings_file=$default_gradle_settings_file
 }
 
 __gradle-set-build-file() {
     __gradle-set-settings-file
-    # In order of precedence: --build-file=filename, rootProject.buildFileName, build.gradle, build.gradle.kts
+    # In order of precedence: rootProject.buildFileName, build.gradle, build.gradle.kts
 
     local default_gradle_build_file_name="build.gradle"
     if [[ -r $gradle_settings_file ]]; then
@@ -45,8 +45,7 @@ __gradle-set-build-file() {
         default_gradle_build_file="$project_root_dir/build.gradle.kts"
     fi
 
-    # If a build file is specified after '-b' or '--build-file', use this file.
-    gradle_build_file=${${(v)opt_args[(i)-b|--build-file]}:-$default_gradle_build_file}
+    gradle_build_file=$default_gradle_build_file
 }
 
 __gradle-set-cache-name() {
@@ -94,10 +93,11 @@ __gradle-generate-tasks-cache() {
     # Reuse Gradle Daemon if IDLE but don't start a new one.
     local gradle_tasks_output
     if [[ ! -z "$($gradle_cmd --status 2>/dev/null | grep IDLE)" ]]; then
-        gradle_tasks_output="$($gradle_cmd --daemon --no-scan --build-file $gradle_build_file --console=plain -q tasks --all 2>/dev/null)"
+        gradle_tasks_output="$(cd "$project_root_dir" && "$gradle_cmd" --daemon --no-scan --console=plain -q tasks --all 2>/dev/null)"
     else
-        gradle_tasks_output="$($gradle_cmd --no-daemon --no-scan --build-file $gradle_build_file --console=plain -q tasks --all 2>/dev/null)"
+        gradle_tasks_output="$(cd "$project_root_dir" && "$gradle_cmd" --no-daemon --no-scan --console=plain -q tasks --all 2>/dev/null)"
     fi
+
     local gradle_all_tasks="" root_tasks="" subproject_tasks="" output_line
     local -a match
     for output_line in ${(f)"$(printf "%s\n" "${gradle_tasks_output[@]}")"}; do
@@ -235,70 +235,106 @@ __gradle_subcommand() {
             ;;
         (*)
             _arguments -C \
-                {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
-                '(--no-build-cache)--build-cache[Enable the Gradle build cache.]' \
-                {-b,--build-file}'[Specifies the build file.]:build script:_files -g \*.gradle' \
-                {-C,--cache}'[Specifies how compiled build scripts should be cached.]:cache policy:(on rebuild)' \
-                {-c,--settings-file}'[Specifies the settings file.]:settings file:_files -g \*.gradle' \
-                '(--configuration-cache)--no-configuration-cache[Disables the configuration cache. Gradle will not reuse the build configuration from previous builds.]' \
-                '--configuration-cache-problems=[Configures how the configuration cache handles problems]:problem handling:(fail warn)' \
-                '(--no-configure-on-demand)--configure-on-demand[Only relevant projects are configured in this build run.]' \
-                '(--no-configuration-cache)--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-                '--console=[Specifies which type of console output to generate.]:console output type:(plain auto rich verbose)' \
-                '--continue[Continues task execution after a task failure.]' \
-                '-Dorg.gradle.cache.reserved.mb=[Reserve Gradle Daemon memory for operations.]' \
-                '-Dorg.gradle.caching=[Set true to enable Gradle build cache.]:enable build cache:(true false)' \
-                '-Dorg.gradle.console=[Set type of console output to generate.]:console output type:(plain auto rich verbose)' \
-                '-Dorg.gradle.daemon.debug=[Set true to debug Gradle Daemon.]:enable daemon debug:(true false)' \
-                '-Dorg.gradle.daemon.idletimeout=[Kill Gradle Daemon after # idle millis.]' \
-                '-Dorg.gradle.debug=[Set true to debug Gradle Client.]' \
-                '-Dorg.gradle.jvmargs=[Set JVM arguments.]' \
-                '-Dorg.gradle.java.home=[Set JDK home dir.]' \
-                '-Dorg.gradle.logging.level=[Set default Gradle log level.]:log level:(quiet warn lifecycle info debug)' \
-                '-Dorg.gradle.parallel=[Set true to enable parallel project builds.]:enable parallel build:(true false)' \
-                '-Dorg.gradle.priority=[Set priority for Gradle worker processes.]:priority:(low normal)' \
-                '-Dorg.gradle.unsafe.watch-fs=[Set true to enable Gradle file watcher.]:enable watcher:(true false)' \
-                '-Dorg.gradle.warning.mode=[Set types of warnings to log.]:warning level:(all summary none)' \
-                '-Dorg.gradle.workers.max=[Set the number of workers Gradle is allowed to use.]' \
-                '(-i --info -w --warn -q --quiet)'{-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-                '(--no-daemon)--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-                '--foreground[Starts the Gradle daemon in the foreground.]' \
-                {-g,--gradle-user-home}'[Specifies the gradle user home directory.]:file:_directories' \
-                \*--include-build'[Includes the specified build in the composite.]:file:_directories' \
-                \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle' \
-                '(-d --debug -w --warn -q --quiet)'{-i,--info}'[Set log level to info.]' \
-                '--max-workers[Set the maximum number of concurrent workers that Gradle may use.]:number workers' \
-                {-m,--dry-run}'[Runs the builds with all task actions disabled.]' \
-                '--no-color[Do not use color in the console output. (Removed in Gradle 3.0)]' \
-                '(--build-cache)--no-build-cache[Do not use the Gradle build cache.]' \
-                '(--configure-on-demand)--no-configure-on-demand[Disables configuration on demand.]' \
-                '(--daemon)--no-daemon[Do not use the Gradle daemon to run the build.]' \
-                '(--parallel)--no-parallel[Disables parallel execution to build projects.]' \
-                '(--scan)--no-scan[Do not create a build scan.]' \
-                '--offline[The build should operate without accessing network resources.]' \
-                \*{-P+,--project-prop}'[Set project property for the build script (e.g. -Pmyprop=myvalue).]:project property (prop=val):' \
-                {-p,--project-dir}'[Specifies the start directory for Gradle.]:start directory:_directories' \
-                '(--no-parallel)--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-                '--profile[Profiles build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-                '--priority[Set priority for Gradle worker processes.]:priority:(low normal)' \
-                '--project-cache-dir[Specifies the project-specific cache directory.]:cache directory:_directories' \
-                '(-d --debug -w --warn -i --info)'{-q,--quiet}'[Log errors only.]' \
-                '--recompile-scripts[Force build script recompiling.]' \
-                '--refresh[Refresh the state of resources of the type(s) specified.]:refresh policy:(dependencies)' \
-                '--refresh-dependencies[Refresh the state of dependencies.]' \
-                '--rerun-tasks[Ignore previously cached task results.]' \
-                '(--no-scan)--scan[Create a build scan.]' \
-                '(-S --full-stacktrace)'{-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-                '(-s --stacktrace)'{-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-                '--system-prop[system property (prop=val)]' \
+                '-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories' \
+                '-Dorg.gradle.caching.debug=[]' \
+                '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false)' \
+                '-Dorg.gradle.configuration-cache.entries-per-key=[]' \
+                '-Dorg.gradle.configuration-cache.fine-grained-property-tracking=[]' \
+                '-Dorg.gradle.configuration-cache.heap-dump-dir=[]:org.gradle.configuration cache.heap dump dir:_directories' \
+                '-Dorg.gradle.configuration-cache.inputs.unsafe.ignore.file-system-checks=[]' \
+                '-Dorg.gradle.configuration-cache.inputs.unsafe.ignore.in-serialization=[]' \
+                '-Dorg.gradle.configuration-cache.integrity-check=[]' \
+                '-Dorg.gradle.configuration-cache.max-problems=[]' \
+                '-Dorg.gradle.configuration-cache.parallel=[]' \
+                '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn)' \
+                '-Dorg.gradle.configuration-cache.read-only=[]' \
+                '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]' \
+                '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
+                '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]' \
+                '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose)' \
+                '-Dorg.gradle.continue=[Continue task execution after a task failure.]' \
+                '-Dorg.gradle.continuous.quietperiod=[]' \
+                '-Dorg.gradle.daemon.healthcheckinterval=[]' \
+                '-Dorg.gradle.daemon.idletimeout=[]' \
+                '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories' \
+                '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                '-Dorg.gradle.debug.host=[]' \
+                '-Dorg.gradle.debug.port=[]' \
+                '-Dorg.gradle.debug.server=[]' \
+                '-Dorg.gradle.debug.suspend=[]' \
+                '-Dorg.gradle.debug=[]:org.gradle.debug:(true false)' \
+                '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off)' \
+                '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories' \
+                '-Dorg.gradle.java.installations.auto-detect=[]' \
+                '-Dorg.gradle.java.installations.auto-download=[]' \
+                '-Dorg.gradle.java.installations.fromEnv=[]' \
+                '-Dorg.gradle.java.installations.idea-jdks-directory=[]:org.gradle.java.installations.idea jdks directory:_directories' \
+                '-Dorg.gradle.java.installations.paths=[]:org.gradle.java.installations.paths:_directories' \
+                '-Dorg.gradle.jvmargs=[]' \
+                '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug)' \
+                '-Dorg.gradle.logging.stacktrace=[]' \
+                '-Dorg.gradle.native=[]' \
+                '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false)' \
+                '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low)' \
+                '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]' \
+                '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories' \
+                '-Dorg.gradle.unsafe.isolated-projects=[]' \
+                '-Dorg.gradle.vfs.verbose=[]' \
+                '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false)' \
+                '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']' \
+                '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never)' \
+                '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
+                (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
+                '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn)' \
+                (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+                '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose)' \
+                (--no-continue)'--continue[Continue task execution after a task failure.]' \
                 {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-                {-u,--no-search-upward}"[Don't search in parent folders for a settings.gradle file.]" \
-                '(--write-locks)--update-locks[Perform a partial update of the dependency lock.]' \
-                '(-d --debug -q --quiet -i --info)'{-w,--warn}'[Log warnings and errors only.]' \
-                '--warning-mode=[Set types of warnings to log.]:warning mode:(all summary none)' \
-                '(--no-watch-fs)--watch-fs[Gradle watches filesystem for incremental builds.]' \
-                '(--update-locks)--write-locks[Persists dependency resolution for locked configurations.]' \
-                {-x,--exclude-task}'[Specify a task to be excluded from execution.]' && ret=0
+                (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+                (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
+                {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off)' \
+                {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
+                \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+                '--export-keys[Exports the public keys used for dependency verification.]' \
+                '--foreground[Starts the Gradle daemon in the foreground.]' \
+                (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
+                {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories' \
+                \*'--include-build[Include the specified build in the composite.]:include build:_directories' \
+                (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
+                \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts)' \
+                '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]' \
+                (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
+                (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
+                (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
+                (--continue)'--no-continue[Stop task execution after a task failure.]' \
+                (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+                (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
+                (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
+                {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+                (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
+                (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
+                '--offline[Execute the build without accessing network resources.]' \
+                (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+                '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']' \
+                (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
+                '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
+                '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories' \
+                {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories' \
+                '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
+                (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
+                {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
+                '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+                '--rerun-tasks[Ignore previously cached task results.]' \
+                (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+                (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
+                '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
+                \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+                (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
+                '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none)' \
+                (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
+                '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
+                {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]' && ret=0
             ;;
     esac
 
