Skip to content

Migrate lockfile serialization to toml_writer - #20450

Merged
charliermarsh merged 2 commits into
mainfrom
charlie/toml-writer-lockfile
Jul 17, 2026
Merged

Migrate lockfile serialization to toml_writer#20450
charliermarsh merged 2 commits into
mainfrom
charlie/toml-writer-lockfile

Conversation

@charliermarsh

@charliermarsh charliermarsh commented Jul 15, 2026

Copy link
Copy Markdown
Member

Summary

Migrate native uv.lock serialization from building a toml_edit document to writing TOML directly with toml_writer.

The output format remains unchanged, including inline tables, multiline arrays, marker simplification, conflict metadata, relative exclude-newer compatibility fields, and package and dependency metadata. The separate pylock.toml export continues to use toml_edit.

This avoids constructing a full editable TOML AST when serializing lockfiles:

Workload Serialization uv lock wall CPU
transformers 15.34 → 6.15 ms (−60%) −2.4% −1.5%
home-assistant 2.59 → 0.80 ms (−69%) −3.9% −5.5%
warehouse 6.49 → 1.98 ms (−70%) −1.5% −1.6%
jupyterlab 1.97 → 0.56 ms (−72%) −2.6% −1.5%
semantic-kernel 1.79 → 0.51 ms (−71%) −1.2% −1.4%

Note that the changes here are largely moving code out of lock/mod.rs and into serialize.rs, with alterations to leverage toml_writer.

@charliermarsh
charliermarsh force-pushed the charlie/toml-writer-lockfile branch from 61a197c to 1070ed6 Compare July 15, 2026 22:28
@charliermarsh
charliermarsh requested review from epage and zanieb July 15, 2026 22:29
@charliermarsh
charliermarsh marked this pull request as ready for review July 15, 2026 22:29
@charliermarsh charliermarsh changed the title Migrate lockfile serialization to toml_writer Migrate lockfile serialization to toml_writer Jul 15, 2026
@astral-sh-bot

astral-sh-bot Bot commented Jul 15, 2026

Copy link
Copy Markdown

uv test inventory changes

This PR changes the tests when compared with the latest main baseline.

  • Added tests: 1
  • Removed tests: 0
  • Changed suites: 1
uv-resolver: +1 / -0

Added:

  • uv-resolver::lock::serialize::tests::string_encoding_matches_toml_edit

Removed: none

@charliermarsh
charliermarsh requested review from konstin and removed request for zanieb July 16, 2026 01:28
@konstin
konstin removed their request for review July 16, 2026 08:36
charliermarsh added a commit that referenced this pull request Jul 16, 2026
## Summary

This avoids recomputing the same fork marker for every resolved node
while recording preferences, skips the identity case in
`UniversalMarker::imbibe`, and removes two redundant PEP 508 projections
that are already performed by the underlying conflict helpers.

## Performance

Measured with profiling binaries, a warm local cache, `--offline`,
pinned CPUs (8-15), fixed `UV_EXCLUDE_NEWER`, alternating base/head
order, 10 warmups, and 60 paired runs. The baseline is current `main`
(including the just-merged Python-requirement marker cache, #20461) plus
the in-review TOML writer (#20450). Every pair produced identical
lockfile hashes.

| Workload | Wall before → after | Wall Δ | CPU before → after | CPU Δ |
|---|---:|---:|---:|---:|
| Transformers | 308.5 → 301.1 ms | -2.4% | 343.3 → 336.0 ms | -2.1% |
| Home Assistant | 121.5 → 120.9 ms | -0.5% | 82.2 → 81.4 ms | -1.0% |
| Warehouse | 167.4 → 168.2 ms | +0.5% | 176.5 → 175.7 ms | -0.5% |
| JupyterLab | 112.5 → 112.3 ms | -0.1% | 57.3 → 56.9 ms | -0.6% |
| Semantic Kernel | 120.8 → 119.4 ms | -1.1% | 70.0 → 70.2 ms | +0.2% |

Transformers is the clear win: block-aware paired analysis was **-2.23%
wall** (95% CI -4.17 to -0.26) and **-2.37% CPU** (95% CI -3.46 to
-1.22).

