Migrate lockfile serialization to toml_writer - #20450
Conversation
61a197c to
1070ed6
Compare
toml_writer
uv test inventory changesThis PR changes the tests when compared with the latest
|
## Summary This avoids recomputing the same fork marker for every resolved node while recording preferences, skips the identity case in `UniversalMarker::imbibe`, and removes two redundant PEP 508 projections that are already performed by the underlying conflict helpers. ## Performance Measured with profiling binaries, a warm local cache, `--offline`, pinned CPUs (8-15), fixed `UV_EXCLUDE_NEWER`, alternating base/head order, 10 warmups, and 60 paired runs. The baseline is current `main` (including the just-merged Python-requirement marker cache, #20461) plus the in-review TOML writer (#20450). Every pair produced identical lockfile hashes. | Workload | Wall before → after | Wall Δ | CPU before → after | CPU Δ | |---|---:|---:|---:|---:| | Transformers | 308.5 → 301.1 ms | -2.4% | 343.3 → 336.0 ms | -2.1% | | Home Assistant | 121.5 → 120.9 ms | -0.5% | 82.2 → 81.4 ms | -1.0% | | Warehouse | 167.4 → 168.2 ms | +0.5% | 176.5 → 175.7 ms | -0.5% | | JupyterLab | 112.5 → 112.3 ms | -0.1% | 57.3 → 56.9 ms | -0.6% | | Semantic Kernel | 120.8 → 119.4 ms | -1.1% | 70.0 → 70.2 ms | +0.2% | Transformers is the clear win: block-aware paired analysis was **-2.23% wall** (95% CI -4.17 to -0.26) and **-2.37% CPU** (95% CI -3.46 to -1.22). The focused resolver suite passes (63 tests), including the added `imbibe(TRUE)` regression test; formatting and diff checks are clean. Co-authored-by: Charlie Marsh <charliemarsh@openai.com>
## Summary Large cached Simple API responses spend significant time validating/decoding their archived payload on the async runtime. This moves both fresh-cache and revalidated-cache payload decoding onto the existing bounded cache-read runtime, keeping that CPU-heavy work off resolver workers. This is intentionally a wall-time/CPU tradeoff: task handoff and overlap increase aggregate CPU, while larger lock workloads complete sooner. ## Performance Measured with profiling binaries, a warm local cache, `--offline`, pinned CPUs (8-15), fixed `UV_EXCLUDE_NEWER`, alternating base/head order, 10 warmups, and 60 paired runs. This is incremental on current `main` (including #20461) plus #20450 and the marker fastpaths. Every pair produced identical lockfile hashes. | Workload | Wall before → after | Wall Δ | CPU before → after | CPU Δ | |---|---:|---:|---:|---:| | Transformers | 309.1 → 300.8 ms | -2.7% | 335.9 → 353.8 ms | +5.4% | | Home Assistant | 121.2 → 116.5 ms | -3.8% | 81.6 → 84.9 ms | +4.2% | | Warehouse | 167.3 → 155.3 ms | -7.2% | 174.2 → 183.7 ms | +5.5% | | JupyterLab | 111.1 → 112.0 ms | +0.8% | 57.2 → 60.0 ms | +5.0% | | Semantic Kernel | 118.9 → 117.7 ms | -1.0% | 69.2 → 72.1 ms | +4.3% | Across workloads, block-aware paired analysis shows **-3.92% wall** (95% CI -5.67 to -2.15) and **+4.97% CPU** (95% CI +4.49 to +5.45). Warehouse benefits most; small workloads are effectively neutral in wall time. All 83 `uv-client` unit tests pass, and formatting, diff, and all-target compile checks are clean. Co-authored-by: Charlie Marsh <charliemarsh@openai.com>
|
Using https://github.com/astral-sh/uv/compare/main...epage:uv:refactor?expand=1 to help identify changes of interest |
|
Personally, I would have written this with as little "raw" writes as possible but that is a personal choice as we have tests to verify that what we generate is valid TOML and the raw writes do not include non-sanitized end-user values. |
| let count = dist_count_by_name.get(&dependency.package_id.name).copied(); | ||
| writer.inline_string(&mut first, "name", dependency.package_id.name.as_ref())?; | ||
| if count.is_none_or(|count| count > 1) { | ||
| if let Some(version) = &dependency.package_id.version { | ||
| writer.inline_string(&mut first, "version", &version.to_string())?; | ||
| } | ||
| writer.inline_key(&mut first, "source")?; | ||
| write_source_inline(writer, &dependency.package_id.source)?; | ||
| } |
There was a problem hiding this comment.
