Repository navigation
Preserve unquoted dotted revisions in prek update - #2853
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
prek update
📦 Cargo Bloat Comparison
Expand for cargo-bloat outputHead Branch ResultsBase Branch Results |
⚡️ Hyperfine BenchmarksSummary: 0 regressions, 0 improvements above the 10% threshold. Environment
CLI CommandsBenchmarking basic commands in the main repo:
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base --version |
2.4 ± 0.1 | 2.2 | 2.6 | 1.00 |
prek-head --version |
2.4 ± 0.1 | 2.3 | 3.1 | 1.03 ± 0.06 |
prek list
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base list |
9.5 ± 0.1 | 9.2 | 9.8 | 1.00 |
prek-head list |
9.5 ± 0.1 | 9.3 | 9.9 | 1.01 ± 0.02 |
prek validate-config .pre-commit-config.yaml
⏭️ Skipped: .pre-commit-config.yaml not found
prek sample-config
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base sample-config |
2.8 ± 0.1 | 2.6 | 3.3 | 1.00 ± 0.05 |
prek-head sample-config |
2.8 ± 0.1 | 2.6 | 3.2 | 1.00 |
Cold vs Warm Runs
Comparing first run (cold) vs subsequent runs (warm cache):
prek run --all-files (cold - no cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
18.2 ± 0.9 | 17.4 | 20.8 | 1.02 ± 0.05 |
prek-head run --all-files |
17.8 ± 0.2 | 17.5 | 18.2 | 1.00 |
prek run --all-files (warm - with cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
17.9 ± 0.3 | 17.3 | 18.4 | 1.00 |
prek-head run --all-files |
18.4 ± 0.3 | 17.9 | 19.0 | 1.02 ± 0.03 |
Full Hook Suite
Running the builtin hook suite on the benchmark workspace:
prek run --all-files (full builtin hook suite)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
18.0 ± 0.4 | 17.3 | 18.9 | 1.00 |
prek-head run --all-files |
18.2 ± 0.5 | 17.6 | 20.4 | 1.01 ± 0.03 |
Individual Hook Performance
Benchmarking each hook individually on the test repo:
prek run trailing-whitespace --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run trailing-whitespace --all-files |
8.9 ± 0.2 | 8.5 | 9.2 | 1.01 ± 0.02 |
prek-head run trailing-whitespace --all-files |
8.8 ± 0.1 | 8.5 | 9.0 | 1.00 |
prek run end-of-file-fixer --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run end-of-file-fixer --all-files |
8.1 ± 0.1 | 7.9 | 8.5 | 1.00 |
prek-head run end-of-file-fixer --all-files |
8.2 ± 0.2 | 7.9 | 8.7 | 1.00 ± 0.03 |
prek run check-json --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-json --all-files |
7.1 ± 0.1 | 7.0 | 7.4 | 1.00 |
prek-head run check-json --all-files |
7.2 ± 0.1 | 7.1 | 7.6 | 1.01 ± 0.02 |
prek run check-yaml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-yaml --all-files |
7.4 ± 0.1 | 7.2 | 7.8 | 1.00 ± 0.03 |
prek-head run check-yaml --all-files |
7.3 ± 0.2 | 7.1 | 7.7 | 1.00 |
prek run check-toml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-toml --all-files |
7.2 ± 0.1 | 7.0 | 7.4 | 1.01 ± 0.02 |
prek-head run check-toml --all-files |
7.1 ± 0.1 | 6.9 | 7.5 | 1.00 |
prek run check-xml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-xml --all-files |
7.3 ± 0.1 | 7.1 | 7.4 | 1.01 ± 0.02 |
prek-head run check-xml --all-files |
7.2 ± 0.1 | 7.0 | 7.4 | 1.00 |
prek run detect-private-key --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run detect-private-key --all-files |
7.7 ± 0.2 | 7.5 | 8.3 | 1.02 ± 0.03 |
prek-head run detect-private-key --all-files |
7.6 ± 0.1 | 7.4 | 7.8 | 1.00 |
prek run fix-byte-order-marker --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run fix-byte-order-marker --all-files |
7.7 ± 0.1 | 7.6 | 8.0 | 1.01 ± 0.02 |