The focused resolver suite passes (63 tests), including the added
`imbibe(TRUE)` regression test; formatting and diff checks are clean.

Co-authored-by: Charlie Marsh <charliemarsh@openai.com>
charliermarsh added a commit that referenced this pull request Jul 16, 2026
## Summary

Large cached Simple API responses spend significant time
validating/decoding their archived payload on the async runtime. This
moves both fresh-cache and revalidated-cache payload decoding onto the
existing bounded cache-read runtime, keeping that CPU-heavy work off
resolver workers.

This is intentionally a wall-time/CPU tradeoff: task handoff and overlap
increase aggregate CPU, while larger lock workloads complete sooner.

## Performance

Measured with profiling binaries, a warm local cache, `--offline`,
pinned CPUs (8-15), fixed `UV_EXCLUDE_NEWER`, alternating base/head
order, 10 warmups, and 60 paired runs. This is incremental on current
`main` (including #20461) plus #20450 and the marker fastpaths. Every
pair produced identical lockfile hashes.

| Workload | Wall before → after | Wall Δ | CPU before → after | CPU Δ |
|---|---:|---:|---:|---:|
| Transformers | 309.1 → 300.8 ms | -2.7% | 335.9 → 353.8 ms | +5.4% |
| Home Assistant | 121.2 → 116.5 ms | -3.8% | 81.6 → 84.9 ms | +4.2% |
| Warehouse | 167.3 → 155.3 ms | -7.2% | 174.2 → 183.7 ms | +5.5% |
| JupyterLab | 111.1 → 112.0 ms | +0.8% | 57.2 → 60.0 ms | +5.0% |
| Semantic Kernel | 118.9 → 117.7 ms | -1.0% | 69.2 → 72.1 ms | +4.3% |

Across workloads, block-aware paired analysis shows **-3.92% wall** (95%
CI -5.67 to -2.15) and **+4.97% CPU** (95% CI +4.49 to +5.45). Warehouse
benefits most; small workloads are effectively neutral in wall time.

All 83 `uv-client` unit tests pass, and formatting, diff, and all-target
compile checks are clean.

Co-authored-by: Charlie Marsh <charliemarsh@openai.com>
@epage

epage commented Jul 16, 2026

Copy link
Copy Markdown

@epage

epage commented Jul 16, 2026

Copy link
Copy Markdown

Personally, I would have written this with as little "raw" writes as possible but that is a personal choice as we have tests to verify that what we generate is valid TOML and the raw writes do not include non-sanitized end-user values.

Comment on lines +525 to +533
let count = dist_count_by_name.get(&dependency.package_id.name).copied();
writer.inline_string(&mut first, "name", dependency.package_id.name.as_ref())?;
if count.is_none_or(|count| count > 1) {
if let Some(version) = &dependency.package_id.version {
writer.inline_string(&mut first, "version", &version.to_string())?;
}
writer.inline_key(&mut first, "source")?;
write_source_inline(writer, &dependency.package_id.source)?;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it work to still call write_package_id here so we can keep this knowledge centralized?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes!

Comment on lines +295 to +306
if let Some(source_dist) = &package.sdist {
writer.key_start("sdist")?;
write_source_dist_inline(writer, source_dist)?;
writer.raw("\n");
}

if !package.wheels.is_empty() {
writer.multiline_array("wheels", &package.wheels, write_wheel_inline)?;
}

if package
.optional_dependencies

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Self-note: some of the logic was re-arranged. It appears it was done to due to the constraints that we need to finish writing one standard table before we start on the next.

Comment on lines +556 to +572
/// Writes a Serde-backed array, omitting the key when the array is empty.
fn write_serialized_array<T: Serialize>(
writer: &mut LockWriter,
key: &str,
values: &BTreeSet<T>,
) -> Result<(), WriteError> {
if values.is_empty() {
return Ok(());
}
write_serialized_array_including_empty(writer, key, values)
}

/// Writes a Serde-backed array using the canonical layout for its cardinality.
///
/// Empty and single-element arrays stay on one line, while larger arrays place each element on
/// its own line. Unlike [`write_serialized_array`], this retains empty dependency groups.
fn write_serialized_array_including_empty<T: Serialize>(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I would name the first write_serialized_non_empty_array and the second write_serialized_array. Without knowing the particulars of the implementation, the current naming means I assume that is always writes which could lead to surprising results and having to do extra cycles between coding and tests

