Skip to content

typosquat-uses: support pre-commit inputs - #2437

Merged
woodruffw merged 4 commits into
mainfrom
ww/pc-typosquat-uses
Oct 13, 2026
Merged

typosquat-uses: support pre-commit inputs#2437
woodruffw merged 4 commits into
mainfrom
ww/pc-typosquat-uses

Conversation

@woodruffw

@woodruffw woodruffw commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Seeded this from https://pre-commit.com/hooks.html, plus some others I thought would be important. That's not really a sustainable approach over time, though.

See #2256

@woodruffw woodruffw added the enhancement New feature or request label Oct 9, 2026
@woodruffw woodruffw mentioned this pull request Oct 9, 2026
Open
4 of 13 tasks
@woodruffw woodruffw added this to the 1.31.0 milestone Oct 13, 2026
@woodruffw
woodruffw merged commit 1779f43 into main Oct 13, 2026
15 checks passed
@woodruffw
woodruffw deleted the ww/pc-typosquat-uses branch October 13, 2026 03:08
@BrewTestBot BrewTestBot mentioned this pull request Oct 15, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Oct 19, 2026
Closed
This was referenced Oct 19, 2026
Merged
Merged
Merged
Merged
Merged
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
46b550e 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade zizmor (#314)
c2e3c61 
Automated mise tool upgrades from local config.

mise-managed tools:
- `zizmor`

Command: `mise upgrade --bump --local zizmor`

<details>
<summary>Version changelog (zizmor)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#122)
ca5799b 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator aube
editorconfig-checker ghalint jactionlint pinact pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
e40e5ea 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade zizmor
8b785c8 
Automated mise tool upgrades from local config.

mise-managed tools:
- `zizmor`

Command: `mise upgrade --bump --local zizmor`

<details>
<summary>Version changelog (zizmor)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#125)
c7f5ef8 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade zizmor (#142)
39c334a 
Automated mise tool upgrades from local config.

mise-managed tools:
- `zizmor`

Command: `mise upgrade --bump --local zizmor`

<details>
<summary>Version changelog (zizmor)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
@github-actions @jylenhof
chore(mise): upgrade local tools
bfa98e4 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the `default` or `correctness` profile, so a run that was clean on 2.1.0 can show new findings. See **Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without shellcheck, JavaScript syntax errors in `actions/github-script`, job permissions too narrow for the actions in the job, `gh` without a token, `ubuntu-slim` limits, `github.event` property typos, and validation of GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`, `template-injection` and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in `bash`/`sh` `run:` scripts, such as an unclosed quote or a missing `fi`/`done`, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose explicit `permissions:` miss a scope that one of its actions needs (`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git push` and others, about 26 entries). `missing-permissions --fix` now uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
  Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
  reduces repeated work. Speedups compare median elapsed times from 31 paired
  runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
  default threads, warm filesystem cache, and `--no-config --no-cache --silent`
  (`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs Material).
  Output includes the correctness fixes listed below and can differ from 0.2.79.
- Code block tools are supported and remain opt-in. Missing tags, missing
  active-mode tools and invocations with no tools checked are ignored by default.
  An omitted unknown-tag policy inherits `on-missing-language-definition`,
  preserving existing strict configurations. Valid internal cached checks count
  as checked; applicable external tools rerun to reflect changes in their own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary preferences can
  opt into nearest-first project lookup bounded by repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer provides
  automatic fixes, including editor fixes. Repair the reported emphasis manually;
  inserting escapes or removing whitespace can change literal Markdown meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the complete
  selected file batch before applying any writes, with atomic replacement per
  file after successful planning.
- Configurable coverage policies with block diagnostics and invocation-wide
  fail-fast behavior. Invalid tool definitions receive central configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010 in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in tombi-toml/tombi#2294

**Full Changelog**: tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by @​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010 in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root schema by @​ya7010 in tombi-toml/tombi#2298

**Full Changelog**: tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in tombi-toml/tombi#2299

**Full Changelog**: tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by @​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by @​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by @​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied destinations by @​ya7010 in tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in tombi-toml/tombi#2306

**Full Changelog**: tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by @​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010 in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in tombi-toml/tombi#2316