@@ -324,76 +360,111 @@ _gradle() {
     typeset -A opt_args
 
     _arguments -C \
-        '(-)'{-\?,-h,--help}'[Shows a help message.]' \
-        {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
-        '(--no-build-cache)--build-cache[Enable the Gradle build cache.]' \
-        {-b,--build-file}'[Specifies the build file.]:build script:_files -g \*.gradle' \
-        {-C,--cache}'[Specifies how compiled build scripts should be cached.]:cache policy:(on rebuild)' \
-        {-c,--settings-file}'[Specifies the settings file.]:settings file:_files -g \*.gradle:->argument-expected' \
-        '(--no-configuration-cache)--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
-        '(--configuration-cache)--no-configuration-cache[Disables the configuration cache. Gradle will not reuse the build configuration from previous builds.]' \
-        '--configuration-cache-problems=[Configures how the configuration cache handles problems]:problem handling:(fail warn)' \
-        '(--no-configure-on-demand)--configure-on-demand[Only relevant projects are configured in this build run.]' \
-        '--console=[Specifies which type of console output to generate.]:console output type:(plain auto rich verbose)' \
-        '--continue[Continues task execution after a task failure.]' \
-        '-Dorg.gradle.cache.reserved.mb=[Reserve Gradle Daemon memory for operations.]' \
-        '-Dorg.gradle.caching=[Set true to enable Gradle build cache.]' \
-        '-Dorg.gradle.console=[Set type of console output to generate.]:console output type:(plain auto rich verbose)' \
-        '-Dorg.gradle.daemon.debug=[Set true to debug Gradle Daemon.]' \
-        '-Dorg.gradle.daemon.idletimeout=[Kill Gradle Daemon after # idle millis.]' \
-        '-Dorg.gradle.debug=[Set true to debug Gradle Client.]' \
-        '-Dorg.gradle.jvmargs=[Set JVM arguments.]' \
-        '-Dorg.gradle.java.home=[Set JDK home dir.]' \
-        '-Dorg.gradle.logging.level=[Set default Gradle log level.]:log level:(quiet warn lifecycle info debug)' \
-        '-Dorg.gradle.parallel=[Set true to enable parallel project builds.]:(true false)' \
-        '-Dorg.gradle.priority=[Set priority for Gradle worker processes.]:priority:(low normal)' \
-        '-Dorg.gradle.unsafe.watch-fs=[Set true to enable Gradle file watcher.]:enable watcher:(true false)' \
-        '-Dorg.gradle.warning.mode=[Set types of warnings to log.]:warning level:(all summary none)' \
-        '-Dorg.gradle.workers.max=[Set the number of workers Gradle is allowed to use.]' \
-        '(-i --info -w --warn -q --quiet)'{-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
-        '(--no-daemon)--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
-        '--foreground[Starts the Gradle daemon in the foreground.]' \
-        {-g,--gradle-user-home}'[Specifies the gradle user home directory.]:home directory:_directories:->argument-expected' \
-        '(-)--gui[Launches the Gradle GUI. (Removed in Gradle 4.0)]' \
-        \*--include-build'[Includes the specified build in the composite.]:file:_directories:->argument-expected' \
-        \*{-I,--init-script}'[Specifies an initialization script.]:init script:_files -g \*.gradle:->argument-expected' \
-        '(-d --debug -w --warn -q --quiet)'{-i,--info}'[Set log level to info.]' \
-        '--max-workers[Set the maximum number of concurrent workers that Gradle may use.]:number workers:->argument-expected' \
-        {-m,--dry-run}'[Runs the builds with all task actions disabled.]' \
-        '--no-color[Do not use color in the console output. (Removed in Gradle 3.0)]' \
-        '(--build-cache)--no-build-cache[Do not use the Gradle build cache.]' \
-        '(--configure-on-demand)--no-configure-on-demand[Disables configuration on demand.]' \
-        '(--daemon)--no-daemon[Do not use the Gradle daemon to run the build.]' \
-        '(--parallel)--no-parallel[Disables parallel execution to build projects.]' \
-        '(--scan)--no-scan[Do not create a build scan.]' \
-        '--offline[The build should operate without accessing network resources.]' \
-        \*{-P+,--project-prop}'[Set project property for the build script (e.g. -Pmyprop=myvalue).]:project property (prop=val):->argument-expected' \
-        {-p,--project-dir}'[Specifies the start directory for Gradle.]:start directory:_directories:->argument-expected' \
-        '(--no-parallel)--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
-        '--priority=[Set priority for Gradle worker processes.]:priority:(low normal)' \
-        '--profile[Profiles build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
-        '--project-cache-dir=[Specifies the project-specific cache directory.]:cache directory:_directories:->argument-expected' \
-        '(-d --debug -w --warn -i --info)'{-q,--quiet}'[Log errors only.]' \
-        '--recompile-scripts[Force build script recompiling.]' \
-        '--refresh[Refresh the state of resources of the type(s) specified.]:refresh policy:(dependencies)' \
-        '--refresh-dependencies[Refresh the state of dependencies.]' \
-        '--rerun-tasks[Ignore previously cached task results.]' \
-        '(--no-scan)--scan[Create a build scan.]' \
-        '(-S --full-stacktrace)'{-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
-        '(-s --stacktrace)'{-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
-        '(-)--status[Shows status of running and recently stopped Gradle Daemons.]' \
-        '(-)--stop[Stops all Gradle daemons.]' \
-        '--system-prop[system property (prop=val)]' \
+'-Dgradle.user.home=[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle.user.home:_directories:->argument-expected' \
+        '-Dorg.gradle.caching.debug=[]:->argument-expected' \
+        '-Dorg.gradle.caching=[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]:org.gradle.caching:(true false):->argument-expected' \
+        '-Dorg.gradle.configuration-cache.entries-per-key=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.fine-grained-property-tracking=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.heap-dump-dir=[]:org.gradle.configuration cache.heap dump dir:_directories:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.inputs.unsafe.ignore.file-system-checks=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.inputs.unsafe.ignore.in-serialization=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.integrity-check=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.max-problems=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.parallel=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.problems=[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:org.gradle.configuration cache.problems:(fail warn):->argument-expected' \
+        '-Dorg.gradle.configuration-cache.read-only=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache.unsafe.ignore.unsupported-build-events-listeners=[]:->argument-expected' \
+        '-Dorg.gradle.configuration-cache=[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]:->argument-expected' \
+        '-Dorg.gradle.configureondemand=[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds.]:->argument-expected' \
+        '-Dorg.gradle.console=[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:org.gradle.console:(plain auto rich verbose):->argument-expected' \
+        '-Dorg.gradle.continue=[Continue task execution after a task failure.]:->argument-expected' \
+        '-Dorg.gradle.continuous.quietperiod=[]:->argument-expected' \
+        '-Dorg.gradle.daemon.healthcheckinterval=[]:->argument-expected' \
+        '-Dorg.gradle.daemon.idletimeout=[]:->argument-expected' \
+        '-Dorg.gradle.daemon.registry.base=[]:org.gradle.daemon.registry.base:_directories:->argument-expected' \
+        '-Dorg.gradle.daemon=[Uses the Gradle daemon to run the build. Starts the daemon if not running.]:->argument-expected' \
+        '-Dorg.gradle.debug.host=[]:->argument-expected' \
+        '-Dorg.gradle.debug.port=[]:->argument-expected' \
+        '-Dorg.gradle.debug.server=[]:->argument-expected' \
+        '-Dorg.gradle.debug.suspend=[]:->argument-expected' \
+        '-Dorg.gradle.debug=[]:org.gradle.debug:(true false):->argument-expected' \
+        '-Dorg.gradle.dependency.verification=[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:org.gradle.dependency.verification:(strict lenient off):->argument-expected' \
+        '-Dorg.gradle.java.home=[]:org.gradle.java.home:_directories:->argument-expected' \
+        '-Dorg.gradle.java.installations.auto-detect=[]:->argument-expected' \
+        '-Dorg.gradle.java.installations.auto-download=[]:->argument-expected' \
+        '-Dorg.gradle.java.installations.fromEnv=[]:->argument-expected' \
+        '-Dorg.gradle.java.installations.idea-jdks-directory=[]:org.gradle.java.installations.idea jdks directory:_directories:->argument-expected' \
+        '-Dorg.gradle.java.installations.paths=[]:org.gradle.java.installations.paths:_directories:->argument-expected' \
+        '-Dorg.gradle.jvmargs=[]:->argument-expected' \
+        '-Dorg.gradle.logging.level=[]:org.gradle.logging.level:(quiet warn info debug):->argument-expected' \
+        '-Dorg.gradle.logging.stacktrace=[]:->argument-expected' \
+        '-Dorg.gradle.native=[]:->argument-expected' \
+        '-Dorg.gradle.parallel=[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]:org.gradle.parallel:(true false):->argument-expected' \
+        '-Dorg.gradle.priority=[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:org.gradle.priority:(normal low):->argument-expected' \
+        '-Dorg.gradle.problems.report=[(Experimental) enables HTML problems report]:->argument-expected' \
+        '-Dorg.gradle.projectcachedir=[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:org.gradle.projectcachedir:_directories:->argument-expected' \
+        '-Dorg.gradle.unsafe.isolated-projects=[]:->argument-expected' \
+        '-Dorg.gradle.vfs.verbose=[]:->argument-expected' \
+        '-Dorg.gradle.vfs.watch=[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]:org.gradle.vfs.watch:(true false):->argument-expected' \
+        '-Dorg.gradle.warning.mode=[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:->argument-expected' \
+        '-Dorg.gradle.welcome=[]:org.gradle.welcome:(once never):->argument-expected' \
+        '-Dorg.gradle.workers.max=[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        (--no-build-cache)'--build-cache[Enables the Gradle build cache. Gradle will try to reuse outputs from previous builds.]' \
+        (--no-configuration-cache)'--configuration-cache[Enables the configuration cache. Gradle will try to reuse the build configuration from previous builds.]' \
+        '--configuration-cache-problems[Configures how the configuration cache handles problems (fail or warn). Defaults to fail.]:configuration cache problems:(fail warn):->argument-expected' \
+        (--no-configure-on-demand)'--configure-on-demand[Configure necessary projects only. Gradle will attempt to reduce configuration time for large multi-project builds. (incubating)]' \
+        '--console[Specifies which type of console output to generate. Values are 'plain', 'colored', 'auto' (default), 'rich' or 'verbose'.]:console:(plain auto rich verbose):->argument-expected' \
+        (--no-continue)'--continue[Continue task execution after a task failure.]' \
         {-t,--continuous}'[Enables continuous build. Gradle does not exit and will re-execute tasks when task file inputs change.]' \
-        {-u,--no-search-upward}"[Don't search in parent folders for a settings.gradle file.]" \
-        '(--write-locks)--update-locks[Perform a partial update of the dependency lock.]' \
-        '(-)'{-v,--version}'[Print version info.]' \
-        '(-d --debug -q --quiet -i --info)'{-w,--warn}'[Log warnings and errors only.]' \
-        '--warning-mode=[Set types of warnings to log.]:warning mode:(all summary none)' \
-        '(--update-locks)--write-locks[Persists dependency resolution for locked configurations.]' \
-        '(--no-watch-fs)--watch-fs[Gradle watches filesystem for incremental builds.]' \
-        {-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
-        '(-)*:: :->task-or-option' && ret=0
+        (--no-daemon)'--daemon[Uses the Gradle daemon to run the build. Starts the daemon if not running.]' \
+        (--quiet,-q,--warn,-w,--info,-i){-d,--debug}'[Log in debug mode (includes normal stacktrace).]' \
+        {-F,--dependency-verification}'[Configures the dependency verification mode. Values are 'strict', 'lenient' or 'off'.]:dependency verification:(strict lenient off):->argument-expected' \
+        {-m,--dry-run}'[Run the builds with all task actions disabled.]' \
+        \*{-x,--exclude-task}'[Specify a task to be excluded from execution.]' \
+        '--export-keys[Exports the public keys used for dependency verification.]' \
+        '--foreground[Starts the Gradle daemon in the foreground.]' \
+        (--stacktrace,-s){-S,--full-stacktrace}'[Print out the full (very verbose) stacktrace for all exceptions.]' \
+        {-g,--gradle-user-home}'[Specifies the Gradle user home directory. Defaults to ~/.gradle]:gradle user home:_directories:->argument-expected' \
+        {-h,--help}'[Shows a help message.]' \
+        \*'--include-build[Include the specified build in the composite.]:include build:_directories:->argument-expected' \
+        (--quiet,-q,--warn,-w,--debug,-d){-i,--info}'[Set log level to info.]' \
+        \*{-I,--init-script}'[Specify an initialization script.]:init script:_files -g \*.gradle(|.kts):->argument-expected' \
+        '--max-workers[Configure the number of concurrent workers Gradle is allowed to use.]:->argument-expected' \
+        (--build-cache)'--no-build-cache[Disables the Gradle build cache.]' \
+        (--configuration-cache)'--no-configuration-cache[Disables the configuration cache.]' \
+        (--configure-on-demand)'--no-configure-on-demand[Disables the use of configuration on demand. (incubating)]' \
+        (--continue)'--no-continue[Stop task execution after a task failure.]' \
+        (--daemon)'--no-daemon[Do not use the Gradle daemon to run the build. Useful occasionally if you have configured Gradle to always run with the daemon by default.]' \
+        (--parallel)'--no-parallel[Disables parallel execution to build projects.]' \
+        (--problems-report)'--no-problems-report[(Experimental) disables HTML problems report]' \
+        {-a,--no-rebuild}'[Do not rebuild project dependencies.]' \
+        (--scan)'--no-scan[Disables the creation of a Build Scan.]' \
+        (--watch-fs)'--no-watch-fs[Disables watching the file system.]' \
+        '--offline[Execute the build without accessing network resources.]' \
+        (--no-parallel)'--parallel[Build projects in parallel. Gradle will attempt to determine the optimal number of executor threads to use.]' \
+        '--priority[Specifies the scheduling priority for the Gradle daemon and all processes launched by it. Values are 'normal' (default) or 'low']:->argument-expected' \
+        (--no-problems-report)'--problems-report[(Experimental) enables HTML problems report]' \
+        '--profile[Profile build execution time and generates a report in the <build_dir>/reports/profile directory.]' \
+        '--project-cache-dir[Specify the project-specific cache directory. Defaults to .gradle in the root project directory.]:project cache dir:_directories:->argument-expected' \
+        {-p,--project-dir}'[Specifies the start directory for Gradle. Defaults to current directory.]:project dir:_directories:->argument-expected' \
+        '--property-upgrade-report[(Experimental) Runs build with experimental property upgrade report.]' \
+        (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
+        {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
+        '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+        '--rerun-tasks[Ignore previously cached task results.]' \
+        (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+        (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
+        '--status[Shows status of running and recently stopped Gradle daemon(s).]' \
+        '--stop[Stops the Gradle daemon if it is running.]' \
+        '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
+        \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
+        {-v,--version}'[Shows the version info.]' \
+        (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
+        '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none):->argument-expected' \
+        (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \
+        '--write-locks[Persists dependency resolution for locked configurations, ignoring existing locking information if it exists]' \
+        {-M,--write-verification-metadata}'[Generates checksums for dependencies used in the project (comma-separated list)]:->argument-expected' \
+'(-)*:: :->task-or-option' && ret=0
 
     if [[ $words[CURRENT] != -* && $state != "argument-expected" ]]; then
         __gradle_tasks && ret=0

From 99017b8eac3d7d0e5ba01c7bf0cf9c6d38985536 Mon Sep 17 00:00:00 2001
From: Alexey Trofimenko <aronaxis@gmail.com>
Date: Thu, 23 Oct 2025 22:29:46 +0400
Subject: [PATCH 33/80] fix(key-bindings): ensure `<Esc-l>` works if line is
 not empty (#13391)

---
 lib/key-bindings.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/key-bindings.zsh b/lib/key-bindings.zsh
index bf5d4ba30..0d2cecb6a 100644
--- a/lib/key-bindings.zsh
+++ b/lib/key-bindings.zsh
@@ -112,7 +112,7 @@ bindkey -M vicmd '^[[1;5D' backward-word
 
 
 bindkey '\ew' kill-region                             # [Esc-w] - Kill from the cursor to the mark
-bindkey -s '\el' 'ls\n'                               # [Esc-l] - run command: ls
+bindkey -s '\el' '^q ls\n'                            # [Esc-l] - run command: ls
 bindkey '^r' history-incremental-search-backward      # [Ctrl-r] - Search backward incrementally for a specified string. The string may begin with ^ to anchor the search to the beginning of the line.
 bindkey ' ' magic-space                               # [Space] - don't do history expansion
 

From 969cd28e0d5724019061f10454c02d3ec2a71fd4 Mon Sep 17 00:00:00 2001
From: "ohmyzsh[bot]" <54982679+ohmyzsh[bot]@users.noreply.github.com>
Date: Sun, 26 Oct 2025 08:56:26 +0100
Subject: [PATCH 34/80] chore(gradle): update completion to 1525cf3f (#13393)

