fix: harden Zscaler containment and API handling

.pre-commit-config.yaml

@@ -27,13 +27,13 @@ repos:
       - id: check-json
       - id: check-yaml
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.22
+    rev: v0.16.1
     hooks:
       - id: ruff
         args: [ "--fix", "--unsafe-fixes"] # Allow unsafe fixes (ruff pretty strict about what it can fix)
       - id: ruff-format
   - repo: https://github.com/djlint/djLint
-    rev: v1.42.1
+    rev: v1.43.2
     hooks:
       - id: djlint-reformat-django
       - id: djlint-django
@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.2.8
+    rev: v2.2.9
     hooks:
       - id: build-docs
         language: python

release_notes/unreleased.md

@@ -1 +1,11 @@
 **Unreleased**
+* Block and lookup actions now account for ZIA allowlist entries that override the advanced-threat denylist.
+* Group membership updates now fetch the user immediately before writing and compare existing memberships by group ID.
+* URL list actions now convert internationalized hostnames to IDNA2008 A-labels before sending them to ZIA.
+* URL category actions now use incremental list updates that preserve concurrent entries and existing keyword configuration.
+* The get departments action now encodes its search and pagination query parameters through the HTTP client.
+* Authentication now returns a controlled error when the ZIA response omits its required session cookie.
+* Unblock and unallow actions now remove only shared-list entries recorded as added by the current connector asset.
+* Unexpected scalar JSON and malformed rate-limit response bodies now return controlled action errors.
+* Unparseable Retry-After values now preserve the original rate-limit failure instead of being treated as success.
+* URL category updates and user listing now inherit the connector's finite request timeout.

requirements.txt

@@ -0,0 +1 @@
+idna>=3.7,<4