Comment on lines +770 to +789
fn inline_value(
&mut self,
first: &mut bool,
key: &str,
value: impl WriteTomlValue,
) -> Result<(), WriteError> {
self.inline_key(first, key)?;
self.output.value(value)?;
Ok(())
}

fn inline_string(
&mut self,
first: &mut bool,
key: &str,
value: &str,
) -> Result<(), WriteError> {
self.inline_key(first, key)?;
self.string(value)
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason you don't just use inline_value for strings?

Comment on lines +760 to +767
fn inline_key(&mut self, first: &mut bool, key: &str) -> Result<(), WriteError> {
if *first {
self.raw(" ");
*first = false;
} else {
self.raw(", ");
}
self.key_start(key)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is an inline version of key_start, should this be named inline_key_start` to clarify that?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, thank you.

Ok(())
}

fn inline_array<I, T, F>(&mut self, values: I, mut write_value: F) -> Result<(), WriteError>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your other inline_ prefixed functions are for when it is inside an inline table. Seems like inline_ should be dropped here to make that more consistent

Comment on lines +713 to +732
fn multiline_array_values<I, T, F>(
&mut self,
values: I,
mut write_value: F,
) -> Result<(), WriteError>
where
I: IntoIterator<Item = T>,
F: FnMut(&mut Self, T) -> Result<(), WriteError>,
{
self.raw("[\n");
for value in values {
self.raw(" ");
write_value(self, value)?;
self.raw(",\n");
}
self.raw("]\n");
Ok(())
}

fn inline_array<I, T, F>(&mut self, values: I, mut write_value: F) -> Result<(), WriteError>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One includes _values while the other different but both seem to be about the same purpose with just one being mult-line. Maybe another area for improving consistency?

Comment on lines +648 to +660
fn key_value(&mut self, key: &str, value: impl WriteTomlValue) -> Result<(), WriteError> {
self.key_start(key)?;
self.output.value(value)?;
self.raw("\n");
Ok(())
}

fn key_value_string(&mut self, key: &str, value: &str) -> Result<(), WriteError> {
self.key_start(key)?;
self.string(value)?;
self.raw("\n");
Ok(())
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need both?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No! Thanks.

Comment on lines +637 to +640
fn string(&mut self, value: &str) -> Result<(), WriteError> {
self.output.value(value)?;
Ok(())
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we generalize as a fn value?

Comment on lines +592 to +593
/// Converts values without native `toml_writer` support through Serde's TOML value serializer.
fn serialize_value<T: Serialize + ?Sized>(value: &T) -> Result<Value, WriteError> {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you turn this into a wrapper type that impls toml_writer::WriteTomlValue, then it will compose with the rest of the LockWriter, requiring fewer raw calls.

Comment on lines +618 to +620
/// Emits TOML while retaining the established whitespace and inline-table layout of `uv.lock`.
#[derive(Default)]
struct LockWriter {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Side note: I wouldn't be surprised if we find this helpful elsewhere and eventually generalize it. As for going beyond astral, iirc I was being fairly strict about the scope of toml_writer and unsure where else it would go (oh joy, another crate?).

@epage epage left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Functionality looks correct. I have some style suggestions for improving the readability of the code.

@charliermarsh
charliermarsh force-pushed the charlie/toml-writer-lockfile branch from 1070ed6 to a700452 Compare July 16, 2026 23:52
@charliermarsh
charliermarsh enabled auto-merge (squash) July 16, 2026 23:54
@charliermarsh
charliermarsh merged commit 39917c2 into main Jul 17, 2026
84 checks passed
@charliermarsh
charliermarsh deleted the charlie/toml-writer-lockfile branch July 17, 2026 00:02
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Jul 20, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.11.29` → `0.11.30` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.11.30`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01130)

Released on 2026-07-20.