Co-authored-by: ohmyzsh[bot] <54982679+ohmyzsh[bot]@users.noreply.github.com>
---
 .github/dependencies.yml |  2 +-
 plugins/gradle/_gradle   | 46 ++++++++++++++++++++++++++--------------
 2 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/.github/dependencies.yml b/.github/dependencies.yml
index 8e01a3548..b8e33e62e 100644
--- a/.github/dependencies.yml
+++ b/.github/dependencies.yml
@@ -12,7 +12,7 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: d51199b54e5b6d7b5a6e37d8a3badc3df7efd8ee
+    version: 1525cf3f2242062199ffcf0c5c1055625db6b9d2
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete
diff --git a/plugins/gradle/_gradle b/plugins/gradle/_gradle
index 369cbc140..04f6425be 100644
--- a/plugins/gradle/_gradle
+++ b/plugins/gradle/_gradle
@@ -199,39 +199,53 @@ __gradle_subcommand() {
             ;;
         (dependencyInsight)
             _arguments \
+                '--all-variants[Show all variants of each dependency]' \
+                '--configuration=[Looks for the dependency in given configuration.]:dependency configuration:_gradle_dependency_configurations' \
                 '--dependency=[Shows the details of given dependency.]' \
-                '--configuration=[Looks for the dependency in given configuration.]:dependency configuration:_gradle_dependency_configurations' && ret=0
+                '--single-path[Show at most one path to each dependency]' && ret=0
             ;;
         (help)
             _arguments \
-                '--task[The task to show help for.]' && ret=0
+                '--task=[The task to show help for.]' && ret=0
             ;;
         (init)
             _arguments \
-                '--dsl=[DSL to be used in generated scripts.]:dsl:(groovy kotlin)' \
-                '--package=[Package for the generated source.]' \
-                '--project-name=[Name of the generated project.]' \
-                '--test-framework=[Test framework to be used.]:test framework:(junit kotlintest scalatest spock testng)' \
-                '--type=[Project type to generate.]:project type:(basic cpp-application cpp-library groovy-application groovy-library java-application java-library kotlin-application kotlin-library pom scala-library)' && ret=0
+                '--comments[Include clarifying comments in files.]' \
+                '--dsl=[Set the build script DSL to be used in generated scripts.]' \
+                '--incubating[Allow the generated build to use new features and APIs.]' \
+                '--insecure-protocol=[How to handle insecure URLs used for Maven Repositories.]' \
+                '--java-version=[Provides java version to use in the project.]' \
+                '--overwrite[Allow existing files in the build directory to be overwritten?]' \
+                '--package=[Set the package for source files.]' \
+                '--project-name=[Set the project name.]' \
+                '--split-project[Split functionality across multiple subprojects?]' \
+                '--test-framework=[Set the test framework to be used.]' \
+                '--type=[Set the type of project to generate.]' \
+                '--use-defaults[Use default values for options not configured explicitly]' && ret=0
             ;;
         (tasks)
             _arguments \
-                '--all[List all tasks, including subproject tasks.]' \
-                '--group=[Show tasks only from given task group.]' && ret=0
+                '--all[Show additional tasks and detail.]' \
+                '--group=[Show tasks for a specific group.]' \
+                '--groups=[Show tasks for specific groups (can be used multiple times to specify multiple groups).]' \
+                '--types[Show task class types]' && ret=0
             ;;
         (test)
             _arguments -C \
-                '--debug-jvm[Enable debugging for the test process. The process is started suspended and listening on port 5005. Requires the "java" plugin.]' \
-                '--fail-fast[Stops test execution after the first failed test. Requires the "java" plugin.]' \
-                '--tests=[Sets test class or method name to be included, * is supported. Requires the "java" plugin.]' \
+                '--debug-jvm[Enable debugging for the test process. The process is started suspended and listening on port 5005.]' \
+                '--fail-fast[Stops test execution after the first failed test.]' \
+                '--test-dry-run[Simulate test execution.]' \
+                '--tests=[Sets test class or method name to be included (in addition to the test task filters), '*' is supported.]' \
                 '(-)*:: :->task-or-option' && ret=0
             ;;
         (wrapper)
             _arguments \
-                '--distribution-type=[Binary-only or all with docs and sources]:*:distribution type:(bin all)' \
-                '--gradle-version=[Set Gradle version for wrapper]' \
-                '--gradle-distribution-sha256-sum=[SHA-256 checksum]' \
-                '--gradle-distribution-url=[Set Gradle distribution URL]' && ret=0
+                '--distribution-type=[The type of the Gradle distribution to be used by the wrapper.]:*:distribution type:(bin all)' \
+                '--gradle-distribution-sha256-sum=[The SHA-256 hash sum of the gradle distribution.]' \
+                '--gradle-distribution-url=[The URL to download the Gradle distribution from.]' \
+                '--gradle-version=[The version of the Gradle distribution required by the wrapper. The following labels are allowed: latest, release-candidate, release-milestone, release-nightly, and nightly.]' \
+                '--network-timeout=[Timeout in ms to use when the wrapper is performing network operations.]' \
+                '--validate-url[Sets task to validate the configured distribution url.]' && ret=0
             ;;
         (*)
             _arguments -C \

From 279e91e1327ed3683d099f59e304ba2c8e1153b8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 26 Oct 2025 06:16:55 -0700
Subject: [PATCH 35/80] chore(deps): bump github/codeql-action from 4.30.9 to
 4.31.0 (#13394)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d2e0ff01b..40c795877 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
+        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
         with:
           sarif_file: results.sarif

From 829b8fdea441208c08c9d231079f46215344cc46 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 26 Oct 2025 06:17:45 -0700
Subject: [PATCH 36/80] chore(deps): bump actions/upload-artifact from 4.6.2 to
 5.0.0 (#13395)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 40c795877..93a55a250 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -53,7 +53,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif

From 136298e11073c7b34e5a977595c7ba5345ca910e Mon Sep 17 00:00:00 2001
From: Mohaiminus Sakib <3596793+rode093@users.noreply.github.com>
Date: Mon, 27 Oct 2025 19:37:07 +0100
Subject: [PATCH 37/80] feat(nestjs) Adding NestJS plugin (#13104)

* Adding NestJS command aliases
* Removed installation instructions from the README file of NestJS plugin
---
 plugins/nestjs/README.md         | 52 ++++++++++++++++++++++++++++++++
 plugins/nestjs/nestjs.plugin.zsh | 41 +++++++++++++++++++++++++
 2 files changed, 93 insertions(+)
 create mode 100644 plugins/nestjs/README.md
 create mode 100644 plugins/nestjs/nestjs.plugin.zsh

diff --git a/plugins/nestjs/README.md b/plugins/nestjs/README.md
new file mode 100644
index 000000000..295618214
--- /dev/null
+++ b/plugins/nestjs/README.md
@@ -0,0 +1,52 @@
+# NestJS Plugin for Oh My Zsh
+
+This plugin provides aliases for common [NestJS CLI](https://docs.nestjs.com/cli/overview) commands.
+
+## Requirements
+
+- [NestJS CLI](https://docs.nestjs.com/cli/overview#installation) installed globally:
+  `npm install -g @nestjs/cli`
+
+## Aliases
+
+| Alias   | Command                      | Description                                 |
+| :------ | :--------------------------- | :------------------------------------------ |
+| `nnew`  | `nest new`                   | Create a new NestJS project                 |
+| `nb`    | `nest build`                 | Build the NestJS application                |
+| `ns`    | `nest start`                 | Start the application                       |
+| `nsw`   | `nest start --watch`         | Start the application in watch mode         |
+| `nsd`   | `nest start --dev`           | Start the application in dev mode           |
+| `nsdbg` | `nest start --debug --watch` | Start the application in debug & watch mode |
+| `ng`    | `nest generate`              | Generate a NestJS element                   |
+| `ngm`   | `nest generate module`       | Generate a module                           |
+| `ngc`   | `nest generate controller`   | Generate a controller                       |
+| `ngs`   | `nest generate service`      | Generate a service                          |
+| `ngg`   | `nest generate guard`        | Generate a guard                            |
+| `ngp`   | `nest generate pipe`         | Generate a pipe                             |
+| `ngf`   | `nest generate filter`       | Generate a filter                           |
+| `ngr`   | `nest generate resolver`     | Generate a GraphQL resolver                 |
+| `ngcl`  | `nest generate class`        | Generate a class                            |
+| `ngi`   | `nest generate interface`    | Generate an interface                       |
+| `ngit`  | `nest generate interceptor`  | Generate an interceptor                     |
+| `ngmi`  | `nest generate middleware`   | Generate a middleware                       |
+| `ngd`   | `nest generate decorator`    | Generate a custom decorator                 |
+| `ngres` | `nest generate resource`     | Generate a CRUD resource                    |
+| `nglib` | `nest generate library`      | Generate a new library                      |
+| `ngsub` | `nest generate sub-app`      | Generate a new sub-application (monorepo)   |
+| `na`    | `nest add`                   | Add a library to the project                |
+| `ni`    | `nest info`                  | Display NestJS project information          |
+| `nu`    | `nest update`                | Update NestJS dependencies                  |
+
+## Usage
+
+1. Add `nestjs` to the `plugins` array in your `~/.zshrc` file:
+
+```zsh
+plugins=(... nestjs)
+```
+
+2. Restart your terminal or source your `~/.zshrc` file:
+
+```zsh
+source ~/.zshrc
+```
diff --git a/plugins/nestjs/nestjs.plugin.zsh b/plugins/nestjs/nestjs.plugin.zsh
new file mode 100644
index 000000000..9496abdeb
--- /dev/null
+++ b/plugins/nestjs/nestjs.plugin.zsh
@@ -0,0 +1,41 @@
+# Oh My Zsh plugin for NestJS CLI
+
+# Check if nest command exists
+if ! command -v nest &>/dev/null; then
+  return
+fi
+
+# Project creation
+alias nnew='nest new'
+
+# Basic development
+alias nb='nest build'
+alias ns='nest start'
+alias nsw='nest start --watch'
+alias nsd='nest start --dev' # Alias for start --watch
+alias nsdbg='nest start --debug --watch'
+
+# Code generation (short aliases)
+alias ng='nest generate'
+alias ngm='nest generate module'
+alias ngc='nest generate controller'
+alias ngs='nest generate service'
+alias ngg='nest generate guard'
+alias ngp='nest generate pipe'
+alias ngf='nest generate filter'
+alias ngr='nest generate resolver'
+alias ngcl='nest generate class'
+alias ngi='nest generate interface'
+alias ngit='nest generate interceptor'
+alias ngmi='nest generate middleware'
+alias ngd='nest generate decorator'
+alias ngres='nest generate resource'
+alias nglib='nest generate library'
+alias ngsub='nest generate sub-app'
+
+# Other commands
+alias na='nest add'
+alias ni='nest info'
+alias nu='nest update'
+
+# You can add more aliases or functions here as needed.

From 1dc87da9e6d67c4057303124d2ebcd8c93eb6141 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Wed, 29 Oct 2025 19:46:31 +0100
Subject: [PATCH 38/80] chore: tidy funding (#13401)

---
 .github/FUNDING.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index 6c86ac450..e91717d9d 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,2 +1,6 @@
-github: [ohmyzsh, robbyrussell, mcornella, larson-carter, carlosala]
+github: 
+  - ohmyzsh
+  - robbyrussell
+  - mcornella
+  - carlosala
 open_collective: ohmyzsh

From 43e880ba45d2785ed0dda3dcaf7b5cd610eb3063 Mon Sep 17 00:00:00 2001
From: Yaroslav Sapak <145782146+IaroslavSapak@users.noreply.github.com>
Date: Fri, 31 Oct 2025 04:22:01 +0200
Subject: [PATCH 39/80] feat(vscode): add support for Cursor (#13382)

---
 plugins/vscode/README.md         | 10 +++++++---
 plugins/vscode/vscode.plugin.zsh |  4 +++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/plugins/vscode/README.md b/plugins/vscode/README.md
index f91b533c9..7c746d3d3 100644
--- a/plugins/vscode/README.md
+++ b/plugins/vscode/README.md
@@ -1,7 +1,6 @@
 # VS Code
 
-This plugin provides useful aliases to simplify the interaction between the command line and VS Code or
-VSCodium editor.
+This plugin provides useful aliases to simplify the interaction between the command line and VS Code, VSCodium, or Cursor editor.
 
 To start using it, add the `vscode` plugin to your `plugins` array in `~/.zshrc`:
 
@@ -18,6 +17,7 @@ You can install either:
 - VS Code (code)
 - VS Code Insiders (code-insiders)
 - VSCodium (codium)
+- Cursor (cursor)
 
 ### MacOS
 
@@ -33,6 +33,10 @@ open the Command Palette via (F1 or ⇧⌘P) and type shell command to find the
 
 > Shell Command: Install 'codium' command in PATH
 
+For Cursor, open the Command Palette via (F1 or ⌘⇧P) and type shell command to find the Shell Command:
+
+> Shell Command: Install 'cursor' command in PATH
+
 ## Using multiple flavours
 