prek-head run fix-byte-order-marker --all-files |
7.6 ± 0.1 | 7.5 | 8.0 | 1.00 |
Installation Performance
Benchmarking hook installation (fast path hooks skip Python setup):
prek install-hooks (cold - no cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base install-hooks |
4.8 ± 0.0 | 4.8 | 4.9 | 1.01 ± 0.02 |
prek-head install-hooks |
4.8 ± 0.1 | 4.7 | 4.9 | 1.00 |
prek install-hooks (warm - with cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base install-hooks |
4.8 ± 0.0 | 4.7 | 4.8 | 1.00 |
prek-head install-hooks |
4.8 ± 0.1 | 4.7 | 4.9 | 1.01 ± 0.02 |
File Filtering/Scoping Performance
Testing different file selection modes:
prek run (staged files only)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run |
11.0 ± 0.1 | 10.8 | 11.3 | 1.00 |
prek-head run |
11.2 ± 0.4 | 10.8 | 12.5 | 1.02 ± 0.04 |
prek run --files '*.json' (specific file type)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --files '*.json' |
5.5 ± 0.1 | 5.5 | 5.7 | 1.00 ± 0.02 |
prek-head run --files '*.json' |
5.5 ± 0.1 | 5.4 | 5.7 | 1.00 |
Workspace Discovery & Initialization
Benchmarking hook discovery and initialization overhead:
prek run --dry-run --all-files (measures init overhead)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --dry-run --all-files |
7.4 ± 0.1 | 7.2 | 7.7 | 1.00 ± 0.02 |
prek-head run --dry-run --all-files |
7.4 ± 0.1 | 7.3 | 7.7 | 1.00 |
Meta Hooks Performance
Benchmarking meta hooks separately:
prek run check-hooks-apply --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-hooks-apply --all-files |
8.8 ± 0.1 | 8.6 | 9.1 | 1.00 ± 0.02 |
prek-head run check-hooks-apply --all-files |
8.8 ± 0.1 | 8.6 | 9.0 | 1.00 |
prek run check-useless-excludes --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-useless-excludes --all-files |
8.8 ± 0.2 | 8.5 | 9.2 | 1.02 ± 0.03 |
prek-head run check-useless-excludes --all-files |
8.6 ± 0.1 | 8.5 | 8.9 | 1.00 |
prek run identity --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run identity --all-files |
7.6 ± 0.1 | 7.5 | 7.7 | 1.00 |
prek-head run identity --all-files |
7.6 ± 0.2 | 7.4 | 8.0 | 1.00 ± 0.03 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2853 +/- ##
=======================================
Coverage 94.33% 94.33%
=======================================
Files 143 143
Lines 30847 30865 +18
=======================================
+ Hits 29100 29118 +18
Misses 1747 1747 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Many thanks for the blazingly fast fix! 🙏🙇 |
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (5 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `pinact` | `5.0.0` → `5.0.1` | `5.0.0` → `5.0.1` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (5 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>pinact: `5.0.0` → `5.0.1` (suzuki-shunsuke/pinact)</summary>
### v5.0.1
suzuki-shunsuke/pinact@v5.0.0...v5.0.1
## ⚠️ Security
#1792 Update Go to v1.27.3
This release is built with Go 1.27.3, which fixes
[CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now
refuses trust in a small set of intermediate certificates of a specific
Certificate Authority, after its CA keys were reported compromised.
`Verify` filters out chains containing those intermediates. The Go team
highly recommends upgrading immediately.
pinact relies on `crypto/x509` to verify the TLS certificate of GitHub
when it calls the GitHub API, with your access token if one is set, to
resolve the commit SHAs that workflows are pinned to. We recommend
upgrading.
ref.
