Box optional uv settings in project manifests by charliermarsh · Pull Request #22870 · astral-sh/uv

charliermarsh · 2026-10-23T16:05:14Z

Summary

Boxing the optional [tool.uv] settings shrinks PyProjectToml from 544 to 192 bytes on x86-64 and each WorkspaceMember from 680 to 328 bytes. The 368-byte settings object gets its own allocation when a manifest defines uv settings.

We measured fresh uv lock runs on Linux x86-64 with a warm, offline cache against f8c2aff33. The generated workspace has 6,169 editable members plus the root, 1,607 registry packages, and 4,770 direct root requirements. Only the root defines [tool.uv]. The two-target run adds Windows and forces one version split.

Workload	Runs per build	Baseline peak RSS	This PR peak RSS	RSS change	Baseline wall time	This PR wall time
Generated workspace, Linux target	24	164.1 MiB	160.3 MiB	−2.3%	2.38 s	2.37 s
Generated workspace, Linux and Windows targets	24	182.3 MiB	180.5 MiB	−1.0%	2.91 s	2.93 s

RSS and wall time are medians. We rotated four builds for the first 12 pairs and alternated the baseline and this PR for the next 12. Peak RSS fell in 16 of 24 Linux pairs and 15 of 24 two-target pairs. On Linux/Windows, median peak RSS rose 1.9 MiB in the four-build comparison and fell 3.6 MiB in the two-build repeat. Every run produced a byte-identical lockfile for its target.

We also tried boxing the entire parsed manifest in each workspace member, which adds a 544-byte allocation per member. Compared directly with this PR in the 12 four-build blocks, the whole-manifest box used 0.5 MiB more on Linux and 5.4 MiB less on Linux/Windows by paired median. It used 3.5 MiB more in a generated workspace with 6,200 members sharing registry dependencies and 2.3 MiB more in one with 3,900 uv-configured members.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.13.5` → `0.13.6` | --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.13.6`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0136) [Compare Source](astral-sh/uv@0.13.5...0.13.6) Released on 2026-10-26. ##### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ##### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ##### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ##### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](astral-sh/uv#22884)) - Reduce parsing overhead for project sources and workspace references ([#22880](astral-sh/uv#22880), [#22883](astral-sh/uv#22883)) - Reduce parsing overhead for cache, exclusion, cutoff, and preview settings ([#22876](astral-sh/uv#22876), [#22877](astral-sh/uv#22877), [#22878](astral-sh/uv#22878), [#22887](astral-sh/uv#22887)) - Reduce PyPI metadata parsing overhead ([#22874](astral-sh/uv#22874), [#22875](astral-sh/uv#22875)) - Speed up parsing tool receipt requirements ([#22885](astral-sh/uv#22885)) ##### Bug fixes - Prevent `uv run --active --script` and `uv sync --active --script` from deleting non-virtual-environment directories ([#21464](astral-sh/uv#21464)) - Use `AMD64` for `platform_machine` when resolving for x86-64 Windows ([#22935](astral-sh/uv#22935)) - Preserve free-threaded and other non-default variants in `uv python upgrade` ([#22836](astral-sh/uv#22836)) - Allow `uv init --no-package` and `uv init --script` when `UV_INIT_BUILD_BACKEND` is set ([#22907](astral-sh/uv#22907)) - Prevent panics when rendering containment markers with local versions ([#22815](astral-sh/uv#22815)) ##### Documentation - Update the Docker guide and reproduction examples to use uv 0.13.5 ([#22867](astral-sh/uv#22867)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/1017