##### Python

- Add CPython 3.15.0b4 ([#&#8203;20519](astral-sh/uv#20519))

##### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#&#8203;20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#&#8203;20436](astral-sh/uv#20436))

##### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#&#8203;20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#&#8203;20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#&#8203;20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#&#8203;20463](astral-sh/uv#20463), [#&#8203;20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#&#8203;20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#&#8203;20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#&#8203;20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#&#8203;20462](astral-sh/uv#20462))

##### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#&#8203;20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#&#8203;20466](astral-sh/uv#20466))

##### Documentation

- Add a contribution guide ([#&#8203;20511](astral-sh/uv#20511), [#&#8203;20552](astral-sh/uv#20552))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/16

Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jul 21, 2026
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [uv](https://github.com/astral-sh/uv) | patch | `0.11.29` → `0.11.30` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.11.30`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01130)

[Compare Source](astral-sh/uv@0.11.29...0.11.30)

Released on 2026-07-20.

##### Python

- Add CPython 3.15.0b4 ([#&#8203;20519](astral-sh/uv#20519))

##### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#&#8203;20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#&#8203;20436](astral-sh/uv#20436))

##### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#&#8203;20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#&#8203;20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#&#8203;20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#&#8203;20463](astral-sh/uv#20463), [#&#8203;20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#&#8203;20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#&#8203;20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#&#8203;20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#&#8203;20462](astral-sh/uv#20462))

##### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#&#8203;20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#&#8203;20466](astral-sh/uv#20466))

##### Documentation

- Add a contribution guide ([#&#8203;20511](astral-sh/uv#20511), [#&#8203;20552](astral-sh/uv#20552))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6cGF0Y2giXX0=-->
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `prek` | `0.4.10` → `0.4.11` | `0.4.10` → `0.4.11` |
| `rumdl` | `0.2.36` → `0.2.43` | `0.2.36` → `0.2.43` |
| `tombi` | `1.2.3` → `1.2.4` | `1.2.3` → `1.2.4` |
| `uv` | `latest` → `latest` | `0.11.29` → `0.11.32` |
| `zizmor` | `latest` → `latest` | `1.27.0` → `1.28.0` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>prek: `0.4.10` → `0.4.11` (j178/prek)</summary>

### v0.4.11

## Release Notes

Released on 2026-07-25.

### Highlights

- This release adds two new builtin hooks, `deny-pattern` and `require-pattern`,
  as native alternatives for `pygrep` use cases. `deny-pattern` fails when a
  configured pattern is found, while `require-pattern` ensures every selected
  file contains a match. By matching natively without spawning a Python
  subprocess, they run over 4x faster than `pygrep` in benchmarks. Note that
  they use [Rust `regex` syntax](https://docs.rs/regex/latest/regex/#syntax), which does
  not support look-around features such as negative lookbehind.

- `prek run` now supports `--glob <PATTERN>` to run hooks on tracked files
  matching a glob. It can be repeated or combined with `--files` and
  `--directory`.

- Hook priorities now support reusable aliases:

    ```toml
    [priorities]
    checks = 10

    [[repos]]
    repo = "builtin"
    hooks = [
      { id = "check-json", priority = "checks" },
      { id = "check-yaml", priority = "checks" },
    ]
    ```

    This makes parallel scheduling easier to read and maintain.

### Enhancements

- Add `deny-pattern` and `require-pattern` builtin hooks ([#2359](j178/prek#2359))
- Support `--glob` patterns in `prek run` ([#2381](j178/prek#2381))
- Support reusable aliases for hook priorities ([#2331](j178/prek#2331))
- Implement `requirements-txt-fixer` as a builtin hook ([#2390](j178/prek#2390))
- Improve user-facing warnings and errors ([#2380](j178/prek#2380))
- Install Node hooks through git url ([#2394](j178/prek#2394))

### Performance

- Reduce blocking-pool overhead in file hooks ([#2384](j178/prek#2384))
- Speed up mixed-line-ending scans with memchr2 ([#2391](j178/prek#2391))

### Bug fixes

- Honor filenames in builti… (truncated)

</details>
<details>
<summary>rumdl: `0.2.36` → `0.2.43` (rvben/rumdl)</summary>

### v0.2.37

### Added

- **reflow**: add atomic_spans configuration and refactor inline wrapping (#742) ([aeabec1](rvben/rumdl@aeabec1))

