Update prek manifest

behavior

.github/.cspell/project-dictionary.txt

@@ -2,6 +2,7 @@ almalinux
 archlinux
 binstall
 callgrind
+CDPATH
 coreutils
 covgate
 cyclonedx
@@ -29,7 +30,6 @@ pluginconf
 ppcle
 prek
 quickinstall
-rclone
 rdme
 rootfs
 sccache

.github/workflows/ci.yml

@@ -33,20 +33,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)

.github/workflows/manifest.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve

.github/workflows/release.yml

@@ -427,7 +427,7 @@ jobs:
           PREPARE_REV: ${{ needs.prepare.outputs.rev }}
           # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
           PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
-      - uses: taiki-e/create-gh-release-action@f67cf7b2dadd83d36b981e674a6b08063997ce68 # v1.10.0
+      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
         with:
           changelog: CHANGELOG.md
           title: $version
@@ -436,7 +436,7 @@ jobs:
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@d34e3b863da529f7c30e571fec0170fbf64fa40c # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action

CHANGELOG.md

@@ -10,6 +10,32 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+- Update `tombi@latest` to 0.9.20.
+
+- Update `martin@latest` to 1.6.0.
+
+- Update `just@latest` to 1.50.0.
+
+- Update `tombi@latest` to 0.9.19.
+
+- Update `mise@latest` to 2026.4.18.
+
+- Update `rclone@latest` to 1.73.5.
+
+- Update `mise@latest` to 2026.4.17.
+
+## [2.75.18] - 2026-04-19
+
+- Update `vacuum@latest` to 0.26.1.
+
+- Update `wasm-tools@latest` to 1.247.0.
+
+- Update `mise@latest` to 2026.4.16.
+
+- Update `espup@latest` to 0.17.1.
+
+- Update `trivy@latest` to 0.70.0.
+
 ## [2.75.17] - 2026-04-17
 
 - Update `tombi@latest` to 0.9.18.
@@ -6293,7 +6319,8 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.17...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.18...HEAD
+[2.75.18]: https://github.com/taiki-e/install-action/compare/v2.75.17...v2.75.18
 [2.75.17]: https://github.com/taiki-e/install-action/compare/v2.75.16...v2.75.17
 [2.75.16]: https://github.com/taiki-e/install-action/compare/v2.75.15...v2.75.16
 [2.75.15]: https://github.com/taiki-e/install-action/compare/v2.75.14...v2.75.15

action.yml

@@ -22,7 +22,10 @@ runs:
   using: composite
   steps:
     - run: |
-        set -eu
+        if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
+          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          exit 1
+        fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
             printf '::group::Install packages required for install-action (bash)\n'
@@ -41,7 +44,7 @@ runs:
           fi
         fi
         bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: sh
+      shell: /usr/bin/env -u ENV -u BASH_ENV -u CDPATH -u SHELLOPTS -u BASHOPTS /bin/sh -eu {0} # zizmor: ignore[misfeature] false positive
       env:
         # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
@@ -54,6 +57,15 @@ runs:
     # https://github.com/actions/partner-runner-images/issues/169
     - run: |
         Set-StrictMode -Version Latest
+        if (Test-Path "Env:ENV") { Remove-Item Env:\ENV }
+        if (Test-Path "Env:BASH_ENV") { Remove-Item Env:\BASH_ENV }
+        if (Test-Path "Env:CDPATH") { Remove-Item Env:\CDPATH }
+        if (Test-Path "Env:SHELLOPTS") { Remove-Item Env:\SHELLOPTS }
+        if (Test-Path "Env:BASHOPTS") { Remove-Item Env:\BASHOPTS }
+        if (Test-Path "Env:BASH_FUNC_*") {
+          Write-Output "::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons"
+          exit 1
+        }
         for ($i=1; $i -le 10; $i++) {
           $prev_err_action = $ErrorActionPreference
           $ErrorActionPreference = "Continue"