 If for any reason, you ever require to use multiple flavours of VS Code i.e. VS Code (stable) and VS Code
@@ -43,7 +47,7 @@ executable.
 ```zsh
 ZSH_THEME=...
 
-# Choose between one [code, code-insiders or codium]
+# Choose between one [code, code-insiders, codium, or cursor]
 # The following line will make the plugin to open VS Code Insiders
 # Invalid entries will be ignored, no aliases will be added
 VSCODE=code-insiders
diff --git a/plugins/vscode/vscode.plugin.zsh b/plugins/vscode/vscode.plugin.zsh
index 77367bcac..1635a9832 100644
--- a/plugins/vscode/vscode.plugin.zsh
+++ b/plugins/vscode/vscode.plugin.zsh
@@ -1,4 +1,4 @@
-# VS Code (stable / insiders) / VSCodium zsh plugin
+# VS Code (stable / insiders) / VSCodium / Cursor zsh plugin
 # Authors:
 #   https://github.com/MarsiBarsi (original author)
 #   https://github.com/babakks
@@ -19,6 +19,8 @@ if [[ -z "$VSCODE" ]]; then
     VSCODE=code-insiders
   elif which codium &>/dev/null; then
     VSCODE=codium
+  elif which cursor &>/dev/null; then
+    VSCODE=cursor
   else
     return
   fi

From 423e9aef522fa954e73b77a99ee627723fc31257 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Nov 2025 08:29:39 +0100
Subject: [PATCH 40/80] chore(deps): bump github/codeql-action from 4.31.0 to
 4.31.2 (#13408)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.0 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/4e94bd11f71e507f7f87df81788dff88d1dacbfb...0499de31b99561a6d14a36a5f662c2a54f91beee)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 93a55a250..ca2655968 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           sarif_file: results.sarif

From 90a22b61e66dbd83928be7b9739de554a5f1c09d Mon Sep 17 00:00:00 2001
From: "ohmyzsh[bot]" <54982679+ohmyzsh[bot]@users.noreply.github.com>
Date: Mon, 3 Nov 2025 08:30:05 +0100
Subject: [PATCH 41/80] feat(gradle): update to 25c3d368 (#13407)

Co-authored-by: ohmyzsh[bot] <54982679+ohmyzsh[bot]@users.noreply.github.com>
---
 .github/dependencies.yml | 2 +-
 plugins/gradle/_gradle   | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/dependencies.yml b/.github/dependencies.yml
index b8e33e62e..d85451007 100644
--- a/.github/dependencies.yml
+++ b/.github/dependencies.yml
@@ -12,7 +12,7 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: 1525cf3f2242062199ffcf0c5c1055625db6b9d2
+    version: 25c3d368527e7679e30a63f53cb20540cb285a24
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete
diff --git a/plugins/gradle/_gradle b/plugins/gradle/_gradle
index 04f6425be..bbb7353cc 100644
--- a/plugins/gradle/_gradle
+++ b/plugins/gradle/_gradle
@@ -339,8 +339,10 @@ __gradle_subcommand() {
                 (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
                 {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
                 '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+                '--rerun[Causes the task to be re-run even if up-to-date.]' \
                 '--rerun-tasks[Ignore previously cached task results.]' \
                 (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+                {-V,--show-version}'[Print version info and continue.]' \
                 (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
                 '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
                 \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
@@ -465,14 +467,16 @@ _gradle() {
         (--warn,-w,--info,-i,--debug,-d){-q,--quiet}'[Log errors only.]' \
         {-U,--refresh-dependencies}'[Refresh the state of dependencies.]' \
         '--refresh-keys[Refresh the public keys used for dependency verification.]' \
+        '--rerun[Causes the task to be re-run even if up-to-date.]' \
         '--rerun-tasks[Ignore previously cached task results.]' \
         (--no-scan)'--scan[Generate a Build Scan (powered by Develocity).]' \
+        {-V,--show-version}'[Print version info and continue.]' \
         (--full-stacktrace,-S){-s,--stacktrace}'[Print out the stacktrace for all exceptions.]' \
         '--status[Shows status of running and recently stopped Gradle daemon(s).]' \
         '--stop[Stops the Gradle daemon if it is running.]' \
         '--task-graph[(Experimental) Print task graph instead of executing tasks.]' \
         \*'--update-locks[Perform a partial update of the dependency lock, letting passed in module notations change version. (incubating)]' \
-        {-v,--version}'[Shows the version info.]' \
+        {-v,--version}'[Print version info and exit.]' \
         (--quiet,-q,--info,-i,--debug,-d){-w,--warn}'[Set log level to warn.]' \
         '--warning-mode[Specifies which mode of warnings to generate. Values are 'all', 'fail', 'summary'(default) or 'none']:warning mode:(all summary none):->argument-expected' \
         (--no-watch-fs)'--watch-fs[Enables watching the file system for changes, allowing data about the file system to be re-used for the next build.]' \

From e70086a76a89405caa22f3e7fed6fcc8aeaa6f7c Mon Sep 17 00:00:00 2001
From: "ohmyzsh[bot]" <54982679+ohmyzsh[bot]@users.noreply.github.com>
Date: Sun, 9 Nov 2025 07:48:59 +0100
Subject: [PATCH 42/80] feat(gradle): update to a9d7c822 (#13413)

Co-authored-by: ohmyzsh[bot] <54982679+ohmyzsh[bot]@users.noreply.github.com>
---
 .github/dependencies.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependencies.yml b/.github/dependencies.yml
index d85451007..08289a04b 100644
--- a/.github/dependencies.yml
+++ b/.github/dependencies.yml
@@ -12,7 +12,7 @@ dependencies:
   plugins/gradle:
     repo: gradle/gradle-completion
     branch: master
-    version: 25c3d368527e7679e30a63f53cb20540cb285a24
+    version: a9d7c822e42cc6a5b028b59e46cffcc8e7bc1134
     precopy: |
       set -e
       find . ! -name _gradle ! -name LICENSE -delete

From 18d0a63df8ed61aad7b25dc9c6f61a7cb88760dc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 9 Nov 2025 20:03:00 +0100
Subject: [PATCH 43/80] chore(deps): bump step-security/harden-runner from
 2.13.1 to 2.13.2 (#13414)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/installer.yml    | 4 ++--
 .github/workflows/main.yml         | 2 +-
 .github/workflows/project.yml      | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index be54fdf41..9ff5ae375 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 2d1de706a..829d3804f 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b48a3d32b..5bd062e1b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index e6da2cbe5..1d22ec3d1 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ca2655968..6bb853386 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 

From a0576348d012cbcac17967ef66ed996fee188e38 Mon Sep 17 00:00:00 2001
From: Oskar Hermansson <oskar.hermansson@gmail.com>
Date: Wed, 12 Nov 2025 00:10:26 +0100
Subject: [PATCH 44/80] docs(dotnet): remove `Core` suffix (#13418)

---
 plugins/dotnet/README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/plugins/dotnet/README.md b/plugins/dotnet/README.md
index 217c46751..2b06d8810 100644
--- a/plugins/dotnet/README.md
+++ b/plugins/dotnet/README.md
@@ -1,6 +1,6 @@
-# .NET Core CLI plugin
+# .NET CLI plugin
 
-This plugin provides completion and useful aliases for [.NET Core CLI](https://dotnet.microsoft.com/).
+This plugin provides completion and useful aliases for [.NET CLI](https://dotnet.microsoft.com/).
 
 To use it, add `dotnet` to the plugins array in your zshrc file.
 
@@ -23,4 +23,4 @@ plugins=(... dotnet)
 | dp    | dotnet pack      | Create a NuGet package.                                           |
 | dng   | dotnet nuget     | Provides additional NuGet commands.                               |
 | db    | dotnet build     | Build a .NET project                                              |
-| dres  | dotnet restore   | Restore dependencies and project-specific tools for a project.    |
\ No newline at end of file
+| dres  | dotnet restore   | Restore dependencies and project-specific tools for a project.    |

From dca16e8f9a20a84172044621a95832b4d5a1e057 Mon Sep 17 00:00:00 2001
From: Fournet Enzo <63660254+enzofrnt@users.noreply.github.com>
Date: Wed, 12 Nov 2025 11:42:35 +0100
Subject: [PATCH 45/80] docs(docker-compose): clarify tool choice (#13399)

---
 plugins/docker-compose/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/plugins/docker-compose/README.md b/plugins/docker-compose/README.md
index 66d4e0521..5a0290462 100644
--- a/plugins/docker-compose/README.md
+++ b/plugins/docker-compose/README.md
@@ -2,6 +2,8 @@
 
 This plugin provides completion for [docker-compose](https://docs.docker.com/compose/) as well as some
 aliases for frequent docker-compose commands.
+This plugin chooses automatically between the legacy `docker-compose` command and the modern 
+`docker compose` subcommand, preferring `docker-compose` when both are available.
 
 To use it, add docker-compose to the plugins array of your zshrc file:
 

From 5a282b9b3050e4851c15cfdb9d79af6a708988b7 Mon Sep 17 00:00:00 2001
From: Artyom Fedosov <50590380+artyom-fedosov@users.noreply.github.com>
Date: Fri, 14 Nov 2025 15:21:32 +0200
Subject: [PATCH 46/80] chore(git): remove quotes around `$#` (#13403)

---
 plugins/git/git.plugin.zsh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/plugins/git/git.plugin.zsh b/plugins/git/git.plugin.zsh
index a0052891a..c11799208 100644
--- a/plugins/git/git.plugin.zsh
+++ b/plugins/git/git.plugin.zsh
@@ -102,7 +102,7 @@ function work_in_progress() {
 alias grt='cd "$(git rev-parse --show-toplevel || echo .)"'
 
 function ggpnp() {
-  if [[ "$#" == 0 ]]; then
+  if [[ $# == 0 ]]; then
     ggl && ggp
   else
     ggl "${*}" && ggp "${*}"
@@ -281,7 +281,7 @@ alias gprav='git pull --rebase --autostash -v'
 
 function ggu() {
   local b
-  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  [[ $# != 1 ]] && b="$(git_current_branch)"
   git pull --rebase origin "${b:-$1}"
 }
 compdef _git ggu=git-pull
@@ -293,11 +293,11 @@ alias gprumi='git pull --rebase=interactive upstream $(git_main_branch)'
 alias ggpull='git pull origin "$(git_current_branch)"'
 
 function ggl() {
-  if [[ "$#" != 0 ]] && [[ "$#" != 1 ]]; then
+  if [[ $# != 0 ]] && [[ $# != 1 ]]; then
     git pull origin "${*}"
   else
     local b
-    [[ "$#" == 0 ]] && b="$(git_current_branch)"
+    [[ $# == 0 ]] && b="$(git_current_branch)"
     git pull origin "${b:-$1}"
   fi
 }
@@ -310,7 +310,7 @@ alias gpd='git push --dry-run'
 
 function ggf() {
   local b
-  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  [[ $# != 1 ]] && b="$(git_current_branch)"
   git push --force origin "${b:-$1}"
 }
 compdef _git ggf=git-push
@@ -322,7 +322,7 @@ is-at-least 2.30 "$git_version" \
 
 function ggfl() {
   local b
-  [[ "$#" != 1 ]] && b="$(git_current_branch)"
+  [[ $# != 1 ]] && b="$(git_current_branch)"
   git push --force-with-lease origin "${b:-$1}"
 }
 compdef _git ggfl=git-push
@@ -337,11 +337,11 @@ alias gpod='git push origin --delete'
 alias ggpush='git push origin "$(git_current_branch)"'
 
 function ggp() {
-  if [[ "$#" != 0 ]] && [[ "$#" != 1 ]]; then
+  if [[ $# != 0 ]] && [[ $# != 1 ]]; then
     git push origin "${*}"
   else
     local b
-    [[ "$#" == 0 ]] && b="$(git_current_branch)"
+    [[ $# == 0 ]] && b="$(git_current_branch)"
     git push origin "${b:-$1}"
   fi
 }

From 9d93dfaa60ccc7980ad69b75b1accae0232e4e8f Mon Sep 17 00:00:00 2001
From: Carlo Sala <carlosalag@protonmail.com>
Date: Sat, 15 Nov 2025 11:39:09 -0300
Subject: [PATCH 47/80] fix(keychain): use pattern matching to detect version
 (#13423)

---
 plugins/keychain/keychain.plugin.zsh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/plugins/keychain/keychain.plugin.zsh b/plugins/keychain/keychain.plugin.zsh
index ce5351bce..23cf1af9a 100644
--- a/plugins/keychain/keychain.plugin.zsh
+++ b/plugins/keychain/keychain.plugin.zsh
@@ -20,10 +20,11 @@ function {
 	zstyle -a :omz:plugins:keychain options options
 
 	# Check keychain version to decide whether to use --agents
-	local version_string=$(keychain --version 2>&1 | head -n 2 | tail -n 1 | cut -d ' ' -f 4)
+	local version_string=$(keychain --version 2>&1)
   # start keychain, only use --agents for versions below 2.9.0
 	autoload -Uz is-at-least
-	if is-at-least 2.9 "$version_string"; then
+	if [[ "$version_string" =~ 'keychain ([0-9]+\.[0-9]+)' ]] && \
+      is-at-least 2.9 "$match[1]"; then
 		keychain ${^options:-} ${^identities} --host $SHORT_HOST
 	else
 		keychain ${^options:-} --agents ${agents:-gpg} ${^identities} --host $SHORT_HOST

From 8c5a60644a2a93fb6b7d76ec7a5598f99b426cf0 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sat, 15 Nov 2025 21:00:26 +0100
Subject: [PATCH 48/80] feat: announce OpenSwag and `omz shop` command (#13428)

* Update shop URLs from Planet Argon to OpenSwag and add omz shop command

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: robbyrussell <257+robbyrussell@users.noreply.github.com>
Co-authored-by: mcornella <1441704+mcornella@users.noreply.github.com>
---
 README.md        |  2 +-
 lib/cli.zsh      | 11 +++++++++++
 tools/install.sh |  2 +-
 tools/upgrade.sh |  2 +-
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 55bfa0c5a..eaa3fb29e 100644
--- a/README.md
+++ b/README.md
@@ -547,7 +547,7 @@ We're on social media:
 ## Merchandise
 
 We have
-[stickers, shirts, and coffee mugs available](https://shop.planetargon.com/collections/oh-my-zsh?utm_source=github)
+[stickers, shirts, and coffee mugs available](https://openswag.shop/collections/oh-my-zsh?utm_source=github)
 for you to show off your love of Oh My Zsh. Again, you will become the talk of the town!
 
 ## License
diff --git a/lib/cli.zsh b/lib/cli.zsh
index a002a5073..c62da36af 100644
--- a/lib/cli.zsh
+++ b/lib/cli.zsh
@@ -28,6 +28,7 @@ function _omz {
     'plugin:Manage plugins'
     'pr:Manage Oh My Zsh Pull Requests'
     'reload:Reload the current zsh session'
+    'shop:Open the Oh My Zsh shop'
     'theme:Manage themes'
     'update:Update Oh My Zsh'
     'version:Show the version'
@@ -173,6 +174,7 @@ Available commands:
   plugin <command>    Manage plugins
   pr     <command>    Manage Oh My Zsh Pull Requests
   reload              Reload the current zsh session
+  shop                Open the Oh My Zsh shop
   theme  <command>    Manage themes
   update              Update Oh My Zsh
   version             Show the version
@@ -721,6 +723,15 @@ function _omz::pr::test {
   )
 }
 
+function _omz::shop {
+  local shop_url="https://openswag.shop/collections/oh-my-zsh"
+  
+  _omz::log info "Opening Oh My Zsh shop in your browser..."
+  _omz::log info "$shop_url"
+  
+  open_command "$shop_url"
+}
+
 function _omz::reload {
   # Delete current completion cache
   command rm -f $_comp_dumpfile $ZSH_COMPDUMP
diff --git a/tools/install.sh b/tools/install.sh
index 8cf62a76e..d86550cdd 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -505,7 +505,7 @@ print_success() {
   printf '\n'
   printf '%s\n' "• Follow us on X: $(fmt_link @ohmyzsh https://x.com/ohmyzsh)"
   printf '%s\n' "• Join our Discord community: $(fmt_link "Discord server" https://discord.gg/ohmyzsh)"
-  printf '%s\n' "• Get stickers, t-shirts, coffee mugs and more: $(fmt_link "Planet Argon Shop" https://shop.planetargon.com/collections/oh-my-zsh)"
+  printf '%s\n' "• Get stickers, t-shirts, coffee mugs and more: $(fmt_link "OpenSwag Shop" https://openswag.shop/collections/oh-my-zsh)"
   printf '%s\n' $FMT_RESET
 }
 
diff --git a/tools/upgrade.sh b/tools/upgrade.sh
index 1aa3d8af4..82c0624bc 100755
--- a/tools/upgrade.sh
+++ b/tools/upgrade.sh
@@ -273,7 +273,7 @@ if LANG= git pull --quiet --rebase $remote $branch; then
     printf "${BLUE}%s${RESET}\n\n" "$message"
     printf "${BLUE}${BOLD}%s %s${RESET}\n" "To keep up with the latest news and updates, follow us on X:" "$(fmt_link @ohmyzsh https://x.com/ohmyzsh)"
     printf "${BLUE}${BOLD}%s %s${RESET}\n" "Want to get involved in the community? Join our Discord:" "$(fmt_link "Discord server" https://discord.gg/ohmyzsh)"
-    printf "${BLUE}${BOLD}%s %s${RESET}\n" "Get your Oh My Zsh swag at:" "$(fmt_link "Planet Argon Shop" https://shop.planetargon.com/collections/oh-my-zsh)"
+    printf "${BLUE}${BOLD}%s %s${RESET}\n" "Get your Oh My Zsh swag at:" "$(fmt_link "OpenSwag Shop" https://openswag.shop/collections/oh-my-zsh)"
   elif [[ $verbose_mode == minimal ]]; then
     printf "${BLUE}%s${RESET}\n" "$message"
   fi

From 73d79fe1376cc773b2bcb7f7a27bff880a4502e2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 16 Nov 2025 09:08:43 -0300
Subject: [PATCH 49/80] chore(deps): bump certifi in
 /.github/workflows/dependencies (#13431)

Bumps [certifi](https://github.com/certifi/python-certifi) from 2025.10.5 to 2025.11.12.
