Release 2.62.65

Updates the requirements on [spdx](https://github.com/EmbarkStudios/spdx) to permit the latest version.
- [Release notes](https://github.com/EmbarkStudios/spdx/releases)
- [Changelog](https://github.com/EmbarkStudios/spdx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/EmbarkStudios/spdx/compare/0.12.0...0.13.0)

---
updated-dependencies:
- dependency-name: spdx
  dependency-version: 0.13.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/.cspell/rust-dependencies.txt

@@ -1,5 +1,5 @@
-// This file is @generated by tidy.sh.
-// It is not intended for manual editing.
+# This file is @generated by tidy.sh.
+# It is not intended for manual editing.
 
 flate
 minisign

.github/workflows/release.yml

@@ -32,7 +32,8 @@ jobs:
 
   create-release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && startsWith(github.ref_name, 'install-action-manifest-schema-')
-    uses: taiki-e/github-actions/.github/workflows/create-release.yml@main
+    # TODO: use new rust-release workflow
+    uses: taiki-e/github-actions/.github/workflows/create-release.yml@853cebf868aa2dce1470668df24176803e05adc8
     with:
       crates: tools/manifest-schema
       changelog: tools/manifest-schema/CHANGELOG.md

.github/zizmor.yml

@@ -2,7 +2,7 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  dependabot-cooldown: { disable: true } # Useless unless unpinned-uses is enabled.
+  dependabot-cooldown: { disable: true } # Useless unless hash-pin is forced by unpinned-uses.
   ref-confusion: { disable: true } # TODO: Old GHA didn't work without this pattern in some cases, but does it seem to be fixed?
   secrets-inherit: { disable: true }
   unpinned-uses:
@@ -12,5 +12,5 @@ rules:
         '*': ref-pin
   obfuscation:
     ignore:
-      # We use `shell: cmd` to test compatibility
+      # We use `shell: cmd` to test compatibility.
       - ci.yml

CHANGELOG.md

@@ -10,6 +10,48 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.62.65] - 2025-12-09
+
+- Update `cyclonedx@latest` to 0.29.2.
+
+- Update `just@latest` to 1.44.1.
+
+- Update `cargo-shear@latest` to 1.7.2.
+
+- Update `mise@latest` to 2025.12.1.
+
+## [2.62.64] - 2025-12-08
+
+- Update `cargo-deny@latest` to 0.18.9.
+
+- Update `just@latest` to 1.44.0.
+
+- Update `uv@latest` to 0.9.16.
+
+## [2.62.63] - 2025-12-06
+
+- Update `protoc@latest` to 3.33.2.
+
+- Update `release-plz@latest` to 0.3.150.
+
+- Update `cargo-binstall@latest` to 1.16.3.
+
+- Update `knope@latest` to 0.21.7.
+
+- Update `mise@latest` to 2025.12.0.
+
+## [2.62.62] - 2025-12-03
+
+- Update `cargo-deny@latest` to 0.18.8.
+
+- Update `cargo-shear@latest` to 1.7.1.
+
+- Update `trivy@latest` to 0.68.1.
+
+- Update `uv@latest` to 0.9.15.
+
+- Update `knope@latest` to 0.21.6.
+
 ## [2.62.61] - 2025-12-02
 
 - Update `cargo-deny@latest` to 0.18.7.
@@ -5039,7 +5081,11 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.62.61...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.62.65...HEAD
+[2.62.65]: https://github.com/taiki-e/install-action/compare/v2.62.64...v2.62.65
+[2.62.64]: https://github.com/taiki-e/install-action/compare/v2.62.63...v2.62.64
+[2.62.63]: https://github.com/taiki-e/install-action/compare/v2.62.62...v2.62.63
+[2.62.62]: https://github.com/taiki-e/install-action/compare/v2.62.61...v2.62.62
 [2.62.61]: https://github.com/taiki-e/install-action/compare/v2.62.60...v2.62.61
 [2.62.60]: https://github.com/taiki-e/install-action/compare/v2.62.59...v2.62.60
 [2.62.59]: https://github.com/taiki-e/install-action/compare/v2.62.58...v2.62.59

README.md

@@ -20,10 +20,10 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 
 ### Inputs
 
-| Name     | Required | Description                             | Type    | Default |
-| -------- |:--------:| --------------------------------------- | ------- | ------- |
-| tool     | **✓**    | Tools to install (comma-separated list) | String  |         |
-| checksum |          | Whether to enable checksums             | Boolean | `true`  |
+| Name | Required | Description | Type | Default |
+| ---- | :------: | ----------- | ---- | ------- |
+| tool | **✓** | Tools to install (comma-separated list) | String | |
+| checksum | | Whether to enable checksums | Boolean | `true` |
 
