Skip to content

Update uv to 0.13.0 - #2856

Merged
j178 merged 1 commit into
j178:masterfrom
shaanmajid:chore/uv-0.13
Oct 10, 2026
Merged

j178 merged 1 commit into
j178:masterfrom
shaanmajid:chore/uv-0.13

Conversation

@shaanmajid

Copy link
Copy Markdown
Collaborator

Summary

Bumps CUR_UV_VERSION to 0.13.0 to support Python 3.15.

@shaanmajid
shaanmajid requested a review from j178 as a code owner October 10, 2026 01:09
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-10T01:15:32.211081Z 9f4ffc2 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@codecov

codecov Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.33%. Comparing base (d8b4548) to head (9f4ffc2).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2856   +/-   ##
=======================================
  Coverage   94.33%   94.33%           
=======================================
  Files         143      143           
  Lines       30865    30865           
=======================================
+ Hits        29117    29118    +1     
+ Misses       1748     1747    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@prek-ci-bot

prek-ci-bot Bot commented Oct 10, 2026

Copy link
Copy Markdown

📦 Cargo Bloat Comparison

.text size change: +0.00% (12.9 MiB → 12.9 MiB)

Expand for cargo-bloat output

Head Branch Results

File  .text     Size             Crate Name
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_encrypt_avx512
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_decrypt_avx512
0.0%   0.7%  94.9KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
0.0%   0.4%  50.3KiB annotate_snippets annotate_snippets::renderer::render::render
0.0%   0.4%  47.5KiB              prek <<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  45.0KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  41.2KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
0.0%   0.3%  35.1KiB              prek prek::run::{closure#0}
0.0%   0.2%  29.5KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  28.8KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  28.0KiB              toml <toml::de::deserializer::value::ValueDeserializer as serde_core::de::Deserializer>::deserialize_any::<<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor>
0.0%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble_alt
0.0%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble
0.0%   0.2%  27.4KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.2KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.1KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  26.4KiB              prek <prek::languages::ruby::installer::RubyInstaller>::install::{closure#0}
4.1%  87.3%  11.3MiB                   And 20867 smaller methods. Use -n N to show more.
4.7% 100.0%  12.9MiB                   .text section size, the file size is 277.0MiB

Base Branch Results

File  .text     Size             Crate Name
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_encrypt_avx512
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_decrypt_avx512
0.0%   0.7%  94.9KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
0.0%   0.4%  50.3KiB annotate_snippets annotate_snippets::renderer::render::render
0.0%   0.4%  47.5KiB              prek <<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  45.0KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  41.2KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
0.0%   0.3%  35.1KiB              prek prek::run::{closure#0}
0.0%   0.2%  29.5KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  28.8KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  28.0KiB              toml <toml::de::deserializer::value::ValueDeserializer as serde_core::de::Deserializer>::deserialize_any::<<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor>
0.0%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble_alt
0.0%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble
0.0%   0.2%  27.4KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.2KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.1KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  27.0KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
0.0%   0.2%  26.4KiB              prek <prek::languages::ruby::installer::RubyInstaller>::install::{closure#0}
4.1%  87.3%  11.3MiB                   And 20867 smaller methods. Use -n N to show more.
4.7% 100.0%  12.9MiB                   .text section size, the file size is 277.0MiB

@prek-ci-bot

prek-ci-bot Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

⚡️ Hyperfine Benchmarks

Summary: 0 regressions, 0 improvements above the 10% threshold.