**Full Changelog**: tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in tombi-toml/tombi#2323

**Full Changelog**: tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip install --strict`, consistent with resolution ([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors ([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1 ([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when `tool-install-locks` is enabled ([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel filenames with `wheel-variants` ([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size ([#22429](astral-sh/uv#22429), [#22430](astral-sh/uv#22430), [#22432](astral-sh/uv#22432))
- Speed up Simple API parsing ([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead ([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated files beside their storage directories ([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or full-length tar user or group names ([#22516](astral-sh/uv#22516), [#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv export` output destinations ([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul… (truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#2437](zizmorcore/zizmor#2437))

- The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#2350](zizmorcore/zizmor#2350))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue_comment trigger fundamentally dangerous ([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger ([#2397](zizmorcore/zizmor#2397))

- The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#2395](zizmorcore/zizmor#2395))

    Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in [1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore comments/configurations would no longer apply to the [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Oct 24, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#90)
2a3c84b 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.1.0` → `2.2.0` | `2.1.0` → `2.2.0` |
| `rumdl` | `0.2.79` → `0.3.0` | `0.2.79` → `0.3.0` |
| `tombi` | `1.8.1` → `1.8.7` | `1.8.1` → `1.8.7` |
| `uv` | `0.13.0` → `0.13.1` | `0.13.0` → `0.13.1` |
| `zizmor` | `1.30.1` → `1.31.1` | `1.30.1` → `1.31.1` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>jactionlint: `2.1.0` → `2.2.0` (jdx/jactionlint)</summary>

### v2.2.0

jactionlint 2.2.0 adds about thirty new rules and extends many existing
ones, mostly for script injection, token permissions, pinning and runner
limits. It also adds CLI modes for pull request checks
(`--changed-since`), rule discovery (`--list-rules`, `--explain`, shell
completions), fact export and timeout suggestions, and publishes wheels
to PyPI. Several new rules are in the `default` or `correctness`
profile, so a run that was clean on 2.1.0 can show new findings. See
**Changed** before you upgrade.

## Highlights

- **More checks before a run fails:** shell syntax errors without
shellcheck, JavaScript syntax errors in `actions/github-script`, job
permissions too narrow for the actions in the job, `gh` without a token,
`ubuntu-slim` limits, `github.event` property typos, and validation of
GitHub's Actions lock file.
- **Deeper security analysis:** `untrusted-checkout`, `cache-poisoning`,
`template-injection` and the secret rules follow more code paths. New
pedantic and online rules cover command and argument injection,
repojacking, release age, unpinned action dependencies and environments
without required reviewers.
- **Better for CI and tooling:** report only findings on changed lines,
select single rules, export the repository model as JSON, get JSON
Schemas for config and output, and install with `pip`/`uvx`.

## Added

### New rules in the `default` and `correctness` profiles

- **`shell-syntax`** (default, error): reports syntax errors in
`bash`/`sh` `run:` scripts, such as an unclosed quote or a missing
`fi`/`done`, using a built-in parser. It runs only when shellcheck does
not run, so the two never report the same error. (#273, @​jdx)
- **`insufficient-permissions`** (default, error): reports a job whose
explicit `permissions:` miss a scope that one of its actions needs
(`upload-sarif`, `deploy-pages`, OIDC logins, `gh release create`, `git
push` and others, about 26 entries). `missing-permissions --fix` now
uses the same table to write job… (truncated)

</details>
<details>
<summary>rumdl: `0.2.79` → `0.3.0` (rvben/rumdl)</summary>

### v0.3.0

### Changed

- **2.4–4.7× faster `rumdl fmt`** than 0.2.79 on frozen documentation
  snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31
paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release
builds,
default threads, warm filesystem cache, and `--no-config --no-cache
--silent`
(`--flavor=standard` for Cargo/Ruff, `--flavor=mkdocs` for MkDocs
Material).
Output includes the correctness fixes listed below and can differ from
0.2.79.
- Code block tools are supported and remain opt-in. Missing tags,
missing
active-mode tools and invocations with no tools checked are ignored by
default.
An omitted unknown-tag policy inherits `on-missing-language-definition`,
preserving existing strict configurations. Valid internal cached checks
count
as checked; applicable external tools rerun to reflect changes in their
own
  configuration and environment.
- `on-missing-language-definition = "warn"` now reports uncovered
languages;
  previous releases treated it as `ignore`.
- Executable lookup remains system-only by default. Per-binary
preferences can
opt into nearest-first project lookup bounded by
repository/configuration
  boundaries, including hoisted workspace installations.
- MD037 still reports spaces inside emphasis delimiters but no longer
provides
automatic fixes, including editor fixes. Repair the reported emphasis
manually;
inserting escapes or removing whitespace can change literal Markdown
meaning.