- https://go.dev/doc/devel/release#go1.27.3
-
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
This release also includes Go 1.27.2 (#1764), which has security fixes
to the `go` command and the `crypto/tls`, `html/template`, `net/http`,
`net/textproto`, and `os` packages.
- https://go.dev/doc/devel/release#go1.27.2
## Others
#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and
go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and
test-workflow
## Dependency updates
#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `prek` Command: `mise upgrade --bump --local prek` <details> <summary>Version changelog (prek)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary> ### v0.5.6 ## Release Notes Released on 2026-10-19. ### Enhancements - Add builtin hook `check-commit-trailers` ([#2885](j178/prek#2885)) - Add builtin hook `check-signed-commit` ([#2725](j178/prek#2725)) ### Performance - Enable PGO for native release builds ([#2890](j178/prek#2890)) - Reduce hook process launches with balanced batches ([#2907](j178/prek#2907)) - Resolve hook commands before batching ([#2840](j178/prek#2840)) ### Bug fixes - Accept UTF-8 BOM in `check-json` ([#2879](j178/prek#2879)) - Preserve unquoted dotted revisions in `prek update` ([#2853](j178/prek#2853)) ### Documentation - Document standalone installer options ([#2859](j178/prek#2859)) - Update benchmarks for prek 0.5.5 ([#2786](j178/prek#2786)) ### Other changes - Enable ICF for release builds ([#2891](j178/prek#2891)) - Update uv to 0.13.0 ([#2856](j178/prek#2856)) ### Contributors - @ebuildy - @j178 - @shaanmajid ## Install prek 0.5.6 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.6 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-… (truncated) ### v0.5.7 ## Release Notes Released on 2026-10-21. ### Enhancements - Support system Rust toolchains without rustup ([#2887](j178/prek#2887)) ### Performance - Use blocking file checks for CPU-heavy builtin hooks ([#2910](j178/prek#2910)) ### Other changes - Update CA root crates and uv for the eMudhra intermediate CA compromise ([#2919](j178/prek#2919)) ### Contributors - @shaanmajid - @j178 ## Install prek 0.5.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.7 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256) | | [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (4 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (4 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (4 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |
</details>
<details>
<summary>Release notes (4 tools)</summary>
<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>
### v2.3.0
jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.
## Added
- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @jdx)
```yaml
ignores:
- rule: unpinned-uses
uses: actions/cache
reason: pinned by the Actions lock file on some branches
allow-unused: true
```
## Fixed
- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@jdalton)
## New Contributors
* @jdalton made their first contribution in #292
**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0
## 💚 Sponsor jactionlint
jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)
</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>
### v0.5.6
## Release Notes
Released on 2026-10-19.
### Enhancements
- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))
### Performance
- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))
### Bug fixes
- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))
### Documentation
- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))
### Other changes
- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))
### Contributors
- @ebuildy
- @j178
- @shaanmajid
## Install prek 0.5.6
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.6
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)
### v0.5.7
## Release Notes
Released on 2026-10-21.
### Enhancements
- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))
### Performance
- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))
### Other changes
- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))
### Contributors
- @shaanmajid
- @j178
## Install prek 0.5.7
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install prek
```
## Download prek 0.5.7
| File | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)
</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>
### v1.8.8
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @ya7010 in
tombi-toml/tombi#2328
**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8
### v1.8.9
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->
## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @ya7010 in
tombi-toml/tombi#2332
## New Contributors
* @JounQin made their first contribution in
tombi-toml/tombi#2330
**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9
### v1.8.10
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->
## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @ya7010 in
tombi-toml/tombi#2347
**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10
### v1.9.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->
## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @ya7010 in
tombi-toml/tombi#2349
**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0
### v1.9.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->
## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @ya7010 in
tombi-toml/tombi#2353
**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1
</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>
### 0.13.2
## Release Notes
Released on 2026-10-19.
