Release 2.75.11

https://github.com/cargo-bins/cargo-binstall/pull/2533

.github/.cspell/project-dictionary.txt

@@ -36,6 +36,7 @@ sccache
 SHASUMS
 shortstat
 sigstore
+startswith
 syft
 tombi
 udeps

.github/workflows/ci.yml

@@ -33,20 +33,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@606d6c78d69927c489d319133073a03157928a7a # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@dec917193d835117a7238865adf83273d9fcd27a # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@606d6c78d69927c489d319133073a03157928a7a # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@dec917193d835117a7238865adf83273d9fcd27a # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@606d6c78d69927c489d319133073a03157928a7a # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@dec917193d835117a7238865adf83273d9fcd27a # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@606d6c78d69927c489d319133073a03157928a7a # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@dec917193d835117a7238865adf83273d9fcd27a # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -181,9 +181,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        fallback:
-          - none
-          - cargo-install
+        include:
+          - fallback: none
+          - fallback: cargo-install
+          - fallback: cargo-binstall
+          - fallback: cargo-binstall
+            version: 0.3
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 60
     steps:
@@ -195,7 +198,7 @@ jobs:
         id: install
         continue-on-error: ${{ matrix.fallback == 'none' }}
         with:
-          tool: parse-changelog@0.4.6
+          tool: parse-changelog@${{ matrix.version || '0.4.6' }}
           fallback: ${{ matrix.fallback }}
       - run: exit 1
         if: matrix.fallback == 'none' && steps.install.outcome != 'failure'

.github/workflows/manifest.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@7e4093bf4e87dd120ac0c3be2e47ebe7f737a47d # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@dec917193d835117a7238865adf83273d9fcd27a # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@7a562dfa955aa2e4d5b0fd6ebd57ff9715c07b0b # v2.73.0
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
         with:
           tool: parse-changelog
           fallback: none
@@ -208,7 +208,7 @@ jobs:
       contents: write # for taiki-e/create-gh-release-action
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@7a562dfa955aa2e4d5b0fd6ebd57ff9715c07b0b # v2.73.0
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
         with:
           tool: parse-changelog
           fallback: none
@@ -304,6 +304,50 @@ jobs:
             )
           fi
 
+          major_version_tag="v${version%%.*}"
+          (
+            set -x
+            git tag "${tag}"
+            git branch "releases/${major_version_tag}"
+            git tag -f "${major_version_tag}"
+          )
+          refs=("refs/heads/${BRANCH}" "refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
+
+          tools=()
+          for tool in tools/codegen/base/*.json; do
+            tool="${tool##*/}"
+            tools+=("${tool%.*}")
+          done
+          # Aliases.
+          # NB: Update case for aliases in main.sh, tool input option in test-alias job
+          # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
+          tools+=(
+            nextest
+            taplo-cli
+            typos-cli
+            wasm-bindgen-cli
+            wasmtime-cli
+          )
+          # Non-manifest-based tools.
+          tools+=(valgrind)
+
+          branches=()
+          for tool in "${tools[@]}"; do
+            (
+              set -x
+              git checkout -b "releases/${tool}"
+              sed -E "${in_place[@]}" action.yml \
+                -e "s/required: true/required: false/g" \
+                -e "s/# default: #publish:tool/default: ${tool}/g"
+              git add action.yml
+              git commit -m "${tool}"
+              git tag -f "${tool}"
+              git checkout refs/tags/"${tag}"
+            )
+            refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
+            branches+=("releases/${tool}")
+          done
+
           prev_credential_helper=$(git config get --local credential.helper || true)
           if [[ -n "${prev_credential_helper}" ]]; then
             printf 'credential helper is already set (%s)\n' "${prev_credential_helper}"
@@ -326,46 +370,6 @@ jobs:
 
           (
             set -x
-            git tag "${tag}"
-            retry git push origin HEAD
-
-            major_version_tag="v${version%%.*}"
-            git branch "releases/${major_version_tag}"
-            git tag -f "${major_version_tag}"
-            refs=("refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
-
-            tools=()
-            for tool in tools/codegen/base/*.json; do
-              tool="${tool##*/}"
-              tools+=("${tool%.*}")
-            done
-            # Aliases.
-            # NB: Update case for aliases in main.sh, tool input option in test-alias job
-            # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
-            tools+=(
-              nextest
-              taplo-cli
-              typos-cli
-              wasm-bindgen-cli
-              wasmtime-cli
-            )
-            # Non-manifest-based tools.
-            tools+=(valgrind)
-
-            branches=()
-            for tool in "${tools[@]}"; do
-              git checkout -b "releases/${tool}"
-              sed -E "${in_place[@]}" action.yml \
-                -e "s/required: true/required: false/g" \
-                -e "s/# default: #publish:tool/default: ${tool}/g"
-              git add action.yml
-              git commit -m "${tool}"
-              git tag -f "${tool}"
-              git checkout refs/tags/"${tag}"
-              refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
-              branches+=("releases/${tool}")
-            done
-
             retry git push origin --atomic "${refs[@]}"
             git branch -d "releases/${major_version_tag}"
             git branch -D "${branches[@]}"
@@ -432,7 +436,7 @@ jobs:
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@606d6c78d69927c489d319133073a03157928a7a # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@dec917193d835117a7238865adf83273d9fcd27a # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action

.github/zizmor.yml

@@ -2,5 +2,5 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  anonymous-definition: { disable: true }
+  anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
   dependabot-cooldown: { config: { days: 14 } }