### Changed

- **BREAKING**: the MD013 `emphasis-spans` option is renamed to `atomic-spans` (default `true`), with inverted meaning (`emphasis-spans = true` is now `atomic-spans = false`). Configs setting the old key should migrate; it is no longer recognized

### Fixed

- **reflow**: keep code spans atomic when wrapping would collapse whitespace ([d43618b](rvben/rumdl@d43618b))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.37-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/rel… (truncated)

### v0.2.38

### Added

- **md044**: add ignore-frontmatter-fields option ([b664e5a](rvben/rumdl@b664e5a))
- **config**: warn when an inline enable cannot re-enable a config-disabled rule ([a74a923](rvben/rumdl@a74a923))

### Fixed

- **md044**: stop flagging proper names inside frontmatter file paths ([35649d9](rvben/rumdl@35649d9))
- **md022**: stop panicking when one blank-line requirement is unlimited ([8a25eb2](rvben/rumdl@8a25eb2))
- **config**: report unknown option keys in inline configure-file comments ([8f4c0ea](rvben/rumdl@8f4c0ea))
- **config**: apply markdownlint-configure-file when the comment spans lines ([7a023a5](rvben/rumdl@7a023a5))
- **config**: honor booleans and alias keys in markdownlint-configure-file (#745) ([acefc19](rvben/rumdl@acefc19))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.38-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-aarch64-unkn… (truncated)

### v0.2.39

### Added

- **config**: expand ~ to the home directory in path settings ([70f91aa](rvben/rumdl@70f91aa))

### Fixed

- **md013**: wrap over-long emphasis spans that contain nested markup ([ddc73f4](rvben/rumdl@ddc73f4))
- **discovery**: strip Windows verbatim prefix from canonicalized paths ([a85ab87](rvben/rumdl@a85ab87))
- **discovery**: apply absolute exclude patterns during directory discovery ([0d20fc8](rvben/rumdl@0d20fc8))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.39-x86_64-apple-darw… (truncated)

### v0.2.40

### Fixed

- **md003**: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so `rumdl fmt` added a horizontal rule the document never had ([7363c34](rvben/rumdl@7363c34))
- **md077**: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged ([58fb25b](rvben/rumdl@58fb25b))
- **reflow**: keep wiki links, shortcodes and math whole inside a wrapped span ([db12c2c](rvben/rumdl@db12c2c))
- **config**: honor the documented MD033 `table_allowed` alias, which silently dropped the configured value ([db2c204](rvben/rumdl@db2c204))
- **config**: stop reporting MD013's documented `semantic-link-understanding` alias as an unknown option ([1539a64](rvben/rumdl@1539a64))
- **parity**: make the markdownlint comparison harness actually run ([182763c](rvben/rumdl@182763c))

### Documentation

- **md013**: document that `ignore-link-urls` affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat ([c4f8bad](rvben/rumdl@c4f8bad))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.40-x86_64-u… (truncated)

### v0.2.41

### Added

- **flavor**: add Hugo flavor and skip block attribute lists in blanks-around rules ([e6bb033](rvben/rumdl@e6bb033))

### Fixed

- **md044**: recognize indented HTML comments so links and code escape the rule ([3d6191c](rvben/rumdl@3d6191c))
- **md013**: keep an attr list whole inside a wrapped span ([e06f03d](rvben/rumdl@e06f03d))
- **md013**: keep a reference-style link whole inside a wrapped span ([de42709](rvben/rumdl@de42709))
- **md013**: wrap an over-long span whose whole content is another span ([f6c7c9c](rvben/rumdl@f6c7c9c))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz) | Linux… (truncated)

### v0.2.42

### Added

- **mojibake**: new rule MD083 for mojibake detection (#753) ([552842b](rvben/rumdl@552842b))

### Fixed

- **lint_context**: prevent panic when HTML tag window splits a UTF-8 char ([d14b252](rvben/rumdl@d14b252))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.42-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/relea… (truncated)

### v0.2.43

### Added

- **invisiblechars**: new rule MD084 for detecting invisible characters (#758) ([0a6354a](rvben/rumdl@0a6354a))