- [Commits](https://github.com/certifi/python-certifi/compare/2025.10.05...2025.11.12)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2025.11.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index cc8b0a28f..4fc25d593 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -1,4 +1,4 @@
-certifi==2025.10.5
+certifi==2025.11.12
 charset-normalizer==3.4.4
 idna==3.11
 PyYAML==6.0.3

From 8a4d6fc0a2b5586f093fb2b96b51e2141f643284 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 16 Nov 2025 09:09:09 -0300
Subject: [PATCH 50/80] chore(deps): bump github/codeql-action from 4.31.2 to
 4.31.3 (#13430)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.2 to 4.31.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...014f16e7ab1402f30e7c3329d33797e7948572db)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6bb853386..eec4b453d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         with:
           sarif_file: results.sarif

From b52dd1a425e9ed9f844ba46cd27ff94a3b4949dc Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Wed, 19 Nov 2025 17:44:11 -0800
Subject: [PATCH 51/80] feat: Update OpenSwag domain references to CommitGoods
 (#13434)

* Initial plan

* Update all OpenSwag domain references to CommitGoods

Co-authored-by: robbyrussell <257+robbyrussell@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: robbyrussell <257+robbyrussell@users.noreply.github.com>
---
 README.md        | 2 +-
 lib/cli.zsh      | 2 +-
 tools/install.sh | 2 +-
 tools/upgrade.sh | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index eaa3fb29e..2ccb63b69 100644
--- a/README.md
+++ b/README.md
@@ -547,7 +547,7 @@ We're on social media:
 ## Merchandise
 
 We have
-[stickers, shirts, and coffee mugs available](https://openswag.shop/collections/oh-my-zsh?utm_source=github)
+[stickers, shirts, and coffee mugs available](https://commitgoods.com/collections/oh-my-zsh?utm_source=github)
 for you to show off your love of Oh My Zsh. Again, you will become the talk of the town!
 
 ## License
diff --git a/lib/cli.zsh b/lib/cli.zsh
index c62da36af..55938ba8a 100644
--- a/lib/cli.zsh
+++ b/lib/cli.zsh
@@ -724,7 +724,7 @@ function _omz::pr::test {
 }
 
 function _omz::shop {
-  local shop_url="https://openswag.shop/collections/oh-my-zsh"
+  local shop_url="https://commitgoods.com/collections/oh-my-zsh"
   
   _omz::log info "Opening Oh My Zsh shop in your browser..."
   _omz::log info "$shop_url"
diff --git a/tools/install.sh b/tools/install.sh
index d86550cdd..c31ce2d55 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -505,7 +505,7 @@ print_success() {
   printf '\n'
   printf '%s\n' "• Follow us on X: $(fmt_link @ohmyzsh https://x.com/ohmyzsh)"
   printf '%s\n' "• Join our Discord community: $(fmt_link "Discord server" https://discord.gg/ohmyzsh)"
-  printf '%s\n' "• Get stickers, t-shirts, coffee mugs and more: $(fmt_link "OpenSwag Shop" https://openswag.shop/collections/oh-my-zsh)"
+  printf '%s\n' "• Get stickers, t-shirts, coffee mugs and more: $(fmt_link "CommitGoods Shop" https://commitgoods.com/collections/oh-my-zsh)"
   printf '%s\n' $FMT_RESET
 }
 
diff --git a/tools/upgrade.sh b/tools/upgrade.sh
index 82c0624bc..01719d217 100755
--- a/tools/upgrade.sh
+++ b/tools/upgrade.sh
@@ -273,7 +273,7 @@ if LANG= git pull --quiet --rebase $remote $branch; then
     printf "${BLUE}%s${RESET}\n\n" "$message"
     printf "${BLUE}${BOLD}%s %s${RESET}\n" "To keep up with the latest news and updates, follow us on X:" "$(fmt_link @ohmyzsh https://x.com/ohmyzsh)"
     printf "${BLUE}${BOLD}%s %s${RESET}\n" "Want to get involved in the community? Join our Discord:" "$(fmt_link "Discord server" https://discord.gg/ohmyzsh)"
-    printf "${BLUE}${BOLD}%s %s${RESET}\n" "Get your Oh My Zsh swag at:" "$(fmt_link "OpenSwag Shop" https://openswag.shop/collections/oh-my-zsh)"
+    printf "${BLUE}${BOLD}%s %s${RESET}\n" "Get your Oh My Zsh swag at:" "$(fmt_link "CommitGoods Shop" https://commitgoods.com/collections/oh-my-zsh)"
   elif [[ $verbose_mode == minimal ]]; then
     printf "${BLUE}%s${RESET}\n" "$message"
   fi

From 15bcada010887a519f70f8612c5750b396d49b9d Mon Sep 17 00:00:00 2001
From: StavShukrunRise <Stav.Shukrun@risecodes.com>
Date: Sat, 22 Nov 2025 19:11:40 +0200
Subject: [PATCH 52/80] feat(pulumi): add plugin for Pulumi CLI (#13041)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Marc Cornellà <marc@mcornella.com>
---
 plugins/pulumi/README.md         | 41 ++++++++++++++++++++++++++++++++
 plugins/pulumi/pulumi.plugin.zsh | 28 ++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 plugins/pulumi/README.md
 create mode 100644 plugins/pulumi/pulumi.plugin.zsh

diff --git a/plugins/pulumi/README.md b/plugins/pulumi/README.md
new file mode 100644
index 000000000..4c771964b
--- /dev/null
+++ b/plugins/pulumi/README.md
@@ -0,0 +1,41 @@
+# Pulumi
+
+This is an **Oh My Zsh plugin** for the [**Pulumi CLI**](https://www.pulumi.com/docs/iac/cli/),
+an Infrastructure as Code (IaC) tool for building, deploying and managing cloud infrastucture.
+
+This plugin provides:
+
+- 🚀 Short, intuitive aliases for common Pulumi commands
+- 🎯 Auto-completion support for Pulumi
+
+To use it, add `pulumi` to the plugins array in your `.zshrc` file:  
+
+```zsh
+plugins=(... pulumi)
+```
+
+## ⚡ Aliases
+
+| Alias    | Command                | Description                   |
+| -------- | ---------------------- | ----------------------------- |
+| `pul`    | `pulumi`               | Shortcut for Pulumi CLI       |
+| `pulcs`  | `pulumi config set`    | Set Pulumi configuration      |
+| `puld`   | `pulumi destroy`       | Destroy all resources         |
+| `pullog` | `pulumi logs -f`       | Tail Pulumi logs in real-time |
+| `pulp`   | `pulumi preview`       | Show planned changes          |
+| `pulr`   | `pulumi refresh`       | Refresh state from cloud      |
+| `puls`   | `pulumi stack`         | Show stack details            |
+| `pulsh`  | `pulumi stack history` | Show stack history            |
+| `pulsi`  | `pulumi stack init`    | Initialize a new stack        |
+| `pulsl`  | `pulumi stack ls`      | List available stacks         |
+| `pulso`  | `pulumi stack output`  | Show stack outputs            |
+| `pulss`  | `pulumi stack select`  | Switch stack                  |
+| `pulu`   | `pulumi up`            | Deploy infrastructure         |
+
+## 🎯 Autocompletion
+
+If `pulumi gen-completion zsh` is available, this plugin **automatically loads Pulumi auto-completion**.
+
+## 🛠️ Contribution
+
+Feel free to open an issue or PR for improvements! 🚀
diff --git a/plugins/pulumi/pulumi.plugin.zsh b/plugins/pulumi/pulumi.plugin.zsh
new file mode 100644
index 000000000..70686017f
--- /dev/null
+++ b/plugins/pulumi/pulumi.plugin.zsh
@@ -0,0 +1,28 @@
+if (( ! $+commands[pulumi] )); then
+  return
+fi
+
+# If the completion file doesn't exist yet, we need to autoload it and
+# bind it to `pulumi`. Otherwise, compinit will have already done that.
+if [[ ! -f "$ZSH_CACHE_DIR/completions/_pulumi" ]]; then
+  typeset -g -A _comps
+  autoload -Uz _pulumi
+  _comps[pulumi]=_pulumi
+fi
+
+pulumi gen-completion zsh >| "$ZSH_CACHE_DIR/completions/_pulumi" &|
+
+# Aliases
+alias pul='pulumi'
+alias pulcs='pulumi config set'
+alias puld='pulumi destroy'
+alias pullog='pulumi logs -f'
+alias pulp='pulumi preview'
+alias pulr='pulumi refresh'
+alias puls='pulumi stack'
+alias pulsh='pulumi stack history'
+alias pulsi='pulumi stack init'
+alias pulsl='pulumi stack ls'
+alias pulso='pulumi stack output'
+alias pulss='pulumi stack select'
+alias pulu='pulumi up'

From b04e01d41822963875db876e1d3e7e7d1b67541c Mon Sep 17 00:00:00 2001
From: Firas Bouzguenda <19820205+mofibo@users.noreply.github.com>
Date: Sat, 22 Nov 2025 18:31:03 +0100
Subject: [PATCH 53/80] feat(kubectl): add aliases for `kubectl rollout
 restart` (#12883)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Marc Cornellà <marc@mcornella.com>
---
 plugins/kubectl/README.md          | 4 +++-
 plugins/kubectl/kubectl.plugin.zsh | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/plugins/kubectl/README.md b/plugins/kubectl/README.md
index 6f347a8ee..e510c5f40 100644
--- a/plugins/kubectl/README.md
+++ b/plugins/kubectl/README.md
@@ -27,7 +27,7 @@ plugins=(... kubectl)
 | kdel     | `kubectl delete`                                        | Delete resources by filenames, stdin, resources and names, or by resources and label selector    |
 | kdelf    | `kubectl delete -f`                                     | Delete a pod using the type and name specified in -f argument                                    |
 | kge      | `kubectl get events --sort-by=".lastTimestamp"`         | Get events (sorted by timestamp)                                                                 |
-| kgew     | `kubectl get events --watch --sort-by=".lastTimestamp"` | Get events and watch as they occur (sorted by timestamp)                                                                 |
+| kgew     | `kubectl get events --watch --sort-by=".lastTimestamp"` | Get events and watch as they occur (sorted by timestamp)                                         |
 |          |                                                         | **Pod management**                                                                               |
 | kgp      | `kubectl get pods`                                      | List all pods in ps output format                                                                |
 | kgpl     | `kgp -l`                                                | Get pods by label. Example: `kgpl "app=myapp" -n myns`                                           |
@@ -74,6 +74,7 @@ plugins=(... kubectl)
 | kdeld    | `kubectl delete deployment`                             | Delete the deployment                                                                            |
 | ksd      | `kubectl scale deployment`                              | Scale a deployment                                                                               |
 | krsd     | `kubectl rollout status deployment`                     | Check the rollout status of a deployment                                                         |
+| krrd     | `kubectl rollout restart deployment`                    | Rollout restart a deployment                                                                     |
 | kres     | `kubectl set env $@ REFRESHED_AT=...`                   | Recreate all pods in deployment with zero-downtime                                               |
 |          |                                                         | **Rollout management**                                                                           |
 | kgrs     | `kubectl get replicaset`                                | List all ReplicaSets `rs` created by the deployment                                              |
@@ -112,6 +113,7 @@ plugins=(... kubectl)
 | kdelss   | `kubectl delete statefulset`                            | Delete the statefulset                                                                           |
 | ksss     | `kubectl scale statefulset`                             | Scale a statefulset                                                                              |
 | krsss    | `kubectl rollout status statefulset`                    | Check the rollout status of a deployment                                                         |
+| krrss    | `kubectl rollout restart statefulset`                   | Rollout restart a statefulset                                                                    |
 |          |                                                         | **Service Accounts management**                                                                  |
 | kdsa     | `kubectl describe sa`                                   | Describe a service account in details                                                            |
 | kdelsa   | `kubectl delete sa`                                     | Delete the service account                                                                       |
diff --git a/plugins/kubectl/kubectl.plugin.zsh b/plugins/kubectl/kubectl.plugin.zsh
index 4a72c02af..912136da4 100644
--- a/plugins/kubectl/kubectl.plugin.zsh
+++ b/plugins/kubectl/kubectl.plugin.zsh
@@ -98,6 +98,7 @@ alias kdd='kubectl describe deployment'
 alias kdeld='kubectl delete deployment'
 alias ksd='kubectl scale deployment'
 alias krsd='kubectl rollout status deployment'
+alias krrd='kubectl rollout restart deployment'
 
 function kres(){
   kubectl set env $@ REFRESHED_AT=$(date +%Y%m%d%H%M%S)
@@ -120,6 +121,7 @@ alias kdss='kubectl describe statefulset'
 alias kdelss='kubectl delete statefulset'
 alias ksss='kubectl scale statefulset'
 alias krsss='kubectl rollout status statefulset'
+alias krrss='kubectl rollout restart statefulset'
 
 # Port forwarding
 alias kpf="kubectl port-forward"

From fc2d0f8848aded33596b85eafa0b50d7e6558d0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Sun, 23 Nov 2025 20:50:17 +0100
Subject: [PATCH 54/80] chore: add OpenSSF Best Practices badge (#13443)

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 2ccb63b69..ab2e57144 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,7 @@ To learn more, visit [ohmyz.sh](https://ohmyz.sh), follow [@ohmyzsh](https://x.c
 Twitter), and join us on [Discord](https://discord.gg/ohmyzsh).
 
 [![CI](https://github.com/ohmyzsh/ohmyzsh/workflows/CI/badge.svg)](https://github.com/ohmyzsh/ohmyzsh/actions?query=workflow%3ACI)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10713/badge)](https://www.bestpractices.dev/projects/10713)
 [![X (formerly Twitter) Follow](https://img.shields.io/twitter/follow/ohmyzsh?label=%40ohmyzsh&logo=x&style=flat)](https://twitter.com/intent/follow?screen_name=ohmyzsh)
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/111169632522566717?label=%40ohmyzsh&domain=https%3A%2F%2Fmstdn.social&logo=mastodon&style=flat)](https://mstdn.social/@ohmyzsh)
 [![Discord server](https://img.shields.io/discord/642496866407284746)](https://discord.gg/ohmyzsh)

From 441299ca775d0e718e72d8cf2490702ac98d3b08 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 23 Nov 2025 22:35:53 +0100
Subject: [PATCH 55/80] chore(deps): bump actions/checkout from 5.0.0 to 6.0.0
 (#13438)

Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...1af3b93b6815bc44a9784bd300feb67ff0d1eeb3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/installer.yml    | 4 ++--
 .github/workflows/main.yml         | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 9ff5ae375..45dee6f5d 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -19,7 +19,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 829d3804f..120381dd8 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -31,7 +31,7 @@ jobs:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -52,7 +52,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5bd062e1b..8200f50a6 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -29,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index eec4b453d..5078aecc6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 

From 0116e7a5af51e1c1bb10f99004224a2136406420 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 23 Nov 2025 22:36:07 +0100
Subject: [PATCH 56/80] chore(deps): bump github/codeql-action from 4.31.3 to
 4.31.4 (#13439)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.3 to 4.31.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/014f16e7ab1402f30e7c3329d33797e7948572db...e12f0178983d466f2f6028f5cc7a6d786fd97f4b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5078aecc6..e57546112 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
+        uses: github/codeql-action/upload-sarif@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           sarif_file: results.sarif

From beadd56dd75e8a40fe0a7d4a5d63ed5bf9efcd48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 23 Nov 2025 22:37:35 +0100
Subject: [PATCH 57/80] chore(deps): bump actions/create-github-app-token from
 2.1.4 to 2.2.0 (#13440)

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.1.4 to 2.2.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e71183d1719ab42...7e473efe3cb98aa54f8d4bac15400b15fad77d94)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/project.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 45dee6f5d..1c4ae131a 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 1d22ec3d1..6a236e691 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -22,7 +22,7 @@ jobs:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}

From 343c5a83cb758e65fd638c7c05672198a9860619 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 30 Nov 2025 16:28:47 +0100
Subject: [PATCH 58/80] chore(deps): bump github/codeql-action from 4.31.4 to