 ### Example workflow
 

manifests/cargo-binstall.json

@@ -22,32 +22,32 @@
   },
   "license_markdown": "[GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE)",
   "latest": {
-    "version": "1.16.2"
+    "version": "1.16.3"
   },
-  "1.16.2": {
+  "1.16.3": {
     "x86_64_linux_musl": {
-      "etag": "0x8DE2A5BADA92790",
-      "checksum": "3be2695803f7b9a86b9976f2bdb8568ed6e8df026bacfc39c8546d3c6ea34808"
+      "etag": "0x8DE340179C4B10A",
+      "checksum": "dcd7d1d03d73fcd6825e981955263d4df08b81d73ce92eed1998dbda003a328a"
     },
     "x86_64_macos": {
-      "etag": "0x8DE2A5B9D421EB3",
-      "checksum": "a039819a14009dd72d32c24ce97d2c16be12959e601ae516574e2f2a770db59d"
+      "etag": "0x8DE3401D7BF12C5",
+      "checksum": "eb8d55ddf27761f625266a9dfc75142a96d22fbafec48eb2982c3e45bc119d95"
     },
     "x86_64_windows": {
-      "etag": "0x8DE2A5C20BAF21A",
-      "checksum": "970882c90c512f53d5ce446cf0b68dc70c35e75cc52dbb264606bcf72edfc02b"
+      "etag": "0x8DE34020AE0BB67",
+      "checksum": "8b93d53a6313e6c4e23326dc2a0f89044932768b1cc3b3592ec77a31ddb6a1a2"
     },
     "aarch64_linux_musl": {
-      "etag": "0x8DE2A5BB02B02DE",
-      "checksum": "a31113a645e0a96d5123a52ece88ee9723305939c4b1c7683aa3ddf6ca4c49ba"
+      "etag": "0x8DE3401A8D7D5FC",
+      "checksum": "5e36157edecaa41be235259a1d2ee5d08ba401aaf7b5b04ca15e69a31e8ca5c1"
     },
     "aarch64_macos": {
-      "etag": "0x8DE2A5BBA3835F6",
-      "checksum": "d51b7d2487a10abc395ccec7a2c9c79c83e44aac4b830e1694f8c8e10cad5e88"
+      "etag": "0x8DE34018BF6D6D2",
+      "checksum": "ec5f87ce4f9120bf45820da743e3be6f92dea86058505b7ac6000f8ac6a4bfda"
     },
     "aarch64_windows": {
-      "etag": "0x8DE2A5C4AC6C930",
-      "checksum": "cc506948ffbd388fa29eeca88744a2dfeb988b8bb41453dc5a7eda3441bf1aac"
+      "etag": "0x8DE34021246199B",
+      "checksum": "0d321702d5da405f85d091101ada998cc4c5b9e764d6e12971713fd8a4ae85aa"
     }
   }
 }

manifests/cargo-deny.json

@@ -24,10 +24,54 @@
   },
   "license_markdown": "[MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.18.7"
+    "version": "0.18.9"
   },
   "0.18": {
-    "version": "0.18.7"
+    "version": "0.18.9"
+  },
+  "0.18.9": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE365F9DB7C550",
+      "checksum": "491d04e4c05d7c92582e3d40ec94126c52472a546326a6d29473a5a4e73babd2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE365FC112E094",
+      "checksum": "4d49f9e0764b018fbffe90e6159aed29eef828ea17042f9c08049ca96c1fe9ca"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE36600C8678E4",
+      "checksum": "86a3f6dfa497b1e4e34e037e5be98ec2abde5949bed312948525864e9291827f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE365FA547B0BA",
+      "checksum": "8bc65cc9f5573e1538f914a227e87f70586a50922b73d0def28ffd6f74514a53"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE365FAFEA1A89",
+      "checksum": "a06e6cbab3d51f51997c5bb986580e4127b65ac323d2f354535bcca0a5d9b67f"
+    }
+  },
+  "0.18.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE3283C5559F67",
+      "checksum": "663f655b23c58e7d8eaf1c6b6bd8e197742757b5314bd292fd8dcbc0a16581c6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE3283B49FB8D0",
+      "checksum": "7091e8bdd0fa8febb904c403fe1390352afe54436964a5ecd698a5e16d6a1822"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE328430395712",
+      "checksum": "7ac004b6205e1478ad8b05d743758e69bceb77f38e9dbb0ec56ea832e5bbdd96"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE3283E191578F",
+      "checksum": "2f6ee38e5ca2e4c42ad5d730cf90ba443cd09f7744da38a2806df24a8b63f61f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE3283D77ADD23",
+      "checksum": "83a1b8adde73f2e40ed26dfbbe360f94459ecf39f4994396d8d73f88b9d82ad8"
+    }
   },
   "0.18.7": {
     "x86_64_linux_musl": {