### Fixed

- **md084**: treat a zero width joiner between visible characters as presentation ([4fbb1cc](rvben/rumdl@4fbb1cc))
- **md084**: keep attached variation selectors in consecutive-character detection ([f4e9fd3](rvben/rumdl@f4e9fd3))
- **md084**: don't flag variation selectors attached to a base character ([14941bb](rvben/rumdl@14941bb))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz.sha256)… (truncated)

</details>
<details>
<summary>tombi: `1.2.3` → `1.2.4` (tombi-toml/tombi)</summary>

### v1.2.4

<!-- Release notes generated using configuration in .github/release.yml at v1.2.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(date-time): accept leap second 60 in date-time values by @​LordAizen1 in tombi-toml/tombi#2024

## New Contributors
* @​LordAizen1 made their first contribution in tombi-toml/tombi#2024

**Full Changelog**: tombi-toml/tombi@v1.2.3...v1.2.4

</details>
<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>
<details>
<summary>zizmor: `1.27.0` → `1.28.0` (zizmorcore/zizmor)</summary>

### v1.28.0

## Security 🔒[🔗](https://docs.zizmor.sh/release-notes/#security)

- v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh](GHSA-f42p-wjw5-97qh) for full information.

    Many thanks to [@​shaanmajid](https://github.com/shaanmajid) for finding and reporting this vulnerability.

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes ([#2186](zizmorcore/zizmor#2186))

- The [dependabot-cooldown](https://docs.zizmor.sh/audits/#dependabot-cooldown) audit is now aware of GitHub's new three-day default cooldown ([#2193](zizmorcore/zizmor#2193))

- sbt is now recognized as a package-ecosystem in dependabot.yml ([#2211](zizmorcore/zizmor#2211))

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a bug where the [template-injection](https://docs.zizmor.sh/audits/#template-injection) audit would incorrectly flag `steps.*.outcome` and `steps.*.conclusion` as injection risks in the default persona ([#2199](zizmorcore/zizmor#2199))

- Fixed a bug where the [github-env](https://docs.zizmor.sh/audits/#github-env) audit would incorrectly flag some printf calls as exploitable ([#2201](zizmorcore/zizmor#2201))

- Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input ([#2205](zizmorcore/zizmor#2205))

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Jul 27, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `prek` | `0.4.10` → `0.4.11` | `0.4.10` → `0.4.11` |
| `rumdl` | `0.2.36` → `0.2.43` | `0.2.36` → `0.2.43` |
| `tombi` | `1.2.3` → `1.2.4` | `1.2.3` → `1.2.4` |
| `uv` | `latest` → `latest` | `0.11.29` → `0.11.32` |
| `zizmor` | `latest` → `latest` | `1.27.0` → `1.28.0` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>prek: `0.4.10` → `0.4.11` (j178/prek)</summary>

### v0.4.11

## Release Notes

Released on 2026-07-25.

### Highlights

- This release adds two new builtin hooks, `deny-pattern` and `require-pattern`,
  as native alternatives for `pygrep` use cases. `deny-pattern` fails when a
  configured pattern is found, while `require-pattern` ensures every selected
  file contains a match. By matching natively without spawning a Python
  subprocess, they run over 4x faster than `pygrep` in benchmarks. Note that
  they use [Rust `regex` syntax](https://docs.rs/regex/latest/regex/#syntax), which does
  not support look-around features such as negative lookbehind.

- `prek run` now supports `--glob <PATTERN>` to run hooks on tracked files
  matching a glob. It can be repeated or combined with `--files` and
  `--directory`.

- Hook priorities now support reusable aliases:

    ```toml
    [priorities]
    checks = 10

    [[repos]]
    repo = "builtin"
    hooks = [
      { id = "check-json", priority = "checks" },
      { id = "check-yaml", priority = "checks" },
    ]
    ```

    This makes parallel scheduling easier to read and maintain.