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.13.5` → `0.13.6` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.13.6`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0136) [Compare Source](astral-sh/uv@0.13.5...0.13.6) Released on 2026-10-26. ##### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ##### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ##### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ##### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](astral-sh/uv#22884)) - Reduce parsing overhead for project sources and workspace references ([#22880](astral-sh/uv#22880), [#22883](astral-sh/uv#22883)) - Reduce parsing overhead for cache, exclusion, cutoff, and preview settings ([#22876](astral-sh/uv#22876), [#22877](astral-sh/uv#22877), [#22878](astral-sh/uv#22878), [#22887](astral-sh/uv#22887)) - Reduce PyPI metadata parsing overhead ([#22874](astral-sh/uv#22874), [#22875](astral-sh/uv#22875)) - Speed up parsing tool receipt requirements ([#22885](astral-sh/uv#22885)) ##### Bug fixes - Prevent `uv run --active --script` and `uv sync --active --script` from deleting non-virtual-environment directories ([#21464](astral-sh/uv#21464)) - Use `AMD64` for `platform_machine` when resolving for x86-64 Windows ([#22935](astral-sh/uv#22935)) - Preserve free-threaded and other non-default variants in `uv python upgrade` ([#22836](astral-sh/uv#22836)) - Allow `uv init --no-package` and `uv init --script` when `UV_INIT_BUILD_BACKEND` is set ([#22907](astral-sh/uv#22907)) - Prevent panics when rendering containment markers with local versions ([#22815](astral-sh/uv#22815)) ##### Documentation - Update the Docker guide and reproduction examples to use uv 0.13.5 ([#22867](astral-sh/uv#22867)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/62 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.13.5` → `0.13.6` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.13.6`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0136) [Compare Source](astral-sh/uv@0.13.5...0.13.6) Released on 2026-10-26. ##### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ##### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ##### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ##### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](astral-sh/uv#22884)) - Reduce parsing overhead for project sources and workspace references ([#22880](astral-sh/uv#22880), [#22883](astral-sh/uv#22883)) - Reduce parsing overhead for cache, exclusion, cutoff, and preview settings ([#22876](astral-sh/uv#22876), [#22877](astral-sh/uv#22877), [#22878](astral-sh/uv#22878), [#22887](astral-sh/uv#22887)) - Reduce PyPI metadata parsing overhead ([#22874](astral-sh/uv#22874), [#22875](astral-sh/uv#22875)) - Speed up parsing tool receipt requirements ([#22885](astral-sh/uv#22885)) ##### Bug fixes - Prevent `uv run --active --script` and `uv sync --active --script` from deleting non-virtual-environment directories ([#21464](astral-sh/uv#21464)) - Use `AMD64` for `platform_machine` when resolving for x86-64 Windows ([#22935](astral-sh/uv#22935)) - Preserve free-threaded and other non-default variants in `uv python upgrade` ([#22836](astral-sh/uv#22836)) - Allow `uv init --no-package` and `uv init --script` when `UV_INIT_BUILD_BACKEND` is set ([#22907](astral-sh/uv#22907)) - Prevent panics when rendering containment markers with local versions ([#22815](astral-sh/uv#22815)) ##### Documentation - Update the Docker guide and reproduction examples to use uv 0.13.5 ([#22867](astral-sh/uv#22867)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/83 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `aube` - `editorconfig-checker` - `ghalint` - `jactionlint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (7 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `pinact` | `5.0.1` → `5.0.2` | `5.0.1` → `5.0.2` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (6 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>pinact: `5.0.1` → `5.0.2` (suzuki-shunsuke/pinact)</summary> ### v5.0.2 suzuki-shunsuke/pinact@v5.0.1...v5.0.2 #1813 Publish packslip.sigstore.json </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `aube` - `editorconfig-checker` - `ghalint` - `jactionlint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (7 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `pinact` | `5.0.1` → `5.0.2` | `5.0.1` → `5.0.2` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (6 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>pinact: `5.0.1` → `5.0.2` (suzuki-shunsuke/pinact)</summary> ### v5.0.2 