Skip to content

fix(deps): update packages flagged by OSV scanner - #2348

Merged
ya7010 merged 1 commit into
mainfrom
fix-osv-vulnerabilities
Oct 21, 2026
Merged

fix(deps): update packages flagged by OSV scanner#2348
ya7010 merged 1 commit into
mainfrom
fix-osv-vulnerabilities

Conversation

@ya7010

@ya7010 ya7010 commented Oct 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Update the Rust and pnpm lockfiles for the 18 fixable findings reported by OSV Scanner run 39687994353.
  • Raise rustls-webpki to 0.103.16, @vitest/mocker to 4.1.12, follow-redirects to 1.16.1, markdown-it to 14.3.3, and Vite to 6.4.4 / 7.3.7.
  • Align the package constraints and lockfile snapshots; no vulnerability suppressions were added.

Validation

  • cargo check -p tombi-schema-store --locked
  • pnpm install --lockfile-only --frozen-lockfile --ignore-scripts
  • git diff --check
  • OSV Scanner workflow rerun: 39690575836 (queued at PR creation).

@ya7010 ya7010 added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@ya7010
ya7010 merged commit fb6ce9e into main Oct 21, 2026
36 checks passed
@ya7010
ya7010 deleted the fix-osv-vulnerabilities branch October 21, 2026 23:22
@BrewTestBot BrewTestBot mentioned this pull request Oct 22, 2026
Merged
This was referenced Oct 24, 2026
Merged
Closed
Merged
Merged
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#130)
1fa1df4 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `pinact` | `5.0.0` → `5.0.1` | `5.0.0` → `5.0.1` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>pinact: `5.0.0` → `5.0.1` (suzuki-shunsuke/pinact)</summary>

### v5.0.1

suzuki-shunsuke/pinact@v5.0.0...v5.0.1

## ⚠️ Security

#1792 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes
[CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now
refuses trust in a small set of intermediate certificates of a specific
Certificate Authority, after its CA keys were reported compromised.
`Verify` filters out chains containing those intermediates. The Go team
highly recommends upgrading immediately.

pinact relies on `crypto/x509` to verify the TLS certificate of GitHub
when it calls the GitHub API, with your access token if one is set, to
resolve the commit SHAs that workflows are pinned to. We recommend
upgrading.

ref.

- https://go.dev/doc/devel/release#go1.27.3
-
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#1764), which has security fixes
to the `go` command and the `crypto/tls`, `html/template`, `net/http`,
`net/textproto`, and `os` packages.

- https://go.dev/doc/devel/release#go1.27.2

## Others

#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and
go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and
test-workflow

## Dependency updates

#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#129)
9353118 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@ghappforreleaseplease ghappforreleaseplease Bot mentioned this pull request Oct 24, 2026
Merged
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#324)
529d582 
Automated mise tool upgrades from local config.

mise-managed tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

_Omitted 1 older release._

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#94)
1522795 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 24, 2026
Closed
Merged
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#150)
f5be954 
Automated mise tool upgrades from local config.

mise-managed tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.8.1` → `1.9.1` | `1.8.1` → `1.9.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.8.1` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

_Omitted 1 older release._

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ya7010