Repository navigation
refactor(lsp): migrate from tower-lsp to tower-lsp-server - #2297
Merged
Merged
Conversation
tower-lsp 0.20.0 is unmaintained and panics in Pending::insert with "receiver already dropped" when a handler is cancelled while a server-to-client request is in flight. tower-lsp-server ignores that error. Pin tower-lsp-server =0.24.0-rc.1 with the url-url feature so that Uri = url::Url and tombi_uri::Uri conversions keep working via into(). Adapt to gen-lsp-types (enum constants, split provider capability enums, DocumentChange/Edit unions, Declaration/Definition responses, semantic token legend as strings, FileEvent::kind) and drop #[async_trait] from the LanguageServer impl. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
リリース候補版への広範なプロトコル型移行であり、実エディタとのE2E互換性が未検証です。
0 open findings
What changed in this PR
LSP基盤を tower-lsp-server へ移行し、キャンセル済み要求への遅延応答でサーバーがパニックする問題を解消します。
Changes:
- 依存関係を
tower-lsp-server =0.24.0-rc.1へ移行 - LSP型、応答、capability、workspace editを新APIへ適合
- CLI・WASM・拡張機能・テストの実行経路を更新
| File | Description |
|---|---|
Cargo.toml |
新LSP依存関係とURL機能を定義 |
Cargo.lock |
依存グラフを更新 |
crates/tombi-lsp/Cargo.toml |
native/WASM runtime機能を移行 |
crates/tombi-lsp/src/backend.rs |
LanguageServer実装と応答型を移行 |
crates/tombi-lsp/src/code_action.rs |
workspace edit型を移行 |
crates/tombi-lsp/src/diagnostic.rs |
診断型を移行 |
crates/tombi-lsp/src/extension.rs |
拡張機能からLSP型への変換を更新 |
crates/tombi-lsp/src/goto_definition.rs |
definition/declaration応答を移行 |
crates/tombi-lsp/src/goto_type_definition.rs |
type-definition応答を移行 |
crates/tombi-lsp/src/hover.rs |
hover応答型を移行 |
crates/tombi-lsp/src/lib.rs |
LSP service構築を移行 |
crates/tombi-lsp/src/location.rs |
Location変換を移行 |
crates/tombi-lsp/src/references.rs |
参照Location型を移行 |
crates/tombi-lsp/src/remote_file.rs |
applyEdit要求とdocument changeを移行 |
crates/tombi-lsp/src/workspace_diagnostic.rs |
診断エラー型を移行 |
crates/tombi-lsp/src/semantic_tokens/builder.rs |
semantic token型を移行 |
crates/tombi-lsp/src/semantic_tokens/token_type.rs |
token legendを文字列化 |
crates/tombi-lsp/src/handler/code_action.rs |
code-action応答型を移行 |
crates/tombi-lsp/src/handler/completion.rs |
completion paramsを移行 |
crates/tombi-lsp/src/handler/diagnostic.rs |
pull diagnostic応答を移行 |
crates/tombi-lsp/src/handler/did_change.rs |
content-change enumを処理 |
crates/tombi-lsp/src/handler/did_change_configuration.rs |
configuration paramsを移行 |
crates/tombi-lsp/src/handler/did_change_watched_files.rs |
file event型を移行 |
crates/tombi-lsp/src/handler/did_close.rs |
close paramsを移行 |
crates/tombi-lsp/src/handler/did_open.rs |
open paramsを移行 |
crates/tombi-lsp/src/handler/did_save.rs |
save paramsを移行 |
crates/tombi-lsp/src/handler/document_link.rs |
document-link型を移行 |
crates/tombi-lsp/src/handler/document_symbol.rs |
symbol応答とenumを移行 |
crates/tombi-lsp/src/handler/folding_range.rs |
folding-range型を移行 |
crates/tombi-lsp/src/handler/formatting.rs |
formatting通知・型を移行 |
crates/tombi-lsp/src/handler/get_built_in_schema.rs |
JSON-RPCエラー型を移行 |
crates/tombi-lsp/src/handler/get_status.rs |
document identifierを移行 |
crates/tombi-lsp/src/handler/get_toml_version.rs |
document identifierを移行 |
crates/tombi-lsp/src/handler/goto_declaration.rs |
declaration paramsを移行 |
crates/tombi-lsp/src/handler/goto_definition.rs |
definition paramsを移行 |
crates/tombi-lsp/src/handler/goto_type_definition.rs |
type-definition paramsを移行 |
crates/tombi-lsp/src/handler/hover.rs |
hover paramsを移行 |
crates/tombi-lsp/src/handler/initialize.rs |
server capabilitiesを新型へ移行 |
crates/tombi-lsp/src/handler/initialized.rs |
watcher登録型を移行 |
crates/tombi-lsp/src/handler/inlay_hint.rs |
inlay-hint paramsを移行 |
crates/tombi-lsp/src/handler/list_schemas.rs |
JSON-RPCエラー型を移行 |
crates/tombi-lsp/src/handler/references.rs |
reference paramsを移行 |
crates/tombi-lsp/src/handler/refresh_cache.rs |
JSON-RPCエラー型を移行 |
crates/tombi-lsp/src/handler/semantic_tokens_full.rs |
semantic-token応答を移行 |
crates/tombi-lsp/src/handler/shutdown.rs |
JSON-RPCエラー型を移行 |
crates/tombi-lsp/src/handler/update_config.rs |
identifier・エラー型を移行 |
crates/tombi-lsp/src/handler/update_schema.rs |
show-message通知を移行 |
crates/tombi-lsp/src/handler/workspace_diagnostic.rs |
workspace diagnostic応答を移行 |
crates/tombi-lsp/tests/test_code_action_refactor_rewrite.rs |
新workspace edit型へテスト適合 |
crates/tombi-lsp/tests/test_completion_edit.rs |
completionテスト型を移行 |
crates/tombi-lsp/tests/test_completion_labels.rs |
