feat(deps): update dependency chezmoi ( 2.71.1 ➔ 2.72.0 )

[robot-rosey]

This PR contains the following updates:

Package	Type	Update	Change
chezmoi	tools	minor	2.71.1 → 2.72.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

twpayne/chezmoi (chezmoi)

v2.72.0

Compare Source

Changelog

Features

• f81cb32 feat: Fix multiple security vulns thanks to secur0.com
• 1e51cc5 feat: Add shellQuote and shellQuoteList template funcs
• 4249f4f feat: Add gopassCat template function
• a7d91a5 feat: Add debugf template function

Fixes

• 0ad679a fix: Tighten permissions on temporary files
• 4031be1 fix: Ensure HTTP cache dir is private
• ba5a19a fix: Disallow relative paths with /.. suffix
• 1fe7627 fix: Disallow .. in ignore and remove patterns
• 3c9e70b fix: Disallow .. paths in mackup files
• 01b60dd fix: Disallow filenames that resolve to .
• 5cdaf4e fix: Improve handling of untrusted relative paths
• e8a57dc fix: Disallow .. paths in .chezmoiroot
• 76e2ddf fix: Reject negative format-indent-width template directives
• 840f682 fix: Ensure that secret keyring get command always writes a private file
• f7282b8 fix: Ensure that age-keygen always writes a private file
• e7cbe71 fix: Make persistent state directory private by default
• 0d6fc2b fix: Prevent directory escape in tar and rar archives
• 239cc6b fix: Disallow file and dir names that resolve to ..

Documentation

• a331111 docs: Use more robust quoting functions in examples
• 80441a5 docs: Add link to article
• 6cd634d docs: Add link to article

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[clanker-claude]

chezmoi: v2.71.1 → v2.72.0

Verdict: Safe to merge

Breaking changes:

• No actionable incompatibilities found in this repository. v2.72.0 tightens validation of unsafe relative paths, archive extraction, and permissions for temporary, cache, and state files. The active .chezmoiroot (home), home/.chezmoiignore, source filenames, and home/.chezmoiexternal.yaml use ordinary relative paths and do not rely on the rejected behavior. Existing templates use unchanged functions, so no migration is required.

Deprecations:

• None reported in the v2.72.0 release notes or release history.

New features worth adopting:

• shellQuote and shellQuoteList provide safer POSIX-shell argument quoting for future template-generated commands; current templates do not need changes. debugf and gopassCat are additive and unused here.

Sources consulted:

• https://github.com/twpayne/chezmoi/releases/tag/v2.72.0
• https://github.com/twpayne/chezmoi/releases/tag/v2.71.1
• twpayne/chezmoi@v2.71.1...v2.72.0
• https://www.chezmoi.io/reference/release-history/
• https://www.chezmoi.io/reference/templates/functions/shellQuote/
• https://togithub.com/twpayne/chezmoi/pull/5163