Skip to content

fix(schema-store): honor environment proxies for schema fetches - #2306

Merged
ya7010 merged 1 commit into
tombi-toml:mainfrom
cailloumajor:fix/schema-fetch-proxy
Oct 15, 2026
Merged

fix(schema-store): honor environment proxies for schema fetches#2306
ya7010 merged 1 commit into
tombi-toml:mainfrom
cailloumajor:fix/schema-fetch-proxy

Conversation

@cailloumajor

@cailloumajor cailloumajor commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #2305.

#2283 added .no_proxy() to the reqwest client so that the DNS check sees the address actually used by the connection. As a side effect, HTTP_PROXY / HTTPS_PROXY are ignored and remote schemas and catalogs cannot be fetched at all on networks that only reach the Internet through a proxy (a regression of #1035 / #1460).

This PR honors environment proxies again while keeping the non-public destination policy of #2283:

  • Proxy endpoint: hosts of the proxies set in ALL_PROXY / HTTPS_PROXY / HTTP_PROXY (either case) may resolve to non-public addresses. Corporate proxies usually live on a private network. Like TOMBI_SCHEMA_TRUSTED_HOSTS, these come from the user's process environment, never from project files. Every other host is still checked by FilteredDnsResolver.
  • Proxied destination: through a proxy, the destination is resolved by the proxy, not by our resolver. When a proxy is configured, the destination of each request, each redirect hop and the authenticated GitHub retry is resolved locally first (2 s timeout) and refused with HostNotTrusted if it points to a non-public address. If the local lookup fails, the request is left to the proxy, because on proxied networks public names are often not resolvable locally.
  • Unchanged: URL credentials and non-HTTP(S) schemes are rejected, non-public IP literals are rejected, every redirect is rechecked, and behavior without any proxy variable is identical (the local pre-check is skipped).

Residual risk

A host name that does not resolve locally but that the proxy resolves to an internal address cannot be detected by Tombi. In that setup the proxy is the egress control point. Hosts listed in NO_PROXY are connected to directly and remain fully checked by the resolver. If you prefer a stricter default, proxy support could be made opt-in (for example TOMBI_SCHEMA_USE_PROXY=true). I'm happy to change it.

Validation

  • cargo fmt --all -- --check
  • cargo clippy --workspace --all-targets: no new warnings (one existing useless_format in tombi-uri)
  • cargo test --workspace --no-fail-fast: 2866 passed, 0 failed
  • New unit tests: proxy host parsing (with/without scheme, credentials, trailing dot, IPv6), and the resolver exemption only applies to configured proxy hosts.
  • Manually, behind an HTTP proxy without direct Internet access:
    • #:schema https://nexte.st/schemas/repo-config.json is fetched through the proxy.
    • #:schema http://localhost:9/s.json with NO_PROXY empty is refused (schema host is not trusted).
    • #:schema http://169.254.169.254/s.json is refused.
    • Without proxy variables, behavior is unchanged.

🤖 Generated with Claude Code

@cailloumajor @claude
fix(schema-store): honor environment proxies for schema fetches
31eea0d 
tombi-toml#2283 made the reqwest client ignore HTTP(S)_PROXY, so remote schemas
and catalogs could not be fetched on networks that only reach the
Internet through a proxy.

Environment proxies are honored again, keeping the non-public
destination policy:

- Proxy hosts read from the environment may resolve to non-public
  addresses; every other host is still checked by the DNS resolver.
- When a proxy is configured, the destination of each request and
  redirect hop is resolved locally first and refused if it points to a
  non-public address. A destination only the proxy can resolve is left
  to the proxy.

Fixes tombi-toml#2305

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cailloumajor
cailloumajor requested a review from ya7010 as a code owner October 15, 2026 07:54
@ya7010

ya7010 commented Oct 15, 2026

Copy link
Copy Markdown
Collaborator

Thanks!

@ya7010
ya7010 merged commit ffa851e into tombi-toml:main Oct 15, 2026
34 checks passed
This was referenced Oct 15, 2026
Merged
Merged
Merged
@BrewTestBot BrewTestBot mentioned this pull request Oct 16, 2026
Merged
This was referenced Oct 19, 2026
Merged
Merged
Closed
Merged
Closed
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
46b550e 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#122)
ca5799b 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
e40e5ea 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#125)
c7f5ef8 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
bfa98e4 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#90)
2a3c84b 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 24, 2026
Closed
Merged
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#324)
529d582 
Automated mise tool upgrades from local config.

mise-managed tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

_Omitted 1 older release._

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 24, 2026
Closed
Merged
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#150)
f5be954 
Automated mise tool upgrades from local config.

mise-managed tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

_Omitted 1 older release._

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ya7010 ya7010 Awaiting requested review from ya7010 ya7010 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

🐝 Issue: Schema fetches ignore HTTP(S)_PROXY since v1.8.0

2 participants

@cailloumajor @ya7010