CHANGELOG.md

@@ -10,6 +10,76 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.75.11] - 2026-04-14
+
+- Update `prek@latest` to 0.3.9.
+
+- Update `mise@latest` to 2026.4.11.
+
+- Update `zizmor@latest` to 1.24.0.
+
+## [2.75.10] - 2026-04-13
+
+- Update `tombi@latest` to 0.9.17.
+
+- Update `mise@latest` to 2026.4.10.
+
+## [2.75.9] - 2026-04-13
+
+- Enhance security when cargo-binstall fallback is used. ([acc1621b](https://github.com/taiki-e/install-action/commit/acc1621b4419c9cf5d2361f3dd3bedcc288c6c43))
+
+## [2.75.8] - 2026-04-13
+
+- Update `vacuum@latest` to 0.25.8.
+
+- Update `mise@latest` to 2026.4.9.
+
+- Update `cargo-binstall@latest` to 1.18.0.
+
+- Update `gungraun-runner@latest` to 0.18.1.
+
+## [2.75.7] - 2026-04-11
+
+- Update `covgate@latest` to 0.1.4.
+
+- Update `wasm-bindgen@latest` to 0.2.118.
+
+## [2.75.6] - 2026-04-11
+
+- Update `mise@latest` to 2026.4.8.
+
+- Update `cargo-deny@latest` to 0.19.1.
+
+## [2.75.5] - 2026-04-10
+
+- Update `biome@latest` to 2.4.11.
+
+- Update `wasmtime@latest` to 43.0.1.
+
+- Update `uv@latest` to 0.11.6.
+
+- Update `mise@latest` to 2026.4.7.
+
+- Update `gungraun-runner@latest` to 0.18.0.
+
+## [2.75.4] - 2026-04-10
+
+- Enhance security when cargo-binstall fallback is enabled. ([08a38582](https://github.com/taiki-e/install-action/commit/08a38582e35739e1fda5e4cd298e348536a1ddaa), [ba626b4d](https://github.com/taiki-e/install-action/commit/ba626b4d71edcae17f6ca956b7b81e925b2d24ef))
+
+- Update `martin@latest` to 1.5.0.
+
+- Update `uv@latest` to 0.11.5.
+
+- Update `syft@latest` to 1.42.4.
+
+- Update `dprint@latest` to 0.54.0.
+
+## [2.75.3] - 2026-04-09
+
+- Enhance security when cargo-binstall fallback is disabled. ([77557fa3](https://github.com/taiki-e/install-action/commit/77557fa3993e075c27572045b0d159865c23016b))
+
+- Update `rclone@latest` to 1.73.4.
+
 ## [2.75.2] - 2026-04-09
 
 - Update `uv@latest` to 0.11.4.
@@ -6179,7 +6249,16 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.2...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.11...HEAD
+[2.75.11]: https://github.com/taiki-e/install-action/compare/v2.75.10...v2.75.11
+[2.75.10]: https://github.com/taiki-e/install-action/compare/v2.75.9...v2.75.10
+[2.75.9]: https://github.com/taiki-e/install-action/compare/v2.75.8...v2.75.9
+[2.75.8]: https://github.com/taiki-e/install-action/compare/v2.75.7...v2.75.8
+[2.75.7]: https://github.com/taiki-e/install-action/compare/v2.75.6...v2.75.7
+[2.75.6]: https://github.com/taiki-e/install-action/compare/v2.75.5...v2.75.6
+[2.75.5]: https://github.com/taiki-e/install-action/compare/v2.75.4...v2.75.5
+[2.75.4]: https://github.com/taiki-e/install-action/compare/v2.75.3...v2.75.4
+[2.75.3]: https://github.com/taiki-e/install-action/compare/v2.75.2...v2.75.3
 [2.75.2]: https://github.com/taiki-e/install-action/compare/v2.75.1...v2.75.2
 [2.75.1]: https://github.com/taiki-e/install-action/compare/v2.75.0...v2.75.1
 [2.75.0]: https://github.com/taiki-e/install-action/compare/v2.74.1...v2.75.0

README.md

@@ -102,6 +102,10 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.
 
+The default fallback (cargo-binstall) is often affected by GitHub's API rate limits, so we [pass the `${{ github.token }}` to cargo-binstall](https://github.com/taiki-e/install-action/issues/561). Disabling the cargo-binstall fallback prevent passing token so helps enhance security.
+
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
+
 <!-- omit in toc -->
 ### Security on installation from GitHub Releases
 

action.yml

@@ -47,7 +47,7 @@ runs:
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
         INPUT_FALLBACK: ${{ inputs.fallback }}
-        DEFAULT_GITHUB_TOKEN: ${{ github.token }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
       if: runner.os != 'Windows'
     # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
@@ -77,6 +77,6 @@ runs:
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
         INPUT_FALLBACK: ${{ inputs.fallback }}
-        DEFAULT_GITHUB_TOKEN: ${{ github.token }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
       if: runner.os == 'Windows'

main.sh

@@ -236,7 +236,7 @@ read_manifest() {
   local version="$2"
   local manifest
   rust_crate=$(jq -r '.rust_crate' "${manifest_dir}/${tool}.json")
-  manifest=$(jq -r ".[\"${version}\"]" "${manifest_dir}/${tool}.json")
+  manifest=$(jq -r --arg version "${version}" '.[$version]' "${manifest_dir}/${tool}.json")
   if [[ "${manifest}" == "null" ]]; then
     download_info="null"
     return 0
@@ -245,7 +245,7 @@ read_manifest() {
   if [[ "${exact_version}" == "null" ]]; then
     exact_version="${version}"
   else
-    manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+    manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
     if [[ "${rust_crate}" != "null" ]]; then
       # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
       case "${tool}" in
@@ -253,7 +253,7 @@ read_manifest() {
           crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
           if [[ -n "${crate_info}" ]]; then
             while true; do
-              yanked=$(jq -r ".versions[] | select(.num == \"${exact_version}\") | .yanked" <<<"${crate_info}")
+              yanked=$(jq -r --arg version "${exact_version}" '.versions[] | select(.num == $version) | .yanked' <<<"${crate_info}")
               if [[ "${yanked}" != "true" ]]; then
                 break
               fi
@@ -263,7 +263,7 @@ read_manifest() {
               fi
               info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
               exact_version="${previous_stable_version}"
-              manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+              manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
             done
           fi
           ;;
@@ -277,14 +277,14 @@ read_manifest() {
       # usually preferred over linux-gnu binaries because they can avoid glibc version issues.
       # (rustc enables statically linking for linux-musl by default, except for mips.)
       host_platform="${host_arch}_linux_musl"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       if [[ "${download_info}" == "null" ]]; then
         # Even if host_env is musl, we won't issue an error here because it seems that in
         # some cases linux-gnu binaries will work on linux-musl hosts.
         # https://wiki.alpinelinux.org/wiki/Running_glibc_programs
         # TODO: However, a warning may make sense.
         host_platform="${host_arch}_linux_gnu"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       elif [[ "${host_env}" == "gnu" ]]; then
         # TODO: don't hardcode tool name and use 'prefer_linux_gnu' field in base manifest.
         case "${tool}" in
@@ -296,7 +296,7 @@ read_manifest() {
               # musl build of nextest is slow, so use glibc build if host_env is gnu.
               # https://github.com/taiki-e/install-action/issues/13
               host_platform="${host_arch}_linux_gnu"
-              download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+              download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
             fi
             ;;
         esac
@@ -306,10 +306,10 @@ read_manifest() {
       # Binaries compiled for x86_64 macOS will usually also work on AArch64 macOS.
       # Binaries compiled for x86_64 Windows will usually also work on AArch64 Windows 11+.
       host_platform="${host_arch}_${host_os}"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       if [[ "${download_info}" == "null" ]] && [[ "${host_arch}" != "x86_64" ]]; then
         host_platform="x86_64_${host_os}"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       fi
       ;;
     *) bail "unsupported OS type '${host_os}' for ${tool}" ;;
@@ -327,7 +327,7 @@ read_download_info() {
   bin_in_archive=()
   if [[ "${url}" == "null" ]]; then
     local template
-    template=$(jq -c ".template.${host_platform}" "${manifest_dir}/${tool}.json")
+    template=$(jq -c --arg p "${host_platform}" '.template[$p]' "${manifest_dir}/${tool}.json")
     template="${template//\$\{version\}/${exact_version}}"
     url=$(jq -r '.url' <<<"${template}")
     tmp=$(jq -r '.bin' <<<"${template}")
@@ -627,6 +627,14 @@ case "${fallback}" in
   *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
 esac
 
+# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
+# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
+token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
+# This prevents tokens from being exposed to subprocesses via environment variables.
+# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
+# set in the first place) remains the best practice from a security standpoint, as readme says.
+unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
+
 case "${host_os}" in
   linux)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null || ! type -P tar >/dev/null; then
@@ -917,13 +925,68 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
   case "${fallback}" in
     cargo-binstall)
       install_cargo_binstall
-      if [[ -z "${GITHUB_TOKEN:-}" ]] && [[ -n "${DEFAULT_GITHUB_TOKEN:-}" ]]; then
-        export GITHUB_TOKEN="${DEFAULT_GITHUB_TOKEN}"
-      fi
       # By default, cargo-binstall enforce downloads over secure transports only.
       # As a result, http will be disabled, and it will also set
       # min tls version to be 1.2
-      cargo-binstall binstall --force --no-confirm --locked "${unsupported_tools[@]}"
+      binstall_args=(
+        --force
+        --no-confirm
+        --locked
+        # Since the build script can access the token when `cargo install` is called
+        # within `cargo-binstall`, disables building from source in cargo-binstall
+        # and fallback to `cargo install` which doesn't need the token.
+        # TODO: once https://github.com/cargo-bins/cargo-binstall/pull/2533 merged,
+        # we can remove this and use batch install again.
+        --disable-strategies compile
+      )
+      unsupported_tools2=()
+      for tool in "${unsupported_tools[@]}"; do
+        if [[ -n "${token}" ]]; then
+          if ! GITHUB_TOKEN="${token}" cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        else
+          if ! cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        fi
+      done
+      if [[ ${#unsupported_tools2[@]} -gt 0 ]]; then
+        for tool in "${unsupported_tools2[@]}"; do
+          # This logic is from cache-cargo-install-action.
+          cargo_args=(--locked)
+          if [[ "${tool}" == *"@"* ]]; then
+            version="${tool#*@}"
+            tool="${tool%@*}"
+            if [[ ! "${version}" =~ ^([1-9][0-9]*\.[0-9]+\.[0-9]+|0\.[1-9][0-9]*\.[0-9]+|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+              if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${tool}")
+              if [[ ! "${version}" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              # shellcheck disable=SC2207
+              versions=($(jq -r --arg start "${version}." '.versions[] | select(.num | startswith($start)) | select(.yanked == false) | .num' <<<"${crate_info}"))
+              full_version=''
+              for v in ${versions[@]+"${versions[@]}"}; do
+                if [[ "${v}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z\.-]+)?$ ]]; then
+                  full_version="${v}"
+                  break
+                fi
+              done
+              if [[ -z "${full_version}" ]]; then
+                bail "no stable version found for ${tool} that match with '${version}.*'; if you want to install a pre-release version, please specify the full version"
+              fi
+              version="${full_version}"
+            fi
+            cargo_args+=(--version "${version}")
+          fi
+          cargo install "${cargo_args[@]}" "${tool}"
+        done
+      fi
       if ! type -P cargo >/dev/null; then
         _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
         # TODO: avoid this when already added

manifests/biome.json

@@ -3,13 +3,51 @@
   "template": null,
   "license_markdown": "[Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "2.4.10"
+    "version": "2.4.11"
   },
   "2": {
-    "version": "2.4.10"
+    "version": "2.4.11"
   },
   "2.4": {
-    "version": "2.4.10"
+    "version": "2.4.11"
+  },
+  "2.4.11": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-linux-x64-musl",
+      "etag": "0x8DE9656A2924E77",
+      "hash": "f10d041ae17c8d4d659950941fec862dc342945ab3af811e3e90bd93770c08e6",
+      "bin": "biome"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-darwin-x64",
+      "etag": "0x8DE9656A24F9CFE",
+      "hash": "9069156955cfd53efc273cfcd4ece85a7af2ed715d20a8717a63bde3e05b5a40",
+      "bin": "biome"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-win32-x64.exe",
+      "etag": "0x8DE9656A2C64373",
+      "hash": "6c626fdf119215234cbe51455b07995eb67b24ada85819d9273a02b7c6770fbd",
+      "bin": "biome.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-linux-arm64-musl",
+      "etag": "0x8DE9656A253B713",
+      "hash": "f58e2abd4fa737b90d1d9a4f2a3e87af1583df064b9ec14a10b34f4f34f61d88",
+      "bin": "biome"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-darwin-arm64",
+      "etag": "0x8DE9656A22891CD",
+      "hash": "9de8fa513c170b33933f397e4906eb4f8af21890aa5f36a36db22df3d9ed1978",
+      "bin": "biome"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-win32-arm64.exe",
+      "etag": "0x8DE9656A280D5F1",
+      "hash": "a0b928f3894dfaea97906974e30785948e44e9fbab8b3d86897fb7da55ab36a9",
+      "bin": "biome.exe"
+    }
   },
   "2.4.10": {
     "x86_64_linux_musl": {