manifests/cargo-shear.json

@@ -28,13 +28,65 @@
   },
   "license_markdown": "[MIT](https://github.com/Boshen/cargo-shear/blob/main/LICENSE)",
   "latest": {
-    "version": "1.7.0"
+    "version": "1.7.2"
   },
   "1": {
-    "version": "1.7.0"
+    "version": "1.7.2"
   },
   "1.7": {
-    "version": "1.7.0"
+    "version": "1.7.2"
+  },
+  "1.7.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE36D58BB8E26B",
+      "checksum": "249777f60f61b8735c351e64c53af709568282a86a0653f4b4511c7b34f74197"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE36D58D58635A",
+      "checksum": "7b34458eb7fbdcca89d98839edd75b9cdd440b1e20283beab79cf1c7d7322050"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE36D5D208EC72",
+      "checksum": "c9473f78b7f41c098d0226bfbc6cefcef9589a9f16c8caab7f420b3dbfbbcfdc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE36D58F3371D0",
+      "checksum": "82cb8c31d53c39fbabbacdee669946b852cec547dd766b654bb1496a6aa2890b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE36D591C32280",
+      "checksum": "d9aa86217e0453132531f98ab327a7f79625789ed70f6c928597840587f21158"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE36D5B744FB63",
+      "checksum": "3876fd9d31c3a8a6869dd8ebb2373028cedd2a73b81462e458ce62c86909e6b8"
+    }
+  },
+  "1.7.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE327BCBE75955",
+      "checksum": "48dbeb3aa587e217e5f91505991b353d6f9c6e8eb663241f339de643b21f847e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE327BDF400922",
+      "checksum": "4f8d4c2d6e8f51ed5a8ff6d1a065028bd6440091e62bb06e8f86fbe804218744"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE327C18793EB8",
+      "checksum": "79acec595ffd79824d1ad706c5da21b9e96c5de13afe865282dc90d456c91cf9"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE327BD0614462",
+      "checksum": "46944afc093256d68b1a3eba6355ef637113129aa0d7ae59d4459edbaf53335a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE327BD75F9FAE",
+      "checksum": "171b70e2550f9742aabe9550fde6e9147b594ae82133e280a08a8c26e38d27d3"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE327BF755A705",
+      "checksum": "d487f98d466be25c9e94030a3740a52774494d1ec081412877e8f21af9306442"
+    }
   },
   "1.7.0": {
     "x86_64_linux_musl": {

manifests/cyclonedx.json

@@ -22,10 +22,36 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE)",
   "latest": {
-    "version": "0.29.1"
+    "version": "0.29.2"
   },
   "0.29": {
-    "version": "0.29.1"
+    "version": "0.29.2"
+  },
+  "0.29.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE372FEE109B76",
+      "checksum": "6c5ed6321ee3bb3c268b6d19477dbcd5509a757f118bed4b6508fe9fbbdc2a5b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE372FFA07758A",
+      "checksum": "06be109330e934c556e8439bbb41ef44aa311f3f83456196f024facfa06f8c91"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE372FF4B4968F",
+      "checksum": "1cebf468eeeb36d518a68eda6e2d67cfa4d20c4c2f3f9defe6d29a736cc7dfd7"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE372FF331CD0B",
+      "checksum": "2fe04169f663935ad8510ca3dfbec68f9ab2eb0136918abd00bc454ec20cbeaf"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE373014FD7800",
+      "checksum": "4fdc937c1bf8b1a3e68e3250c72976258e9b4ff03966516df8184c5a359e2154"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE372FF845792B",
+      "checksum": "e26e56d7624a4c4d8f1ca3903460f4bf6e433735614486f4ac5a11e8168cb7a9"
+    }
   },
   "0.29.1": {
     "x86_64_linux_gnu": {

