diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c675715..7b3cef1 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -39,7 +39,7 @@ jobs:
         persist-credentials: false
 
     - name: Setup Python ${{ matrix.python-version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fac63f2..715db08 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,7 @@ jobs:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: '3.x'
     - name: Install dependencies
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..8c04ff7
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,39 @@
+name: GitHub Actions Security Analysis with zizmor
+
+on:
+  push:
+    branches: [ main, 7.x, 8.x ]
+  pull_request:
+    branches: [ main, 7.x, 8.x ]
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Needed to upload the results to the code-scanning dashboard.
+      security-events: write
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
+    - name: Install uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+    - name: Run zizmor
+      id: zizmor
+      run: uvx zizmor --format=sarif . > results.sarif
+      continue-on-error: true
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Upload SARIF results
+      if: always()
+      uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      with:
+        sarif_file: results.sarif
+        category: zizmor
+    - name: Fail if zizmor found problems
+      if: steps.zizmor.outcome == 'failure'
+      run: exit 1
diff --git a/matplotlib_inline/backend_inline.py b/matplotlib_inline/backend_inline.py
index a798c56..0e148ac 100644
--- a/matplotlib_inline/backend_inline.py
+++ b/matplotlib_inline/backend_inline.py
@@ -124,25 +124,25 @@ def flush_figures():
             # ignore the tracking, just draw and close all figures
             try:
                 return show(True)
-            except Exception as e:
+            except Exception:
                 # safely show traceback if in IPython, else raise
                 ip = get_ipython()
                 if ip is None:
-                    raise e
+                    raise
                 else:
                     ip.showtraceback()
                     return
 
         # exclude any figures that were closed:
-        active = set([fm.canvas.figure for fm in Gcf.get_all_fig_managers()])
+        active = {fm.canvas.figure for fm in Gcf.get_all_fig_managers()}
         for fig in [fig for fig in show._to_draw if fig in active]:
             try:
                 display(fig, metadata=_fetch_figure_metadata(fig))
-            except Exception as e:
+            except Exception:
                 # safely show traceback if in IPython, else raise
                 ip = get_ipython()
                 if ip is None:
-                    raise e
+                    raise
                 else:
                     ip.showtraceback()
                     return
diff --git a/matplotlib_inline/config.py b/matplotlib_inline/config.py
index ce9be03..1518d03 100644
--- a/matplotlib_inline/config.py
+++ b/matplotlib_inline/config.py
@@ -61,9 +61,8 @@ def _update_figure_formatters(self):
             )
 
     def _figure_formats_changed(self, name, old, new):
-        if "jpg" in new or "jpeg" in new:
-            if not pil_available():
-                raise TraitError("Requires PIL/Pillow for JPG figures")
+        if ("jpg" in new or "jpeg" in new) and not pil_available():
+            raise TraitError("Requires PIL/Pillow for JPG figures")
         self._update_figure_formatters()
 
     figure_format = Unicode(
diff --git a/tests/notebooks/config_InlineBackend.ipynb b/tests/notebooks/config_InlineBackend.ipynb
index 968c42f..fb9a3cf 100644
--- a/tests/notebooks/config_InlineBackend.ipynb
+++ b/tests/notebooks/config_InlineBackend.ipynb
@@ -25,8 +25,9 @@
     "                                        'optimize': True}}\n",
     "\n",
     "import matplotlib.pyplot as plt\n",
-    "from matplotlib_inline.backend_inline import set_matplotlib_formats\n",
-    "from traitlets.config import get_config"
+    "from traitlets.config import get_config\n",
+    "\n",
+    "from matplotlib_inline.backend_inline import set_matplotlib_formats"
    ]
   },
   {