Would it work to still call write_package_id here so we can keep this knowledge centralized?
| if let Some(source_dist) = &package.sdist { | ||
| writer.key_start("sdist")?; | ||
| write_source_dist_inline(writer, source_dist)?; | ||
| writer.raw("\n"); | ||
| } | ||
|
|
||
| if !package.wheels.is_empty() { | ||
| writer.multiline_array("wheels", &package.wheels, write_wheel_inline)?; | ||
| } | ||
|
|
||
| if package | ||
| .optional_dependencies |
There was a problem hiding this comment.
Self-note: some of the logic was re-arranged. It appears it was done to due to the constraints that we need to finish writing one standard table before we start on the next.
| /// Writes a Serde-backed array, omitting the key when the array is empty. | ||
| fn write_serialized_array<T: Serialize>( | ||
| writer: &mut LockWriter, | ||
| key: &str, | ||
| values: &BTreeSet<T>, | ||
| ) -> Result<(), WriteError> { | ||
| if values.is_empty() { | ||
| return Ok(()); | ||
| } | ||
| write_serialized_array_including_empty(writer, key, values) | ||
| } | ||
|
|
||
| /// Writes a Serde-backed array using the canonical layout for its cardinality. | ||
| /// | ||
| /// Empty and single-element arrays stay on one line, while larger arrays place each element on | ||
| /// its own line. Unlike [`write_serialized_array`], this retains empty dependency groups. | ||
| fn write_serialized_array_including_empty<T: Serialize>( |
There was a problem hiding this comment.
nit: I would name the first write_serialized_non_empty_array and the second write_serialized_array. Without knowing the particulars of the implementation, the current naming means I assume that is always writes which could lead to surprising results and having to do extra cycles between coding and tests
| fn inline_value( | ||
| &mut self, | ||
| first: &mut bool, | ||
| key: &str, | ||
| value: impl WriteTomlValue, | ||
| ) -> Result<(), WriteError> { | ||
| self.inline_key(first, key)?; | ||
| self.output.value(value)?; | ||
| Ok(()) | ||
| } | ||
|
|
||
| fn inline_string( | ||
| &mut self, | ||
| first: &mut bool, | ||
| key: &str, | ||
| value: &str, | ||
| ) -> Result<(), WriteError> { | ||
| self.inline_key(first, key)?; | ||
| self.string(value) | ||
| } |
There was a problem hiding this comment.
Is there a reason you don't just use inline_value for strings?
| fn inline_key(&mut self, first: &mut bool, key: &str) -> Result<(), WriteError> { | ||
| if *first { | ||
| self.raw(" "); | ||
| *first = false; | ||
| } else { | ||
| self.raw(", "); | ||
| } | ||
| self.key_start(key) |
There was a problem hiding this comment.
If this is an inline version of key_start, should this be named inline_key_start` to clarify that?
| Ok(()) | ||
| } | ||
|
|
||
| fn inline_array<I, T, F>(&mut self, values: I, mut write_value: F) -> Result<(), WriteError> |
There was a problem hiding this comment.
Your other inline_ prefixed functions are for when it is inside an inline table. Seems like inline_ should be dropped here to make that more consistent
| fn multiline_array_values<I, T, F>( | ||
| &mut self, | ||
| values: I, | ||
| mut write_value: F, | ||
| ) -> Result<(), WriteError> | ||
| where | ||
| I: IntoIterator<Item = T>, | ||
| F: FnMut(&mut Self, T) -> Result<(), WriteError>, | ||
| { | ||
| self.raw("[\n"); | ||
| for value in values { | ||
| self.raw(" "); | ||
| write_value(self, value)?; | ||
| self.raw(",\n"); | ||
| } | ||
| self.raw("]\n"); | ||
| Ok(()) | ||
| } | ||
|
|
||
| fn inline_array<I, T, F>(&mut self, values: I, mut write_value: F) -> Result<(), WriteError> |
There was a problem hiding this comment.
One includes _values while the other different but both seem to be about the same purpose with just one being mult-line. Maybe another area for improving consistency?
| fn key_value(&mut self, key: &str, value: impl WriteTomlValue) -> Result<(), WriteError> { | ||
| self.key_start(key)?; | ||
| self.output.value(value)?; | ||
| self.raw("\n"); | ||
| Ok(()) | ||
| } | ||
|
|
||
| fn key_value_string(&mut self, key: &str, value: &str) -> Result<(), WriteError> { | ||
| self.key_start(key)?; | ||
| self.string(value)?; | ||
| self.raw("\n"); | ||
| Ok(()) | ||
| } |
| fn string(&mut self, value: &str) -> Result<(), WriteError> { | ||
| self.output.value(value)?; | ||
| Ok(()) | ||
| } |
| /// Converts values without native `toml_writer` support through Serde's TOML value serializer. | ||
| fn serialize_value<T: Serialize + ?Sized>(value: &T) -> Result<Value, WriteError> { |
There was a problem hiding this comment.
If you turn this into a wrapper type that impls toml_writer::WriteTomlValue, then it will compose with the rest of the LockWriter, requiring fewer raw calls.
| /// Emits TOML while retaining the established whitespace and inline-table layout of `uv.lock`. | ||
| #[derive(Default)] | ||
| struct LockWriter { |
There was a problem hiding this comment.
Side note: I wouldn't be surprised if we find this helpful elsewhere and eventually generalize it. As for going beyond astral, iirc I was being fairly strict about the scope of toml_writer and unsure where else it would go (oh joy, another crate?).
epage
left a comment
There was a problem hiding this comment.
Functionality looks correct. I have some style suggestions for improving the readability of the code.
1070ed6 to
a700452
Compare
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.11.29` → `0.11.30` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.11.30`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01130) Released on 2026-07-20. ##### Python - Add CPython 3.15.0b4 ([#​20519](astral-sh/uv#20519)) ##### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#​20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#​20436](astral-sh/uv#20436)) ##### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#​20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#​20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#​20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#​20463](astral-sh/uv#20463), [#​20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#​20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#​20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#​20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#​20462](astral-sh/uv#20462)) ##### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#​20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#​20466](astral-sh/uv#20466)) ##### Documentation - Add a contribution guide ([#​20511](astral-sh/uv#20511), [#​20552](astral-sh/uv#20552)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/16 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [uv](https://github.com/astral-sh/uv) | patch | `0.11.29` → `0.11.30` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.11.30`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01130) [Compare Source](astral-sh/uv@0.11.29...0.11.30) Released on 2026-07-20. ##### Python - Add CPython 3.15.0b4 ([#​20519](astral-sh/uv#20519)) ##### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#​20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#​20436](astral-sh/uv#20436)) ##### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#​20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#​20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#​20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#​20463](astral-sh/uv#20463), [#​20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#​20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#​20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#​20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#​20462](astral-sh/uv#20462)) ##### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#​20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#​20466](astral-sh/uv#20466)) ##### Documentation - Add a contribution guide ([#​20511](astral-sh/uv#20511), [#​20552](astral-sh/uv#20552)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6cGF0Y2giXX0=-->
Automated mise tool upgrades from local config. Updated tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> </details> Modified files: - `.mise.toml`
Automated mise tool upgrades from local config. Updated tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> </details> Modified files: - `.mise.toml`
Automated mise tool upgrades from local config. Updated tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. Updated tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> </details> Modified files: - `.mise.toml`
Automated mise tool upgrades from local config. Updated tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.11.29` → `0.11.32` | `0.11.29` → `0.11.32` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.4.10` → `0.4.11` | `0.4.10` → `0.4.11` | | `rumdl` | `0.2.36` → `0.2.43` | `0.2.36` → `0.2.43` | | `tombi` | `1.2.3` → `1.2.4` | `1.2.3` → `1.2.4` | | `uv` | `latest` → `latest` | `0.11.29` → `0.11.32` | | `zizmor` | `latest` → `latest` | `1.27.0` → `1.28.0` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>prek: `0.4.10` → `0.4.11` (j178/prek)</summary> ### v0.4.11 ## Release Notes Released on 2026-07-25. ### Highlights - This release adds two new builtin hooks, `deny-pattern` and `require-pattern`, as native alternatives for `pygrep` use cases. `deny-pattern` fails when a configured pattern is found, while `require-pattern` ensures every selected file contains a match. By matching natively without spawning a Python subprocess, they run over 4x faster than `pygrep` in benchmarks. Note that they use [Rust `regex` syntax](https://docs.rs/regex/latest/regex/#syntax), which does not support look-around features such as negative lookbehind. - `prek run` now supports `--glob <PATTERN>` to run hooks on tracked files matching a glob. It can be repeated or combined with `--files` and `--directory`. - Hook priorities now support reusable aliases: ```toml [priorities] checks = 10 [[repos]] repo = "builtin" hooks = [ { id = "check-json", priority = "checks" }, { id = "check-yaml", priority = "checks" }, ] ``` This makes parallel scheduling easier to read and maintain. ### Enhancements - Add `deny-pattern` and `require-pattern` builtin hooks ([#2359](j178/prek#2359)) - Support `--glob` patterns in `prek run` ([#2381](j178/prek#2381)) - Support reusable aliases for hook priorities ([#2331](j178/prek#2331)) - Implement `requirements-txt-fixer` as a builtin hook ([#2390](j178/prek#2390)) - Improve user-facing warnings and errors ([#2380](j178/prek#2380)) - Install Node hooks through git url ([#2394](j178/prek#2394)) ### Performance - Reduce blocking-pool overhead in file hooks ([#2384](j178/prek#2384)) - Speed up mixed-line-ending scans with memchr2 ([#2391](j178/prek#2391)) ### Bug fixes - Honor filenames in builti… (truncated) </details> <details> <summary>rumdl: `0.2.36` → `0.2.43` (rvben/rumdl)</summary> ### v0.2.37 ### Added - **reflow**: add atomic_spans configuration and refactor inline wrapping (#742) ([aeabec1](rvben/rumdl@aeabec1)) ### Changed - **BREAKING**: the MD013 `emphasis-spans` option is renamed to `atomic-spans` (default `true`), with inverted meaning (`emphasis-spans = true` is now `atomic-spans = false`). Configs setting the old key should migrate; it is no longer recognized ### Fixed - **reflow**: keep code spans atomic when wrapping would collapse whitespace ([d43618b](rvben/rumdl@d43618b)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.37-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/rel… (truncated) ### v0.2.38 ### Added - **md044**: add ignore-frontmatter-fields option ([b664e5a](rvben/rumdl@b664e5a)) - **config**: warn when an inline enable cannot re-enable a config-disabled rule ([a74a923](rvben/rumdl@a74a923)) ### Fixed - **md044**: stop flagging proper names inside frontmatter file paths ([35649d9](rvben/rumdl@35649d9)) - **md022**: stop panicking when one blank-line requirement is unlimited ([8a25eb2](rvben/rumdl@8a25eb2)) - **config**: report unknown option keys in inline configure-file comments ([8f4c0ea](rvben/rumdl@8f4c0ea)) - **config**: apply markdownlint-configure-file when the comment spans lines ([7a023a5](rvben/rumdl@7a023a5)) - **config**: honor booleans and alias keys in markdownlint-configure-file (#745) ([acefc19](rvben/rumdl@acefc19)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.38-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-aarch64-unkn… (truncated) ### v0.2.39 ### Added - **config**: expand ~ to the home directory