main.sh

@@ -453,6 +453,51 @@ canonicalize_windows_path() {
   esac
 }
 
+if [[ $# -gt 0 ]]; then
+  bail "invalid argument '$1'"
+fi
+
+# Inputs
+tool="${INPUT_TOOL:-}"
+tools=()
+if [[ -n "${tool}" ]]; then
+  while read -rd,; do
+    tools+=("${REPLY}")
+  done < <(normalize_comma_or_space_separated "${tool}")
+fi
+if [[ ${#tools[@]} -eq 0 ]]; then
+  warn "no tool specified; this could be caused by a dependabot bug where @<tool_name> tags on this action are replaced by @<version> tags"
+  # Exit with 0 for backward compatibility.
+  # TODO: We want to reject it in the next major release.
+  exit 0
+fi
+
+enable_checksum="${INPUT_CHECKSUM:-}"
+case "${enable_checksum}" in
+  true) ;;
+  false)
+    enable_checksum=''
+    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
+    ;;
+  *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
+esac
+
+fallback="${INPUT_FALLBACK:-}"
+case "${fallback}" in
+  none | cargo-binstall | cargo-install) ;;
+  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
+esac
+
+# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
+# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
+token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
+# This prevents tokens from being exposed to subprocesses via environment variables.
+# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
+# set in the first place) remains the best practice from a security standpoint, as readme says.
+# Note that this does not prevent token leaks via reading `/proc/*/environ` on Linux or
+# via `ps -Eww` on macOS. It only reduces the risk of leaks.
+unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
+
 # Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
 base_distro=''
 exe=''
@@ -571,7 +616,7 @@ cargo_path=$(type -P cargo || true)
 if [[ "${host_os}" == "windows" ]]; then
   mkdir -p -- "${install_action_dir}"
   # See action.yml.
-  touch -- "${install_action_dir}"/init
+  printf '' >|"${install_action_dir}"/init
   if [[ -n "${cargo_path}" ]]; then
     info "cargo is located at ${cargo_path}"
     cargo_bin="${cargo_path%/*}"
@@ -591,52 +636,9 @@ fi
 export CARGO_NET_RETRY=10
 export RUSTUP_MAX_RETRIES=10
 
-if [[ $# -gt 0 ]]; then
-  bail "invalid argument '$1'"
-fi
-
 export DEBIAN_FRONTEND=noninteractive
 manifest_dir="${GITHUB_ACTION_PATH}/manifests"
 
-# Inputs
-tool="${INPUT_TOOL:-}"
-tools=()
-if [[ -n "${tool}" ]]; then
-  while read -rd,; do
-    tools+=("${REPLY}")
-  done < <(normalize_comma_or_space_separated "${tool}")
-fi
-if [[ ${#tools[@]} -eq 0 ]]; then
-  warn "no tool specified; this could be caused by a dependabot bug where @<tool_name> tags on this action are replaced by @<version> tags"
-  # Exit with 0 for backward compatibility.
-  # TODO: We want to reject it in the next major release.
-  exit 0
-fi
-
-enable_checksum="${INPUT_CHECKSUM:-}"
-case "${enable_checksum}" in
-  true) ;;
-  false)
-    enable_checksum=''
-    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
-    ;;
-  *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
-esac
-
-fallback="${INPUT_FALLBACK:-}"
-case "${fallback}" in
-  none | cargo-binstall | cargo-install) ;;
-  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
-esac
-
-# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
-# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
-token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
-# This prevents tokens from being exposed to subprocesses via environment variables.
-# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
-# set in the first place) remains the best practice from a security standpoint, as readme says.
-unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
-
 case "${host_os}" in
   linux)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null || ! type -P tar >/dev/null; then

manifests/cargo-xwin.json

@@ -17,6 +17,24 @@
   "latest": {
     "version": "0.21.5"
   },
+  "0.22.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F37C7CF1B98",
+      "hash": "a883bdc833df614978514485d00e6174fcc3a229bf0edc07bbea8762a0405e0b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F37FADC11D8",
+      "hash": "6a0ba0734f9c8af3c98338be34ad70a3010d1014b5e551134d3e087d46192ffd"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F38104A6015",
+      "hash": "2d0e46a28b2919e92f6952dcd88c9a8f9a1e6426a6ef1319ff3a6ccaef264774"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F37D403A82E",
+      "hash": "f4ec28c33817623c2f2638c11fc7f011d7ea2468d8b56ef590daa4032ee2e256"
+    }
+  },
   "0.21": {
     "version": "0.21.5"
   },

manifests/espup.json

@@ -18,7 +18,10 @@
     }
   },
   "latest": {
-    "version": "0.16.0"
+    "version": "0.17.1"
+  },
+  "0.17": {
+    "version": "0.17.1"
   },
   "0.17.1": {
     "x86_64_linux_gnu": {