manifests/just.json

@@ -22,10 +22,65 @@
   },
   "license_markdown": "[CC0-1.0](https://github.com/casey/just/blob/master/LICENSE)",
   "latest": {
-    "version": "1.43.1"
+    "version": "1.44.1"
   },
   "1": {
-    "version": "1.43.1"
+    "version": "1.44.1"
+  },
+  "1.44": {
+    "version": "1.44.1"
+  },
+  "1.44.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE36FD78B004A4",
+      "checksum": "65a2a774d4ba07741c7beb89c74fdf77b97621610ae231d687ce9bee82fecbfc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE36FD8597B7D1",
+      "checksum": "0b567d2440e00819805492cc0b09096c6452fb6f679657e2c6894ed180f09810"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE36FDC643FE60",
+      "checksum": "bfdeea81f9fa630bb8cb2bbeee41b5b60e5fc96a9600471f54f1cf6dbd5b334a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE36FD893D9546",
+      "checksum": "15c56615a797135e5e195e874c22a52003ba9b3f760554a016bcb108486ac67e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE36FD84EFD819",
+      "checksum": "e00f6f026add950f65dc7c5e4839471a20fb2e7541424e071c6b47ab3ffb72a2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE36FDABE70878",
+      "checksum": "767fd5360ab34f635f1f0591efc6f0bd3e7b5b6229204bfa4b50fdc26da33a9f"
+    }
+  },
+  "1.44.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE3527EDBC4376",
+      "checksum": "892d229432f5ac56f8538ab9e115ce949d20541a5a15b93432687fb62dd21d97"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE3527F1213FC3",
+      "checksum": "00c3ca83a13378032e4c7d6aa1ab2ba5c7410b02563aa438dc4ad7f00531cb3b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE352827EE1A1B",
+      "checksum": "56e5766d94fe211f196a980e50da3754370b412fb0264d4f146350b720b9e1d8"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE3527FBFE29D1",
+      "checksum": "9091286b238e86bc9103a765246e2d88508190be993721eea1d8eb98d5999d52"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE3527E7A47ECF",
+      "checksum": "faf40761054e94cdff4ad5fd25b092d43fe65b6ad7d0accc08ca2194c8a91620"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE3528240D254D",
+      "checksum": "91b2427d5d1e3cdf9ad92cc814ead75e3776ae17f736cc17201659acd7f37f5d"
+    }
   },
   "1.43": {
     "version": "1.43.1"

manifests/knope.json

@@ -3,10 +3,36 @@
   "template": null,
   "license_markdown": "[MIT](https://github.com/knope-dev/knope/blob/main/LICENSE)",
   "latest": {
-    "version": "0.21.5"
+    "version": "0.21.7"
   },
   "0.21": {
-    "version": "0.21.5"
+    "version": "0.21.7"
+  },
+  "0.21.7": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.7/knope-x86_64-unknown-linux-musl.tgz",
+      "etag": "0x8DE336F8FEBF974",
+      "checksum": "93b1feef88b54c69a6e8f6293244ab1cb7297068a0973bdc30be6babb0489f35",
+      "bin": "knope-x86_64-unknown-linux-musl/knope"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.7/knope-x86_64-apple-darwin.tgz",
+      "etag": "0x8DE336F8FE597FC",
+      "checksum": "808da7fefa3e6bc7353c07725e0c37971d2e9eb5980d47759cc2f389c379a3ac",
+      "bin": "knope-x86_64-apple-darwin/knope"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.7/knope-x86_64-pc-windows-msvc.tgz",
+      "etag": "0x8DE336F8FE6A83C",
+      "checksum": "828efee1308563ff528df6ff7829ac226cac13bde7fed1be6c2923e3dcf8f2ec",
+      "bin": "knope-x86_64-pc-windows-msvc/knope.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/knope-dev/knope/releases/download/knope/v0.21.7/knope-aarch64-apple-darwin.tgz",
+      "etag": "0x8DE336F8FDE741D",
+      "checksum": "19784c576db2942485a7d45e8d2fc0ad5a3fcf252c1774e233bc53f1a6beea31",
+      "bin": "knope-aarch64-apple-darwin/knope"
+    }
   },
   "0.21.6": {
     "x86_64_linux_musl": {