Environment
  • OS: Linux 6.17.0-1022-azure
  • CPU: 4 cores
  • prek version: prek 0.5.5+12 (67e8204 2026-10-09)
  • Rust version: rustc 1.99.0 (b940084d7 2026-09-28)
  • Hyperfine version: hyperfine 1.20.0
CLI Commands

Benchmarking basic commands in the main repo:

prek --version

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base --version 2.5 ± 0.1 2.4 2.8 1.04 ± 0.05
prek-head --version 2.4 ± 0.1 2.3 2.9 1.00

prek list

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base list 9.7 ± 0.1 9.5 9.9 1.02 ± 0.02
prek-head list 9.5 ± 0.1 9.2 9.8 1.00

prek validate-config .pre-commit-config.yaml

⏭️ Skipped: .pre-commit-config.yaml not found

prek sample-config

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base sample-config 2.9 ± 0.0 2.8 3.0 1.06 ± 0.03
prek-head sample-config 2.7 ± 0.0 2.6 2.9 1.00
Cold vs Warm Runs

Comparing first run (cold) vs subsequent runs (warm cache):

prek run --all-files (cold - no cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 18.2 ± 0.5 17.7 19.3 1.00
prek-head run --all-files 18.3 ± 0.8 17.8 20.3 1.00 ± 0.05

prek run --all-files (warm - with cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 17.9 ± 0.3 17.5 18.6 1.01 ± 0.03
prek-head run --all-files 17.8 ± 0.5 17.1 18.5 1.00
Full Hook Suite

Running the builtin hook suite on the benchmark workspace:

prek run --all-files (full builtin hook suite)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 18.7 ± 0.5 18.0 21.0 1.02 ± 0.03
prek-head run --all-files 18.3 ± 0.3 17.5 19.2 1.00
Individual Hook Performance

Benchmarking each hook individually on the test repo:

prek run trailing-whitespace --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run trailing-whitespace --all-files 9.5 ± 0.3 9.0 10.1 1.05 ± 0.03
prek-head run trailing-whitespace --all-files 9.0 ± 0.2 8.7 9.3 1.00

prek run end-of-file-fixer --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run end-of-file-fixer --all-files 8.4 ± 0.1 8.2 8.6 1.03 ± 0.02
prek-head run end-of-file-fixer --all-files 8.2 ± 0.1 8.0 8.4 1.00

prek run check-json --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-json --all-files 7.4 ± 0.1 7.2 7.7 1.02 ± 0.02
prek-head run check-json --all-files 7.3 ± 0.1 7.0 7.5 1.00

prek run check-yaml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-yaml --all-files 7.5 ± 0.1 7.4 7.8 1.03 ± 0.02
prek-head run check-yaml --all-files 7.3 ± 0.1 7.1 7.4 1.00

prek run check-toml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-toml --all-files 7.4 ± 0.2 7.2 7.9 1.02 ± 0.03
prek-head run check-toml --all-files 7.3 ± 0.1 7.1 7.6 1.00

prek run check-xml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-xml --all-files 7.5 ± 0.1 7.3 7.7 1.03 ± 0.02
prek-head run check-xml --all-files 7.2 ± 0.1 7.1 7.4 1.00

prek run detect-private-key --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run detect-private-key --all-files 7.9 ± 0.1 7.8 8.1 1.03 ± 0.02
prek-head run detect-private-key --all-files 7.7 ± 0.1 7.5 7.9 1.00

prek run fix-byte-order-marker --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run fix-byte-order-marker --all-files 7.9 ± 0.1 7.8 8.1 1.02 ± 0.02
prek-head run fix-byte-order-marker --all-files 7.8 ± 0.1 7.6 8.0 1.00
Installation Performance

Benchmarking hook installation (fast path hooks skip Python setup):

prek install-hooks (cold - no cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base install-hooks 5.1 ± 0.1 5.0 5.2 1.06 ± 0.03
prek-head install-hooks 4.8 ± 0.1 4.7 4.9 1.00

prek install-hooks (warm - with cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base install-hooks 5.0 ± 0.1 4.9 5.0 1.03 ± 0.01
prek-head install-hooks 4.8 ± 0.0 4.8 4.9 1.00
File Filtering/Scoping Performance

