Release 2.62.61

.github/.cspell/project-dictionary.txt

@@ -24,6 +24,7 @@ pluginconf
 ppcle
 quickinstall
 rclone
+rdme
 rootfs
 sccache
 syft

.github/workflows/ci.yml

@@ -63,6 +63,7 @@ jobs:
           - os: ubuntu-22.04-arm
           - os: ubuntu-24.04
           - os: ubuntu-24.04-arm
+          - os: ubuntu-slim
           - os: ubuntu-22.04
             tool: major.minor.patch
           - os: ubuntu-22.04
@@ -125,6 +126,7 @@ jobs:
       - name: Test pwsh
         run: just --version; shfmt --version; protoc --version
         shell: pwsh
+        if: matrix.os != 'ubuntu-slim'
       - name: Test powershell
         run: just --version; shfmt --version; protoc --version
         shell: powershell
@@ -138,7 +140,7 @@ jobs:
       # check it with CI. (e.g., 0.14.0->0.16.0 update change it
       # from "cargo-binstall <version>" to "<version>")
       - run: |
-          if [[ "$(cargo binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
+          if [[ "$(cargo-binstall binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
             exit 1
           fi
         if: matrix.bash != 'cygwin' && matrix.os != 'windows-11-arm'

.github/zizmor.yml

@@ -0,0 +1,16 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  dependabot-cooldown: { disable: true } # Useless unless unpinned-uses is enabled.
+  ref-confusion: { disable: true } # TODO: Old GHA didn't work without this pattern in some cases, but does it seem to be fixed?
+  secrets-inherit: { disable: true }
+  unpinned-uses:
+    config:
+      policies:
+        taiki-e/*: any
+        '*': ref-pin
+  obfuscation:
+    ignore:
+      # We use `shell: cmd` to test compatibility
+      - ci.yml

.shellcheckrc

@@ -5,6 +5,9 @@
 # https://github.com/koalaman/shellcheck/wiki/Optional
 # https://google.github.io/styleguide/shellguide.html
 
+# https://github.com/koalaman/shellcheck/wiki/Directive#external-sources
+external-sources=true
+
 # https://github.com/koalaman/shellcheck/wiki/SC2249
 # enable=add-default-case
 

CHANGELOG.md

@@ -10,6 +10,20 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.62.61] - 2025-12-02
+
+- Update `cargo-deny@latest` to 0.18.7.
+
+- Update `cargo-careful@latest` to 0.4.9.
+
+- Update `uv@latest` to 0.9.14.
+
+- Update `vacuum@latest` to 0.20.4.
+
+- Update `cargo-valgrind@latest` to 2.4.0.
+
+- Update `mise@latest` to 2025.11.11.
+
 ## [2.62.60] - 2025-11-30
 
 - Update `zizmor@latest` to 1.18.0.
@@ -5025,7 +5039,8 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.62.60...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.62.61...HEAD
+[2.62.61]: https://github.com/taiki-e/install-action/compare/v2.62.60...v2.62.61
 [2.62.60]: https://github.com/taiki-e/install-action/compare/v2.62.59...v2.62.60
 [2.62.59]: https://github.com/taiki-e/install-action/compare/v2.62.58...v2.62.59
 [2.62.58]: https://github.com/taiki-e/install-action/compare/v2.62.57...v2.62.58

manifests/cargo-careful.json

@@ -3,10 +3,27 @@
   "template": null,
   "license_markdown": "[MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE)",
   "latest": {
-    "version": "0.4.8"
+    "version": "0.4.9"
   },
   "0.4": {
-    "version": "0.4.8"
+    "version": "0.4.9"
+  },
+  "0.4.9": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DE3125D4C34BAD",
+      "checksum": "a329e0711910fb7f0f7e803ad243f5a1edac85e885eba0d15e986aac30508fe4"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DE3125D4BC758E",
+      "checksum": "9ccfb3a0d502eec025841b11cf06b5a3359b72979e3317dab699aa5806725f1a"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-windows.exe",
+      "etag": "0x8DE3125D4BF3189",
+      "checksum": "d329ad9f85da406c52f846d568a1406b71058bccdc85c79fad8d5cf828456518"
+    }
   },
   "0.4.8": {
     "x86_64_linux_musl": {