completionテスト型を移行 |
crates/tombi-lsp/tests/test_diagnostic.rs |
診断・変更イベントテストを移行 |
crates/tombi-lsp/tests/test_document_link.rs |
document-linkテスト型を移行 |
crates/tombi-lsp/tests/test_folding_range.rs |
folding-rangeテスト型を移行 |
crates/tombi-lsp/tests/test_get_built_in_schema.rs |
service型を移行 |
crates/tombi-lsp/tests/test_get_status.rs |
URI・document item型を移行 |
crates/tombi-lsp/tests/test_goto_declaration.rs |
declarationテスト型を移行 |
crates/tombi-lsp/tests/test_goto_definition.rs |
definitionテスト型を移行 |
crates/tombi-lsp/tests/test_goto_type_definition.rs |
type-definitionテスト型を移行 |
crates/tombi-lsp/tests/test_hover.rs |
hoverテスト型を移行 |
crates/tombi-lsp/tests/test_inlay_hint.rs |
inlay-hintテスト型を移行 |
crates/tombi-lsp/tests/test_references.rs |
referencesテスト型を移行 |
crates/tombi-text/Cargo.toml |
LSP型依存とruntime機能を移行 |
crates/tombi-text/src/lib.rs |
Range変換先を移行 |
crates/tombi-text/src/encoding_kind.rs |
position encoding変換を移行 |
crates/tombi-text/src/features/lsp/from_lsp.rs |
LSP入力変換を移行 |
crates/tombi-text/src/features/lsp/into_lsp.rs |
LSP出力テストを移行 |
crates/tombi-diagnostic/Cargo.toml |
optional LSP依存を移行 |
crates/tombi-diagnostic/src/lib.rs |
Diagnostic変換を移行 |
extensions/tombi-extension-cargo/Cargo.toml |
native/WASM runtime依存を移行 |
extensions/tombi-extension-cargo/src/code_action.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/completion.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/crates_io.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/document_link.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/goto_declaration.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/goto_definition.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/hover.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/inlay_hint.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/references.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-cargo/src/workspace.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-nagi-sql/Cargo.toml |
native/WASM runtime依存を移行 |
extensions/tombi-extension-nagi-sql/src/completion.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-nagi-sql/src/goto_declaration.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-nagi-sql/src/goto_definition.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-nagi-sql/src/references.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/Cargo.toml |
native/WASM runtime依存を移行 |
extensions/tombi-extension-pyproject/src/code_action.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/completion.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/dependency.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/document_link.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/goto_declaration.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/goto_definition.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/hover.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/inlay_hint.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/pypi_org.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/references.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-pyproject/src/workspace.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-tombi/Cargo.toml |
LSP依存を移行 |
extensions/tombi-extension-tombi/src/completion.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-tombi/src/document_link.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-tombi/src/goto_definition.rs |
JSON-RPCエラー型を移行 |
extensions/tombi-extension-tombi/src/hover.rs |
JSON-RPCエラー型を移行 |
rust/tombi-cli/Cargo.toml |
CLIのLSP runtime依存を移行 |
rust/tombi-cli/src/app/command/lsp.rs |
native LSP server起動を移行 |
rust/tombi-cli/src/app/diagnostics/report/sarif.rs |
SARIF用Range型を移行 |
rust/tombi-wasm/Cargo.toml |
WASM LSP runtime依存を移行 |
rust/tombi-wasm/src/lsp.rs |
WASM LSP server起動を移行 |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
2 tasks done
This was referenced Oct 19, 2026
jylenhof
pushed a commit
to jylenhof/mise-update-tool
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `aube` - `editorconfig-checker` - `ghalint` - `jactionlint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml`
jylenhof
pushed a commit
to jylenhof/mise-update-tool
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `aube` - `editorconfig-checker` - `ghalint` - `jactionlint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof
pushed a commit
to jylenhof/github-actions-resources