### Enhancements
- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))
### Python
- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))
### Preview features
- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))
### Performance
- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)
### 0.13.3
## Release Notes
Released on 2026-10-20.
### Performance
- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))
## Install uv 0.13.3
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```
## Download uv 0.13.3
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)
### 0.13.4
## Release Notes
Released on 2026-10-20.
This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.
### Preview features
- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))
### Other changes
- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))
## Install uv 0.13.4
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```
## Download uv 0.13.4
| File | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)
### 0.13.5
## Release Notes
Released on 2026-10-21.
Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.
Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.
### Enhancements
- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))
### Python
- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))
### Preview features
- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `prek` Command: `mise upgrade --bump --local prek` <details> <summary>Version changelog (prek)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.5.4` → `0.5.7` | `0.5.4` → `0.5.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>prek: `0.5.4` → `0.5.7` (j178/prek)</summary> ### v0.5.5 ## Release Notes Released on 2026-10-05. ### Enhancements - Add Nushell completion generation ([#2785](j178/prek#2785)) - Add `ppc64le` wheel and binary builds ([#2809](j178/prek#2809)) ### Performance - Avoid JSON imports when querying Python interpreters ([#2790](j178/prek#2790)) - Avoid duplicate diffs after hooks rewrite files ([#2815](j178/prek#2815)) - Batch file reads in shebang checks ([#2793](j178/prek#2793)) - Check cached hook environments concurrently ([#2797](j178/prek#2797)) - Overlap Git discovery with worktree status checks ([#2821](j178/prek#2821)) - Query staged additions only for case conflicts ([#2802](j178/prek#2802)) - Reduce worker overhead in XML and pygrep checks ([#2789](j178/prek#2789)) - Reuse Git worktree state during hook startup ([#2787](j178/prek#2787)) - Reuse intent-to-add paths when saving unstaged changes ([#2788](j178/prek#2788)) - Run Git queries concurrently for case-conflict checks ([#2792](j178/prek#2792)) - Share Bun and Deno version queries across environments ([#2795](j178/prek#2795)) - Share Lua runtime probes across hook environments ([#2796](j178/prek#2796)) - Share Ruby version queries across hook environments ([#2794](j178/prek#2794)) - Share mise version queries across hook environments ([#2798](j178/prek#2798)) - Skip site initialization in Python interpreter probes ([#2822](j178/prek#2822)) - Skip untracked files in destroyed symlink checks ([#2799](j178/prek#2799)) - Skip unused file input for always-run hooks ([#2813](j178/prek#2813)) ### Bug fixe… (truncated) ### v0.5.6 ## Release Notes Released on 2026-10-19. ### Enhancements - Add builtin hook `check-commit-trailers` ([#2885](j178/prek#2885)) - Add builtin hook `check-signed-commit` ([#2725](j178/prek#2725)) ### Performance - Enable PGO for native release builds ([#2890](j178/prek#2890)) - Reduce hook process launches with balanced batches ([#2907](j178/prek#2907)) - Resolve hook commands before batching ([#2840](j178/prek#2840)) ### Bug fixes - Accept UTF-8 BOM in `check-json` ([#2879](j178/prek#2879)) - Preserve unquoted dotted revisions in `prek update` ([#2853](j178/prek#2853)) ### Documentation - Document standalone installer options ([#2859](j178/prek#2859)) - Update benchmarks for prek 0.5.5 ([#2786](j178/prek#2786)) ### Other changes - Enable ICF for release builds ([#2891](j178/prek#2891)) - Update uv to 0.13.0 ([#2856](j178/prek#2856)) ### Contributors - @ebuildy - @j178 - @shaanmajid ## Install prek 0.5.6 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.6 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-… (truncated) ### v0.5.7 ## Release Notes Released on 2026-10-21. ### Enhancements - Support system Rust toolchains without rustup ([#2887](j178/prek#2887)) ### Performance - Use blocking file checks for CPU-heavy builtin hooks ([#2910](j178/prek#2910)) ### Other changes - Update CA root crates and uv for the eMudhra intermediate CA compromise ([#2919](j178/prek#2919)) ### Contributors - @shaanmajid - @j178 ## Install prek 0.5.