Testing different file selection modes:

prek run (staged files only)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run 11.2 ± 0.1 11.0 11.3 1.01 ± 0.02
prek-head run 11.0 ± 0.2 10.8 11.3 1.00

prek run --files '*.json' (specific file type)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --files '*.json' 5.7 ± 0.1 5.6 5.9 1.03 ± 0.03
prek-head run --files '*.json' 5.5 ± 0.1 5.4 5.7 1.00
Workspace Discovery & Initialization

Benchmarking hook discovery and initialization overhead:

prek run --dry-run --all-files (measures init overhead)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --dry-run --all-files 7.5 ± 0.1 7.4 7.7 1.02 ± 0.02
prek-head run --dry-run --all-files 7.3 ± 0.1 7.2 7.6 1.00
Meta Hooks Performance

Benchmarking meta hooks separately:

prek run check-hooks-apply --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-hooks-apply --all-files 8.9 ± 0.1 8.7 9.2 1.02 ± 0.02
prek-head run check-hooks-apply --all-files 8.7 ± 0.1 8.6 8.9 1.00

prek run check-useless-excludes --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-useless-excludes --all-files 8.9 ± 0.1 8.8 9.0 1.03 ± 0.01
prek-head run check-useless-excludes --all-files 8.6 ± 0.1 8.5 8.7 1.00

prek run identity --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run identity --all-files 7.9 ± 0.1 7.8 8.1 1.03 ± 0.02
prek-head run identity --all-files 7.7 ± 0.1 7.6 7.8 1.00

@shaanmajid

Copy link
Copy Markdown
Collaborator Author

CI is failing since the Aliyun PyPI mirror has not yet synced uv's 0.13.0 release earlier today. It should pass once that's resolved.

@j178

j178 commented Oct 10, 2026

Copy link
Copy Markdown
Owner

Thanks!

@j178
j178 merged commit a59718f into j178:master Oct 10, 2026
71 of 73 checks passed
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `pinact` | `5.0.0` → `5.0.1` | `5.0.0` → `5.0.1` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>pinact: `5.0.0` → `5.0.1` (suzuki-shunsuke/pinact)</summary>

### v5.0.1

suzuki-shunsuke/pinact@v5.0.0...v5.0.1

## ⚠️ Security

#1792 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes
[CVE-2026-111943](https://go.dev/issue/82345) in `crypto/x509`. Go now
refuses trust in a small set of intermediate certificates of a specific
Certificate Authority, after its CA keys were reported compromised.
`Verify` filters out chains containing those intermediates. The Go team
highly recommends upgrading immediately.

pinact relies on `crypto/x509` to verify the TLS certificate of GitHub
when it calls the GitHub API, with your access token if one is set, to
resolve the commit SHAs that workflows are pinned to. We recommend
upgrading.

ref.

- https://go.dev/doc/devel/release#go1.27.3
-
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#1764), which has security fixes
to the `go` command and the `crypto/tls`, `html/template`, `net/http`,
`net/textproto`, and `os` packages.

- https://go.dev/doc/devel/release#go1.27.2

## Others

#1766 ci: Update GitHub Actions runner to ubuntu-26.04
#1767 ci: Use download-go-module-action
#1768 ci: Share Go modules between integration test and
go-test-full-workflow
#1774 ci: Use the reusable workflow of go-autofix-action
#1782 ci: Replace go-test-full-workflow with go-test-workflow and
test-workflow

## Dependency updates

#1764 #1792 Update Go to v1.27.3
#1730 #1789 Update github.com/google/go-github to v93
#1739 Update github.com/suzuki-shunsuke/cobra-util to v0.0.5
#1723 Update github.com/sourcegraph/go-diff to v0.9.0

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `prek`

Command: `mise upgrade --bump --local prek`

<details>
<summary>Version changelog (prek)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.2.0` → `2.3.0` | `2.2.0` → `2.3.0` |
| `prek` | `0.5.5` → `0.5.7` | `0.5.5` → `0.5.7` |
| `tombi` | `1.8.7` → `1.9.1` | `1.8.7` → `1.9.1` |
| `uv` | `0.13.1` → `0.13.5` | `0.13.1` → `0.13.5` |

</details>

<details>
<summary>Release notes (4 tools)</summary>

<details>
<summary>jactionlint: `2.2.0` → `2.3.0` (jdx/jactionlint)</summary>

### v2.3.0

jactionlint 2.3.0 adds an `allow-unused` option to `ignores` entries in
the config file and fixes a `workflow-call-permissions` false positive
for OIDC. It is also built with Go 1.27.3, so online checks reject
certificates from the compromised eMudhra CA.