### Added

- `fmt --preflight` and `check --fix --preflight` validate and plan the
complete
selected file batch before applying any writes, with atomic replacement
per
  file after successful planning.
- Configurable coverage policies with block diagnostics and
invocation-wide
fail-fast behavior. Invalid tool definitions receive central
configuration
  warnin… (truncated)

</details>
<details>
<summary>tombi: `1.8.1` → `1.8.7` (tombi-toml/tombi)</summary>

### v1.8.2

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.2 -->

## What's Changed
### 🛠️ Other Changes
* chore(deps): format Cargo.toml by @​ya7010 in
tombi-toml/tombi#2291
* fix(schema-store): allow documents to share a schema $id by @​ya7010
in tombi-toml/tombi#2293
* refactor(schema-store): remove the ast-syntax feature by @​ya7010 in
tombi-toml/tombi#2294


**Full Changelog**:
tombi-toml/tombi@v1.8.1...v1.8.2

### v1.8.3

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.3 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): skip file watcher events inside VCS metadata directories by
@​ya7010 in tombi-toml/tombi#2296
* refactor(lsp): migrate from tower-lsp to tower-lsp-server by @​ya7010
in tombi-toml/tombi#2297
* fix(validator): apply sub-schemas under keys rejected by the root
schema by @​ya7010 in tombi-toml/tombi#2298


**Full Changelog**:
tombi-toml/tombi@v1.8.2...v1.8.3

### v1.8.4

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(config): order schema catalog before format by @​ya7010 in
tombi-toml/tombi#2299


**Full Changelog**:
tombi-toml/tombi@v1.8.3...v1.8.4

### v1.8.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.5 -->

## What's Changed
### 🛠️ Other Changes
* update: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2302
* chore: tombi.toml sample by @​ya7010 in
tombi-toml/tombi#2303
* docs: embed configuration Full Structure from a checked TOML file by
@​ya7010 in tombi-toml/tombi#2304
* fix(schema-store): honor environment proxies for schema fetches by
@​cailloumajor in tombi-toml/tombi#2306
* fix(schema-store): refuse schema URLs targeting the proxy host by
@​ya7010 in tombi-toml/tombi#2308
* test(schema-store): cover local resolution check for proxied
destinations by @​ya7010 in
tombi-toml/tombi#2307
* feat(schema-store): honor operating-system proxy settings for schema
fetches by @​ya7010 in tombi-toml/tombi#2309

## New Contributors
* @​cailloumajor made their first contribution in
tombi-toml/tombi#2306

**Full Changelog**:
tombi-toml/tombi@v1.8.4...v1.8.5

### v1.8.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.6 -->

## What's Changed
### 🐝 Bug Fixes
* fix(docs): resolve embedded snippet during Pages build by @​ya7010 in
tombi-toml/tombi#2310
### 📦 Dependencies
* fix(deps): update quinn-proto and rustls for OSV advisories by
@​ya7010 in tombi-toml/tombi#2311
* fix(deps): update zip to 9.0.4 by @​ya7010 in
tombi-toml/tombi#2317
### 🛠️ Other Changes
* refactor(lsp): collect folding spans in one AST traversal by @​ya7010
in tombi-toml/tombi#2312
* refactor: reuse AST groups during formatting and hover by @​ya7010 in
tombi-toml/tombi#2313
* refactor(formatter): reuse root leading comments by @​ya7010 in
tombi-toml/tombi#2314
* feat(lsp): highlight TOML region markers by @​ya7010 in
tombi-toml/tombi#2316


**Full Changelog**:
tombi-toml/tombi@v1.8.5...v1.8.6

### v1.8.7

<!-- Release notes generated using configuration in .github/release.yml
at v1.8.7 -->