manifests/cargo-binstall.json

@@ -22,32 +22,32 @@
   },
   "license_markdown": "[GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE)",
   "latest": {
-    "version": "1.17.9"
+    "version": "1.18.0"
   },
-  "1.17.9": {
+  "1.18.0": {
     "x86_64_linux_musl": {
-      "etag": "0x8DE8D54CBD7C8ED",
-      "hash": "bdea3fd820b118576316bf69c8240f454857287717809e6ecef010faace901ff"
+      "etag": "0x8DE98AE6D18E96D",
+      "hash": "7ca2de024161eb95b0207475e931cca7ffa8aae1567811b2dc5e18581f2fe216"
     },
     "x86_64_macos": {
-      "etag": "0x8DE8D54D0C7EA49",
-      "hash": "1d4fbd74c15274a029dd92e19a0ead8e1831b6e6b60f0f5c3690ef517022c41c"
+      "etag": "0x8DE98AE7368B908",
+      "hash": "f6014ff3c1fd2c2a744005b370ee3e271ef7d2b7d5c68fa49da17d66de3d714d"
     },
     "x86_64_windows": {
-      "etag": "0x8DE8D54CF270B9E",
-      "hash": "d17b413a19592af2cf57f9f742d49bef8837099e1407d73e79de5bc7834c4fd6"
+      "etag": "0x8DE98AE715AC769",
+      "hash": "0458444c42221fd6d89785ea438cab9bedebdfe93425f0ea31e6bb53b7b9db9f"
     },
     "aarch64_linux_musl": {
-      "etag": "0x8DE8D54D9B48785",
-      "hash": "89df253cc00a307209daee7648272bba4d8a342fce084d5922f6b3f4e4db0e25"
+      "etag": "0x8DE98AE7E2AB5E8",
+      "hash": "a59b465665e3a4ce54d2039f858217b68b2d972cb6bd189995f56a76f43418fd"
     },
     "aarch64_macos": {
-      "etag": "0x8DE8D54DF4E885F",
-      "hash": "021d537caa2071bbcd8ec50b210ea45af68a6983cca7780918b3603ef68d2585"
+      "etag": "0x8DE98AE86092802",
+      "hash": "2e5196f9039089f7df6f20443ce430fd91c3795725911fcc59847ea8cccb6b3d"
     },
     "aarch64_windows": {
-      "etag": "0x8DE8D54DD746155",
-      "hash": "37295aa1c3aed07bda2b757f613477c8ca2de1208ec360c7d00238b6886de780"
+      "etag": "0x8DE98AE8376BD4D",
+      "hash": "a1b61dd998338c9c71abb169850e8de9c436dd1db901498c05287fc18c7169b9"
     }
   }
 }

manifests/cargo-deny.json

@@ -24,10 +24,54 @@
   },
   "license_markdown": "[MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.19.0"
+    "version": "0.19.1"
   },
   "0.19": {
-    "version": "0.19.0"
+    "version": "0.19.1"
+  },
+  "0.19.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE99FE8DE28F6D",
+      "hash": "0c722daba6e38497a008c75f9232578481f0a1ad621d99865024a68204f18cc7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99FE88C77055",
+      "hash": "b73dc84685920324f0092e2ade445be5d8d2581f409454241c38135b1a34ff68"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE99FECCC8BC39",
+      "hash": "27d2584ad4edee4d481852a5b62748059863c9fb623d238a76c87b0c1cf4dca6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE99FEAFD6114C",
+      "hash": "8de0b4774ed6236a21dd5a4407bd98acf814073b58fbe4fb60a792e5bacac07b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE99FE6BE18845",
+      "hash": "35e715486a78c0583c05a8cfe136c54b7e4e20e43bf01d91d345f80dfd345076"
+    }
+  },
+  "0.19.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE96F183A112FE",
+      "hash": "baa0d618ce06bd1fb352115de47e31acba439c3e639b990dc43429c948364d70"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96F1880BF6C5",
+      "hash": "aaf5970ea5241cbf552fc14dea1e8cc788b25a6b3d77f2729692964d0f4142c8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96F1B5ECB7E2",
+      "hash": "0b60886df60629e68511bc2445d249d3646390db47e78f60ea8094606f4b606a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96F18AF78F66",
+      "hash": "8f09b71258750bc58c828e47bb73d75500a43feea3c07af923002ca4869c2be1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96F1661BFBFD",
+      "hash": "d8a162b2595117101b6769ba678bd3396e5d3fcb49612f385d7a9f6acf1c30b4"
+    }
   },
   "0.19.0": {
     "x86_64_linux_musl": {

manifests/cargo-xwin.json

@@ -21,6 +21,24 @@
   "0.21": {
     "version": "0.21.4"
   },
+  "0.21.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE996AB7D4D4DC",
+      "hash": "42928296cfaaede33b85cc1b96c0db424070f32dfbd5c0a2abbd6d0d64f05334"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE996A9D6EC9D6",
+      "hash": "68824cbab61a1f16b9648eb82637de2ecb4b1e7b590e10808b7f11fb60c5a5b0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE996A6C11905B",
+      "hash": "05664cc1dcebb2529a26c876957738abc7bf9e5bad53c8de82e0696bb68cacd5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE996A75B99E58",
+      "hash": "5af6421d4970a0c289d60f5cd79023cade9a83ba25a8495e8d401a45095ffcc1"
+    }
+  },
   "0.21.4": {
     "x86_64_linux_musl": {
       "etag": "0x8DE600B46A93E96",

manifests/covgate.json

@@ -20,10 +20,28 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE)",
   "latest": {
-    "version": "0.1.3"
+    "version": "0.1.4"
   },
   "0.1": {
-    "version": "0.1.3"
+    "version": "0.1.4"
+  },
+  "0.1.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE97290157DE06",
+      "hash": "443bcdb2d5bd550c374f9721a6663a42d0d402955cbd32bb61b3b875a04bc80f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9729014F3532",
+      "hash": "fcd6971cbcb58181b85042f6f80eb2a4e05bccfa1450aa203083dd6f95a14254"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE97290159FE80",
+      "hash": "15477ecb35695955ebaf6677a18a94fe5ac50dadc9985f277651e5c9b0ea4471"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9729015A4C45",
+      "hash": "af6713df579260053b1b5054f0750febc8e456ba54041154900fe19cf51f3160"
+    }
   },
   "0.1.3": {
     "x86_64_linux_musl": {