## Added

- **`allow-unused` for durable ignores.** An `ignores` entry with
`allow-unused: true` is not reported as `unused-ignore` when it
suppresses nothing. Use it for findings that come and go, such as one
caused by a moving tag. `expired-ignore` still reports the entry when it
expires. The default is `false`, and any value other than `true` or
`false` is a config error. The option is also in the config JSON Schema.
(#297, @​jdx)
  ```yaml
  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true
  ```

## Fixed

- **`workflow-call-permissions`** no longer reports a missing `id-token:
write` when the caller sets no `permissions:` and
`assume-default-permissions` is `permissive` or not set. In that case,
GitHub gives the called job an OIDC token. With
`assume-default-permissions: restricted`, jactionlint still reports it.
(#299, @​jdx)
- **Online checks reject forged certificates from the compromised
eMudhra CA.** Release binaries are now built with Go 1.27.3, which
rejects these certificate chains. Older binaries do not have this fix,
so replace them with this release if you use `--online`. (#301,
@​jdalton)

## New Contributors

* @​jdalton made their first contribution in #292

**Full Changelog**:
jdx/jactionlint@v2.2.0...v2.3.0

## 💚 Sponsor jactionlint

jactionlint is a fork of
[rhysd/actionlint](https://github.com/rhysd/actionlint), maintained by
[@​jdx](https://github.com/jdx), an open source developer at
[**entire.io**](https://entire.io/), the title sponsor of his open
source work.

If jactionlint has a place in your development workflow, please consider
becoming an [ind… (truncated)

</details>
<details>
<summary>prek: `0.5.5` → `0.5.7` (j178/prek)</summary>

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>
<details>
<summary>tombi: `1.8.7` → `1.9.1` (tombi-toml/tombi)</summary>

### v1.8.8

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.8 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): avoid duplicate diagnostics after tombi/associateSchema in
pull mode by @​ya7010 in tombi-toml/tombi#2325
* chore: run cargo fmt by @​ya7010 in
tombi-toml/tombi#2327
* refactor(command): move Cache command to the end of TomlCommand enum
and add documentation for cache module by @​ya7010 in
tombi-toml/tombi#2328


**Full Changelog**:
tombi-toml/tombi@v1.8.7...v1.8.8

### v1.8.9

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.9 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): apply [[overrides]] rules over the base rules by
@​JounQin in tombi-toml/tombi#2330
* fix(config): make rule merge prefer overrides by @​ya7010 in
tombi-toml/tombi#2331
* fix(document-tree): preserve explicit parent directives by @​ya7010 in
tombi-toml/tombi#2332

## New Contributors
* @​JounQin made their first contribution in
tombi-toml/tombi#2330

**Full Changelog**:
tombi-toml/tombi@v1.8.8...v1.8.9

### v1.8.10

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.10 -->

## What's Changed
### 🐝 Bug Fixes
* fix(vscode): block schema selection for directive files by @​ya7010 in
tombi-toml/tombi#2335
* fix(vscode): route language server logs by severity by @​ya7010 in
tombi-toml/tombi#2344
### 📦 Dependencies
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in
tombi-toml/tombi#2348
### 🛠️ Other Changes
* fix(lsp): preserve selected schema priority across reloads by @​ya7010
in tombi-toml/tombi#2334
* fix(lsp): split multi-line semantic tokens for clients without
multilineTokenSupport by @​ya7010 in
tombi-toml/tombi#2340
* feat: add options to not send semantic tokens for strings and comments
by @​ya7010 in tombi-toml/tombi#2343
* fix(formatter): avoid panic on array of tables under schema-less table
property by @​ya7010 in tombi-toml/tombi#2346
* style: cargo fmt by @​ya7010 in
tombi-toml/tombi#2347