## What's Changed
### 🦅 New Features
* Add --cache-ttl CLI option by @​ya7010 in
tombi-toml/tombi#2320
* feat(cache): add `tombi cache clean/dir` commands by @​ya7010 in
tombi-toml/tombi#2321
### 🐝 Bug Fixes
* fix(direnv): skip flake when nix is unavailable by @​ya7010 in
tombi-toml/tombi#2323


**Full Changelog**:
tombi-toml/tombi@v1.8.6...v1.8.7

</details>
<details>
<summary>uv: `0.13.0` → `0.13.1` (astral-sh/uv)</summary>

### 0.13.1

## Release Notes

Released on 2026-10-14.

### Enhancements

- Ignore `Requires-Python` upper bounds in `uv pip check` and `uv pip
install --strict`, consistent with resolution
([#22500](astral-sh/uv#22500))
- Support Linux SPARC by falling back when filesystem cloning and
detailed cache accounting are unavailable
([#22463](astral-sh/uv#22463))
- Report missing trusted hashes in resolution errors
([#22241](astral-sh/uv#22241))

### Python

- Add CPython 3.16.0a1
([#22527](astral-sh/uv#22527))

### Preview features

- Allow `uv tool upgrade` to upgrade installed tools when
`tool-install-locks` is enabled
([#22498](astral-sh/uv#22498))
- Add preliminary support for parsing PEP 825 variant labels in wheel
filenames with `wheel-variants`
([#22039](astral-sh/uv#22039))

### Performance

- Reduce uv's binary size
([#22429](astral-sh/uv#22429),
[#22430](astral-sh/uv#22430),
[#22432](astral-sh/uv#22432))
- Speed up Simple API parsing
([#22429](astral-sh/uv#22429))
- Reduce package metadata parsing overhead
([#22239](astral-sh/uv#22239))

### Bug fixes

- Prevent tool and managed Python uninstalls from deleting unrelated
files beside their storage directories
([#22495](astral-sh/uv#22495))
- Restore support for source distributions containing hard links or
full-length tar user or group names
([#22516](astral-sh/uv#22516),
[#22522](astral-sh/uv#22522))
- Preserve device files and FIFOs used as `uv pip compile` or `uv
export` output destinations
([#22496](astral-sh/uv#22496))
- Fix `sys._base_executable` detection for environments created from
symlinked interpreters ([#22520](https://github.com/astral-sh/uv/pul…
(truncated)

</details>
<details>
<summary>zizmor: `1.30.1` → `1.31.1` (zizmorcore/zizmor)</summary>

### v1.31.0

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses)
audit now supports pre-commit config inputs
([#2437](zizmorcore/zizmor#2437))

- The
[self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner)
audit is now significantly more precise
([#2350](zizmorcore/zizmor#2350))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now considers the issue_comment trigger fundamentally dangerous
([#2396](zizmorcore/zizmor#2396))

- zizmor is now aware of the image_version workflow trigger
([#2397](zizmorcore/zizmor#2397))

- The
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit now produces more precise finding/diagnostic spans
([#2402](zizmorcore/zizmor#2402))

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of [pnpm/setup](https://github.com/pnpm/setup)
([#2409](zizmorcore/zizmor#2409))

- The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images)
audit now produces more precise findings when the user's workflow
contains an indirect matrix
([#2395](zizmorcore/zizmor#2395))

Many thanks to [@​ubiratansoares](https://github.com/ubiratansoares) for
proposing and implementing this enhancement!

- The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning)
audit is now aware of GitHub's new cache-mode: setting, and will skip
any findings that would occur when a job has an effective cache-mode:
none ([#2418](https://github.com/zizmorcore/zizmor/iss… (truncated)

### v1.31.1

[Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/)

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a regression in
[1.31.0](https://docs.zizmor.sh/release-notes/#1310) where some ignore
comments/configurations would no longer apply to the
[dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers)
audit ([#2450](zizmorcore/zizmor#2450))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

enhancement New feature or request

Projects

None yet

Milestone

1.31.0

Development

Successfully merging this pull request may close these issues.

1 participant

@woodruffw