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml`
jylenhof
pushed a commit
to jylenhof/github-actions-resources
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof
pushed a commit
to jylenhof/mise-en-place-resources
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml`
jylenhof
pushed a commit
to jylenhof/mise-en-place-resources
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `editorconfig-checker` - `ghalint` - `jactionlint` - `lychee` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` | | `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` | | `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` | | `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` | | `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary> ### v2.2.0 jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade. ## Highlights - **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file. - **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers. - **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`. ## Added ### New rules in the `default` and `correctness` profiles - **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx) - **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated) </details> <details> <summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary> ### v0.3.0 ### Changed - **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis reduces repeated work. Speedups compare median elapsed times from 31 paired runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds, default threads, warm filesystem cache, and `--no-config --no-cache --silent` (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material). Output includes the correctness fixes listed below and can differ from 0.2.79. - Code block tools are supported and remain opt-in. Missing tags, missing active-mode tools and invocations with no tools checked are ignored by default. An omitted unknown-tag policy inherits `on-missing-language-definition`, preserving existing strict configurations. Valid internal cached checks count as checked; applicable external tools rerun to reflect changes in their own configuration and environment. - `on-missing-language-definition = "warn"` now reports uncovered languages; previous releases treated it as `ignore`. - Executable lookup remains system-only by default. Per-binary preferences can opt into nearest-first project lookup bounded by repository/configuration boundaries, including hoisted workspace installations. - MD037 still reports spaces inside emphasis delimiters but no longer provides automatic fixes, including editor fixes. Repair the reported emphasis manually; inserting escapes or removing whitespace can change literal Markdown meaning. ### Added - `fmt --preflight` and `check --fix --preflight` validate and plan the complete selected file batch before applying any writes, with atomic replacement per file after successful planning. - Configurable coverage policies with block diagnostics and invocation-wide fail-fast behavior. Invalid tool definitions receive central configuration warnin… (truncated) </details> <details> <summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary> ### v1.8.2 <!-- Release notes generated using configuration in .github/release.yml at v1.8.2 --> ## What's Changed ### 🛠️ Other Changes * chore(deps): format Cargo.toml by @ya7010 in tombi-toml/tombi#2291 * fix(schema-store): allow documents to share a schema $id by @ya7010 in tombi-toml/tombi#2293 * refactor(schema-store): remove the ast-syntax feature by @ya7010 in tombi-toml/tombi#2294 **Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2 ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 </details> <details> <summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary> ### 0.13.1 ## Release Notes Released on 2026-10-14. ### Enhancements - Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500)) - Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463)) - Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241)) ### Python - Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527)) ### Preview features - Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498)) - Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039)) ### Performance - Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432)) - Speed up Simple API parsing ([#22429](astral-sh/uv#22429)) - Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239)) ### Bug fixes - Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495)) - Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522)) - Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496)) - Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated) </details> <details> <summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary> ### v1.31.0 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396)) - zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395)) Many thanks to [@ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated) ### v1.31.1 [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450)) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 24, 2026
jylenhof
pushed a commit
to jylenhof/gh-action-pulse
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `tombi` Command: `mise upgrade --bump --local tombi` <details> <summary>Version changelog (tombi)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary> ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 ### v1.8.8 <!-- Release notes generated using configuration in .github/release.yml at v1.8.8 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in pull mode by @ya7010 in tombi-toml/tombi#2325 * chore: run cargo fmt by @ya7010 in tombi-toml/tombi#2327 * refactor(command): move Cache command to the end of TomlCommand enum and add documentation for cache module by @ya7010 in tombi-toml/tombi#2328 **Full Changelog**: tombi-toml/tombi@v1.8.7...v1.8.8 ### v1.8.9 <!-- Release notes generated using configuration in .github/release.yml at v1.8.9 --> ## What's Changed ### 🛠️ Other Changes * fix(config): apply [[overrides]] rules over the base rules by @JounQin in tombi-toml/tombi#2330 * fix(config): make rule merge prefer overrides by @ya7010 in tombi-toml/tombi#2331 * fix(document-tree): preserve explicit parent directives by @ya7010 in tombi-toml/tombi#2332 ## New Contributors * @JounQin made their first contribution in tombi-toml/tombi#2330 **Full Changelog**: tombi-toml/tombi@v1.8.8...v1.8.9 ### v1.8.10 <!-- Release notes generated using configuration in .github/release.yml at v1.8.10 --> ## What's Changed ### 🐝 Bug Fixes * fix(vscode): block schema selection for directive files by @ya7010 in tombi-toml/tombi#2335 * fix(vscode): route language server logs by severity by @ya7010 in tombi-toml/tombi#2344 ### 📦 Dependencies * fix(deps): update packages flagged by OSV scanner by @ya7010 in tombi-toml/tombi#2348 ### 🛠️ Other Changes * fix(lsp): preserve selected schema priority across reloads by @ya7010 in tombi-toml/tombi#2334 * fix(lsp): split multi-line semantic tokens for clients without multilineTokenSupport by @ya7010 in tombi-toml/tombi#2340 * feat: add options to not send semantic tokens for strings and comments by @ya7010 in tombi-toml/tombi#2343 * fix(formatter): avoid panic on array of tables under schema-less table property by @ya7010 in tombi-toml/tombi#2346 * style: cargo fmt by @ya7010 in tombi-toml/tombi#2347 **Full Changelog**: tombi-toml/tombi@v1.8.9...v1.8.10 ### v1.9.0 <!-- Release notes generated using configuration in .github/release.yml at v1.9.0 --> ## What's Changed ### 🚨 Breaking Changes * fix: use enabled for semantic token settings by @ya7010 in tombi-toml/tombi#2349 **Full Changelog**: tombi-toml/tombi@v1.8.10...v1.9.0 ### v1.9.1 <!-- Release notes generated using configuration in .github/release.yml at v1.9.1 --> ## What's Changed ### 🛠️ Other Changes * fix(parser): accept zero floats with an uppercase exponent by @MaxFreedomPollard in tombi-toml/tombi#2350 * feat(lsp): show default and enum values in completion documentation by @ya7010 in tombi-toml/tombi#2351 * fix(lsp): separate hover/completion constraint blocks with a single blank line by @ya7010 in tombi-toml/tombi#2352 * fix(deps): update DOMPurify to 3.4.17 by @ya7010 in tombi-toml/tombi#2353 **Full Changelog**: tombi-toml/tombi@v1.9.0...v1.9.1 _Omitted 1 older release._ </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 24, 2026
jylenhof
pushed a commit
to jylenhof/mise-en-place-tips
that referenced
this pull request
Oct 24, 2026