manifests/dprint.json

@@ -28,7 +28,10 @@
   },
   "license_markdown": "[MIT](https://github.com/dprint/dprint/blob/main/LICENSE)",
   "latest": {
-    "version": "0.53.2"
+    "version": "0.54.0"
+  },
+  "0.54": {
+    "version": "0.54.0"
   },
   "0.54.0": {
     "x86_64_linux_musl": {

manifests/gungraun-runner.json

@@ -24,7 +24,54 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/gungraun/gungraun/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/gungraun/gungraun/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.17.2"
+    "version": "0.18.1"
+  },
+  "0.18": {
+    "version": "0.18.1"
+  },
+  "0.18.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9748264D41CC",
+      "hash": "8e085908f9de28f4e4b599f171aff61e72342481c5af3a8086ed800be8e17a35"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE97471C4DE6D4",
+      "hash": "46b29d7bb529062256b28eca27d26c6f5ca1943a627f9dd024d7641b604ecf11"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE974857C237F9",
+      "hash": "c7833abfdd55440b8be85e854e7b673c6cd8933c85517eb6309dfee31079f4a7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE974839AFEA4F",
+      "hash": "3374713f6e77b0f5329674a9d03bc0ed9ee5e899a9ad0d23382cff247097e8e0"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE97483DFFED3C",
+      "hash": "997d992f59088c1d7b77cc4906f5c28fcbc1c59e01ecd5442ebcdeae9e47d87c"
+    }
+  },
+  "0.18.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9642F0CF107C",
+      "hash": "6bc46e9b0b9df0a13897c277c9c529488e1746b5f6ad6fa33b966f4f395bec28"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9642F5351AC4",
+      "hash": "9ffe79ab8523c1ada9a52c1352333d6499cd26fabb60d9ba6a8eeb1ab4102dc2"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9642F38861F9",
+      "hash": "6b2ddd799fec1517aee95fd03eb021e125b46690c679d29d54824b87b97c61fe"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9642EC2FBFDC",
+      "hash": "8bf2263ac4a41cb9132df94d4e570eb3e310e2afc970ff6581ccc6a32fc66c22"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9642EE460E79",
+      "hash": "e540f51a2621fe1a69cf9e7d0acf97d0e1c8b11866ba1ef08564614c496c5259"
+    }
   },
   "0.17": {
     "version": "0.17.2"

manifests/martin.json

@@ -32,10 +32,13 @@
   },
   "license_markdown": "[MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "1.4.0"
+    "version": "1.5.0"
   },
   "1": {
-    "version": "1.4.0"
+    "version": "1.5.0"
+  },
+  "1.5": {
+    "version": "1.5.0"
   },
   "1.5.0": {
     "x86_64_linux_musl": {

manifests/mise.json

@@ -28,13 +28,117 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2026.4.6"
+    "version": "2026.4.11"
   },
   "2026": {
-    "version": "2026.4.6"
+    "version": "2026.4.11"
   },
   "2026.4": {
-    "version": "2026.4.6"
+    "version": "2026.4.11"
+  },
+  "2026.4.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE99529B2B70CC",
+      "hash": "e5950f11eaf8b6dfa9779b16b60c16e77581e9e3c2ca6ee6d0fcdbac4213755c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99529E24DCBF",
+      "hash": "560f1de4717b1b112e715f2e7b8e42b4ff42cff30974b4d5af6a2beee49d0fa8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE99529F6DEBAC",
+      "hash": "bd3f65b704b3eb7ca149796cb4884f1a2cd5303095955a90cf2960226c3abf4d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE995297A42038",
+      "hash": "7d81786e18d807e99e441e1a519abf47a5dd02b4beb7c1eb4c6ec8e4f4d7519e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE99529D304581",
+      "hash": "0058795c35854976d5e0cd6cb1cb644cd7d5d5a9c57989e4a696f0555dd6ceeb"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE99529F21813E",
+      "hash": "0595c0ace18209519cdb98b15b8e4aeba48b8dbe56a2ce5483baa3464e4c13f5"
+    }
+  },
+  "2026.4.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9883ECEDE998",
+      "hash": "6a5fe535fd05e6ac7c525c70a1e05d9b1489ad735a6259c5ff29c7aeb4904b44"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9883F0376682",
+      "hash": "0efa9ad39af34c8ac86b6de4cef9edf855cdff871db8f5146b7c13bdd841358c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9883F1781AC8",
+      "hash": "7a259920a81a995856949df55c6cc4c8c8f1c64313d6988fbb2b16c9b1cfcb74"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9883E8686E03",
+      "hash": "20876268118bb54471fd3701143f902f48272e59830eeaa2cb06e73012580236"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9883EF04378C",
+      "hash": "dd36283b3418070e1606a2e80839577a8d895f02c1df0d23e424e7104efac81c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9883F10ADFAC",
+      "hash": "530e3613ede81b1a7a9fc2c7c45ec75ca774672cdd258f33c4048a12fe1e50a3"
+    }
+  },
+  "2026.4.9": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE980D9FC8526F",
+      "hash": "ba7b8e34c00948d34d7e28eeddc6591d79afc248967ab42180a6c12622a11e5c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE980DA219DF1A",
+      "hash": "26440608074420298a792c0f22ef8d84580ff3b5f0066ba77567fc68ca12c86b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE980DA2DB1CEB",
+      "hash": "f309f77f3c9456aaff9a6795fb435ebab4bc3ca88948efe6f7f82ad3cec7b922"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE980D9CC506E0",
+      "hash": "254a97e05b5241fd1818ecffc000f2971978c7b4d13b719f669103109968044f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE980DA1314861",
+      "hash": "52d983f61b5326bf45b16ed182a7ad55fa5f8a3fd83003c97601f8bf02ecd0a4"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE980DA2BB8382",
+      "hash": "ce5f87b91f25ad378a3f945b3a820003fea506220f26237aa5c9a1b4621a3186"
+    }
+  },
+  "2026.4.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE96FA8585A4DB",
+      "hash": "9d670988a11e6af1a478fc2037b55af90c51e4f3bc538fe684b18b71c5a5fc4e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96FA882F0282",
+      "hash": "b8dd35a066ed7ccfba1c9217db04cd15f0f3976f06b1c59b99a9f38122a35bd6"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96FA88E8CF31",
+      "hash": "6bc622404bcfda0bca3f87a69dfd3ea83b2da92a0e06596c2fd4953b4ab10c5a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96FA8212FBA0",
+      "hash": "a5be964c2e29237dc6808c237793c73732db29877aa135b2457345f5d788b436"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96FA8721A766",
+      "hash": "b27b067d5dc5ad208eabffffb001d87d1edee82d2140ebdc35332ec434ea8e98"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96FA888159DE",
+      "hash": "0a13e8ec7dbacd13b4eeb88ffdfd8800c5646be9592a4e2781d3f92b97ab18b1"
+    }
   },
   "2026.4.7": {
     "x86_64_linux_musl": {