 4.31.5 (#13456)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.4 to 4.31.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e12f0178983d466f2f6028f5cc7a6d786fd97f4b...fdbfb4d2750291e159f0156def62b853c2798ca2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e57546112..95d1086b8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
+        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
         with:
           sarif_file: results.sarif

From a449c0247d69726fe4f3ca4fe88182bdb215a5d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 30 Nov 2025 16:29:07 +0100
Subject: [PATCH 59/80] chore(deps): bump actions/setup-python from 6.0.0 to
 6.1.0 (#13455)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/e797f83bcb11b83ae66e0230d6156d7c80228e7c...83679a892e2d95755f2dac6acb0bfd1e9ac5d548)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 1c4ae131a..000589087 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -29,7 +29,7 @@ jobs:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.12"
           cache: "pip"

From ca5c467db1d495a4b5c0049a4cf476ca7f34b790 Mon Sep 17 00:00:00 2001
From: Carlo Sala <carlosalag@protonmail.com>
Date: Mon, 1 Dec 2025 09:59:09 +0100
Subject: [PATCH 60/80] fix(dependencies): only open PR if there are relevant
 changes (#13454)

Fixes cases like #13453
---
 .github/workflows/dependencies/updater.py | 70 +++++++++++++----------
 1 file changed, 39 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/dependencies/updater.py b/.github/workflows/dependencies/updater.py
index 02cff9030..aee15d9e0 100644
--- a/.github/workflows/dependencies/updater.py
+++ b/.github/workflows/dependencies/updater.py
@@ -219,32 +219,33 @@ class Dependency:
                     # Create new branch
                     branch = Git.checkout_or_create_branch(branch_name)
 
-                    # Update dependencies.yml file
-                    self.__update_yaml(
-                        f"tag:{new_version}" if is_tag else status["version"]
-                    )
-
                     # Update dependency files
                     self.__apply_upstream_changes()
 
-                    # Add all changes and commit
-                    has_new_commit = Git.add_and_commit(self.name, new_version)
-
-                    if has_new_commit:
-                        # Push changes to remote
-                        Git.push(branch)
-
-                        # Create GitHub PR
-                        GitHub.create_pr(
-                            branch,
-                            f"feat({self.name}): update to version {new_version}",
-                            f"""## Description
-
-Update for **{self.desc}**: update to version [{new_version}]({status['head_url']}).
-Check out the [list of changes]({status['compare_url']}).
-""",
+                    if not Git.repo_is_clean():
+                        # Update dependencies.yml file
+                        self.__update_yaml(
+                            f"tag:{new_version}" if is_tag else status["version"]
                         )
 
+                        # Add all changes and commit
+                        has_new_commit = Git.add_and_commit(self.name, new_version)
+
+                        if has_new_commit:
+                            # Push changes to remote
+                            Git.push(branch)
+
+                            # Create GitHub PR
+                            GitHub.create_pr(
+                                branch,
+                                f"feat({self.name}): update to version {new_version}",
+                                f"""## Description
+
+Update for **{self.desc}**: update to version [{new_version}]({status["head_url"]}).
+Check out the [list of changes]({status["compare_url"]}).
+""",
+                            )
+
                     # Clean up repository
                     Git.clean_repo()
                 except (CommandRunner.Exception, shutil.Error) as e:
@@ -275,8 +276,8 @@ Check out the [list of changes]({status['compare_url']}).
 
 There is a new version of `{self.name}` {self.kind} available.
 
-New version: [{new_version}]({status['head_url']})
-Check out the [list of changes]({status['compare_url']}).
+New version: [{new_version}]({status["head_url"]})
+Check out the [list of changes]({status["compare_url"]}).
 """
 
                     print("Creating GitHub issue", file=sys.stderr)
@@ -377,21 +378,28 @@ class Git:
             )
         return branch_name
 
+    @staticmethod
+    def repo_is_clean() -> bool:
+        """
+        Returns `True` if the repo is clean.
+        Returns `False` if the repo is dirty.
+        """
+        try:
+            CommandRunner.run_or_fail(
+                ["git", "diff", "--exit-code"], stage="CheckRepoClean"
+            )
+            return True
+        except CommandRunner.Exception:
+            return False
+
     @staticmethod
     def add_and_commit(scope: str, version: str) -> bool:
         """
         Returns `True` if there were changes and were indeed commited.
         Returns `False` if the repo was clean and no changes were commited.
         """
-        # check if repo is clean (clean => no error, no commit)
-        try:
-            CommandRunner.run_or_fail(
-                ["git", "diff", "--exit-code"], stage="CheckRepoClean"
-            )
+        if Git.repo_is_clean():
             return False
-        except CommandRunner.Exception:
-            # if it's other kind of error just throw!
-            pass
 
         user_name = os.environ.get("GIT_APP_NAME")
         user_email = os.environ.get("GIT_APP_EMAIL")

From ee30bc535a5a9ec1f062558af2ed8b83ad5af7a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Mon, 1 Dec 2025 10:49:01 +0100
Subject: [PATCH 61/80] refactor(fig)!: remove archived `fig` plugin

BREAKING CHANGE: the fig plugin has been removed. `fig` was sunset
on September 1, 2024. Having this plugin no longer makes sense.
See https://fig.io/ for more information.
---
 plugins/fig/README.md      |  9 ---------
 plugins/fig/fig.plugin.zsh | 13 -------------
 2 files changed, 22 deletions(-)
 delete mode 100644 plugins/fig/README.md
 delete mode 100644 plugins/fig/fig.plugin.zsh

diff --git a/plugins/fig/README.md b/plugins/fig/README.md
deleted file mode 100644
index 3861958d6..000000000
--- a/plugins/fig/README.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Fig plugin
-
-This plugin sets up completion for [Fig](https://fig.io/).
-
-To use it, add `fig` to the plugins array in your zshrc file:
-
-```zsh
-plugins=(... fig)
-```
diff --git a/plugins/fig/fig.plugin.zsh b/plugins/fig/fig.plugin.zsh
deleted file mode 100644
index cddb6c7c0..000000000
--- a/plugins/fig/fig.plugin.zsh
+++ /dev/null
@@ -1,13 +0,0 @@
-if ! (( $+commands[fig] )); then
-  return
-fi
-
-# If the completion file doesn't exist yet, we need to autoload it and
-# bind it to `fig`. Otherwise, compinit will have already done that
-if [[ ! -f "$ZSH_CACHE_DIR/completions/_fig" ]]; then
-  autoload -Uz _fig
-  typeset -g -A _comps
-  _comps[fig]=_fig
-fi
-
-fig completion zsh >| "$ZSH_CACHE_DIR/completions/_fig" &|

From 977c4f93a65e9befbb6b960c7062f24c5fca6059 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Mon, 1 Dec 2025 10:51:33 +0100
Subject: [PATCH 62/80] refactor(rbfu)!: remove deprecated `rbfu` plugin

BREAKING CHANGE: `rbfu`, the tool to manage Ruby versions, has long
been deprecated (2013-02-05). The plugin has been removed. If you
were still using it, consider using alternative Ruby version
managers: https://www.jetbrains.com/help/ruby/ruby-version-managers.html
---
 plugins/rbfu/README.md       | 18 -------------
 plugins/rbfu/rbfu.plugin.zsh | 49 ------------------------------------
 2 files changed, 67 deletions(-)
 delete mode 100644 plugins/rbfu/README.md
 delete mode 100644 plugins/rbfu/rbfu.plugin.zsh

diff --git a/plugins/rbfu/README.md b/plugins/rbfu/README.md
deleted file mode 100644
index fbcab64de..000000000
--- a/plugins/rbfu/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# rbfu plugin
-
-This plugin starts [rbfu](https://github.com/hmans/rbfu), a minimal Ruby version
-manager, and adds some useful functions.
-
-To use it, add `rbfu` to the plugins array in your zshrc file:
-
-```zsh
-plugins=(... rbfu)
-```
-
-**Note: `rbfu` is deprecated and should no longer be used.**
-
-## Functions
-
-- `rbfu-rubies`: lists all installed rubies available to rbfu.
-
-- `rvm_prompt_info`: shows the Ruby version being used with rbfu.
diff --git a/plugins/rbfu/rbfu.plugin.zsh b/plugins/rbfu/rbfu.plugin.zsh
deleted file mode 100644
index 27dc3eec6..000000000
--- a/plugins/rbfu/rbfu.plugin.zsh
+++ /dev/null
@@ -1,49 +0,0 @@
-# Enables rbfu with --auto option, if available.
-#
-# Also provides a command to list all installed/available
-# rubies. To ensure compatibility with themes, creates the
-# rvm_prompt_info function to return the $RBFU_RUBY_VERSION
-# version.
-
-command -v rbfu &>/dev/null || return
-
-eval "$(rbfu --init --auto)"
-
-# Internal: Print ruby version details, if it's currently active, etc.
-function _rbfu_rubies_print() {
-  # 1: path to ruby file
-  # 2: active ruby
-  local rb rb_out
-  rb="${$1:t}"
-  rb_out="$rb"
-
-  # If the ruby is a symlink, add @ to the name.
-  if [[ -h "$1" ]]; then
-    rb_out="${rb_out}${fg[green]}@${reset_color}"
-  fi
-
-  # If the ruby is active, add * to the name and show it in red.
-  if [[ "$rb" = "$2" ]]; then
-    rb_out="${fg[red]}${rb_out} ${fg[red]}*${reset_color}"
-  fi
-
-  echo $rb_out
-}
-
-# Public: Provide a list with all available rubies, this basically depends
-# on ~/.rfbu/rubies. Highlights the currently active ruby version and aliases.
-function rbfu-rubies() {
-  local rbfu_dir active_rb
-  rbfu_dir="${RBFU_RUBIES:-${HOME}/.rbfu/rubies}"
-  active_rb="${RBFU_RUBY_VERSION:-system}"
-
-  _rbfu_rubies_print "${rbfu_dir}/system" "$active_rb"
-  for rb in ${rbfu_dir}/*(N); do
-    _rbfu_rubies_print "$rb" "$active_rb"
-  done
-}
-
-# Public: Create rvm_prompt_info command for themes compatibility, unless
-# it has already been defined.
-(( ${+functions[rvm_prompt_info]} )) || \
-function rvm_prompt_info() { echo "${${RBFU_RUBY_VERSION:=system}:gs/%/%%}" }

From e9fc134236323ce3ce376715b1e55a54ed6ac7ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <marc@mcornella.com>
Date: Mon, 1 Dec 2025 11:22:14 +0100
Subject: [PATCH 63/80] ci(dependencies): update job permissions, change
 commits to `chore` (#13457)

---
 .github/workflows/dependencies.yml        | 5 ++---
 .github/workflows/dependencies/updater.py | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 000589087..a21803ec6 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -4,14 +4,13 @@ on:
   schedule:
     - cron: "0 6 * * 0"
 
-permissions:
-  contents: write
-
 jobs:
   check:
     name: Check for updates
     runs-on: ubuntu-latest
     if: github.repository == 'ohmyzsh/ohmyzsh'
+    permissions:
+      contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
diff --git a/.github/workflows/dependencies/updater.py b/.github/workflows/dependencies/updater.py
index aee15d9e0..783161d6c 100644
--- a/.github/workflows/dependencies/updater.py
+++ b/.github/workflows/dependencies/updater.py
@@ -238,7 +238,7 @@ class Dependency:
                             # Create GitHub PR
                             GitHub.create_pr(
                                 branch,
-                                f"feat({self.name}): update to version {new_version}",
+                                f"chore({self.name}): update to version {new_version}",
                                 f"""## Description
 
 Update for **{self.desc}**: update to version [{new_version}]({status["head_url"]}).
@@ -423,7 +423,7 @@ class Git:
                 f"user.email={user_email}",
                 "commit",
                 "-m",
-                f"feat({scope}): update to {version}",
+                f"chore({scope}): update to {version}",
             ],
             stage="CreateCommit",
             env=clean_env,

From 5f7f41975992ac1e21fd91df866b02ddfd4fad65 Mon Sep 17 00:00:00 2001
From: benzlokzik <121052717+benzlokzik@users.noreply.github.com>
Date: Fri, 5 Dec 2025 10:51:45 +0300
Subject: [PATCH 64/80] feat(uv): add alias for pinning Python version (#12914)

---
 plugins/uv/README.md     | 1 +
 plugins/uv/uv.plugin.zsh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/plugins/uv/README.md b/plugins/uv/README.md
index 1b99c1185..144ec456a 100644
--- a/plugins/uv/README.md
+++ b/plugins/uv/README.md
@@ -19,6 +19,7 @@ plugins=(... uv)
 | uvlu  | `uv lock --upgrade`                                                     | Lock the dependencies to the newest compatible versions              |
 | uvp   | `uv pip`                                                                | Manage pip packages                                                  |
 | uvpy  | `uv python`                                                             | Manage Python installs                                               |
+| uvpp  | `uv python pin`                                                         | Pin the current project to use a specific Python version             |
 | uvr   | `uv run`                                                                | Run commands within the project's environment                        |
 | uvrm  | `uv remove`                                                             | Remove packages from the project                                     |
 | uvs   | `uv sync`                                                               | Sync the environment with the lock file                              |
diff --git a/plugins/uv/uv.plugin.zsh b/plugins/uv/uv.plugin.zsh
index abcbc117e..ef0f78f6b 100644
--- a/plugins/uv/uv.plugin.zsh
+++ b/plugins/uv/uv.plugin.zsh
@@ -12,6 +12,7 @@ alias uvlr='uv lock --refresh'
 alias uvlu='uv lock --upgrade'
 alias uvp='uv pip'
 alias uvpy='uv python'
+alias uvpp='uv python pin'
 alias uvr='uv run'
 alias uvrm='uv remove'
 alias uvs='uv sync'

From a98a9f7122d583a9547e9a8b2ab8c14570fc6e54 Mon Sep 17 00:00:00 2001
From: Cyril Plisko <cyril.plisko@mountall.com>
Date: Fri, 5 Dec 2025 13:00:56 +0200
Subject: [PATCH 65/80] feat(jj): add `jj` aliases for common workflows
 (#13179)

- jj bookmark
    Aliases for bookmark subcommands
- jj git push
    Aliases for popular push flags
- jj new "trunk()"
- jj rebase -d "trunk()"
- jj status
---
 plugins/jj/README.md     | 17 +++++++++++++++++
 plugins/jj/jj.plugin.zsh | 16 ++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/plugins/jj/README.md b/plugins/jj/README.md
index 541b8f907..fd964e309 100644
--- a/plugins/jj/README.md
+++ b/plugins/jj/README.md
@@ -12,6 +12,16 @@ plugins=(... jj)
 
 | Alias  | Command                       |
 | ------ | ----------------------------- |
+| jjb    | `jj bookmark`                 |
+| jjbc   | `jj bookmark create`          |
+| jjbd   | `jj bookmark delete`          |
+| jjbf   | `jj bookmark forget`          |
+| jjbl   | `jj bookmark list`            |
+| jjbm   | `jj bookmark move`            |
+| jjbr   | `jj bookmark rename`          |
+| jjbs   | `jj bookmark set`             |
+| jjbt   | `jj bookmark track`           |
+| jjbu   | `jj bookmark untrack`         |
 | jjc    | `jj commit`                   |
 | jjcmsg | `jj commit --message`         |
 | jjd    | `jj diff`                     |
@@ -22,14 +32,20 @@ plugins=(... jj)
 | jjgf   | `jj git fetch`                |
 | jjgfa  | `jj git fetch --all-remotes`  |
 | jjgp   | `jj git push`                 |
+| jjgpa  | `jj git push --all`           |
+| jjgpd  | `jj git push --deleted`       |
+| jjgpt  | `jj git push --tracked`       |
 | jjl    | `jj log`                      |
 | jjla   | `jj log -r "all()"`           |
 | jjn    | `jj new`                      |
+| jjnt   | `jj new "trunk()"`            |
 | jjrb   | `jj rebase`                   |
+| jjrbm  | `jj rebase -d "trunk()"`      |
 | jjrs   | `jj restore`                  |
 | jjrt   | `cd "$(jj root \|\| echo .)"` |
 | jjsp   | `jj split`                    |
 | jjsq   | `jj squash`                   |
+| jjst   | `jj status`                   |
 
 ## Prompt usage
 
@@ -88,3 +104,4 @@ that.
 ## Contributors
 
 - [nasso](https://github.com/nasso) - Plugin Author
+- [imp](https://github.com/imp) - Occasional Alias Contributor
diff --git a/plugins/jj/jj.plugin.zsh b/plugins/jj/jj.plugin.zsh
index 825460517..696bc380b 100644
--- a/plugins/jj/jj.plugin.zsh
+++ b/plugins/jj/jj.plugin.zsh
@@ -34,6 +34,16 @@ function jj_prompt_template() {
 }
 
 # Aliases (sorted alphabetically)
+alias jjb='jj bookmark'
+alias jjbc='jj bookmark create'
+alias jjbd='jj bookmark delete'
+alias jjbf='jj bookmark forget'