manifests/just.json

@@ -21,10 +21,39 @@
     }
   },
   "latest": {
-    "version": "1.49.0"
+    "version": "1.50.0"
   },
   "1": {
-    "version": "1.49.0"
+    "version": "1.50.0"
+  },
+  "1.50": {
+    "version": "1.50.0"
+  },
+  "1.50.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6F41A84659",
+      "hash": "27e011cd6328fadd632e59233d2cf5f18460b8a8c4269acd324c1a8669f34db0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6F39943078",
+      "hash": "e4fa28fe63381ca32fad101e86d4a1da7cd2d34d1b080985a37ec9dc951922fe"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6F71190D2B",
+      "hash": "5dc713f049e174e22de41fd06292a26c9b90f2d37c1be9390d2082fe6928b376"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6F47F2EDF4",
+      "hash": "3beb4967ce05883cf09ac12d6d128166eb4c6d0b03eff74b61018a6880655d7d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6F49FBDCE5",
+      "hash": "891262207663bff1aa422dbe799a76deae4064eaa445f14eb28aef7a388222cd"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6F73FB889D",
+      "hash": "91065b94d11beb4b05c8117d8a736e978f41764d73131de35d8134c9ab9dee7a"
+    }
   },
   "1.49": {
     "version": "1.49.0"

manifests/martin.json

@@ -31,10 +31,31 @@
     }
   },
   "latest": {
-    "version": "1.5.0"
+    "version": "1.6.0"
   },
   "1": {
-    "version": "1.5.0"
+    "version": "1.6.0"
+  },
+  "1.6": {
+    "version": "1.6.0"
+  },
+  "1.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6794FD4A72",
+      "hash": "b71c6e5006ab152ebe6ee021ba3280dadc681a1e723f48109ac4317d34c7926e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6794344CFE",
+      "hash": "1a33cc0b9580ab5b7d9ba124113eb8db9cdd9191d6206a2e0d452d88b2ed40bc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6794361FAD",
+      "hash": "42ef50d65d62358e806827f78ef660ef58eba126a449a237cbd57ab727105ea0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6794327A4B",
+      "hash": "18afc12cdb9e84b095f26a260880ef488ea0185d6ff9821bb38d2b38d2b70d63"
+    }
   },
   "1.5": {
     "version": "1.5.0"

manifests/mise.json

@@ -27,13 +27,65 @@
     }
   },
   "latest": {
-    "version": "2026.4.15"
+    "version": "2026.4.18"
   },
   "2026": {
-    "version": "2026.4.15"
+    "version": "2026.4.18"
   },
   "2026.4": {
-    "version": "2026.4.15"
+    "version": "2026.4.18"
+  },
+  "2026.4.18": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E2E39FC992B",
+      "hash": "dcb0187879dcd8adb0f26279f08f9b06f7b78fa3fea3fb95ffd4db72375201f4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2E3C75312A",
+      "hash": "78b95c4a26d4c7f2bbda91dc119e1001eae33aade428f134dc6f1b6857a02cce"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2E3D783715",
+      "hash": "0651d43232b99d579f63ee83fa745f2418b37ae187b3f82322e9a2fd2192fe9f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E2E36AB5E0A",
+      "hash": "a451af75120d69139c3a88622299a893c2ef6eabdc80ec1226e2296ab6cc3432"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E2E3B93975F",
+      "hash": "65b8e5f3a8654d725ff3af7781e447e2ed130dcdf412ee937cbd43ef64bb7629"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2E3D5D7A28",
+      "hash": "b2107c8a8a21ae6bf7d9e89efdb60a814864dd7b99c7770175896273bb798c0e"
+    }
+  },
+  "2026.4.17": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9D70541A0D1C",
+      "hash": "5c661249b75506bdc0a133d91460544b9a0c096c40cdb60a5c8d9e60bc144897"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9D705805C8FD",
+      "hash": "7925831a68bb119ae0a744408ab646b476f6309720b46d7f5ab466613ca7ada8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9D705A337B82",
+      "hash": "51bf2412db91411717e5b34bfdf4ec86428abe20de5115c71c3c2ae96baee5de"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9D704E988A27",
+      "hash": "e9e47b246b73f84348736f48e909424865a01d0d5e853df51d77da33d53ae84d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9D7056DA3305",
+      "hash": "ac0251f8ccbd48de250aa866a05637b74439b22f815a894bd47fce5d52e209e7"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9D7059853AF9",
+      "hash": "efbeb472c5e30ec6715ff3722a099c70191da00a2324cfdae16c4c2af3e55103"
+    }
   },
   "2026.4.16": {
     "x86_64_linux_musl": {