suzuki-shunsuke/pinact@v5.0.1...v5.0.2 #1813 Publish packslip.sigstore.json </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml` --------- Signed-off-by: jylenhof <jygithub@lenhof.eu.org> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: jylenhof <jygithub@lenhof.eu.org>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml` --------- Signed-off-by: jylenhof <jygithub@lenhof.eu.org> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: jylenhof <jygithub@lenhof.eu.org>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `ghalint` | `1.5.6` → `1.6.0` | `1.5.6` → `1.6.0` | | `jactionlint` | `2.3.0` → `2.4.0` | `2.3.0` → `2.4.0` | | `prek` | `0.5.7` → `0.5.9` | `0.5.7` → `0.5.9` | | `rumdl` | `0.3.0` → `0.3.2` | `0.3.0` → `0.3.2` | | `tombi` | `1.9.5` → `1.9.8` | `1.9.5` → `1.9.8` | | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>ghalint: `1.5.6` → `1.6.0` (suzuki-shunsuke/ghalint)</summary> ### v1.5.7 suzuki-shunsuke/ghalint@v1.5.6...v1.5.7 ## ⚠️ Security #1507 Update Go to v1.27.3 This release is built with Go 1.27.3, which fixes [CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. `Verify` filters out chains containing those intermediates. The Go team highly recommends upgrading immediately. ghalint relies on `crypto/x509` to verify the TLS certificate of the GitHub API, which `ghalint experiment validate-input` calls. Other commands don't access the network. ref. - https://go.dev/doc/devel/release#go1.27.3 - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html v1.5.6 was built with Go 1.26.2. This release also includes Go 1.26.3 (#1325), 1.26.4 (#1357), 1.26.5 (#1396), 1.26.6 (#1428), and 1.27.2 (#1490), which have security fixes to the `go` command, the `pack` tool, and the `crypto/tls`, `crypto/x509`, `encoding/asn1`, `encoding/xml`, `html/template`, `mime`, `net`, `net/http`, `net/http/httputil`, `net/mail`, `net/textproto`, `net/url`, `os`, and `syscall` packages. - https://go.dev/doc/devel/release#go1.26.3 - https://go.dev/doc/devel/release#go1.26.4 - https://go.dev/doc/devel/release#go1.26.5 - https://go.dev/doc/devel/release#go1.26.6 - https://go.dev/doc/devel/release#go1.27.2 ## ⚠️ Changes of Release Assets The ghalint binary itself isn't affected, but the release assets for verification have changed. - #1373 `*.sig` and `*.pem` aren't published anymore, and `*.bundle` is renamed to `*.sigstore.json` (Sigstore bundle) - #1482 `multiple.intoto.jsonl` isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead - #1517 A signed [packslip](https://packslip.dev/) `packslip.sigstore.json` is published. You can verify downloaded assets with packslip ## ⚠️ aqua-registry v4.579.0 or later is required… (truncated) ### v1.5.7-3 _No release notes provided._ ### v1.5.7-1 _No release notes provided._ ### v1.5.7-0 _No release notes provided._ ### v1.5.8-0 _No release notes provided._ ### v1.6.0 suzuki-shunsuke/ghalint@v1.5.7...v1.6.0 ## Features #1529 #1535 Support GitHub Actions workflow lockfiles [GitHub Actions workflow lockfiles are generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/). The policy [action_ref_should_be_full_length_commit_sha](https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md) ignores actions in workflows locked by [the workflow dependency lockfile](https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/workflow-dependency-lockfiles) `.github/workflows/actions.lock`, because the lockfile locks them to commits. An action is regarded as locked if its `uses` is listed in both `workflows.<workflow file path>` and `dependencies` of the lockfile. If the lockfile doesn't exist, the behavior doesn't change. The following still need to be pinned by full length commit SHA even if the lockfile exists: - Reusable workflows (`jobs.<job_id>.uses`) - Docker images (`docker://`) - Actions in workflows that the lockfile doesn't lock - Actions in action files (`action.yaml`), because callers of the action don't necessarily use the lockfile > [!WARNING] > If ghalint fails to read the lockfile, for instance because the lockfile is invalid or its schema version is newer than ghalint supports, ghalint can't validate versions of actions properly. > Then ghalint outputs an error and skips action_ref_should_be_full_length_commit_sha, for reusable workflows and Docker images too, because a newer schema may lock them. > The other policies are still applied, and ghalint exits with code 1 even if no policy is violated. #1534 `ghalint exp validate-input`: Validate inputs against the commits locked by the lockfile If the lockfile records an action, `ghalint exp