**Full Changelog**:
tombi-toml/tombi@v1.8.9...v1.8.10

### v1.9.0

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.0 -->

## What's Changed
### 🚨 Breaking Changes
* fix: use enabled for semantic token settings by @​ya7010 in
tombi-toml/tombi#2349


**Full Changelog**:
tombi-toml/tombi@v1.8.10...v1.9.0

### v1.9.1

<!-- Release notes generated using configuration in .github/release.yml
at v1.9.1 -->

## What's Changed
### 🛠️ Other Changes
* fix(parser): accept zero floats with an uppercase exponent by
@​MaxFreedomPollard in tombi-toml/tombi#2350
* feat(lsp): show default and enum values in completion documentation by
@​ya7010 in tombi-toml/tombi#2351
* fix(lsp): separate hover/completion constraint blocks with a single
blank line by @​ya7010 in tombi-toml/tombi#2352
* fix(deps): update DOMPurify to 3.4.17 by @​ya7010 in
tombi-toml/tombi#2353


**Full Changelog**:
tombi-toml/tombi@v1.9.0...v1.9.1

</details>
<details>
<summary>uv: `0.13.1` → `0.13.5` (astral-sh/uv)</summary>

### 0.13.2

## Release Notes

Released on 2026-10-19.

### Enhancements

- Report all installed packages in `uv workspace metadata`, including
packages outside the selected resolution
([#22395](astral-sh/uv#22395))
- Include supported environment restrictions when exporting
`pylock.toml` ([#22596](astral-sh/uv#22596))
- Retry dropped GET and HEAD requests when fetching package and index
data ([#22672](astral-sh/uv#22672))
- Preserve encoding declarations in wheel data scripts that require
shell launchers ([#22526](astral-sh/uv#22526))
- Show causes and hints when `uv python find --script` cannot discover
an interpreter, including with `-q`
([#22549](astral-sh/uv#22549))
- Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh
([#22538](astral-sh/uv#22538),
[#22572](astral-sh/uv#22572))
- Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's `[build-system].requires` validation
([#22577](astral-sh/uv#22577))

### Python

- Add PyPy 3.11.17 and 3.12.15
([#22578](astral-sh/uv#22578))

### Preview features

- Fetch and parse PEP 825 index-level variant metadata with
`wheel-variants` ([#22509](astral-sh/uv#22509),
[#22511](astral-sh/uv#22511))

### Performance

- Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers
([#22608](astral-sh/uv#22608),
[#22615](astral-sh/uv#22615),
[#22651](astral-sh/uv#22651),
[#22674](astral-sh/uv#22674))
- Reduce the time and memory used to parse and store complex dependency
markers ([#22675](astral-sh/uv#22675),
[#22676](https://gith… (truncated)

### 0.13.3

## Release Notes

Released on 2026-10-20.

### Performance

- Avoid severe `uv export` slowdowns in dependency graphs with extras
([#22750](astral-sh/uv#22750))

## Install uv 0.13.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex"
```

## Download uv 0.13.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-aarch64-pc-windows-msvc.zip.sha256)
|
|
[uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip)
| x86 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-i686-pc-windows-msvc.zip.sha256)
|
|
[uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-x86_64-pc-windows-msvc.zip.sha256)
|
| [uv-aarch64-unknown-linux… (truncated)

### 0.13.4

## Release Notes

Released on 2026-10-20.

This release addresses
[GHSA-hq85-5cpj-mr62](GHSA-hq85-5cpj-mr62),
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.

### Preview features

- Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under `wheel-variants`
([#22512](astral-sh/uv#22512))

### Other changes

- Update the bundled Mozilla root certificates via `webpki-root-certs`
1.0.10 ([#22760](astral-sh/uv#22760))

## Install uv 0.13.4

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1 | iex"
```

## Download uv 0.13.4

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256)
|
|
[uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://releases.astral.sh/github/uv/releases/downloa…
(truncated)

### 0.13.5

## Release Notes

Released on 2026-10-21.