manifests/prek.json

@@ -44,6 +44,40 @@
   "0.3": {
     "version": "0.3.9"
   },
+  "0.3.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9F997FFD1858",
+      "hash": "60a873474e2ff2f70a5ad524d1b51abb6fdf5991900001eb7c8979877d75dacd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9F997F77B599",
+      "hash": "313882a8bfd76eb6930949ded36b23ce194ccb5431f474c62ae3fde12df100ae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9F997FB515C3",
+      "hash": "43b85e061bbcf6febb9973a7859d029f29f5ddeeb7722bd234422d8b6bee4406"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9F997DF1BB18",
+      "hash": "50e585ce98988b70d79ec782b2cf6c787c2f0a97a448ba8594448b4a6a688943"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9F997DB040DC",
+      "hash": "e885e023ddb765ba31a2859bd4b9683f9b40fee3195c189a749bc4b28535ab5c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9F997D9866DE",
+      "hash": "4a6de3ff0fc2049ca72b8ab0ec567e195362a22c7efcca7ef0824b36b55d4193"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9F997F2903CC",
+      "hash": "029ba9576b560753b0a4374ace6c5df6808e3e935ae0d4a67a5935debc12dbd4"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9F997F6EE5E2",
+      "hash": "bfe0c951b48cca6f91a85f83ec94a59cc567df988c0a7f23c0f34de0a232e08c"
+    }
+  },
   "0.3.9": {
     "x86_64_linux_musl": {
       "etag": "0x8DE9958BFB91B93",

manifests/rclone.json

@@ -27,13 +27,39 @@
     }
   },
   "latest": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1": {
-    "version": "1.73.4"
+    "version": "1.73.5"
   },
   "1.73": {
-    "version": "1.73.4"
+    "version": "1.73.5"
+  },
+  "1.73.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E0C3BBE3A4E",
+      "hash": "932cf4b7484de74d82b4875488e0009469fd21f9904673385184520fe11a1bf0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E0D0D15BEE0",
+      "hash": "19c709563e455d8f8e343d5521e741afa7a77e37c6552ad8f7b03034f8bc214b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E0D47EF790D",
+      "hash": "201567c54304935112b06dfac4ad754786287fb5acfad8889feca8d1cdeba92b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E0C537CFE99",
+      "hash": "8d465c921d95b2f54c5f2e79b24c97742ebc2082a0b8709a686361bed5ba7932"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E0D1603AE83",
+      "hash": "b9e265eb7a098743d0726c05c73fe207d355950fb8481e0b226c0c00173da1e8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E0D4F7F62B7",
+      "hash": "8805406a984115e7cfe3b021a20a983b7060a70f198484cf373d687b6f625923"
+    }
   },
   "1.73.4": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -21,10 +21,62 @@
     }
   },
   "latest": {
-    "version": "0.9.18"
+    "version": "0.9.20"
   },
   "0.9": {
-    "version": "0.9.18"
+    "version": "0.9.20"
+  },
+  "0.9.20": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E6CBAC4C2D3",
+      "hash": "9899e24f8dafe0ef63347b974704fdbbc9ab1e6a2346ad8ec629ff458746160a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E6CBA55DC08",
+      "hash": "cd793862d7916fefd92888f2441b20f8cce3d119cc5ed793da463ec6839b21fa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E6CBA72E04B",
+      "hash": "974170e908df51e169a4f773680f5eb857c5a483b6c2075933e779d8e366d8c5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E6CBA53E270",
+      "hash": "46a4cc79deae036def85651e36111225de2f11c6e2ff6e1d9c27ae8f3955a6aa"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E6CBAE5459D",
+      "hash": "083523aeca0491787b773bb0fa719d36d918ba93ef405781f29e1b944e91915a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E6CBA571327",
+      "hash": "a72878a31f80a17db242d122c831ab0a3e53caafd5083b428409356e10737d33"
+    }
+  },
+  "0.9.19": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9E27872323BF",
+      "hash": "3a3d6523e1c39e76ffe9da8561ba48b01ffc8f885912813140afdb718c34d0c0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9E2787CADC04",
+      "hash": "8b6e09d368b4adbeac18df1a21768d960ac3debd5d2a183040c5b2ac37722eae"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9E2787284E16",
+      "hash": "a04b6628a90e26d10dc2dda7ded6423e2f51a870551c8547f7c08678ffa3cd8c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9E27871FCC29",
+      "hash": "ffa0b3b1f11161d28ac962388e3533d6ecb66c26c4b96694c64930ff2b4d0e6f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E278721C5C2",
+      "hash": "93cb44dc5c6c74b4e808d4490fec3b0be4a39e9550ba16d4c4140bb5b4945e3a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9E2787B8A0FD",
+      "hash": "f93b714cb412e71d2ba3467e3b716d0821e3424fc60f9736e24a1c0156098c20"
+    }
   },
   "0.9.18": {
     "x86_64_linux_musl": {