manifests/prek.json

@@ -40,10 +40,44 @@
   },
   "license_markdown": "[MIT](https://github.com/j178/prek/blob/master/LICENSE)",
   "latest": {
-    "version": "0.3.8"
+    "version": "0.3.9"
   },
   "0.3": {
-    "version": "0.3.8"
+    "version": "0.3.9"
+  },
+  "0.3.9": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9958BFB91B93",
+      "hash": "254b48c4b0d8c7da07d0f23144f55f8b56d3a83c416d17a25dbaaee2f721f231"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9958BF2DA54A",
+      "hash": "62b863b3cfcd56dec6a924acad0362594607c86cb773265e148acce252a5c4ac"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9958BF56354B",
+      "hash": "a260094190979a6b2aa6e0bef02121a21e8c2715c2d91603f2763123bfc7f902"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9958BDDB792E",
+      "hash": "b6153b0756a61fc45bf9e63aaf68661bdd9da03dfcf18e2509cedba445b6c4c9"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9958BDA9CBA2",
+      "hash": "0e52d21951d488a9db211c9ea35775614b3cbadc778247486c1e0e9fd0e106cc"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9958BD9BAACF",
+      "hash": "b2fa54c2c6c43cf447a043551e68201c103c2d22692345a29622db8af9c3ce4e"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9958BEFA4C07",
+      "hash": "28e3ba07248eb03f1cd57d6978fdf466eebdf3f69d6eb34b161af898ebb8b45d"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9958BF32A8AF",
+      "hash": "bde03bc2acad42eff7dc1579eceb98f1a0cd271dce7e76cf8a056e93e2b85bd9"
+    }
   },
   "0.3.8": {
     "x86_64_linux_musl": {

manifests/rclone.json

@@ -28,13 +28,13 @@
   },
   "license_markdown": "[MIT](https://github.com/rclone/rclone/blob/master/COPYING)",
   "latest": {
-    "version": "1.73.3"
+    "version": "1.73.4"
   },
   "1": {
-    "version": "1.73.3"
+    "version": "1.73.4"
   },
   "1.73": {
-    "version": "1.73.3"
+    "version": "1.73.4"
   },
   "1.73.4": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -36,13 +36,13 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE)",
   "latest": {
-    "version": "1.42.3"
+    "version": "1.42.4"
   },
   "1": {
-    "version": "1.42.3"
+    "version": "1.42.4"
   },
   "1.42": {
-    "version": "1.42.3"
+    "version": "1.42.4"
   },
   "1.42.4": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -22,10 +22,36 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.16"
+    "version": "0.9.17"
   },
   "0.9": {
-    "version": "0.9.16"
+    "version": "0.9.17"
+  },
+  "0.9.17": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9896615FC8ED",
+      "hash": "e2924b9debcfb8f3ec91e149ded07126c507b04a7cc775253c859d2d1bd60f36"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE98966161C271",
+      "hash": "853a8d6da45b8af67fcdbaf56918895ec04b86733f44243eb8650b9fb258d594"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE989661689880",
+      "hash": "e84b23757c5d01dd175aaee4828497889a667a8344b289dce53bcfff7a1ab69c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE989661DC0DDF",
+      "hash": "d8e5e4655eab5d26932ed741b26cddf9ac017a3aef0da595f776259060fcd83f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE989661E09C9F",
+      "hash": "11dc87c97bfa79da10922f377573509dcbeaf6794118d61baf45890a4c4a48df"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9896616F6E9C",
+      "hash": "a7351b565caaa4014f0f04326028d036c696fddd17cfc6c4377d7a68a33d483b"
+    }
   },
   "0.9.16": {
     "x86_64_linux_musl": {

manifests/typos.json

@@ -30,6 +30,28 @@
   "1.45": {
     "version": "1.45.0"
   },
+  "1.45.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE996D7794BF00",
+      "hash": "33447531a0eff29796d6fb9b555b4628723db72c6bad129e168d97ac86ceb0f1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE996DB81FBE55",
+      "hash": "70767b5d8d920cbb17b452a6b068e36e1b3fd649089bce883d3512eb85990326"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE996D7D9C1AAD",
+      "hash": "a4ae081cb7a403f2b75e8c066aa4a4484207547c4e9eb2b4df3f68ecdbc5dd3e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE996D52EE2586",
+      "hash": "0d3688c607a49ffb6dedaca6de44e4217abeaa5b93228d673dc5caf76f60489f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE996D9C9D7B7B",
+      "hash": "2c31ed16286f26c08ae477faf001af8542ff23aeb6e7323be5f620710c192fb5"
+    }
+  },
   "1.45.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DE8FF7414DC005",

manifests/uv.json

@@ -69,10 +69,10 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.11.4"
+    "version": "0.11.6"
   },
   "0.11": {
-    "version": "0.11.4"
+    "version": "0.11.6"
   },
   "0.11.6": {
     "x86_64_linux_musl": {