+alias jjbl='jj bookmark list'
+alias jjbm='jj bookmark move'
+alias jjbr='jj bookmark rename'
+alias jjbs='jj bookmark set'
+alias jjbt='jj bookmark track'
+alias jjbu='jj bookmark untrack'
 alias jjc='jj commit'
 alias jjcmsg='jj commit --message'
 alias jjd='jj diff'
@@ -44,11 +54,17 @@ alias jjgcl='jj git clone'
 alias jjgf='jj git fetch'
 alias jjgfa='jj git fetch --all-remotes'
 alias jjgp='jj git push'
+alias jjgpa='jj git push --all'
+alias jjgpd='jj git push --deleted'
+alias jjgpt='jj git push --tracked'
 alias jjl='jj log'
 alias jjla='jj log -r "all()"'
 alias jjn='jj new'
+alias jjnt='jj new "trunk()"'
 alias jjrb='jj rebase'
+alias jjrbm='jj rebase -d "trunk()"'
 alias jjrs='jj restore'
 alias jjrt='cd "$(jj root || echo .)"'
 alias jjsp='jj split'
 alias jjsq='jj squash'
+alias jjst='jj status'

From 1b4497fc8f51cfc1f326f3474203f9ea6dfd3804 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 6 Dec 2025 09:06:29 +0100
Subject: [PATCH 66/80] chore(deps): bump urllib3 in
 /.github/workflows/dependencies (#13464)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index 4fc25d593..94eaf3c9a 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -4,4 +4,4 @@ idna==3.11
 PyYAML==6.0.3
 requests==2.32.5
 semver==3.0.4
-urllib3==2.5.0
+urllib3==2.6.0

From 953f526dea332c6ba12f178f61785c5a3aa9ae73 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 7 Dec 2025 18:38:05 +0100
Subject: [PATCH 67/80] chore(deps): bump github/codeql-action from 4.31.5 to
 4.31.7 (#13469)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.5 to 4.31.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/fdbfb4d2750291e159f0156def62b853c2798ca2...cf1bb45a277cb3c205638b2cd5c984db1c46a412)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 95d1086b8..42a1dc0cb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         with:
           sarif_file: results.sarif

From 3b66f643e4cfc78dfd62bb332f28f82d7dff2461 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 7 Dec 2025 18:38:26 +0100
Subject: [PATCH 68/80] chore(deps): bump step-security/harden-runner from
 2.13.2 to 2.13.3 (#13471)

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.13.2 to 2.13.3.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/95d9a5deda9de15063e7595e9719c11c38c90ae2...df199fb7be9f65074067a9eb93f12bb4c5547cf2)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/installer.yml    | 4 ++--
 .github/workflows/main.yml         | 2 +-
 .github/workflows/project.yml      | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index a21803ec6..aeeda6711 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -13,7 +13,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 120381dd8..d48a9603e 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8200f50a6..ea64e3a2f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 6a236e691..baaa1f9f2 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 42a1dc0cb..cc8e0a8eb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

From 0ebeae78d0ebdefbd0af38bfdad10504770acb82 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 7 Dec 2025 18:38:44 +0100
Subject: [PATCH 69/80] chore(deps): bump actions/create-github-app-token from
 2.2.0 to 2.2.1 (#13470)

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.0 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/7e473efe3cb98aa54f8d4bac15400b15fad77d94...29824e69f54612133e76f7eaac726eef6c875baf)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/project.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index aeeda6711..753effdcb 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index baaa1f9f2..9bb3e6550 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -22,7 +22,7 @@ jobs:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
         id: generate-token
-        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         with:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}

From ddec79ad4384325e08104574a9e0b81bb8a7e9d9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 7 Dec 2025 18:39:14 +0100
Subject: [PATCH 70/80] chore(deps): bump actions/checkout from 6.0.0 to 6.0.1
 (#13468)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...8e8c483db84b4bee98b60c0593521ed34d9990e8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/installer.yml    | 4 ++--
 .github/workflows/main.yml         | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 753effdcb..149c7fef7 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -18,7 +18,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index d48a9603e..dcf5b52d8 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -31,7 +31,7 @@ jobs:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -52,7 +52,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ea64e3a2f..a8363eceb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -29,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cc8e0a8eb..068fb5e7d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 

From 72acd2ca90d01e09f7960d6b62b8eb30e476de6c Mon Sep 17 00:00:00 2001
From: Mohaiminus Sakib <3596793+rode093@users.noreply.github.com>
Date: Mon, 8 Dec 2025 16:57:50 +0100
Subject: [PATCH 71/80] feat(uv): add more useful aliases (#13462)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Mohaiminus Sakib <roddur093@gmail.com>
Co-authored-by: Marc Cornellà <marc@mcornella.com>
---
 plugins/uv/README.md     | 43 +++++++++++++++++++++++-----------------
 plugins/uv/uv.plugin.zsh |  6 ++++++
 2 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/plugins/uv/README.md b/plugins/uv/README.md
index 144ec456a..266963e18 100644
--- a/plugins/uv/README.md
+++ b/plugins/uv/README.md
@@ -1,6 +1,7 @@
 # uv plugin
 
-This plugin automatically installs [uv](https://github.com/astral-sh/uv)'s completions for you, and keeps them up to date. It also adds convenient aliases for common usage.
+This plugin automatically installs [uv](https://github.com/astral-sh/uv)'s completions for you,
+and keeps them up to date. It also adds convenient aliases for common usage.
 
 To use it, add `uv` to the plugins array in your zshrc file:
 
@@ -10,20 +11,26 @@ plugins=(... uv)
 
 ## Aliases
 
-| Alias | Command                                                                 | Description                                                          |
-|:----- |------------------------------------------------------------------------ |:-------------------------------------------------------------------- |
-| uva   | `uv add`                                                                | Add packages to the project                                          |
-| uvexp | `uv export --format requirements-txt --no-hashes --output-file requirements.txt --quiet` | Export the lock file to `requirements.txt`          |
-| uvl   | `uv lock`                                                               | Lock the dependencies                                                |
-| uvlr  | `uv lock --refresh`                                                     | Rebuild the lock file without upgrading dependencies                 |
-| uvlu  | `uv lock --upgrade`                                                     | Lock the dependencies to the newest compatible versions              |
-| uvp   | `uv pip`                                                                | Manage pip packages                                                  |
-| uvpy  | `uv python`                                                             | Manage Python installs                                               |
-| uvpp  | `uv python pin`                                                         | Pin the current project to use a specific Python version             |
-| uvr   | `uv run`                                                                | Run commands within the project's environment                        |
-| uvrm  | `uv remove`                                                             | Remove packages from the project                                     |
-| uvs   | `uv sync`                                                               | Sync the environment with the lock file                              |
-| uvsr  | `uv sync --refresh`                                                     | "Force" sync the environment with the lock file (ignore cache)       |
-| uvsu  | `uv sync --upgrade`                                                     | Sync the environment, allowing upgrades and ignoring the lock file   |
-| uvup  | `uv self update`                                                        | Update the UV tool to the latest version                             |
-| uvv   | `uv venv`                                                               | Manage virtual environments                                          |
+| Alias | Command                                                                                  | Description                                                           |
+| :---- | ---------------------------------------------------------------------------------------- | :-------------------------------------------------------------------- |
+| uva   | `uv add`                                                                                 | Add packages to the project                                           |
+| uvexp | `uv export --format requirements-txt --no-hashes --output-file requirements.txt --quiet` | Export the lock file to `requirements.txt`                            |
+| uvi   | `uv init`                                                                                | Initialize a new project in current workspace and environment.        |
+| uvinw | `uv init --no-workspace`                                                                 | Initialize a new project in a new workspace and environment           |
+| uvl   | `uv lock`                                                                                | Lock the dependencies                                                 |
+| uvlr  | `uv lock --refresh`                                                                      | Rebuild the lock file without upgrading dependencies                  |
+| uvlu  | `uv lock --upgrade`                                                                      | Lock the dependencies to the newest compatible versions               |
+| uvp   | `uv pip`                                                                                 | Manage pip packages                                                   |
+| uvpi  | `uv python install`                                                                      | Install a specific version of python                                  |
+| uvpl  | `uv python list`                                                                         | Lists all python version installed                                    |
+| uvpp  | `uv python pin`                                                                          | Pin the current project to use a specific Python version              |
+| uvpu  | `uv python uninstall`                                                                    | Remove a specific version of python                                   |
+| uvpy  | `uv python`                                                                              | Manage Python installs                                                |
+| uvr   | `uv run`                                                                                 | Run commands within the project's environment                         |
+| uvrm  | `uv remove`                                                                              | Remove packages from the project                                      |
+| uvs   | `uv sync`                                                                                | Sync the environment with the lock file                               |
+| uvsr  | `uv sync --refresh`                                                                      | "Force" sync the environment with the lock file (ignore cache)        |
+| uvsu  | `uv sync --upgrade`                                                                      | Sync the environment, allowing upgrades and ignoring the lock file    |
+| uvtr  | `uv tree`                                                                                | Displays the full dependency tree for the current project environment |
+| uvup  | `uv self update`                                                                         | Update the UV tool to the latest version                              |
+| uvv   | `uv venv`                                                                                | Manage virtual environments                                           |
diff --git a/plugins/uv/uv.plugin.zsh b/plugins/uv/uv.plugin.zsh
index ef0f78f6b..0c0795e56 100644
--- a/plugins/uv/uv.plugin.zsh
+++ b/plugins/uv/uv.plugin.zsh
@@ -7,10 +7,15 @@ alias uv="noglob uv"
 
 alias uva='uv add'
 alias uvexp='uv export --format requirements-txt --no-hashes --output-file requirements.txt --quiet'
+alias uvi='uv init'
+alias uvinw='uv init --no-workspace'
 alias uvl='uv lock'
 alias uvlr='uv lock --refresh'
 alias uvlu='uv lock --upgrade'
 alias uvp='uv pip'
+alias uvpi='uv python install'
+alias uvpl='uv python list'
+alias uvpu='uv python uninstall'
 alias uvpy='uv python'
 alias uvpp='uv python pin'
 alias uvr='uv run'
@@ -18,6 +23,7 @@ alias uvrm='uv remove'
 alias uvs='uv sync'
 alias uvsr='uv sync --refresh'
 alias uvsu='uv sync --upgrade'
+alias uvtr='uv tree'
 alias uvup='uv self update'
 alias uvv='uv venv'
 

From 92aed2e93624124182ba977a91efa5bbe1e76d5f Mon Sep 17 00:00:00 2001
From: Tanzim Hossain Romel <romel.rcs@gmail.com>
Date: Wed, 10 Dec 2025 01:14:31 +0600
Subject: [PATCH 72/80] feat(extract): add unar as fallback for RAR extraction
 (#13472)

Add unar as a fallback when unrar is not available for extracting
RAR files. This addresses the issue where unrar has been removed
from Homebrew due to licensing issues.

The extraction now:
- Prefers unrar if available (backward compatible)
- Falls back to unar if unrar is not found
- Shows helpful error message if neither tool is installed
---
 plugins/extract/extract.plugin.zsh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/plugins/extract/extract.plugin.zsh b/plugins/extract/extract.plugin.zsh
index d8cbc8b94..aed77e7d7 100644
--- a/plugins/extract/extract.plugin.zsh
+++ b/plugins/extract/extract.plugin.zsh
@@ -77,7 +77,15 @@ EOF
       (*.lzma) unlzma "$full_path" ;;
       (*.z) uncompress "$full_path" ;;
       (*.zip|*.war|*.jar|*.ear|*.sublime-package|*.ipa|*.ipsw|*.xpi|*.apk|*.aar|*.whl|*.vsix|*.crx|*.pk3|*.pk4) unzip "$full_path" ;;
-      (*.rar) unrar x -ad "$full_path" ;;
+      (*.rar)
+        if (( $+commands[unrar] )); then
+          unrar x -ad "$full_path"
+        elif (( $+commands[unar] )); then
+          unar -o . "$full_path"
+        else
+          echo "extract: cannot extract RAR files: install unrar or unar" >&2
+          success=1
+        fi ;;
       (*.rpm)
         rpm2cpio "$full_path" | cpio --quiet -id ;;
       (*.7z | *.7z.[0-9]* | *.pk7) 7za x "$full_path" ;;

From f84341c57478445d534d0318231df8157ddfed3e Mon Sep 17 00:00:00 2001
From: tDwtp <Dark-player@gmx.de>
Date: Thu, 11 Dec 2025 15:05:23 +0100
Subject: [PATCH 73/80] fix(git): git_status_prompt should respect spaces in
 prefixes (#13478)

---
 lib/git.zsh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/git.zsh b/lib/git.zsh
index f4d4229cb..8d38f3268 100644
--- a/lib/git.zsh
+++ b/lib/git.zsh
@@ -117,7 +117,7 @@ function _omz_git_prompt_status() {
   fi
 
   # For each status prefix, do a regex comparison
-  for status_prefix in ${(k)prefix_constant_map}; do
+  for status_prefix in "${(@k)prefix_constant_map}"; do
     local status_constant="${prefix_constant_map[$status_prefix]}"
     local status_regex=$'(^|\n)'"$status_prefix"
 

From a4e15fdb1695ace2d6d67fb62729393b94d62836 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 09:57:41 +0100
Subject: [PATCH 74/80] chore(deps): bump github/codeql-action from 4.31.7 to
 4.31.8 (#13481)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 068fb5e7d..3a1f5c92c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
+        uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
         with:
           sarif_file: results.sarif

From 57781231bbef3df293ce3a4ae4bc58643f839c97 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 09:59:27 +0100
Subject: [PATCH 75/80] chore(deps): bump urllib3 in
 /.github/workflows/dependencies (#13482)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies/requirements.txt b/.github/workflows/dependencies/requirements.txt