Following [uv
0.13.4](https://github.com/astral-sh/uv/releases/tag/0.13.4), which
removed the affected eMudhra/emSign root from uv's own certificate
store, this release updates the latest managed CPython builds for 3.11
and newer to [python-build-standalone
20261021](https://github.com/astral-sh/python-build-standalone/releases/tag/20261021),
including the CPython
[3.15.1](https://www.python.org/downloads/release/python-3151/),
[3.14.9](https://www.python.org/downloads/release/python-3149/), and
[3.13.17](https://www.python.org/downloads/release/python-31317/)
security patch releases. These builds include [pip
26.2.2](https://pip.pypa.io/en/stable/news/#v26-2-2) both preinstalled
in the managed interpreter and bundled with `ensurepip`, which installs
pip by default when you run `python -m venv`. Both copies use certifi
2026.10.19, which removes the same affected root. After upgrading uv,
run `uv python upgrade` to install the updated builds. Virtual
environments pinned to an older Python patch version do not switch to
the updated interpreter automatically. Upgrade pip separately in
existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.

### Enhancements

- Report incompatible self-dependencies directly in resolution errors
([#21845](astral-sh/uv#21845))

### Python

- Add CPython 3.15.1, 3.14.9, and 3.13.17
([#22802](astral-sh/uv#22802))

### Preview features

- Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with `wheel-variants`
([#22535](astral-sh/uv#22535),
[#22536](https://github.com/astral-sh/uv/pull/22536),… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `prek`

Command: `mise upgrade --bump --local prek`

<details>
<summary>Version changelog (prek)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `prek` | `0.5.4` → `0.5.7` | `0.5.4` → `0.5.7` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>prek: `0.5.4` → `0.5.7` (j178/prek)</summary>

### v0.5.5

## Release Notes

Released on 2026-10-05.

### Enhancements

- Add Nushell completion generation ([#2785](j178/prek#2785))
- Add `ppc64le` wheel and binary builds ([#2809](j178/prek#2809))

### Performance

- Avoid JSON imports when querying Python interpreters ([#2790](j178/prek#2790))
- Avoid duplicate diffs after hooks rewrite files ([#2815](j178/prek#2815))
- Batch file reads in shebang checks ([#2793](j178/prek#2793))
- Check cached hook environments concurrently ([#2797](j178/prek#2797))
- Overlap Git discovery with worktree status checks ([#2821](j178/prek#2821))
- Query staged additions only for case conflicts ([#2802](j178/prek#2802))
- Reduce worker overhead in XML and pygrep checks ([#2789](j178/prek#2789))
- Reuse Git worktree state during hook startup ([#2787](j178/prek#2787))
- Reuse intent-to-add paths when saving unstaged changes ([#2788](j178/prek#2788))
- Run Git queries concurrently for case-conflict checks ([#2792](j178/prek#2792))
- Share Bun and Deno version queries across environments ([#2795](j178/prek#2795))
- Share Lua runtime probes across hook environments ([#2796](j178/prek#2796))
- Share Ruby version queries across hook environments ([#2794](j178/prek#2794))
- Share mise version queries across hook environments ([#2798](j178/prek#2798))
- Skip site initialization in Python interpreter probes ([#2822](j178/prek#2822))
- Skip untracked files in destroyed symlink checks ([#2799](j178/prek#2799))
- Skip unused file input for always-run hooks ([#2813](j178/prek#2813))

### Bug fixe… (truncated)

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers` ([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit` ([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds ([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches ([#2907](j178/prek#2907))
- Resolve hook commands before batching ([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json` ([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update` ([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options ([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5 ([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds ([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
| [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256) |
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup ([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks ([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
| [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256) |
| [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256) |
| [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256) |
| [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `prek`

Command: `mise upgrade --bump --local prek`

<details>
<summary>Version changelog (prek)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `prek` | `0.5.4` → `0.5.7` | `0.5.4` → `0.5.7` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>prek: `0.5.4` → `0.5.7` (j178/prek)</summary>

### v0.5.5

## Release Notes

Released on 2026-10-05.