### Enhancements

- Add `deny-pattern` and `require-pattern` builtin hooks ([#2359](j178/prek#2359))
- Support `--glob` patterns in `prek run` ([#2381](j178/prek#2381))
- Support reusable aliases for hook priorities ([#2331](j178/prek#2331))
- Implement `requirements-txt-fixer` as a builtin hook ([#2390](j178/prek#2390))
- Improve user-facing warnings and errors ([#2380](j178/prek#2380))
- Install Node hooks through git url ([#2394](j178/prek#2394))

### Performance

- Reduce blocking-pool overhead in file hooks ([#2384](j178/prek#2384))
- Speed up mixed-line-ending scans with memchr2 ([#2391](j178/prek#2391))

### Bug fixes

- Honor filenames in builti… (truncated)

</details>
<details>
<summary>rumdl: `0.2.36` → `0.2.43` (rvben/rumdl)</summary>

### v0.2.37

### Added

- **reflow**: add atomic_spans configuration and refactor inline wrapping (#742) ([aeabec1](rvben/rumdl@aeabec1))

### Changed

- **BREAKING**: the MD013 `emphasis-spans` option is renamed to `atomic-spans` (default `true`), with inverted meaning (`emphasis-spans = true` is now `atomic-spans = false`). Configs setting the old key should migrate; it is no longer recognized

### Fixed

- **reflow**: keep code spans atomic when wrapping would collapse whitespace ([d43618b](rvben/rumdl@d43618b))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.37-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/rel… (truncated)

### v0.2.38

### Added

- **md044**: add ignore-frontmatter-fields option ([b664e5a](rvben/rumdl@b664e5a))
- **config**: warn when an inline enable cannot re-enable a config-disabled rule ([a74a923](rvben/rumdl@a74a923))

### Fixed

- **md044**: stop flagging proper names inside frontmatter file paths ([35649d9](rvben/rumdl@35649d9))
- **md022**: stop panicking when one blank-line requirement is unlimited ([8a25eb2](rvben/rumdl@8a25eb2))
- **config**: report unknown option keys in inline configure-file comments ([8f4c0ea](rvben/rumdl@8f4c0ea))
- **config**: apply markdownlint-configure-file when the comment spans lines ([7a023a5](rvben/rumdl@7a023a5))
- **config**: honor booleans and alias keys in markdownlint-configure-file (#745) ([acefc19](rvben/rumdl@acefc19))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.38-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-aarch64-unkn… (truncated)

### v0.2.39

### Added

- **config**: expand ~ to the home directory in path settings ([70f91aa](rvben/rumdl@70f91aa))

### Fixed

- **md013**: wrap over-long emphasis spans that contain nested markup ([ddc73f4](rvben/rumdl@ddc73f4))
- **discovery**: strip Windows verbatim prefix from canonicalized paths ([a85ab87](rvben/rumdl@a85ab87))
- **discovery**: apply absolute exclude patterns during directory discovery ([0d20fc8](rvben/rumdl@0d20fc8))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.39-x86_64-apple-darw… (truncated)

### v0.2.40

### Fixed

- **md003**: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so `rumdl fmt` added a horizontal rule the document never had ([7363c34](rvben/rumdl@7363c34))
- **md077**: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged ([58fb25b](rvben/rumdl@58fb25b))
- **reflow**: keep wiki links, shortcodes and math whole inside a wrapped span ([db12c2c](rvben/rumdl@db12c2c))
- **config**: honor the documented MD033 `table_allowed` alias, which silently dropped the configured value ([db2c204](rvben/rumdl@db2c204))
- **config**: stop reporting MD013's documented `semantic-link-understanding` alias as an unknown option ([1539a64](rvben/rumdl@1539a64))
- **parity**: make the markdownlint comparison harness actually run ([182763c](rvben/rumdl@182763c))

### Documentation

- **md013**: document that `ignore-link-urls` affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat ([c4f8bad](rvben/rumdl@c4f8bad))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.40-x86_64-u… (truncated)

### v0.2.41

### Added

- **flavor**: add Hugo flavor and skip block attribute lists in blanks-around rules ([e6bb033](rvben/rumdl@e6bb033))

### Fixed

- **md044**: recognize indented HTML comments so links and code escape the rule ([3d6191c](rvben/rumdl@3d6191c))
- **md013**: keep an attr list whole inside a wrapped span ([e06f03d](rvben/rumdl@e06f03d))
- **md013**: keep a reference-style link whole inside a wrapped span ([de42709](rvben/rumdl@de42709))
- **md013**: wrap an over-long span whose whole content is another span ([f6c7c9c](rvben/rumdl@f6c7c9c))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz) | Linux… (truncated)