validate-input` validates its inputs against the locked commit, which GitHub Actions runs, instead of resolving the ref… (truncated) </details> <details> <summary>prek: `0.5.7` → `0.5.9` (j178/prek)</summary> ### v0.5.9 ## Release Notes Released on 2026-10-30. ### Enhancements - Add `normalize-indentation` builtin hook ([#2967](j178/prek#2967)) - Allow overriding the uv install version ([#2923](j178/prek#2923)) - Embed dependency metadata in release binaries ([#2976](j178/prek#2976)) - Select musl Bun builds when glibc is unavailable ([#2972](j178/prek#2972)) ### Performance - Improve workspace discovery performance ([#2936](j178/prek#2936)) ### Bug fixes - Preserve clean-filtered files during stashing ([#2915](j178/prek#2915)) ### Contributors - @j178 - @tchernobog ## Install prek 0.5.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.9 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-pc-… (truncated) </details> <details> <summary>rumdl: `0.3.0` → `0.3.2` (rvben/rumdl)</summary> ### v0.3.1 ### Added - `rumdl check-assets` reports assets unreferenced in complete Markdown source scans, with explicit include/keep globs and text or versioned JSON output. Literal filename mentions are kept separately; incomplete scans emit no findings. - MD022 `lines-above-mode = "exact"` removes surplus blank lines above headings while preserving comments and the existing minimum-spacing default (#838). - Opt-in code-block tool version verification against `uv.lock`, declared `pyproject.toml` constraints, or pre-commit/prek hook revisions for Ruff, Black, djLint and SQLFluff. Supports automatic source selection and one configurable policy for mismatched or unresolved versions. - MD013 `link-text-punctuation = "trailing"` optionally recognizes sentence endings in link text and image alt text while keeping each construct intact. When enabled, semantic reflow also preserves detected sentence boundaries when merging short lines. - MD063 `style = "consistent"` infers heading capitalization per document while respecting ignored words, proper names, level filters, and inline disables. - Independent code blocks can share the existing worker pool when error policies permit parallel execution, preserving tool order and applying formatted replacements together from their original source ranges. - MD013 `break-words` adds project-specific or localized words to the semantic reflow defaults, with case-insensitive Unicode matching. - **custom-rules**: prototype versioned checker interchange ([602a8f7](rvben/rumdl@602a8f7)) - **code-block-tools**: verify pre-commit and prek revisions ([0cfe861](rvben/rumdl@0cfe861)) - **MD096**: add opt-in table sorting by named column ([43a7858](rvben/rumdl@43a7858)) ### Changed - Code-block formatting warnings appear in source order, inc… (truncated) ### v0.3.2 ### Fixed - Upgrade pulldown-cmark to fix exponential parser event growth and duplicate diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now requires a fresh dependency security audit, including during recovery runs. - MD087 recognizes inline suppression of heading-capitalization diagnostics, avoiding false unused-disable warnings (#973). - MD022 enforces configured spacing below headings before lists and code fences, including when MD031 or MD032 is disabled. Overlapping spacing fixes insert the required blank lines only once (#971). - MD067 can safely reorder complete footnote definitions to match their first references. Reordering is atomic, preserves surrounding content and directive scope, and leaves ambiguous Markdown or MDX cases report-only (#969). - MD013 recognizes additional common abbreviations and titles, including numeric references with formatted numbers, while preserving sentence boundaries after ambiguous units and labels. Sentence-spacing checks share this behavior (#966). - MD013 preserves meaningful indentation inside multiline code spans following a bare list marker when reflowing text. - **security**: patch parser dependencies and gate release publication ([41d60e1](rvben/rumdl@41d60e1)) - **ci**: install only the tools required by parity checks ([ce014aa](rvben/rumdl@ce014aa)) - **MD013**: preserve code-span indentation after bare list markers ([9cf648f](rvben/rumdl@9cf648f)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.3.2/rumdl-v0.3.2-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](h… (truncated) </details> <details> <summary>tombi: `1.9.5` → `1.9.8` (tombi-toml/tombi)</summary> ### v1.9.6  ## What's Changed ### 🛠️ Other Changes * Use mise as the source of truth for tool versions by @ya7010 