Automated mise tool upgrades from local config. mise-managed tools: - `tombi` Command: `mise upgrade --bump --local tombi` <details> <summary>Version changelog (tombi)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary> ### v1.8.3 <!-- Release notes generated using configuration in .github/release.yml at v1.8.3 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): skip file watcher events inside VCS metadata directories by @ya7010 in tombi-toml/tombi#2296 * refactor(lsp): migrate from tower-lsp to tower-lsp-server by @ya7010 in tombi-toml/tombi#2297 * fix(validator): apply sub-schemas under keys rejected by the root schema by @ya7010 in tombi-toml/tombi#2298 **Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3 ### v1.8.4 <!-- Release notes generated using configuration in .github/release.yml at v1.8.4 --> ## What's Changed ### 🛠️ Other Changes * fix(config): order schema catalog before format by @ya7010 in tombi-toml/tombi#2299 **Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4 ### v1.8.5 <!-- Release notes generated using configuration in .github/release.yml at v1.8.5 --> ## What's Changed ### 🛠️ Other Changes * update: tombi.toml sample by @ya7010 in tombi-toml/tombi#2302 * chore: tombi.toml sample by @ya7010 in tombi-toml/tombi#2303 * docs: embed configuration Full Structure from a checked TOML file by @ya7010 in tombi-toml/tombi#2304 * fix(schema-store): honor environment proxies for schema fetches by @cailloumajor in tombi-toml/tombi#2306 * fix(schema-store): refuse schema URLs targeting the proxy host by @ya7010 in tombi-toml/tombi#2308 * test(schema-store): cover local resolution check for proxied destinations by @ya7010 in tombi-toml/tombi#2307 * feat(schema-store): honor operating-system proxy settings for schema fetches by @ya7010 in tombi-toml/tombi#2309 ## New Contributors * @cailloumajor made their first contribution in tombi-toml/tombi#2306 **Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5 ### v1.8.6 <!-- Release notes generated using configuration in .github/release.yml at v1.8.6 --> ## What's Changed ### 🐝 Bug Fixes * fix(docs): resolve embedded snippet during Pages build by @ya7010 in tombi-toml/tombi#2310 ### 📦 Dependencies * fix(deps): update quinn-proto and rustls for OSV advisories by @ya7010 in tombi-toml/tombi#2311 * fix(deps): update zip to 9.0.4 by @ya7010 in tombi-toml/tombi#2317 ### 🛠️ Other Changes * refactor(lsp): collect folding spans in one AST traversal by @ya7010 in tombi-toml/tombi#2312 * refactor: reuse AST groups during formatting and hover by @ya7010 in tombi-toml/tombi#2313 * refactor(formatter): reuse root leading comments by @ya7010 in tombi-toml/tombi#2314 * feat(lsp): highlight TOML region markers by @ya7010 in tombi-toml/tombi#2316 **Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6 ### v1.8.7 <!-- Release notes generated using configuration in .github/release.yml at v1.8.7 --> ## What's Changed ### 🦅 New Features * Add --cache-ttl CLI option by @ya7010 in tombi-toml/tombi#2320 * feat(cache): add `tombi cache clean/dir` commands by @ya7010 in tombi-toml/tombi#2321 ### 🐝 Bug Fixes * fix(direnv): skip flake when nix is unavailable by @ya7010 in tombi-toml/tombi#2323 **Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7 ### v1.8.8 <!-- Release notes generated using configuration in .github/release.yml at v1.8.8 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in pull mode by @ya7010 in tombi-toml/tombi#2325 * chore: run cargo fmt by @ya7010 in tombi-toml/tombi#2327 * refactor(command): move Cache command to the end of TomlCommand enum and add documentation for cache module by @ya7010 in tombi-toml/tombi#2328 **Full Changelog**: tombi-toml/tombi@v1.8.7...v1.8.8 ### v1.8.9 <!-- Release notes generated using configuration in .github/release.yml at v1.8.9 --> ## What's Changed ### 🛠️ Other Changes * fix(config): apply [[overrides]] rules over the base rules by @JounQin in tombi-toml/tombi#2330 * fix(config): make rule merge prefer overrides by @ya7010 in tombi-toml/tombi#2331 * fix(document-tree): preserve explicit parent directives by @ya7010 in tombi-toml/tombi#2332 ## New Contributors * @JounQin made their first contribution in tombi-toml/tombi#2330 **Full Changelog**: tombi-toml/tombi@v1.8.8...v1.8.9 ### v1.8.10 <!