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.7 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256) | | [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-… (truncated) </details> </details> Modified files: - `.mise.toml`
Automated mise tool upgrades from local config. mise-managed tools: - `prek` Command: `mise upgrade --bump --local prek` <details> <summary>Version changelog (prek)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.5.4` → `0.5.7` | `0.5.4` → `0.5.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>prek: `0.5.4` → `0.5.7` (j178/prek)</summary> ### v0.5.5 ## Release Notes Released on 2026-10-05. ### Enhancements - Add Nushell completion generation ([#2785](j178/prek#2785)) - Add `ppc64le` wheel and binary builds ([#2809](j178/prek#2809)) ### Performance - Avoid JSON imports when querying Python interpreters ([#2790](j178/prek#2790)) - Avoid duplicate diffs after hooks rewrite files ([#2815](j178/prek#2815)) - Batch file reads in shebang checks ([#2793](j178/prek#2793)) - Check cached hook environments concurrently ([#2797](j178/prek#2797)) - Overlap Git discovery with worktree status checks ([#2821](j178/prek#2821)) - Query staged additions only for case conflicts ([#2802](j178/prek#2802)) - Reduce worker overhead in XML and pygrep checks ([#2789](j178/prek#2789)) - Reuse Git worktree state during hook startup ([#2787](j178/prek#2787)) - Reuse intent-to-add paths when saving unstaged changes ([#2788](j178/prek#2788)) - Run Git queries concurrently for case-conflict checks ([#2792](j178/prek#2792)) - Share Bun and Deno version queries across environments ([#2795](j178/prek#2795)) - Share Lua runtime probes across hook environments ([#2796](j178/prek#2796)) - Share Ruby version queries across hook environments ([#2794](j178/prek#2794)) - Share mise version queries across hook environments ([#2798](j178/prek#2798)) - Skip site initialization in Python interpreter probes ([#2822](j178/prek#2822)) - Skip untracked files in destroyed symlink checks ([#2799](j178/prek#2799)) - Skip unused file input for always-run hooks ([#2813](j178/prek#2813)) ### Bug fixe… (truncated) ### v0.5.6 ## Release Notes Released on 2026-10-19. ### Enhancements - Add builtin hook `check-commit-trailers` ([#2885](j178/prek#2885)) - Add builtin hook `check-signed-commit` ([#2725](j178/prek#2725)) ### Performance - Enable PGO for native release builds ([#2890](j178/prek#2890)) - Reduce hook process launches with balanced batches ([#2907](j178/prek#2907)) - Resolve hook commands before batching ([#2840](j178/prek#2840)) ### Bug fixes - Accept UTF-8 BOM in `check-json` ([#2879](j178/prek#2879)) - Preserve unquoted dotted revisions in `prek update` ([#2853](j178/prek#2853)) ### Documentation - Document standalone installer options ([#2859](j178/prek#2859)) - Update benchmarks for prek 0.5.5 ([#2786](j178/prek#2786)) ### Other changes - Enable ICF for release builds ([#2891](j178/prek#2891)) - Update uv to 0.13.0 ([#2856](j178/prek#2856)) ### Contributors - @ebuildy - @j178 - @shaanmajid ## Install prek 0.5.6 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.6 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-… (truncated) ### v0.5.7 ## Release Notes Released on 2026-10-21. ### Enhancements - Support system Rust toolchains without rustup ([#2887](j178/prek#2887)) ### Performance - Use blocking file checks for CPU-heavy builtin hooks ([#2910](j178/prek#2910)) ### Other changes - Update CA root crates and uv for the eMudhra intermediate CA compromise ([#2919](j178/prek#2919)) ### Contributors - @shaanmajid - @j178 ## Install prek 0.5.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.7 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256) | | [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Closes #2852