in tombi-toml/tombi#2370 * fix(lsp): respect ignore files for open documents by @ya7010 in tombi-toml/tombi#2372 **Full Changelog**: tombi-toml/tombi@v1.9.5...v1.9.6 ### v1.9.7  ## What's Changed ### 🛠️ Other Changes * cargo-include-exclude-order: Preserve Cargo pattern order by @ya7010 in tombi-toml/tombi#2375 * chore: change a sort sample of the settings. by @ya7010 in tombi-toml/tombi#2376 **Full Changelog**: tombi-toml/tombi@v1.9.6...v1.9.7 ### v1.9.8  ## What's Changed ### 📦 Dependencies * fix(deps): update node-forge to 1.4.2 by @ya7010 in tombi-toml/tombi#2379 * chore: remove withdrawn braces advisory exception by @ya7010 in tombi-toml/tombi#2380 ### 🛠️ Other Changes * docs-auto-sorting-update: document tombi.toml auto-sorting methods by @ya7010 in tombi-toml/tombi#2377 * fix(deps): update qs and bound deepmerge scan exception by @ya7010 in tombi-toml/tombi#2378 * docs: update sort description by @ya7010 in tombi-toml/tombi#2381 * docs(formatter): correct order of sorting tool mentions in auto-sorting documentation by @ya7010 in tombi-toml/tombi#2382 * Log active LSP handlers at info level by @ya7010 in tombi-toml/tombi#2384 **Full Changelog**: tombi-toml/tombi@v1.9.7...v1.9.8 </details> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml` --------- Signed-off-by: jylenhof <jygithub@lenhof.eu.org> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: jylenhof <jygithub@lenhof.eu.org>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.13.5` → `0.13.6` | `0.13.5` → `0.13.6` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.13.5` → `0.13.6` (astral-sh/uv)</summary> ### 0.13.6 ## Release Notes Released on 2026-10-26. ### Enhancements - Accept an empty `UV_RUN_RECURSION_DEPTH` as zero and report invalid values consistently ([#22814](astral-sh/uv#22814)) - Explain how to add project metadata when `uv init` finds a `pyproject.toml` without a `[project]` table ([#22916](astral-sh/uv#22916)) ### Python - Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 ([#22938](astral-sh/uv#22938)) ### Preview features - Detect NVIDIA GPU capabilities when selecting compatible wheel variants with `wheel-variants` ([#22690](astral-sh/uv#22690)) - Nest each module's owners in an object in `uv workspace metadata` output ([#22638](astral-sh/uv#22638)) - Report the unsupported properties required by an incompatible wheel variant ([#22719](astral-sh/uv#22719)) ### Performance - Reduce peak memory use when resolving large workspaces ([#22860](astral-sh/uv#22860), [#22863](astral-sh/uv#22863), [#22864](astral-sh/uv#22864), [#22866](astral-sh/uv#22866), [#22870](astral-sh/uv#22870)) - Reduce peak memory use when locking or upgrading large projects ([#22833](astral-sh/uv#22833), [#22834](astral-sh/uv#22834)) - Speed up redirected output from `uv export` and `uv pip compile` ([#22840](astral-sh/uv#22840)) - Reuse cached or active environments when running PEP 723 scripts without dependencies ([#21458](astral-sh/uv#21458)) - Reduce parsing overhead for build dependency and build backend settings ([#22848](astral-sh/uv#22848), [#22871](astral-sh/uv#22871), [#22879](astral-sh/uv#22879), [#22884](https://github.com/ast… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Box optional uv settings in project manifests

5c0a910

charliermarsh added the performance label Oct 23, 2026

woodruffw approved these changes Oct 23, 2026

View reviewed changes

charliermarsh temporarily deployed to automations October 23, 2026 16:06 — with GitHub Actions Inactive

charliermarsh marked this pull request as ready for review October 23, 2026 16:22

charliermarsh merged commit 3a0e63e into main Oct 23, 2026
65 checks passed

charliermarsh deleted the charlie/box-uv-project-settings branch October 23, 2026 17:00

BrewTestBot mentioned this pull request Oct 27, 2026

uv 0.13.6 Homebrew/homebrew-core#321522

Merged

github-actions Bot mentioned this pull request Oct 27, 2026

chore(deps): update 2 dependencies (uv, GitHub CLI) progamesigner/sleipnir#38

Merged

3 tasks

scottames-github-bot Bot mentioned this pull request Oct 31, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1136

Merged

1 task

Navigation Menu

Repository navigation

Box optional uv settings in project manifests - #22870

Box optional uv settings in project manifests#22870
charliermarsh merged 1 commit into
mainfrom
charlie/box-uv-project-settings

charliermarsh commented Oct 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

charliermarsh commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

charliermarsh commented Oct 23, 2026 •

edited

Loading