-- Release notes generated using configuration in .github/release.yml at v1.8.10 --> ## What's Changed ### 🐝 Bug Fixes * fix(vscode): block schema selection for directive files by @ya7010 in tombi-toml/tombi#2335 * fix(vscode): route language server logs by severity by @ya7010 in tombi-toml/tombi#2344 ### 📦 Dependencies * fix(deps): update packages flagged by OSV scanner by @ya7010 in tombi-toml/tombi#2348 ### 🛠️ Other Changes * fix(lsp): preserve selected schema priority across reloads by @ya7010 in tombi-toml/tombi#2334 * fix(lsp): split multi-line semantic tokens for clients without multilineTokenSupport by @ya7010 in tombi-toml/tombi#2340 * feat: add options to not send semantic tokens for strings and comments by @ya7010 in tombi-toml/tombi#2343 * fix(formatter): avoid panic on array of tables under schema-less table property by @ya7010 in tombi-toml/tombi#2346 * style: cargo fmt by @ya7010 in tombi-toml/tombi#2347 **Full Changelog**: tombi-toml/tombi@v1.8.9...v1.8.10 ### v1.9.0 <!-- Release notes generated using configuration in .github/release.yml at v1.9.0 --> ## What's Changed ### 🚨 Breaking Changes * fix: use enabled for semantic token settings by @ya7010 in tombi-toml/tombi#2349 **Full Changelog**: tombi-toml/tombi@v1.8.10...v1.9.0 ### v1.9.1 <!-- Release notes generated using configuration in .github/release.yml at v1.9.1 --> ## What's Changed ### 🛠️ Other Changes * fix(parser): accept zero floats with an uppercase exponent by @MaxFreedomPollard in tombi-toml/tombi#2350 * feat(lsp): show default and enum values in completion documentation by @ya7010 in tombi-toml/tombi#2351 * fix(lsp): separate hover/completion constraint blocks with a single blank line by @ya7010 in tombi-toml/tombi#2352 * fix(deps): update DOMPurify to 3.4.17 by @ya7010 in tombi-toml/tombi#2353 **Full Changelog**: tombi-toml/tombi@v1.9.0...v1.9.1 _Omitted 1 older release._ </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the LSP server framework from
tower-lsp0.20.0 totower-lsp-server(=0.24.0-rc.1).Closes #2295
Why
tower-lspis unmaintained.tower-lsp0.20.0,Pending::insertdoestx.send(r).expect("receiver already dropped"). If a handler is cancelled ($/cancelRequest) while it is awaiting a server->client request (e.g.workspace/applyEditinremote_file.rs), the late client response panics the server.tower-lsp-server0.24.0-rc.1 doeslet _ = tx.send(r)and ignores the error (checked by reading both sources).=0.24.0-rc.1).url-urlfeaturetower-lsp-serveris built withurl-url, which turns ongen-lsp-types/url, soUri = url::Url. This keeps the existingtombi_uri::Uri<-> LSP type conversions (.into()) working unchanged. The defaultStringnewtype orfluent-uriwould have required rewriting every URI conversion site.Notable API changes
tower_lsp::lsp_types(lsp-types 0.94) ->tower_lsp_server::gen_lsp_types(gen-lsp-types 0.11).#[async_trait]removed fromimpl LanguageServer for Backend(native async fn in trait).InsertTextFormat::SNIPPET->Snippet,CodeActionKind,InlayHintKind,SymbolKind,CompletionItemKind,MessageType,FileChangeType,TextDocumentSyncKind,InsertTextMode,DiagnosticSeverity.OneOf/*ProviderCapabilityreplaced by per-field enums (HoverProvider::Bool,InlayHintProvider::InlayHintOptions, ...). Wire format is unchanged.Goto*Params/Response->Definition*/Declaration*/TypeDefinition*;codeActionnow returnsVec<CodeActionResponse>; diagnostic / workspace diagnostic / semantic tokens results lost their*Resultwrappers.WorkspaceEdit.document_changesis nowVec<DocumentChange>;TextDocumentEdit.editsisVec<Edit>.TextDocumentContentChangeEventis now an enum (partial / whole document);FileEvent.typ->kind;Diagnostic.messageisMessage.Vec<String>;SUPPORTED_TOKEN_TYPESis&[&str]with the same strings as before.runtime-tokio/runtime-agnostic) are still selected per target; feature references were renamed totower-lsp-server/....CompletionItem::deprecated(deprecated in gen-lsp-types) is still populated, with a local#[allow(deprecated)], to keep the payload unchanged.Verification
Run locally (macOS):
cargo fmt --all --check: OKcargo clippy --workspace --all-targets: no warningscargo test -p tombi-lsp: all pass (includingcompletion_edit::cargo_schema::*, run outside the sandbox with crates.io access)cargo test --workspace --exclude tombi-lsp: all passcargo clippy --locked -p tombi-wasm --target wasm32-unknown-unknown --no-default-features --features {lsp,lib} -- -D warnings: OKNot verified:
tower::Service+ client socket) that does not exist in this repo, so the fix is justified by reading the dependency source only.pnpmWASM package builds were not run (only the cargo clippy step of CI).tower-lsp-server0.24.0-rc.1 is a release candidate; a stable bump should be a follow-up.🤖 Generated with Claude Code