index 94eaf3c9a..44ec3fb30 100644
--- a/.github/workflows/dependencies/requirements.txt
+++ b/.github/workflows/dependencies/requirements.txt
@@ -4,4 +4,4 @@ idna==3.11
 PyYAML==6.0.3
 requests==2.32.5
 semver==3.0.4
-urllib3==2.6.0
+urllib3==2.6.2

From 1fee750c3bf53164ea93f564fe53764bb727f9ea Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 09:59:52 +0100
Subject: [PATCH 76/80] chore(deps): bump step-security/harden-runner from
 2.13.3 to 2.14.0 (#13483)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependencies.yml | 2 +-
 .github/workflows/installer.yml    | 4 ++--
 .github/workflows/main.yml         | 2 +-
 .github/workflows/project.yml      | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 149c7fef7..8d8f5cc73 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -13,7 +13,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index dcf5b52d8..eef5bf322 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a8363eceb..5917d5316 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 9bb3e6550..70597cab6 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3a1f5c92c..2ce0dd5ff 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 

From 7192af5239aaa3b22cb61de8c73702dcf8b1dc06 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 15 Dec 2025 11:07:43 +0100
Subject: [PATCH 77/80] chore(deps): bump actions/upload-artifact from 5.0.0 to
 6.0.0 (#13480)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2ce0dd5ff..a40c491c5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -53,7 +53,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif

From b5c449e1eb69d1390d1ea9ceba9f504fad383780 Mon Sep 17 00:00:00 2001
From: leggatron <ryan.legg@jamf.com>
Date: Wed, 17 Dec 2025 02:04:09 -0500
Subject: [PATCH 78/80] feat(terraform): add `-parallelism=1` aliases (#13484)

---
 plugins/terraform/README.md            | 2 ++
 plugins/terraform/terraform.plugin.zsh | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/plugins/terraform/README.md b/plugins/terraform/README.md
index 48fdae282..f7a9a93dc 100644
--- a/plugins/terraform/README.md
+++ b/plugins/terraform/README.md
@@ -20,9 +20,11 @@ plugins=(... terraform)
 | `tf`    | `terraform`                            |
 | `tfa`   | `terraform apply`                      |
 | `tfaa`  | `terraform apply -auto-approve`        |
+| `tfap`  | `terraform apply -parallelism=1`       |
 | `tfc`   | `terraform console`                    |
 | `tfd`   | `terraform destroy`                    |
 | `tfd!`  | `terraform destroy -auto-approve`      |
+| `tfdp`  | `terraform destroy -parallelism=1`     |
 | `tff`   | `terraform fmt`                        |
 | `tffr`  | `terraform fmt -recursive`             |
 | `tfi`   | `terraform init`                       |
diff --git a/plugins/terraform/terraform.plugin.zsh b/plugins/terraform/terraform.plugin.zsh
index b0054d56a..9026994e4 100644
--- a/plugins/terraform/terraform.plugin.zsh
+++ b/plugins/terraform/terraform.plugin.zsh
@@ -18,9 +18,11 @@ function tf_version_prompt_info() {
 alias tf='terraform'
 alias tfa='terraform apply'
 alias tfaa='terraform apply -auto-approve'
+alias tfap='terraform apply -parallelism=1'
 alias tfc='terraform console'
 alias tfd='terraform destroy'
 alias 'tfd!'='terraform destroy -auto-approve'
+alias tfdp='terraform destroy -parallelism=1'
 alias tff='terraform fmt'
 alias tffr='terraform fmt -recursive'
 alias tfi='terraform init'

From d4a62a271529aab00db83dac72fdbd205dddc7ea Mon Sep 17 00:00:00 2001
From: Arvin Verain <arvinverain@proton.me>
Date: Thu, 18 Dec 2025 01:35:46 +0800
Subject: [PATCH 79/80] refactor(git)!: remove old deprecated aliases (#13149)

BREAKING CHANGE: the following deprecated aliases have been removed:
gup, gupv, gupa, gupav, gupom, gupom. The following aliases have been
deprecated: ggpull, ggpur, ggpush. `current_branch` has also been
deprecated, in favor of `git_current_branch`.
---
 plugins/git/README.md      | 48 ++++++++++++++------------------------
 plugins/git/git.plugin.zsh | 36 +++++++++-------------------
 2 files changed, 29 insertions(+), 55 deletions(-)

diff --git a/plugins/git/README.md b/plugins/git/README.md
index 0ecbea7b6..bbbb28bdf 100644
--- a/plugins/git/README.md
+++ b/plugins/git/README.md
@@ -234,40 +234,29 @@ branch exists. We do this via the function `git_main_branch`.
 These are aliases that have been removed, renamed, or otherwise modified in a way that may, or may not,
 receive further support.
 
-| Alias    | Command                                                   | Modification                                              |
-| :------- | :-------------------------------------------------------- | :-------------------------------------------------------- |
-| `gap`    | `git add --patch`                                         | New alias: `gapa`.                                        |
-| `gcl`    | `git config --list`                                       | New alias: `gcf`.                                         |
-| `gdc`    | `git diff --cached`                                       | New alias: `gdca`.                                        |
-| `gdt`    | `git difftool`                                            | No replacement.                                           |
-| `ggpull` | `git pull origin $(current_branch)`                       | New alias: `ggl`. (`ggpull` still exists for now though.) |
-| `ggpur`  | `git pull --rebase origin $(current_branch)`              | New alias: `ggu`. (`ggpur` still exists for now though.)  |
-| `ggpush` | `git push origin $(current_branch)`                       | New alias: `ggp`. (`ggpush` still exists for now though.) |
-| `gk`     | `gitk --all --branches`                                   | Now aliased to `gitk --all --branches`.                   |
-| `glg`    | `git log --stat --max-count=10`                           | Now aliased to `git log --stat --color`.                  |
-| `glgg`   | `git log --graph --max-count=10`                          | Now aliased to `git log --graph --color`.                 |
-| `gwc`    | `git whatchanged -p --abbrev-commit --pretty = medium`    | New alias: `gwch`.                                        |
-| `gup`    | `git pull --rebase`                                       | now alias `gpr`                                           |
-| `gupv`   | `git pull --rebase -v`                                    | now alias `gprv`                                          |
-| `gupa`   | `git pull --rebase --autostash`                           | now alias `gpra`                                          |
-| `gupav`  | `git pull --rebase --autostash -v`                        | now alias `gprav`                                         |
-| `gupom`  | `git pull --rebase origin $(git_main_branch)`             | now alias `gprom`                                         |
-| `gupomi` | `git pull --rebase=interactive origin $(git_main_branch)` | now alias `gpromi`                                        |
+| Alias    | Command                                                   | Modification                                          |
+| :------- | :-------------------------------------------------------- | :-----------------------------------------------------|
+| `gap`    | `git add --patch`                                         | New alias: `gapa`                                     |
+| `gcl`    | `git config --list`                                       | New alias: `gcf`                                      |
+| `gdt`    | `git difftool`                                            | No replacement                                        |
+| `ggpull` | `git pull origin $(git_current_branch)`                   | New function: `ggl` (`ggpull` is now aliased to this) |
+| `ggpur`  | `git pull --rebase origin $(git_current_branch)`          | New function: `ggu` (`ggpur` is now aliased to this)  |
+| `ggpush` | `git push origin $(git_current_branch)`                   | New function: `ggp` (`ggpush` is now aliased to this) |
 
 ## Functions
 
 ### Current
 
-| Command                  | Description                                                                                                     |
-| :----------------------- | :-------------------------------------------------------------------------------------------------------------- |
-| `current_branch`         | Returns the name of the current branch.                                                                         |
-| `git_current_user_email` | Returns the `user.email` config value. (Lives in `lib/git.zsh`.)                                                |
-| `git_current_user_name`  | Returns the `user.name` config value. (Lives in `lib/git.zsh`.)                                                 |
-| `git_develop_branch`     | Returns the name of the “development” branch: `dev`, `devel`, `development` if they exist, `develop` otherwise. |
-| `git_main_branch`        | Returns the name of the main branch: `main` if it exists, `master` otherwise.                                   |
-| `grename <old> <new>`    | Renames branch `<old>` to `<new>`, including on the origin remote.                                              |
-| `gbda`                   | Deletes all merged branches                                                                                     |
-| `gbds`                   | Deletes all squash-merged branches (**Note: performance degrades with number of branches**)                     |
+| Command                  | Description                                                                                                    |
+| :----------------------- | :------------------------------------------------------------------------------------------------------------- |
+| `git_current_branch`     | Returns the name of the current branch (Lives in `lib/git.zsh`)                                                |
+| `git_current_user_email` | Returns the `user.email` config value (Lives in `lib/git.zsh`)                                                 |
+| `git_current_user_name`  | Returns the `user.name` config value (Lives in `lib/git.zsh`)                                                  |
+| `git_develop_branch`     | Returns the name of the “development” branch: `dev`, `devel`, `development` if they exist, `develop` otherwise |
+| `git_main_branch`        | Returns the name of the main branch: `main` if it exists, `master` otherwise                                   |
+| `grename <old> <new>`    | Renames branch `<old>` to `<new>`, including on the origin remote                                              |
+| `gbda`                   | Deletes all merged branches                                                                                    |
+| `gbds`                   | Deletes all squash-merged branches (**Note: performance degrades with number of branches**)                    |
 
 ### Work in Progress (WIP)
 
@@ -287,4 +276,3 @@ Note that `gwip` and `gunwip` are aliases, but are also documented here to group
 
 | Command              | Description                             | Reason                                                           |
 | :------------------- | :-------------------------------------- | :--------------------------------------------------------------- |
-| `current_repository` | Return the names of the current remotes | Didn't work properly. Use `git remote -v` instead (`grv` alias). |
diff --git a/plugins/git/git.plugin.zsh b/plugins/git/git.plugin.zsh
index c11799208..a240e1fb3 100644
--- a/plugins/git/git.plugin.zsh
+++ b/plugins/git/git.plugin.zsh
@@ -8,14 +8,6 @@ git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
 # (order should follow README)
 #
 
-# The name of the current branch
-# Back-compatibility wrapper for when this function was defined here in
-# the plugin, before being pulled in to core lib/git.zsh as git_current_branch()
-# to fix the core -> git plugin dependency.
-function current_branch() {
-  git_current_branch
-}
-
 # Check for develop and similarly named branches
 function git_develop_branch() {
   command git rev-parse --git-dir &>/dev/null || return
@@ -110,7 +102,6 @@ function ggpnp() {
 }
 compdef _git ggpnp=git-checkout
 
-alias ggpur='ggu'
 alias g='git'
 alias ga='git add'
 alias gaa='git add --all'
@@ -290,7 +281,6 @@ alias gprom='git pull --rebase origin $(git_main_branch)'
 alias gpromi='git pull --rebase=interactive origin $(git_main_branch)'
 alias gprum='git pull --rebase upstream $(git_main_branch)'
 alias gprumi='git pull --rebase=interactive upstream $(git_main_branch)'
-alias ggpull='git pull origin "$(git_current_branch)"'
 
 function ggl() {
   if [[ $# != 0 ]] && [[ $# != 1 ]]; then
@@ -334,7 +324,6 @@ is-at-least 2.30 "$git_version" \
 alias gpv='git push --verbose'
 alias gpoat='git push origin --all && git push origin --tags'
 alias gpod='git push origin --delete'
-alias ggpush='git push origin "$(git_current_branch)"'
 
 function ggp() {
   if [[ $# != 0 ]] && [[ $# != 1 ]]; then
@@ -427,19 +416,16 @@ alias gke='\gitk --all $(git log --walk-reflogs --pretty=%h) &!'
 
 unset git_version
 
-# Logic for adding warnings on deprecated aliases
-local old_alias new_alias
-for old_alias new_alias (
-  # TODO(2023-10-19): remove deprecated `git pull --rebase` aliases
-  gup     gpr
-  gupv    gprv
-  gupa    gpra
-  gupav   gprav
-  gupom   gprom
-  gupomi  gpromi
+# Logic for adding warnings on deprecated aliases or functions
+local old_name new_name
+for old_name new_name (
+  current_branch  git_current_branch
+  ggpull          ggl
+  ggpur           ggu
+  ggpush          ggp
 ); do
-  aliases[$old_alias]="
-    print -Pu2 \"%F{yellow}[oh-my-zsh] '%F{red}${old_alias}%F{yellow}' is a deprecated alias, using '%F{green}${new_alias}%F{yellow}' instead.%f\"
-    $new_alias"
+  aliases[$old_name]="
+    print -Pu2 \"%F{yellow}[oh-my-zsh] '%F{red}${old_name}%F{yellow}' is deprecated, using '%F{green}${new_name}%F{yellow}' instead.%f\"
+    $new_name"
 done
-unset old_alias new_alias
+unset old_name new_name

From 475b18f39a2406d1ba173e36f243935be413239d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my?= <PixiBixi@users.noreply.github.com>
Date: Wed, 17 Dec 2025 18:50:21 +0100
Subject: [PATCH 80/80] fix(kubectl)!: change alias from `kl` to `klog`
 (#13204)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

BREAKING CHANGE: `kl` alias has been renamed to `klog`, because of conflict
with https://github.com/robinovitch61/kl.

Co-authored-by: Marc Cornellà <marc@mcornella.com>
---
 plugins/kubectl/README.md          | 2 +-
 plugins/kubectl/kubectl.plugin.zsh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/kubectl/README.md b/plugins/kubectl/README.md
index e510c5f40..19c36c991 100644
--- a/plugins/kubectl/README.md
+++ b/plugins/kubectl/README.md
@@ -88,7 +88,7 @@ plugins=(... kubectl)
 | kga      | `kubectl get all`                                       | List all resources in ps format                                                                  |
 | kgaa     | `kubectl get all --all-namespaces`                      | List the requested object(s) across all namespaces                                               |
 |          |                                                         | **Logs**                                                                                         |
-| kl       | `kubectl logs`                                          | Print the logs for a container or resource                                                       |
+| klog     | `kubectl logs`                                          | Print the logs for a container or resource                                                       |
 | klf      | `kubectl logs -f`                                       | Stream the logs for a container or resource (follow)                                             |
 |          |                                                         | **File copy**                                                                                    |
 | kcp      | `kubectl cp`                                            | Copy files and directories to and from containers                                                |
diff --git a/plugins/kubectl/kubectl.plugin.zsh b/plugins/kubectl/kubectl.plugin.zsh
index 912136da4..1792d5967 100644
--- a/plugins/kubectl/kubectl.plugin.zsh
+++ b/plugins/kubectl/kubectl.plugin.zsh
@@ -131,7 +131,7 @@ alias kga='kubectl get all'
 alias kgaa='kubectl get all --all-namespaces'
 
 # Logs
-alias kl='kubectl logs'
+alias klog='kubectl logs'
 alias kl1h='kubectl logs --since 1h'
 alias kl1m='kubectl logs --since 1m'
 alias kl1s='kubectl logs --since 1s'