manifests/trivy.json

@@ -31,7 +31,10 @@
     }
   },
   "latest": {
-    "version": "0.69.3"
+    "version": "0.70.0"
+  },
+  "0.70": {
+    "version": "0.70.0"
   },
   "0.70.0": {
     "x86_64_linux_gnu": {

manifests/vacuum.json

@@ -21,7 +21,36 @@
     }
   },
   "latest": {
-    "version": "0.25.9"
+    "version": "0.26.1"
+  },
+  "0.26": {
+    "version": "0.26.1"
+  },
+  "0.26.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9CB74E5A88FF",
+      "hash": "e5981c4df9adfe21ab63cd8d00b073b2f11d09dc7382763da6a4ee00810bdcc2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9CB74E5AAFE2",
+      "hash": "d1b778986b4e5aba1f533f340c8793a223880ee75f9f619c85e1cd7f06be7e65"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9CB74DAAC329",
+      "hash": "84d518e42fd436b64deef747e10b14efd54f295fc88af607fa79e78a9dac83aa"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9CB74DA2B5DE",
+      "hash": "48a32e9affd6b37904565fcaa83f31463f523697fd19cc87d27e1fbad8f76614"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9CB74E5510F4",
+      "hash": "d45dbc463b5cb77e440800bd8e47f735d5a97745615e5b77d1b0df850c81354b"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9CB74DA1A5A8",
+      "hash": "158e29510ae726ffd77a9c2278ff83f1ccb995835209000aeeedd88a51f08bd3"
+    }
   },
   "0.26.0": {
     "x86_64_linux_musl": {

manifests/wasm-tools.json

@@ -23,10 +23,13 @@
     }
   },
   "latest": {
-    "version": "1.246.2"
+    "version": "1.247.0"
   },
   "1": {
-    "version": "1.246.2"
+    "version": "1.247.0"
+  },
+  "1.247": {
+    "version": "1.247.0"
   },
   "1.247.0": {
     "x86_64_linux_gnu": {

manifests/wasmtime.json

@@ -37,6 +37,40 @@
   "latest": {
     "version": "43.0.1"
   },
+  "44.0.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9EECC1A2BBAE",
+      "hash": "52eba06fe9f4364aa6164a4a3eafb2ca692ba9a756cbe8137b5574871f8cbfc8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9EECC1F8DF49",
+      "hash": "cd8043448157abc72fa1bd1b9e66ede23e48fefbab80b2744763d25b65f69662"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9EECC356232C",
+      "hash": "6139de7554514c2df1e30cec9b1e6ca493685ece23a039f987b55bf32bc42a57"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9EECBE872014",
+      "hash": "294cae921fb88cbbcb60a914eaaaf313df3249d718609afb5804186b3f1912f5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9EECBEC6A0D2",
+      "hash": "38a3b9d9fe64cee21bc9d9268e2c19fa35a7be59e030717545b84da0e6514eab"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9EECBF6FB731",
+      "hash": "34d9e5b42b18893649c895d7794cad8866b82d1382fb5f2953ccf1306853a237"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9EECC08BF58F",
+      "hash": "6e747f4ec40b1c5959ff002f147cbf1487a667cce42b690ad907ff0aefb0c707"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9EECC0E549D0",
+      "hash": "2bbbaeb0114c7ca4c6b9f9cceed616cb19858f961ab34bab899e2c3e86d22d31"
+    }
+  },
   "43": {
     "version": "43.0.1"
   },

tools/tidy.sh

@@ -27,14 +27,14 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
   image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:bce85a4321f80c09f2b68420e9149bcf7c085130ab1e1fca54443f76833cd184"
+  image="ghcr.io/taiki-e/tidy@sha256:71def761a5585e83a2672c4051aee13cd886ad5571215aee52f193454bb3cdff"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
 tmp=$(mktemp -d)
 trap -- 'rm -rf -- "${tmp:?}"' EXIT
 mkdir -p -- "${tmp}"/{pwsh-cache,pwsh-local,zizmor-cache,dummy-dir,tmp}
-touch -- "${tmp}"/dummy
+printf '' >"${tmp}"/dummy
 code=0
 color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then