manifests/cargo-deny.json

@@ -24,10 +24,32 @@
   },
   "license_markdown": "[MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.18.6"
+    "version": "0.18.7"
   },
   "0.18": {
-    "version": "0.18.6"
+    "version": "0.18.7"
+  },
+  "0.18.7": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE318197C53192",
+      "checksum": "90a1f5bed6c639de6a234e4a5d08987f51958ba9e8024c48e45592c2b770d5ab"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE31819F444018",
+      "checksum": "488b3298a3fbff6998698e4f3d57e22b93640c8233c21aa3acf530338c7e35d0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE3181FB46E112",
+      "checksum": "f52a35d96cb2a07f2dbbd87f91a8c279aa8ca2fa418e183dd60c1495b2c03955"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE31819D031AF1",
+      "checksum": "3b33b5c50c20644a530ee70ac6748ca9e420e1ca03d10a7df9baf0800f858327"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE31819C9D51A1",
+      "checksum": "4933a8817de07b3604777956b0e460b856cd91b803e0ecba2fcf96acef0216e9"
+    }
   },
   "0.18.6": {
     "x86_64_linux_musl": {

manifests/cargo-valgrind.json

@@ -13,10 +13,27 @@
   },
   "license_markdown": "[MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE)",
   "latest": {
-    "version": "2.3.3"
+    "version": "2.4.0"
   },
   "2": {
-    "version": "2.3.3"
+    "version": "2.4.0"
+  },
+  "2.4": {
+    "version": "2.4.0"
+  },
+  "2.4.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE30DF337C56A8",
+      "checksum": "8a00e22c096e411766da05dcb2d2e0466b2d29e33dd3a9d3032f8dadea1fd15d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE30DF3380979E",
+      "checksum": "0f399df398947d2391d9ae3f6933a553742048f887e7515581c51cee99b7b0ec"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE30DF337F8766",
+      "checksum": "607e2dbef6563b4abb6c3bedb325524ad28c78561d49eb4ab91c16efa0d2c0fd"
+    }
   },
   "2.3": {
     "version": "2.3.3"

manifests/knope.json

@@ -8,6 +8,32 @@
   "0.21": {
     "version": "0.21.5"
   },
+  "0.21.6": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.6/knope-x86_64-unknown-linux-musl.tgz",
+      "etag": "0x8DE315036972926",
+      "checksum": "b55d8029350ebe5ef7fa62d50578ad3c043ebd86296b7743fba455fc55a91a35",
+      "bin": "knope-x86_64-unknown-linux-musl/knope"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.6/knope-x86_64-apple-darwin.tgz",
+      "etag": "0x8DE315036496085",
+      "checksum": "5373b8d2e2d7ca8e89057672b1dc1e44fc7f9dc9e01d7cf7d8f5836714143829",
+      "bin": "knope-x86_64-apple-darwin/knope"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.6/knope-x86_64-pc-windows-msvc.tgz",
+      "etag": "0x8DE3150365733B1",
+      "checksum": "91d695484e6e06235b2264ba5149181ef0b44a2b670cc4806cd1e0792f562408",
+      "bin": "knope-x86_64-pc-windows-msvc/knope.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.6/knope-aarch64-apple-darwin.tgz",
+      "etag": "0x8DE315036426386",
+      "checksum": "0fec964e9fb1dd58ba2fe0d45e0d42d9a63e0cdcba300bad098025664db3e3cd",
+      "bin": "knope-aarch64-apple-darwin/knope"
+    }
+  },
   "0.21.5": {
     "x86_64_linux_musl": {
       "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.5/knope-x86_64-unknown-linux-musl.tgz",