manifests/vacuum.json

@@ -22,10 +22,62 @@
   },
   "license_markdown": "[MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE)",
   "latest": {
-    "version": "0.25.5"
+    "version": "0.25.8"
   },
   "0.25": {
-    "version": "0.25.5"
+    "version": "0.25.8"
+  },
+  "0.25.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE97FE9C1F2A0A",
+      "hash": "b8173eb8ab86ab4fd368351bfe88f740f43b79345210b446d766d90cb0664daa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE97FE9B58735E",
+      "hash": "05f82642227d53581ed26e0aaaba8b68d107627a73a542ffba8a00002a8cea76"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE97FE9C258B81",
+      "hash": "4bfa0b544401de4d94d870ba1ab7bb8cf6b4920d1539b81bff92e15ca3a10c9d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE97FE9B53BDB8",
+      "hash": "2f814f66b7d200cee8a82d97e41f6a794c2686ff04c8079d50623c2c5d1b51a6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE97FE9C198B0F",
+      "hash": "49c5edbdaaf0c04c3105137fa136dc9eeb3036b6259d36445607703b40b0bac7"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE97FE9B4E9365",
+      "hash": "b3edb8d9d564b0b85d4cf9155664c6b9fe571acfa7e6ea97a3cacdbd46d470e4"
+    }
+  },
+  "0.25.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE97526EC427DE",
+      "hash": "a72c3012e3fe1eb7e653be75b041e648cdd6b4b365a0c51e1ca344f9a106c9a6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE97526F65311F",
+      "hash": "63362feaf01adec7d3a3ee557427acf6df32e2c3e1fa247e335e83d302dc2445"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE97526EBB3141",
+      "hash": "4663999cc8a5e10c2023129619af53340321cfb9c4eab963bf91f8edb1f320de"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE97526EA9440E",
+      "hash": "d48fdd661f4484bbb44940595ff7e13cb6782aacea540868d0d44a87b5c1860a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE97526F58BC05",
+      "hash": "77829aa18377f354d1629d7d069297b4a17597e20f7b6184d36744dc4c8358e5"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE97526EAE4774",
+      "hash": "18c9e645a1d97ebd333be634f960428d7f022dfa659ff8536673daf84b8c2a4a"
+    }
   },
   "0.25.5": {
     "x86_64_linux_musl": {

manifests/wasm-bindgen.json

@@ -44,10 +44,32 @@
   },
   "license_markdown": "[MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.2.117"
+    "version": "0.2.118"
   },
   "0.2": {
-    "version": "0.2.117"
+    "version": "0.2.118"
+  },
+  "0.2.118": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE972254F8FEF2",
+      "hash": "00b519c9fc2d6e087265da1a00f29160bfcc6a823993482bc2e691910287427b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE972254EED135",
+      "hash": "2f1c1586c0b5bad9a25e6704825d6b1a9ccdd7c6830d57198645411545b566ad"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE972254D6A966",
+      "hash": "075902fd092f8e2a223783ccb73697f7a619bfa02e166d3b68319924a19d5a08"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE972254FA0F29",
+      "hash": "e8b75bf5055c189af5e4842bf7c58f616880fb8505a10f7cd575353a9f4e2dba"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE972254EE5C7F",
+      "hash": "f76553ae8d084dc3e96a7cef748813bf2dac4d78326166409328fc74646eef76"
+    }
   },
   "0.2.117": {
     "x86_64_linux_musl": {