### v0.2.42

### Added

- **mojibake**: new rule MD083 for mojibake detection (#753) ([552842b](rvben/rumdl@552842b))

### Fixed

- **lint_context**: prevent panic when HTML tag window splits a UTF-8 char ([d14b252](rvben/rumdl@d14b252))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.42-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz.sha256) |
| [rumdl-v0.2.42-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/relea… (truncated)

### v0.2.43

### Added

- **invisiblechars**: new rule MD084 for detecting invisible characters (#758) ([0a6354a](rvben/rumdl@0a6354a))

### Fixed

- **md084**: treat a zero width joiner between visible characters as presentation ([4fbb1cc](rvben/rumdl@4fbb1cc))
- **md084**: keep attached variation selectors in consecutive-character detection ([f4e9fd3](rvben/rumdl@f4e9fd3))
- **md084**: don't flag variation selectors attached to a base character ([14941bb](rvben/rumdl@14941bb))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz.sha256)… (truncated)

</details>
<details>
<summary>tombi: `1.2.3` → `1.2.4` (tombi-toml/tombi)</summary>

### v1.2.4

<!-- Release notes generated using configuration in .github/release.yml at v1.2.4 -->

## What's Changed
### 🛠️ Other Changes
* fix(date-time): accept leap second 60 in date-time values by @​LordAizen1 in tombi-toml/tombi#2024

## New Contributors
* @​LordAizen1 made their first contribution in tombi-toml/tombi#2024

**Full Changelog**: tombi-toml/tombi@v1.2.3...v1.2.4

</details>
<details>
<summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary>

### 0.11.30

## Release Notes

Released on 2026-07-20.

### Python

- Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519))

### Preview features

- Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500))
- Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436))

### Performance

- Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460))
- Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427))
- Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450))
- Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483))
- Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486))
- Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464))
- Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461))
- Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462))

### Bug fixes

- Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429))
- Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466))

### Documentation

- Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552))

## Install uv 0.11.30

### Install prebuilt binaries via shell script

```sh
curl --proto '=htt… (truncated)

### 0.11.31

## Release Notes

Released on 2026-07-21.

### Enhancements

- Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401))
- Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022))
- Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554))

### Preview features

- Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605))

### Configuration

- Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587))

### Performance

- Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578))

### Bug fixes

- Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582))
- Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432))
- Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245))
- Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153))

## Install uv 0.11.31

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"
```

## Download uv 0.11.31

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated)

### 0.11.32

## Release Notes

Released on 2026-07-23.

### Preview features

- Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628))
- Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335))
- Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646))
- Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634))
- Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643))

### Performance

- Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611))

### Bug fixes

- Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586))

## Install uv 0.11.32

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"
```

## Download uv 0.11.32

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated)

</details>
<details>
<summary>zizmor: `1.27.0` → `1.28.0` (zizmorcore/zizmor)</summary>

### v1.28.0

## Security 🔒[🔗](https://docs.zizmor.sh/release-notes/#security)

- v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh](GHSA-f42p-wjw5-97qh) for full information.

    Many thanks to [@​shaanmajid](https://github.com/shaanmajid) for finding and reporting this vulnerability.

## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements)

- The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes ([#2186](zizmorcore/zizmor#2186))

- The [dependabot-cooldown](https://docs.zizmor.sh/audits/#dependabot-cooldown) audit is now aware of GitHub's new three-day default cooldown ([#2193](zizmorcore/zizmor#2193))

- sbt is now recognized as a package-ecosystem in dependabot.yml ([#2211](zizmorcore/zizmor#2211))

## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes)

- Fixed a bug where the [template-injection](https://docs.zizmor.sh/audits/#template-injection) audit would incorrectly flag `steps.*.outcome` and `steps.*.conclusion` as injection risks in the default persona ([#2199](zizmorcore/zizmor#2199))

- Fixed a bug where the [github-env](https://docs.zizmor.sh/audits/#github-env) audit would incorrectly flag some printf calls as exploitable ([#2201](zizmorcore/zizmor#2201))

- Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input ([#2205](zizmorcore/zizmor#2205))

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants