Update prek manifest

behavior

.github/.cspell/project-dictionary.txt

@@ -2,6 +2,7 @@ almalinux
 archlinux
 binstall
 callgrind
+CDPATH
 coreutils
 covgate
 cyclonedx
@@ -29,7 +30,6 @@ pluginconf
 ppcle
 prek
 quickinstall
-rclone
 rdme
 rootfs
 sccache

CHANGELOG.md

@@ -10,6 +10,20 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+- Update `tombi@latest` to 0.9.20.
+
+- Update `martin@latest` to 1.6.0.
+
+- Update `just@latest` to 1.50.0.
+
+- Update `tombi@latest` to 0.9.19.
+
+- Update `mise@latest` to 2026.4.18.
+
+- Update `rclone@latest` to 1.73.5.
+
+- Update `mise@latest` to 2026.4.17.
+
 ## [2.75.18] - 2026-04-19
 
 - Update `vacuum@latest` to 0.26.1.

action.yml

@@ -22,7 +22,10 @@ runs:
   using: composite
   steps:
     - run: |
-        set -eu
+        if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
+          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          exit 1
+        fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
             printf '::group::Install packages required for install-action (bash)\n'
@@ -41,7 +44,7 @@ runs:
           fi
         fi
         bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: sh
+      shell: /usr/bin/env -u ENV -u BASH_ENV -u CDPATH -u SHELLOPTS -u BASHOPTS /bin/sh -eu {0} # zizmor: ignore[misfeature] false positive
       env:
         # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
@@ -54,6 +57,15 @@ runs:
     # https://github.com/actions/partner-runner-images/issues/169
     - run: |
         Set-StrictMode -Version Latest
+        if (Test-Path "Env:ENV") { Remove-Item Env:\ENV }
+        if (Test-Path "Env:BASH_ENV") { Remove-Item Env:\BASH_ENV }
+        if (Test-Path "Env:CDPATH") { Remove-Item Env:\CDPATH }
+        if (Test-Path "Env:SHELLOPTS") { Remove-Item Env:\SHELLOPTS }
+        if (Test-Path "Env:BASHOPTS") { Remove-Item Env:\BASHOPTS }
+        if (Test-Path "Env:BASH_FUNC_*") {
+          Write-Output "::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons"
+          exit 1
+        }
         for ($i=1; $i -le 10; $i++) {
           $prev_err_action = $ErrorActionPreference
           $ErrorActionPreference = "Continue"

main.sh

@@ -616,7 +616,7 @@ cargo_path=$(type -P cargo || true)
 if [[ "${host_os}" == "windows" ]]; then
   mkdir -p -- "${install_action_dir}"
   # See action.yml.
-  touch -- "${install_action_dir}"/init
+  printf '' >|"${install_action_dir}"/init
   if [[ -n "${cargo_path}" ]]; then
     info "cargo is located at ${cargo_path}"
     cargo_bin="${cargo_path%/*}"

manifests/cargo-xwin.json

@@ -17,6 +17,24 @@
   "latest": {
     "version": "0.21.5"
   },
+  "0.22.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F37C7CF1B98",
+      "hash": "a883bdc833df614978514485d00e6174fcc3a229bf0edc07bbea8762a0405e0b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F37FADC11D8",
+      "hash": "6a0ba0734f9c8af3c98338be34ad70a3010d1014b5e551134d3e087d46192ffd"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F38104A6015",
+      "hash": "2d0e46a28b2919e92f6952dcd88c9a8f9a1e6426a6ef1319ff3a6ccaef264774"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F37D403A82E",
+      "hash": "f4ec28c33817623c2f2638c11fc7f011d7ea2468d8b56ef590daa4032ee2e256"
+    }
+  },
   "0.21": {
     "version": "0.21.5"
   },

manifests/just.json

@@ -21,10 +21,39 @@
     }
   },
   "latest": {
-    "version": "1.49.0"
+    "version": "1.50.0"
   },
   "1": {
-    "version": "1.49.0"
+    "version": "1.50.0"
+  },
+  "1.50": {
+    "version": "1.50.0"
+  },
+  "1.50.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6F41A84659",
+      "hash": "27e011cd6328fadd632e59233d2cf5f18460b8a8c4269acd324c1a8669f34db0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6F39943078",
+      "hash": "e4fa28fe63381ca32fad101e86d4a1da7cd2d34d1b080985a37ec9dc951922fe"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6F71190D2B",
+      "hash": "5dc713f049e174e22de41fd06292a26c9b90f2d37c1be9390d2082fe6928b376"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6F47F2EDF4",
+      "hash": "3beb4967ce05883cf09ac12d6d128166eb4c6d0b03eff74b61018a6880655d7d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6F49FBDCE5",
+      "hash": "891262207663bff1aa422dbe799a76deae4064eaa445f14eb28aef7a388222cd"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6F73FB889D",
+      "hash": "91065b94d11beb4b05c8117d8a736e978f41764d73131de35d8134c9ab9dee7a"
+    }
   },
   "1.49": {
     "version": "1.49.0"

manifests/martin.json

@@ -31,10 +31,31 @@
     }
   },
   "latest": {
-    "version": "1.5.0"
+    "version": "1.6.0"
   },
   "1": {
-    "version": "1.5.0"
+    "version": "1.6.0"
+  },
+  "1.6": {
+    "version": "1.6.0"
+  },
+  "1.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6794FD4A72",
+      "hash": "b71c6e5006ab152ebe6ee021ba3280dadc681a1e723f48109ac4317d34c7926e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6794344CFE",
+      "hash": "1a33cc0b9580ab5b7d9ba124113eb8db9cdd9191d6206a2e0d452d88b2ed40bc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6794361FAD",
+      "hash": "42ef50d65d62358e806827f78ef660ef58eba126a449a237cbd57ab727105ea0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6794327A4B",
+      "hash": "18afc12cdb9e84b095f26a260880ef488ea0185d6ff9821bb38d2b38d2b70d63"
+    }
   },
   "1.5": {
     "version": "1.5.0"

manifests/mise.json

@@ -27,13 +27,39 @@
     }
   },
   "latest": {
-    "version": "2026.4.16"
+    "version": "2026.4.18"
   },
   "2026": {
-    "version": "2026.4.16"
+    "version": "2026.4.18"
   },
   "2026.4": {
-    "version": "2026.4.16"
+    "version": "2026.4.18"
+  },
+  "2026.4.18": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E2E39FC992B",
+      "hash": "dcb0187879dcd8adb0f26279f08f9b06f7b78fa3fea3fb95ffd4db72375201f4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2E3C75312A",
+      "hash": "78b95c4a26d4c7f2bbda91dc119e1001eae33aade428f134dc6f1b6857a02cce"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2E3D783715",
+      "hash": "0651d43232b99d579f63ee83fa745f2418b37ae187b3f82322e9a2fd2192fe9f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E2E36AB5E0A",
+      "hash": "a451af75120d69139c3a88622299a893c2ef6eabdc80ec1226e2296ab6cc3432"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E2E3B93975F",
+      "hash": "65b8e5f3a8654d725ff3af7781e447e2ed130dcdf412ee937cbd43ef64bb7629"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2E3D5D7A28",
+      "hash": "b2107c8a8a21ae6bf7d9e89efdb60a814864dd7b99c7770175896273bb798c0e"
+    }
   },
   "2026.4.17": {
     "x86_64_linux_musl": {

manifests/prek.json

@@ -44,6 +44,40 @@
   "0.3": {
     "version": "0.3.9"
   },
+  "0.3.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F997FFD1858",
+      "hash": "60a873474e2ff2f70a5ad524d1b51abb6fdf5991900001eb7c8979877d75dacd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F997F77B599",
+      "hash": "313882a8bfd76eb6930949ded36b23ce194ccb5431f474c62ae3fde12df100ae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F997FB515C3",
+      "hash": "43b85e061bbcf6febb9973a7859d029f29f5ddeeb7722bd234422d8b6bee4406"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F997DF1BB18",
+      "hash": "50e585ce98988b70d79ec782b2cf6c787c2f0a97a448ba8594448b4a6a688943"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9F997DB040DC",
+      "hash": "e885e023ddb765ba31a2859bd4b9683f9b40fee3195c189a749bc4b28535ab5c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9F997D9866DE",
+      "hash": "4a6de3ff0fc2049ca72b8ab0ec567e195362a22c7efcca7ef0824b36b55d4193"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9F997F2903CC",
+      "hash": "029ba9576b560753b0a4374ace6c5df6808e3e935ae0d4a67a5935debc12dbd4"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9F997F6EE5E2",
+      "hash": "bfe0c951b48cca6f91a85f83ec94a59cc567df988c0a7f23c0f34de0a232e08c"
+    }
+  },
   "0.3.9": {
     "x86_64_linux_musl": {
       "etag": "0x8DE9958BFB91B93",

manifests/rclone.json

@@ -27,13 +27,39 @@
     }
   },
   "latest": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1.73": {
-    "version": "1.73.4"
+    "version": "1.73.5"
+  },
+  "1.73.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E0C3BBE3A4E",
+      "hash": "932cf4b7484de74d82b4875488e0009469fd21f9904673385184520fe11a1bf0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E0D0D15BEE0",
+      "hash": "19c709563e455d8f8e343d5521e741afa7a77e37c6552ad8f7b03034f8bc214b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E0D47EF790D",
+      "hash": "201567c54304935112b06dfac4ad754786287fb5acfad8889feca8d1cdeba92b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E0C537CFE99",
+      "hash": "8d465c921d95b2f54c5f2e79b24c97742ebc2082a0b8709a686361bed5ba7932"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E0D1603AE83",
+      "hash": "b9e265eb7a098743d0726c05c73fe207d355950fb8481e0b226c0c00173da1e8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E0D4F7F62B7",
+      "hash": "8805406a984115e7cfe3b021a20a983b7060a70f198484cf373d687b6f625923"
+    }
   },
   "1.73.4": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -21,10 +21,62 @@
     }
   },
   "latest": {
-    "version": "0.9.18"
+    "version": "0.9.20"
   },
   "0.9": {
-    "version": "0.9.18"
+    "version": "0.9.20"
+  },
+  "0.9.20": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6CBAC4C2D3",
+      "hash": "9899e24f8dafe0ef63347b974704fdbbc9ab1e6a2346ad8ec629ff458746160a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6CBA55DC08",
+      "hash": "cd793862d7916fefd92888f2441b20f8cce3d119cc5ed793da463ec6839b21fa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6CBA72E04B",
+      "hash": "974170e908df51e169a4f773680f5eb857c5a483b6c2075933e779d8e366d8c5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6CBA53E270",
+      "hash": "46a4cc79deae036def85651e36111225de2f11c6e2ff6e1d9c27ae8f3955a6aa"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6CBAE5459D",
+      "hash": "083523aeca0491787b773bb0fa719d36d918ba93ef405781f29e1b944e91915a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6CBA571327",
+      "hash": "a72878a31f80a17db242d122c831ab0a3e53caafd5083b428409356e10737d33"
+    }
+  },
+  "0.9.19": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E27872323BF",
+      "hash": "3a3d6523e1c39e76ffe9da8561ba48b01ffc8f885912813140afdb718c34d0c0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2787CADC04",
+      "hash": "8b6e09d368b4adbeac18df1a21768d960ac3debd5d2a183040c5b2ac37722eae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2787284E16",
+      "hash": "a04b6628a90e26d10dc2dda7ded6423e2f51a870551c8547f7c08678ffa3cd8c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E27871FCC29",
+      "hash": "ffa0b3b1f11161d28ac962388e3533d6ecb66c26c4b96694c64930ff2b4d0e6f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E278721C5C2",
+      "hash": "93cb44dc5c6c74b4e808d4490fec3b0be4a39e9550ba16d4c4140bb5b4945e3a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2787B8A0FD",
+      "hash": "f93b714cb412e71d2ba3467e3b716d0821e3424fc60f9736e24a1c0156098c20"
+    }
   },
   "0.9.18": {
     "x86_64_linux_musl": {

manifests/wasmtime.json

@@ -37,6 +37,40 @@
   "latest": {
     "version": "43.0.1"
   },
+  "44.0.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9EECC1A2BBAE",
+      "hash": "52eba06fe9f4364aa6164a4a3eafb2ca692ba9a756cbe8137b5574871f8cbfc8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9EECC1F8DF49",
+      "hash": "cd8043448157abc72fa1bd1b9e66ede23e48fefbab80b2744763d25b65f69662"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9EECC356232C",
+      "hash": "6139de7554514c2df1e30cec9b1e6ca493685ece23a039f987b55bf32bc42a57"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9EECBE872014",
+      "hash": "294cae921fb88cbbcb60a914eaaaf313df3249d718609afb5804186b3f1912f5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9EECBEC6A0D2",
+      "hash": "38a3b9d9fe64cee21bc9d9268e2c19fa35a7be59e030717545b84da0e6514eab"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9EECBF6FB731",
+      "hash": "34d9e5b42b18893649c895d7794cad8866b82d1382fb5f2953ccf1306853a237"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9EECC08BF58F",
+      "hash": "6e747f4ec40b1c5959ff002f147cbf1487a667cce42b690ad907ff0aefb0c707"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9EECC0E549D0",
+      "hash": "2bbbaeb0114c7ca4c6b9f9cceed616cb19858f961ab34bab899e2c3e86d22d31"
+    }
+  },
   "43": {
     "version": "43.0.1"
   },

tools/tidy.sh

@@ -27,14 +27,14 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
   image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:bce85a4321f80c09f2b68420e9149bcf7c085130ab1e1fca54443f76833cd184"
+  image="ghcr.io/taiki-e/tidy@sha256:71def761a5585e83a2672c4051aee13cd886ad5571215aee52f193454bb3cdff"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
 tmp=$(mktemp -d)
 trap -- 'rm -rf -- "${tmp:?}"' EXIT
 mkdir -p -- "${tmp}"/{pwsh-cache,pwsh-local,zizmor-cache,dummy-dir,tmp}
-touch -- "${tmp}"/dummy
+printf '' >"${tmp}"/dummy
 code=0
 color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then