manifests/wasmtime.json

@@ -36,13 +36,47 @@
   },
   "license_markdown": "[Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE)",
   "latest": {
-    "version": "43.0.0"
+    "version": "43.0.1"
   },
   "43": {
-    "version": "43.0.0"
+    "version": "43.0.1"
   },
   "43.0": {
-    "version": "43.0.0"
+    "version": "43.0.1"
+  },
+  "43.0.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE96545D60CB65",
+      "hash": "9f3cf977fc29e2ccab2d198435265b066dce3d608fc6692d700ed1b9b74c35a1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96545D950E1A",
+      "hash": "c6ac5b23b52cb78ea7759ce9bd33985c515f2b620b9385021e32e4f51cdc0aa7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96545EE43160",
+      "hash": "cb627546a9f0f2f24f3d68fce34b40f13d6b1abe4b70f3afde0038ad9fe4e6ea"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE96545A4D6347",
+      "hash": "dbf36d4e9108df377ddfb88f2d8db4e07efce9726b68da53ae78ed5579293923"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96545A9C6308",
+      "hash": "c93751ee2f0ecd34c0e799c6261b06c6efeb3c35f2bdb884569ba37931144980"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96545AFDC4A6",
+      "hash": "0e8dc6155bda65e780279853af147b312fe62673e745a81a413b7a95be76c7ae"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE96545C448CDB",
+      "hash": "8ba5d2c2a9b613de09933998a91cae40a47fde78892f29144358f35ccf7e57c0"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE96545C86C9A4",
+      "hash": "d19c7662bf478d46c235442a2ea2f230b6cb1d98bf99dfe4fc8f8892d43a8fdf"
+    }
   },
   "43.0.0": {
     "x86_64_linux_gnu": {
@@ -79,10 +113,44 @@
     }
   },
   "42": {
-    "version": "42.0.1"
+    "version": "42.0.2"
   },
   "42.0": {
-    "version": "42.0.1"
+    "version": "42.0.2"
+  },
+  "42.0.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9657610D0674",
+      "hash": "4eca8d3d6898b94cff4103dafac40610d81aaa85c10f575f82da78a1553e176d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96576193C77A",
+      "hash": "2baed23bfc1612e475d2f0eac7b66d12789838ec645fe8bbcd2f589d732b178b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9657632D34D9",
+      "hash": "4a687cf2f020ff0071c664511d1d8be2ea99dc7956d4e07e7f03aaac62cd63fa"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE96575E5F1A28",
+      "hash": "9d55dbe5cec028692ea8dd5ceaf0250541e9b7cc50a9f22586bf3e130034ad60"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96575E85D785",
+      "hash": "94227ec56b07283c1184953c698a9b1d0cbac387a3b841e6c9dbddcd36d3a3c4"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96575F3611F8",
+      "hash": "55ea7b324104bd55b3808129ad4159d719f0f8ef7378765b48e1e3ff0baebb2a"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE965760321B68",
+      "hash": "f0a344acd308c1d1a70466f3ec0225e1d563006cf8d21a5745eba6e529df2e3e"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE96576067BC3E",
+      "hash": "663181c75c3c773052669d6c2eb34f83f1ae4d2b73368240152e5f4cadc03733"
+    }
   },
   "42.0.1": {
     "x86_64_linux_gnu": {
@@ -897,10 +965,44 @@
     }
   },
   "36": {
-    "version": "36.0.6"
+    "version": "36.0.7"
   },
   "36.0": {
-    "version": "36.0.6"
+    "version": "36.0.7"
+  },
+  "36.0.7": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9651FF60F756",
+      "hash": "13bd4d8865594a98811c4b5d577e30af6f6a1e3e64e2f211018963c456d4fe89"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE965200A57813",
+      "hash": "f6c21f1d69e68591bd3e0bfd72cef6a43c599db57d930fea96db89271505f782"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE965205C3F09A",
+      "hash": "02a8db01e9f6bb092c2eff51a710838f64370292ff126baac4a093b4b90cfb2d"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9651EEFDD198",
+      "hash": "4f773bb8e587bc6d84f73aa5613fcec6e52368db452e5e13e38341e409d17a9a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9651F0509A53",
+      "hash": "5a2baa053e01d73f72282e3bd0b63f052f4fb41b9a690e87e3f0a0bdbb5c220c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9651F31EBBCD",
+      "hash": "749cbf0a84c9f347d6daff9024678e92f36bf7096ae0d24aba78c4e679f54ae0"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9651F86A7A04",
+      "hash": "61018afd8982f9614bd898848406a59d1b97c971e37405f6655c62ac6dfbbac9"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9651F9AD0148",
+      "hash": "f94dd38b9840cf2b9dacf20ecc2f47431ac16f0740ede6f471faaf344c60eeb3"
+    }
   },
   "36.0.6": {
     "x86_64_linux_gnu": {
@@ -2007,10 +2109,40 @@
     }
   },
   "24": {
-    "version": "24.0.6"
+    "version": "24.0.7"
   },
   "24.0": {
-    "version": "24.0.6"
+    "version": "24.0.7"
+  },
+  "24.0.7": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE964BC372C44C",
+      "hash": "98b00342031de99d5466fc3fe9b5749dc1bb1a83430a2e2335e187976a863422"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE964BC4D72C68",
+      "hash": "d8c6e8747b5f3779efff44bae34d2a9ad694a065552904611f76f6e4a7c29f01"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE964BCA6071C2",
+      "hash": "6797a846322909e61e472d2d0fa066fed301f684006133b88f6f5ab2a884603f"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE964BBA5101B4",
+      "hash": "b37d44a63237b24b86bbf891ab19ac66fcfeb6b15375d544cbc44d380a04853e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE964BBB6C2FF4",
+      "hash": "15e38b4f2e11bdfa4b5978888192f3f85b456a19c75565dcba087817bac15dd7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE964BBCC7C852",
+      "hash": "041d27633efdb8242dc9798e903e06a22622d7df7ccf300eb94c9435cf0fb4f6"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE964BBE2360B4",
+      "hash": "38aa619242a781d61175dc57410b03a6d0da30f16e03b5a6356951b16faa0adc"
+    }
   },
   "24.0.6": {
     "x86_64_linux_gnu": {

manifests/zizmor.json

@@ -19,10 +19,57 @@
   },
   "license_markdown": "[MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE)",
   "latest": {
-    "version": "1.23.1"
+    "version": "1.24.0"
   },
   "1": {
-    "version": "1.23.1"
+    "version": "1.24.0"
+  },
+  "1.24": {
+    "version": "1.24.0"
+  },
+  "1.24.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE99859707E0A7",
+      "hash": "a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99859704D6D9",
+      "hash": "721ba70d7fca753aeef1a4ee959a9bc20c55784d4faa6c56e66129a2611fd52f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE998597046237",
+      "hash": "b777ec2cb1098139ba74b32e30d11ed149c69ab692d23788c466d4a31704bd4b"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE998597142EDB",
+      "hash": "d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE998597093EA9",
+      "hash": "fc4ea59e18bc028dddb5f710b16dbc361b01ff1e7a20c03b8e5778366ca9f4e1"
+    }
+  },
+  "1.24.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9902BD5E11DA",
+      "hash": "0626c578265cdd42724fa3f63447c336ede7d989f95b9ffa7a992eace82d68da"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9902BD4F079C",
+      "hash": "3c58dedfa9457311afb4cd06e62d6a36afa19b7ffb7a2bc4d0ca9c52cffef373"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9902BD65AA78",
+      "hash": "0242e8c2b9886adab22bb1748d05ef8155d529a4716bca33080c6f5c2e2c7c11"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9902BD62C785",
+      "hash": "2739eeae98fdc2ea204cf56cf4dd7cbce7c4f3f00a54fc2960ab41c95fe83fbd"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9902BD5D764B",
+      "hash": "dfae80dfb23cf48778a80799809c971a1b0cb37f341a4044dcf844d7acdb0b10"
+    }
   },
   "1.23": {
     "version": "1.23.1"

tools/ci/tool-list.sh

@@ -147,12 +147,12 @@ for manifest in tools/codegen/base/*.json; do
   fi
   case "${host_os}" in
     linux*)
-      if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}_gnu" "${manifest}")" == "null" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}_musl" "${manifest}")" == "null" ]]; then
+      if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_gnu" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_musl" '.platform[$p]' "${manifest}")" == "null" ]]; then
         continue
       fi
       ;;
     *)
-      if [[ "$(jq -r ".platform.x86_64_${host_os}" "${manifest}")" == "null" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}" "${manifest}")" == "null" ]]; then
+      if [[ "$(jq -r --arg p "x86_64_${host_os}" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}" '.platform[$p]' "${manifest}")" == "null" ]]; then
         continue
       fi
       ;;

tools/codegen/src/main.rs

@@ -231,7 +231,11 @@ fn main() {
 
     let version_req: semver::VersionReq = match version_req {
         _ if latest_only => {
-            let req = format!("={}", releases.first_key_value().unwrap().0.0).parse().unwrap();
+            // Exclude very recently released version from candidate for latest version.
+            let req =
+                format!("={}", releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0)
+                    .parse()
+                    .unwrap();
             eprintln!("update manifest for versions '{req}'");
             req
         }