manifests/mise.json

@@ -28,13 +28,39 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2025.11.10"
+    "version": "2025.11.11"
   },
   "2025": {
-    "version": "2025.11.10"
+    "version": "2025.11.11"
   },
   "2025.11": {
-    "version": "2025.11.10"
+    "version": "2025.11.11"
+  },
+  "2025.11.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE2FCCEBF4547D",
+      "checksum": "b3d0ada98b5319ca9e1095d8761ab10c8854fdd5c7487e85cbb7e6972a69ffea"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE2FCCEDE1EB29",
+      "checksum": "c64c00028db0bbb73d4a9801a2ecb68f9cf5927c4e53740871e5d7ba8ab0b3c7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE2FCCEE62E61F",
+      "checksum": "bcdc0b81e8083da51fad09a975bf36db199eba893d2369ca3e9218cd73bdca92"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE2FCCE907D1C7",
+      "checksum": "502059f4c449e7a18f4994ceba8c91c27f05364bb80b14c51f19be03a8f267d0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE2FCCED3FD1E6",
+      "checksum": "afbf065a2759dcbee8fc56b7afa0324c5f76e09b7bac245284a5f8b8d4bb1d81"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE2FCCEE1E88FE",
+      "checksum": "1a9ee4e2a37f28c485d862e36fcda59dca9dc3dccb2077e6a7cb311552e8dfbd"
+    }
   },
   "2025.11.10": {
     "x86_64_linux_musl": {

manifests/uv.json

@@ -40,10 +40,48 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.9.13"
+    "version": "0.9.14"
   },
   "0.9": {
-    "version": "0.9.13"
+    "version": "0.9.14"
+  },
+  "0.9.14": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE30FE860BAB84",
+      "checksum": "2b9636963c700a595d476e387eb8041973d30c5add3193a8710a4306442ee74b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE30FE85A4D208",
+      "checksum": "276fe2605a0ba8306a875101e3a11bc5b93e2bce0b6b3b6c49c9ad14507d9dba"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE30FE85A06A2E",
+      "checksum": "7ca7a43da656d9c5fd4b40ce6e8de19bc46d51e026c9dfd4909c1bc8b25f88bc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE30FE83342089",
+      "checksum": "631ac3b88a77ec1af35297fdecc0b60b3eef16482617e3a2a5805bd667166437"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE30FE82955F04",
+      "checksum": "5267ecb62737b2ec0d61fd40e93c20d0a201eba96588582633f725792c778e00"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE30FE82DA30D3",
+      "checksum": "966f4ddb5450ade2be0989bb3d4cc4ff66ec316ad714618f2391712ec3660908"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE30FE84F1197F",
+      "checksum": "9ae475bb30150d12633283dd73707fc059bece75e2c42288bf35212b5e6f09ec"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE30FE8511C322",
+      "checksum": "96abad8a9324bd756905ab705ef853e036b3725242161682e7ceab2bf4081186"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE30FE85354FBB",
+      "checksum": "f5250473bd8a036b78f4ec19450eb3efe743232d688f770ea2a92f21da7fb417"
+    }
   },
   "0.9.13": {
     "x86_64_linux_musl": {

manifests/vacuum.json

@@ -22,10 +22,62 @@
   },
   "license_markdown": "[MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE)",
   "latest": {
-    "version": "0.20.2"
+    "version": "0.20.4"
   },
   "0.20": {
-    "version": "0.20.2"
+    "version": "0.20.4"
+  },
+  "0.20.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE30E70694CC7E",
+      "checksum": "8e9e9ced4ce98cc49bd830634b4837d34df75684c22a15d6444111bc5a7c0c35"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE30E70691E98E",
+      "checksum": "3a4ffdb379a0673a9fff1dcd63104834de13f05d411ce9a834c7102799aaf722"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE30E707468B91",
+      "checksum": "cdc93735ccf341d4f29b9056b93494ed2a954437114f628a666ea80f358140f1"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE30E7072FE8C1",
+      "checksum": "10465392e3d4e0eb8e3955f34872cb8b18fa27ef6bcc89c34d06b8ecaf428ece"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE30E7069D00A3",
+      "checksum": "45232257db4988c0adac7ce5e0fce8a81ffce85eea08c493ca57831eee2790ab"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE30E7074EE695",
+      "checksum": "6e1d298462e0be32d17d64bd3a3de916203baca941379e67e76147016e859e45"
+    }
+  },
+  "0.20.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE30E3F4500B49",
+      "checksum": "66c455b1d0dc39ef2d212d8eb01b833c55d4fa12e5fc5c804ed634e2e4a181ba"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE30E3F512329E",
+      "checksum": "1a4d064d501836081c0c3501b98762ba620291f568c51f5c521b397b77559680"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE30E3F45B4940",
+      "checksum": "f6adb269f3e28a2fabe549dc47aadbe53bc0f9405c90ff33fc16f9393b5d3f68"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE30E3F4555C81",
+      "checksum": "6cb436a162216c62cc853bd07626e06feaffa66f166ce42c1a443bfeb02f4c70"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE30E3F4DFE988",
+      "checksum": "5cbafd225356ba7b80777bbed4f34c50af4a82cb96a56f09c4623cecaa2c51ef"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE30E3F4D91377",
+      "checksum": "4cb44457e4cf2a923cc5225dea9a1246f879462ed8ff426190b1086a7a218f72"
+    }
   },
   "0.20.2": {
     "x86_64_linux_musl": {

