Skip to main content

8.79.1 release (2026-04-09)

Total recipe count: 4240

info

This changelog only shows what recipes have been added, removed, or changed. OpenRewrite may do releases that do not include these types of changes. To see these changes, please go to the releases page.

Corresponding CLI version​

  • Stable CLI version v3.57.16
  • Staging CLI version: v3.57.16

Removed Artifacts​

  • rewrite-csharp
  • rewrite-dropwizard

New Recipes​

Removed Recipes​

  • org.openrewrite.github.security.AnonymousJobsRecipe: Find jobs that lack descriptive names, making them harder to identify in workflow runs. Jobs without name properties default to their job ID, which may not be descriptive. Based on zizmor's anonymous-definition audit.
  • org.openrewrite.github.security.ArtifactSecurityRecipe: Find workflows that may persist credentials through artifact uploads. This occurs when checkout actions don't disable credential persistence and upload actions include sensitive paths that may contain credentials, SSH keys, or configuration files. Based on zizmor's artipacked audit.
  • org.openrewrite.github.security.BotConditionsRecipe: Find workflow conditions that check for bot actors in ways that can be spoofed. Bot actor names (like dependabot[bot]) can be easily spoofed by creating accounts with similar names. Use actor_id with numeric comparison instead for secure bot validation. Based on zizmor's bot-conditions audit.
  • org.openrewrite.github.security.CachePoisoningRecipe: Detects potential cache poisoning vulnerabilities in workflows that use caching and publish artifacts. When workflows use caches during artifact publishing, attackers may be able to poison the cache with malicious content that gets included in published artifacts. Based on zizmor's cache-poisoning audit.
  • org.openrewrite.github.security.DangerousTriggersRecipe: Detects use of fundamentally insecure workflow triggers like pull_request_target and workflow_run. These triggers run with elevated privileges and are almost always used insecurely, potentially allowing code injection from untrusted sources. Based on zizmor's dangerous-triggers audit.
  • org.openrewrite.github.security.ExcessivePermissionsRecipe: Find overly broad permissions in GitHub Actions workflows. Flags 'write-all' permissions and excessive write permissions that could be scoped more narrowly for security. Based on zizmor's excessive-permissions audit.
  • org.openrewrite.github.security.ForbiddenUsesRecipe: Find usage of forbidden or dangerous GitHub Actions that have known security vulnerabilities or follow suspicious patterns. Based on zizmor's forbidden-uses audit.
  • org.openrewrite.github.security.GitHubEnvRecipe: Detects dangerous usage of GITHUB_ENV and GITHUB_PATH environment files in workflows with risky triggers like pull_request_target or workflow_run. Writing to these files can allow code injection when the content includes user-controlled data. Based on zizmor's github-env audit.
  • org.openrewrite.github.security.HardcodedCredentialsRecipe: Detects hardcoded credentials in GitHub Actions container configurations. Container registry passwords should use secrets instead of hardcoded values. Based on zizmor's hardcoded-container-credentials audit.
  • org.openrewrite.github.security.InsecureCommandsRecipe: Detects when insecure workflow commands are enabled via ACTIONS_ALLOW_UNSECURE_COMMANDS. This environment variable enables dangerous workflow commands that can lead to code injection vulnerabilities. Based on zizmor's insecure-commands audit.
  • org.openrewrite.github.security.ObfuscationRecipe: Find workflows that use obfuscated action references or expressions that may be attempting to hide malicious behavior. This includes action paths with '.', '..', empty components, or expressions that use quote manipulation to hide their true intent. Based on zizmor's obfuscation audit.
  • org.openrewrite.github.security.RefVersionMismatchRecipe: Find GitHub Actions that are pinned to commit SHAs but have version comments that may not match the actual pinned version. This can lead to confusion about which version is actually being used and potential security issues if the comment misleads developers about the pinned version. Based on zizmor's ref-version-mismatch audit.
  • org.openrewrite.github.security.SecretsInheritRecipe: Detects when reusable workflows unconditionally inherit all parent secrets via secrets: inherit. This practice can lead to over-privileged workflows and potential secret exposure to called workflows that may not need access to all secrets. Consider explicitly passing only required secrets. Based on zizmor's secrets-inherit audit.
  • org.openrewrite.github.security.SelfHostedRunnerRecipe: Find workflows that use self-hosted runners, which may have security implications in public repositories due to potential persistence between workflow runs and lack of isolation. Self-hosted runners should be properly secured and ideally ephemeral. Based on zizmor's self-hosted-runner audit.
  • org.openrewrite.github.security.TemplateInjectionRecipe: Find GitHub Actions workflows vulnerable to template injection attacks. These occur when user-controllable input (like pull request titles, issue bodies, or commit messages) is used directly in run commands or script inputs without proper escaping. Attackers can exploit this to execute arbitrary code. Based on zizmor's template-injection audit.
  • org.openrewrite.github.security.TrustedPublishingRecipe: Find workflows that use manual credentials for publishing instead of OIDC trusted publishing. Trusted publishing eliminates the need for long-lived API tokens and provides better security through short-lived, automatically-rotated tokens. Based on zizmor's use-trusted-publishing audit.
  • org.openrewrite.github.security.UndocumentedPermissionsRecipe: Add documentation comments for permissions blocks in GitHub Actions workflows. Documenting permissions helps reviewers understand why specific permissions are needed and ensures security-conscious development practices. Based on zizmor's undocumented-permissions audit.
  • org.openrewrite.github.security.UnpinnedActionsRecipe: Pin GitHub Actions to specific commit SHAs for security and reproducibility. Actions pinned to tags or branches can be changed by the action author, while SHA pins are immutable. Based on zizmor's unpinned-uses audit.
  • org.openrewrite.github.security.UnpinnedDockerImagesRecipe: Pin Docker images to specific digest hashes for security and reproducibility. Images pinned to tags can be changed by the image author, while digest pins are immutable. Based on zizmor's unpinned-images audit.
  • org.openrewrite.java.spring.data.UseJpaRepositoryDeleteAllInBatch: JpaRepository#deleteInBatch(Iterable) was deprecated in 2.5.
  • org.openrewrite.java.spring.data.UseJpaRepositoryGetById: JpaRepository#getOne(ID) was deprecated in 2.5.
  • org.openrewrite.java.spring.data.UseJpaRepositoryGetReferenceById: JpaRepository#getOne(ID) was deprecated in 2.5 and JpaRepository#getById(ID) was deprecated in 2.7.

Changed Recipes​

  • org.openrewrite.javascript.dependencies.upgrade-dependency-version was changed:
    • Old Options:
      • newVersion: { type: String, required: true }
      • packageName: { type: String, required: true }
    • New Options:
      • newVersion: { type: String, required: true }
      • packageName: { type: String, required: false }
      • packagePattern: { type: String, required: false }
  • org.openrewrite.properties.AddProperty was changed:
    • Old Options:
      • comment: { type: String, required: false }
      • delimiter: { type: String, required: false }
      • orderedInsertion: { type: Boolean, required: false }
      • property: { type: String, required: true }
      • value: { type: String, required: true }
    • New Options:
      • comment: { type: String, required: false }
      • delimiter: { type: String, required: false }
      • insertMode: { type: InsertMode, required: false }
      • insertProperty: { type: String, required: false }
      • orderedInsertion: { type: Boolean, required: false }
      • property: { type: String, required: true }
      • value: { type: String, required: true }