in path settings ([70f91aa](rvben/rumdl@70f91aa)) ### Fixed - **md013**: wrap over-long emphasis spans that contain nested markup ([ddc73f4](rvben/rumdl@ddc73f4)) - **discovery**: strip Windows verbatim prefix from canonicalized paths ([a85ab87](rvben/rumdl@a85ab87)) - **discovery**: apply absolute exclude patterns during directory discovery ([0d20fc8](rvben/rumdl@0d20fc8)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.39-x86_64-apple-darw… (truncated) ### v0.2.40 ### Fixed - **md003**: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so `rumdl fmt` added a horizontal rule the document never had ([7363c34](rvben/rumdl@7363c34)) - **md077**: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged ([58fb25b](rvben/rumdl@58fb25b)) - **reflow**: keep wiki links, shortcodes and math whole inside a wrapped span ([db12c2c](rvben/rumdl@db12c2c)) - **config**: honor the documented MD033 `table_allowed` alias, which silently dropped the configured value ([db2c204](rvben/rumdl@db2c204)) - **config**: stop reporting MD013's documented `semantic-link-understanding` alias as an unknown option ([1539a64](rvben/rumdl@1539a64)) - **parity**: make the markdownlint comparison harness actually run ([182763c](rvben/rumdl@182763c)) ### Documentation - **md013**: document that `ignore-link-urls` affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat ([c4f8bad](rvben/rumdl@c4f8bad)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.40-x86_64-u… (truncated) ### v0.2.41 ### Added - **flavor**: add Hugo flavor and skip block attribute lists in blanks-around rules ([e6bb033](rvben/rumdl@e6bb033)) ### Fixed - **md044**: recognize indented HTML comments so links and code escape the rule ([3d6191c](rvben/rumdl@3d6191c)) - **md013**: keep an attr list whole inside a wrapped span ([e06f03d](rvben/rumdl@e06f03d)) - **md013**: keep a reference-style link whole inside a wrapped span ([de42709](rvben/rumdl@de42709)) - **md013**: wrap an over-long span whose whole content is another span ([f6c7c9c](rvben/rumdl@f6c7c9c)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz) | Linux… (truncated) ### v0.2.42 ### Added - **mojibake**: new rule MD083 for mojibake detection (#753) ([552842b](rvben/rumdl@552842b)) ### Fixed - **lint_context**: prevent panic when HTML tag window splits a UTF-8 char ([d14b252](rvben/rumdl@d14b252)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.42-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/relea… (truncated) ### v0.2.43 ### Added - **invisiblechars**: new rule MD084 for detecting invisible characters (#758) ([0a6354a](rvben/rumdl@0a6354a)) ### Fixed - **md084**: treat a zero width joiner between visible characters as presentation ([4fbb1cc](rvben/rumdl@4fbb1cc)) - **md084**: keep attached variation selectors in consecutive-character detection ([f4e9fd3](rvben/rumdl@f4e9fd3)) - **md084**: don't flag variation selectors attached to a base character ([14941bb](rvben/rumdl@14941bb)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz.sha256)… (truncated) </details> <details> <summary>tombi: `1.2.3` → `1.2.4` (tombi-toml/tombi)</summary> ### v1.2.4 <!-- Release notes generated using configuration in .github/release.yml at v1.2.4 --> ## What's Changed ### 🛠️ Other Changes * fix(date-time): accept leap second 60 in date-time values by @LordAizen1 in tombi-toml/tombi#2024 ## New Contributors * @LordAizen1 made their first contribution in tombi-toml/tombi#2024 **Full Changelog**: tombi-toml/tombi@v1.2.3...v1.2.4 </details> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> <details> <summary>zizmor: `1.27.0` → `1.28.0` (zizmorcore/zizmor)</summary> ### v1.28.0 ## Security 🔒[🔗](https://docs.zizmor.sh/release-notes/#security) - v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh](GHSA-f42p-wjw5-97qh) for full information. Many thanks to [@shaanmajid](https://github.com/shaanmajid) for finding and reporting this vulnerability. ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes ([#2186](zizmorcore/zizmor#2186)) - The [dependabot-cooldown](https://docs.zizmor.sh/audits/#dependabot-cooldown) audit is now aware of GitHub's new three-day default cooldown ([#2193](zizmorcore/zizmor#2193)) - sbt is now recognized as a package-ecosystem in dependabot.yml ([#2211](zizmorcore/zizmor#2211)) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a bug where the [template-injection](https://docs.zizmor.sh/audits/#template-injection) audit would incorrectly flag `steps.*.outcome` and `steps.*.conclusion` as injection risks in the default persona ([#2199](zizmorcore/zizmor#2199)) - Fixed a bug where the [github-env](https://docs.zizmor.sh/audits/#github-env) audit would incorrectly flag some printf calls as exploitable ([#2201](zizmorcore/zizmor#2201)) - Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input ([#2205](zizmorcore/zizmor#2205)) </details> </details> Modified files: - `.mise.toml`
Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.4.10` → `0.4.11` | `0.4.10` → `0.4.11` | | `rumdl` | `0.2.36` → `0.2.43` | `0.2.36` → `0.2.43` | | `tombi` | `1.2.3` → `1.2.4` | `1.2.3` → `1.2.4` | | `uv` | `latest` → `latest` | `0.11.29` → `0.11.32` | | `zizmor` | `latest` → `latest` | `1.27.0` → `1.28.0` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>prek: `0.4.10` → `0.4.11` (j178/prek)</summary> ### v0.4.11 ## Release Notes Released on 2026-07-25. ### Highlights - This release adds two new builtin hooks, `deny-pattern` and `require-pattern`, as native alternatives for `pygrep` use cases. `deny-pattern` fails when a configured pattern is found, while `require-pattern` ensures every selected file contains a match. By matching natively without spawning a Python subprocess, they run over 4x faster than `pygrep` in benchmarks. Note that they use [Rust `regex` syntax](https://docs.rs/regex/latest/regex/#syntax), which does not support look-around features such as negative lookbehind. - `prek run` now supports `--glob <PATTERN>` to run hooks on tracked files matching a glob. It can be repeated or combined with `--files` and `--directory`. - Hook priorities now support reusable aliases: ```toml [priorities] checks = 10 [[repos]] repo = "builtin" hooks = [ { id = "check-json", priority = "checks" }, { id = "check-yaml", priority = "checks" }, ] ``` This makes parallel scheduling easier to read and maintain. ### Enhancements - Add `deny-pattern` and `require-pattern` builtin hooks ([#2359](j178/prek#2359)) - Support `--glob` patterns in `prek run` ([#2381](j178/prek#2381)) - Support reusable aliases for hook priorities ([#2331](j178/prek#2331)) - Implement `requirements-txt-fixer` as a builtin hook ([#2390](j178/prek#2390)) - Improve user-facing warnings and errors ([#2380](j178/prek#2380)) - Install Node hooks through git url ([#2394](j178/prek#2394)) ### Performance - Reduce blocking-pool overhead in file hooks ([#2384](j178/prek#2384)) - Speed up mixed-line-ending scans with memchr2 ([#2391](j178/prek#2391)) ### Bug fixes - Honor filenames in builti… (truncated) </details> <details> <summary>rumdl: `0.2.36` → `0.2.43` (rvben/rumdl)</summary> ### v0.2.37 ### Added - **reflow**: add atomic_spans configuration and refactor inline wrapping (#742) ([aeabec1](rvben/rumdl@aeabec1)) ### Changed - **BREAKING**: the MD013 `emphasis-spans` option is renamed to `atomic-spans` (default `true`), with inverted meaning (`emphasis-spans = true` is now `atomic-spans = false`). Configs setting the old key should migrate; it is no longer recognized ### Fixed - **reflow**: keep code spans atomic when wrapping would collapse whitespace ([d43618b](rvben/rumdl@d43618b)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.37/rumdl-v0.2.37-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.37-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/rel… (truncated) ### v0.2.38 ### Added - **md044**: add ignore-frontmatter-fields option ([b664e5a](rvben/rumdl@b664e5a)) - **config**: warn when an inline enable cannot re-enable a config-disabled rule ([a74a923](rvben/rumdl@a74a923)) ### Fixed - **md044**: stop flagging proper names inside frontmatter file paths ([35649d9](rvben/rumdl@35649d9)) - **md022**: stop panicking when one blank-line requirement is unlimited ([8a25eb2](rvben/rumdl@8a25eb2)) - **config**: report unknown option keys in inline configure-file comments ([8f4c0ea](rvben/rumdl@8f4c0ea)) - **config**: apply markdownlint-configure-file when the comment spans lines ([7a023a5](rvben/rumdl@7a023a5)) - **config**: honor booleans and alias keys in markdownlint-configure-file (#745) ([acefc19](rvben/rumdl@acefc19)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.38-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.38/rumdl-v0.2.38-aarch64-unkn… (truncated) ### v0.2.39 ### Added - **config**: expand ~ to the home directory in path settings ([70f91aa](rvben/rumdl@70f91aa)) ### Fixed - **md013**: wrap over-long emphasis spans that contain nested markup ([ddc73f4](rvben/rumdl@ddc73f4)) - **discovery**: strip Windows verbatim prefix from canonicalized paths ([a85ab87](rvben/rumdl@a85ab87)) - **discovery**: apply absolute exclude patterns during directory discovery ([0d20fc8](rvben/rumdl@0d20fc8)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.39/rumdl-v0.2.39-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.39-x86_64-apple-darw… (truncated) ### v0.2.40 ### Fixed - **md003**: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so `rumdl fmt` added a horizontal rule the document never had ([7363c34](rvben/rumdl@7363c34)) - **md077**: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged ([58fb25b](rvben/rumdl@58fb25b)) - **reflow**: keep wiki links, shortcodes and math whole inside a wrapped span ([db12c2c](rvben/rumdl@db12c2c)) - **config**: honor the documented MD033 `table_allowed` alias, which silently dropped the configured value ([db2c204](rvben/rumdl@db2c204)) - **config**: stop reporting MD013's documented `semantic-link-understanding` alias as an unknown option ([1539a64](rvben/rumdl@1539a64)) - **parity**: make the markdownlint comparison harness actually run ([182763c](rvben/rumdl@182763c)) ### Documentation - **md013**: document that `ignore-link-urls` affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat ([c4f8bad](rvben/rumdl@c4f8bad)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.40/rumdl-v0.2.40-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.40-x86_64-u… (truncated) ### v0.2.41 ### Added - **flavor**: add Hugo flavor and skip block attribute lists in blanks-around rules ([e6bb033](rvben/rumdl@e6bb033)) ### Fixed - **md044**: recognize indented HTML comments so links and code escape the rule ([3d6191c](rvben/rumdl@3d6191c)) - **md013**: keep an attr list whole inside a wrapped span ([e06f03d](rvben/rumdl@e06f03d)) - **md013**: keep a reference-style link whole inside a wrapped span ([de42709](rvben/rumdl@de42709)) - **md013**: wrap an over-long span whose whole content is another span ([f6c7c9c](rvben/rumdl@f6c7c9c)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.41/rumdl-v0.2.41-aarch64-unknown-linux-musl.tar.gz) | Linux… (truncated) ### v0.2.42 ### Added - **mojibake**: new rule MD083 for mojibake detection (#753) ([552842b](rvben/rumdl@552842b)) ### Fixed - **lint_context**: prevent panic when HTML tag window splits a UTF-8 char ([d14b252](rvben/rumdl@d14b252)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.42-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.42/rumdl-v0.2.42-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.42-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/relea… (truncated) ### v0.2.43 ### Added - **invisiblechars**: new rule MD084 for detecting invisible characters (#758) ([0a6354a](rvben/rumdl@0a6354a)) ### Fixed - **md084**: treat a zero width joiner between visible characters as presentation ([4fbb1cc](rvben/rumdl@4fbb1cc)) - **md084**: keep attached variation selectors in consecutive-character detection ([f4e9fd3](rvben/rumdl@f4e9fd3)) - **md084**: don't flag variation selectors attached to a base character ([14941bb](rvben/rumdl@14941bb)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz.sha256)… (truncated) </details> <details> <summary>tombi: `1.2.3` → `1.2.4` (tombi-toml/tombi)</summary> ### v1.2.4 <!-- Release notes generated using configuration in .github/release.yml at v1.2.4 --> ## What's Changed ### 🛠️ Other Changes * fix(date-time): accept leap second 60 in date-time values by @LordAizen1 in tombi-toml/tombi#2024 ## New Contributors * @LordAizen1 made their first contribution in tombi-toml/tombi#2024 **Full Changelog**: tombi-toml/tombi@v1.2.3...v1.2.4 </details> <details> <summary>uv: `0.11.29` → `0.11.32` (astral-sh/uv)</summary> ### 0.11.30 ## Release Notes Released on 2026-07-20. ### Python - Add CPython 3.15.0b4 ([#20519](astral-sh/uv#20519)) ### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](astral-sh/uv#20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](astral-sh/uv#20436)) ### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](astral-sh/uv#20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](astral-sh/uv#20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](astral-sh/uv#20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](astral-sh/uv#20463), [#20483](astral-sh/uv#20483)) - Decode