tools/tidy.sh

@@ -8,7 +8,7 @@ trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
 cd -- "$(dirname -- "$0")"/..
 
 # USAGE:
-#    ./tools/tidy.sh
+#    GH_TOKEN=$(gh auth token) ./tools/tidy.sh
 #
 # Note: This script requires the following tools:
 # - git 1.8+
@@ -17,6 +17,7 @@ cd -- "$(dirname -- "$0")"/..
 # - python 3.6+ and pipx
 # - shfmt
 # - shellcheck
+# - zizmor
 # - cargo, rustfmt (if Rust code exists)
 # - clang-format (if C/C++/Protobuf code exists)
 # - parse-dockerfile <https://github.com/taiki-e/parse-dockerfile> (if Dockerfile exists)
@@ -905,6 +906,18 @@ EOF
     fi
   fi
 fi
+zizmor_targets=(${workflows[@]+"${workflows[@]}"} ${actions[@]+"${actions[@]}"})
+if [[ -e .github/dependabot.yml ]]; then
+  zizmor_targets+=(.github/dependabot.yml)
+fi
+if [[ ${#zizmor_targets[@]} -gt 0 ]]; then
+  if check_install zizmor; then
+    IFS=' '
+    info "running \`zizmor ${zizmor_targets[*]}\`"
+    IFS=$'\n\t'
+    zizmor "${zizmor_targets[@]}"
+  fi
+fi
 printf '\n'
 check_alt '.sh extension' '*.bash extension' "$(ls_files '*.bash')"
 
@@ -981,6 +994,7 @@ if [[ -f .cspell.json ]]; then
       dependencies_words=$(npx -y cspell stdin --no-progress --no-summary --words-only --unique <<<"${dependencies}" || true)
     fi
     all_words=$(ls_files | { grep -Fv "${project_dictionary}" || true; } | npx -y cspell --file-list stdin --no-progress --no-summary --words-only --unique || true)
+    all_words+=$'\n'$(ls_files | npx -y cspell stdin --no-progress --no-summary --words-only --unique || true)
     printf '%s\n' "${config_old}" >|.cspell.json
     trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
     cat >|.github/.cspell/rust-dependencies.txt <<EOF
@@ -1000,6 +1014,15 @@ EOF
       error "you may want to mark .github/.cspell/rust-dependencies.txt linguist-generated"
     fi
 
+    # Check file names.
+    info "running \`git ls-files | npx -y cspell stdin --no-progress --no-summary --show-context\`"
+    if ! ls_files | npx -y cspell stdin --no-progress --no-summary --show-context; then
+      error "spellcheck failed: please fix uses of below words in file names or add to ${project_dictionary} if correct"
+      printf '=======================================\n'
+      { ls_files | npx -y cspell stdin --no-progress --no-summary --words-only || true; } | sed "s/'s$//g" | LC_ALL=C sort -f -u
+      printf '=======================================\n\n'
+    fi
+    # Check file contains.
     info "running \`git ls-files | npx -y cspell --file-list stdin --no-progress --no-summary\`"
     if ! ls_files | npx -y cspell --file-list stdin --no-progress --no-summary; then
       error "spellcheck failed: please fix uses of below words or add to ${project_dictionary} if correct"