### Enhancements

- Add Nushell completion generation
([#2785](j178/prek#2785))
- Add `ppc64le` wheel and binary builds
([#2809](j178/prek#2809))

### Performance

- Avoid JSON imports when querying Python interpreters
([#2790](j178/prek#2790))
- Avoid duplicate diffs after hooks rewrite files
([#2815](j178/prek#2815))
- Batch file reads in shebang checks
([#2793](j178/prek#2793))
- Check cached hook environments concurrently
([#2797](j178/prek#2797))
- Overlap Git discovery with worktree status checks
([#2821](j178/prek#2821))
- Query staged additions only for case conflicts
([#2802](j178/prek#2802))
- Reduce worker overhead in XML and pygrep checks
([#2789](j178/prek#2789))
- Reuse Git worktree state during hook startup
([#2787](j178/prek#2787))
- Reuse intent-to-add paths when saving unstaged changes
([#2788](j178/prek#2788))
- Run Git queries concurrently for case-conflict checks
([#2792](j178/prek#2792))
- Share Bun and Deno version queries across environments
([#2795](j178/prek#2795))
- Share Lua runtime probes across hook environments
([#2796](j178/prek#2796))
- Share Ruby version queries across hook environments
([#2794](j178/prek#2794))
- Share mise version queries across hook environments
([#2798](j178/prek#2798))
- Skip site initialization in Python interpreter probes
([#2822](j178/prek#2822))
- Skip untracked files in destroyed symlink checks
([#2799](j178/prek#2799))
- Skip unused file input for always-run hooks
([#2813](j178/prek#2813))

### Bug fixe… (truncated)

### v0.5.6

## Release Notes

Released on 2026-10-19.

### Enhancements

- Add builtin hook `check-commit-trailers`
([#2885](j178/prek#2885))
- Add builtin hook `check-signed-commit`
([#2725](j178/prek#2725))

### Performance

- Enable PGO for native release builds
([#2890](j178/prek#2890))
- Reduce hook process launches with balanced batches
([#2907](j178/prek#2907))
- Resolve hook commands before batching
([#2840](j178/prek#2840))

### Bug fixes

- Accept UTF-8 BOM in `check-json`
([#2879](j178/prek#2879))
- Preserve unquoted dotted revisions in `prek update`
([#2853](j178/prek#2853))

### Documentation

- Document standalone installer options
([#2859](j178/prek#2859))
- Update benchmarks for prek 0.5.5
([#2786](j178/prek#2786))

### Other changes

- Enable ICF for release builds
([#2891](j178/prek#2891))
- Update uv to 0.13.0 ([#2856](j178/prek#2856))

### Contributors

- @​ebuildy
- @​j178
- @​shaanmajid

## Install prek 0.5.6

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.6

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.6/prek-aarch64-apple-darwin.tar.gz.sha256)
|
| [prek-… (truncated)

### v0.5.7

## Release Notes

Released on 2026-10-21.

### Enhancements

- Support system Rust toolchains without rustup
([#2887](j178/prek#2887))

### Performance

- Use blocking file checks for CPU-heavy builtin hooks
([#2910](j178/prek#2910))

### Other changes

- Update CA root crates and uv for the eMudhra intermediate CA
compromise ([#2919](j178/prek#2919))

### Contributors

- @​shaanmajid
- @​j178

## Install prek 0.5.7

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.7

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-pc-windows-msvc.zip)
| x64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.7/prek-x86_64-…
(truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants