chore: release main

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.3.2"
+  ".": "1.3.3"
 }

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.3.3](https://github.com/ChipWolf/dotfiles/compare/v1.3.2...v1.3.3) (2026-03-24)
+
+
+### Bug Fixes
+
+* **security:** remediate code scanning findings across workflows and scripts ([#12](https://github.com/ChipWolf/dotfiles/issues/12)) ([c22b4de](https://github.com/ChipWolf/dotfiles/commit/c22b4de6f55f40b7e6ae4f02cb3d183141d4b24e))
+
+
+### Miscellaneous
+
+* **deps:** pin dependencies ([#5](https://github.com/ChipWolf/dotfiles/issues/5)) ([3673974](https://github.com/ChipWolf/dotfiles/commit/367397418e97ed6f781adceabaed4d1d98a19410))
+* **deps:** update actions/checkout action to v6 ([#6](https://github.com/ChipWolf/dotfiles/issues/6)) ([75fdeee](https://github.com/ChipWolf/dotfiles/commit/75fdeee927a879f7dd54fb09dd2aeb8099dc2dba))
+* **deps:** update github/codeql-action action to v4 ([#9](https://github.com/ChipWolf/dotfiles/issues/9)) ([6c6dfef](https://github.com/ChipWolf/dotfiles/commit/6c6dfefe366038c114cf11889c0340f33b56c19a))
+
 ## [1.3.2](https://github.com/ChipWolf/dotfiles/compare/v1.3.1...v1.3.2) (2026-03-23)
 
 

README.md

@@ -41,21 +41,21 @@ Opinionated dotfiles managed with [chezmoi](https://chezmoi.io). One repo config
 > [!WARNING]
 > These scripts fetch and execute code from this repo in a single command. Review them first if that matters to you, or use the [inspect-first path](#inspect-first) below.
 >
-> The install scripts are published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.3.2) assets with [SLSA Build L3](https://slsa.dev/spec/v1.0/levels#build-l3) provenance, verified with: `gh attestation verify install.sh --repo chipwolf/dotfiles` <!-- x-release-please-version -->
+> The install scripts are published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.3.3) assets with [SLSA Build L3](https://slsa.dev/spec/v1.0/levels#build-l3) provenance, verified with: `gh attestation verify install.sh --repo chipwolf/dotfiles` <!-- x-release-please-version -->
 
 **macOS / Linux**
 
 <!-- x-release-please-start-version -->
 ```sh
-sh -c "$(curl -fsSL https://github.com/chipwolf/dotfiles/releases/download/v1.3.2/install.sh)"
+sh -c "$(curl -fsSL https://github.com/chipwolf/dotfiles/releases/download/v1.3.3/install.sh)"
 ```
 <!-- x-release-please-end -->
 
 **Windows** (PowerShell, the script self-elevates)
 
 <!-- x-release-please-start-version -->
 ```powershell
-irm https://github.com/chipwolf/dotfiles/releases/download/v1.3.2/install.ps1 | iex
+irm https://github.com/chipwolf/dotfiles/releases/download/v1.3.3/install.ps1 | iex
 ```
 <!-- x-release-please-end -->
 
@@ -170,7 +170,7 @@ All release artifacts are built with [SLSA Build L3](https://slsa.dev/spec/v1.0/
 
 This covers:
 
-- **Install scripts** (`install.sh`, `install.ps1`): published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.3.2) assets. <!-- x-release-please-version -->
+- **Install scripts** (`install.sh`, `install.ps1`): published as [GitHub Release](https://github.com/chipwolf/dotfiles/releases/tag/v1.3.3) assets. <!-- x-release-please-version -->
 - **Codespaces overlay image** ([ghcr.io/chipwolf/dotfiles](https://ghcr.io/chipwolf/dotfiles)): published to GHCR.
 
 > [!NOTE]
@@ -184,7 +184,7 @@ Verify:
 gh attestation verify install.sh --repo chipwolf/dotfiles
 
 # Container image
-gh attestation verify oci://ghcr.io/chipwolf/dotfiles:v1.3.2 --repo chipwolf/dotfiles
+gh attestation verify oci://ghcr.io/chipwolf/dotfiles:v1.3.3 --repo chipwolf/dotfiles
 ```
 <!-- x-release-please-end -->
 

install.ps1

@@ -1,12 +1,12 @@
 # install.ps1 — Bootstrap chezmoi dotfiles on Windows.
 # Forks: update $repoUrl below to point at your fork.
 # Usage (elevated PowerShell not required — script self-elevates):
-#   irm https://github.com/chipwolf/dotfiles/releases/download/v1.3.2/install.ps1 | iex # x-release-please-version
+#   irm https://github.com/chipwolf/dotfiles/releases/download/v1.3.3/install.ps1 | iex # x-release-please-version
 # Or clone the repo and run:
 #   .\install.ps1
 
 $repoUrl = "https://github.com/chipwolf/dotfiles"
-$rawBase = "https://github.com/chipwolf/dotfiles/releases/download/v1.3.2" # x-release-please-version
+$rawBase = "https://github.com/chipwolf/dotfiles/releases/download/v1.3.3" # x-release-please-version
 
 $ErrorActionPreference = "Stop"
 

install.sh

@@ -19,7 +19,7 @@ if [ -n "${CODESPACES:-}" ] && [ -z "${DOTFILES_NO_OVERLAY:-}" ]; then
       | tar -xz -C /tmp/_crane crane
     CRANE=/tmp/_crane/crane
 
-    OUR_IMAGE="ghcr.io/chipwolf/dotfiles:v1.3.2" # x-release-please-version
+    OUR_IMAGE="ghcr.io/chipwolf/dotfiles:v1.3.3" # x-release-please-version
 
     OUR_MANIFEST=$("$CRANE" manifest "$OUR_IMAGE")
     OUR_DIGEST=$("$CRANE" digest "$OUR_IMAGE")