stale cache entries in a single blocking task ([#20486](astral-sh/uv#20486)) - Decode cached payloads outside resolver workers ([#20464](astral-sh/uv#20464)) - Cache resolver Python requirement markers ([#20461](astral-sh/uv#20461)) - Reuse resolver fork markers while recording preferences ([#20462](astral-sh/uv#20462)) ### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](astral-sh/uv#20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](astral-sh/uv#20466)) ### Documentation - Add a contribution guide ([#20511](astral-sh/uv#20511), [#20552](astral-sh/uv#20552)) ## Install uv 0.11.30 ### Install prebuilt binaries via shell script ```sh curl --proto '=htt… (truncated) ### 0.11.31 ## Release Notes Released on 2026-07-21. ### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](astral-sh/uv#18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](astral-sh/uv#20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](astral-sh/uv#20554)) ### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](astral-sh/uv#20605)) ### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](astral-sh/uv#20587)) ### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](astral-sh/uv#20578)) ### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](astral-sh/uv#20582)) - Reject source distributions and wheels with mismatched package names ([#20432](astral-sh/uv#20432)) - Avoid retrying TLS certificate verification failures ([#16245](astral-sh/uv#16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](astral-sh/uv#20153)) ## Install uv 0.11.31 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` ## Download uv 0.11.31 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.ta… (truncated) ### 0.11.32 ## Release Notes Released on 2026-07-23. ### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](astral-sh/uv#20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](astral-sh/uv#20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](astral-sh/uv#20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](astral-sh/uv#20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](astral-sh/uv#20643)) ### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](astral-sh/uv#20611)) ### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](astral-sh/uv#20586)) ## Install uv 0.11.32 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` ## Download uv 0.11.32 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel… (truncated) </details> <details> <summary>zizmor: `1.27.0` → `1.28.0` (zizmorcore/zizmor)</summary> ### v1.28.0 ## Security 🔒[🔗](https://docs.zizmor.sh/release-notes/#security) - v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh](GHSA-f42p-wjw5-97qh) for full information. Many thanks to [@shaanmajid](https://github.com/shaanmajid) for finding and reporting this vulnerability. ## Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes ([#2186](zizmorcore/zizmor#2186)) - The [dependabot-cooldown](https://docs.zizmor.sh/audits/#dependabot-cooldown) audit is now aware of GitHub's new three-day default cooldown ([#2193](zizmorcore/zizmor#2193)) - sbt is now recognized as a package-ecosystem in dependabot.yml ([#2211](zizmorcore/zizmor#2211)) ## Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a bug where the [template-injection](https://docs.zizmor.sh/audits/#template-injection) audit would incorrectly flag `steps.*.outcome` and `steps.*.conclusion` as injection risks in the default persona ([#2199](zizmorcore/zizmor#2199)) - Fixed a bug where the [github-env](https://docs.zizmor.sh/audits/#github-env) audit would incorrectly flag some printf calls as exploitable ([#2201](zizmorcore/zizmor#2201)) - Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input ([#2205](zizmorcore/zizmor#2205)) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Summary
Migrate native
uv.lockserialization from building atoml_editdocument to writing TOML directly withtoml_writer.The output format remains unchanged, including inline tables, multiline arrays, marker simplification, conflict metadata, relative
exclude-newercompatibility fields, and package and dependency metadata. The separatepylock.tomlexport continues to usetoml_edit.This avoids constructing a full editable TOML AST when serializing lockfiles:
Note that the changes here are largely moving code out of
lock/mod.rsand intoserialize.rs, with alterations to leveragetoml_writer.