manifests/mise.json

@@ -28,10 +28,65 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2025.11.11"
+    "version": "2025.12.1"
   },
   "2025": {
-    "version": "2025.11.11"
+    "version": "2025.12.1"
+  },
+  "2025.12": {
+    "version": "2025.12.1"
+  },
+  "2025.12.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE369841C0B929",
+      "checksum": "1fb65f2a1d31882c3f220fc82380c2ad9cb29060ed5aa7da6ea1879b46528379"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE369843C0B127",
+      "checksum": "68b250632b1f1f29f6116ca513d1641097dfdc2cf05520ee0ca23907962b3d6f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE3698447B3FF4",
+      "checksum": "187420e0f0e26f92a4a5e14a8e1532226ff0c42917aea7d0977f72eb0b591c30"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE36983F0F9E34",
+      "checksum": "c6405751686a986e8560866411c3b1eac3695cc937da7434c351af41a70500ca"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE36984340040D",
+      "checksum": "94659ac9b7b30d149464ef4a76498182b0c5cadeccef1811ab9e75ff3d1ad159"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE369844638CE0",
+      "checksum": "9c1dfd2f7fb7e88fc250f33667894c926c5e5a864b141caa70676197021e6d68"
+    }
+  },
+  "2025.12.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE331C7F5172EE",
+      "checksum": "d1e8969ea5339e4849f8f39c72039c44fe76ed40e1d9e2f4358fa861a1833f94"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE331C83060A07",
+      "checksum": "a9f6819ff1431975063c9726c19d873738423d57c9485912f4e216a2d6e922d2"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE331C83CAED8A",
+      "checksum": "733f013d1fc2a16e63a79495f9ed804558b1bdd51cbf06388e95b817317b21a3"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE331C7A6FE775",
+      "checksum": "530550da634d5ae82cf6d51ac0400ba8d9ba3197940841cc8b2f47db4411c95c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE331C81F1646B",
+      "checksum": "4d69455cd35ff28c0a74c072f2daad895742cd0fb847de57f986668c05b8bb14"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE331C8341978B",
+      "checksum": "cc621c8d411b170392b0e4d9c1fa20a915e7dea2dea13f80e8119d113b368d53"
+    }
   },
   "2025.11": {
     "version": "2025.11.11"

manifests/protoc.json

@@ -3,13 +3,50 @@
   "template": null,
   "license_markdown": "[BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE)",
   "latest": {
-    "version": "3.33.1"
+    "version": "3.33.2"
   },
   "3": {
-    "version": "3.33.1"
+    "version": "3.33.2"
   },
   "3.33": {
-    "version": "3.33.1"
+    "version": "3.33.2"
+  },
+  "3.33.2": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-linux-x86_64.zip",
+      "etag": "0x8DE344B9A3BA1FC",
+      "checksum": "b24b53f87c151bfd48b112fe4c3a6e6574e5198874f38036aff41df3456b8caf"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-osx-x86_64.zip",
+      "etag": "0x8DE344B9A608C9D",
+      "checksum": "dba51cfcc85076d56e7de01a647865c5a7f995c3dce427d5215b53e50b7be43f"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-win64.zip",
+      "etag": "0x8DE344B9A984DC3",
+      "checksum": "376770cd4073beb63db56fdd339260edb9957b3c4472e05a75f5f9ec8f98d8f5"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-linux-aarch_64.zip",
+      "etag": "0x8DE344B99D1BEFF",
+      "checksum": "706662a332683aa2fffe1c4ea61588279d31679cd42d91c7d60a69651768edb8"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-osx-aarch_64.zip",
+      "etag": "0x8DE344B9A449896",
+      "checksum": "5be1427127788c9f7dd7d606c3e69843dd3587327dea993917ffcb77e7234b44"
+    },
+    "powerpc64le_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-linux-ppcle_64.zip",
+      "etag": "0x8DE344B99DB9E8D",
+      "checksum": "16b4a36c07daab458bc040523b1f333ddd37e1440fa71634f297a458c7fef4c4"
+    },
+    "s390x_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v33.2/protoc-33.2-linux-s390_64.zip",
+      "etag": "0x8DE344B99ECA266",
+      "checksum": "c53c6513ebd6cd8c3592e2d75ea9d8aa1a91be3ba1e17f3bf95cabc2d6b8c3e0"
+    }
   },
   "3.33.1": {
     "x86_64_linux_gnu": {

manifests/release-plz.json

@@ -22,10 +22,32 @@
   },
   "license_markdown": "[MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.3.149"
+    "version": "0.3.150"
   },
   "0.3": {
-    "version": "0.3.149"
+    "version": "0.3.150"
+  },
+  "0.3.150": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE3440C6A732E0",
+      "checksum": "e6d334363fa377583c71403143da4a069f4e3af8fa69f8624bb1e195c1e93146"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE34414BCC3926",
+      "checksum": "c8710e74994bd5a69efa02f4af17175eb866489a6209cb5debc2c5e32a11db77"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE3440CB59CAAD",
+      "checksum": "b4a7075b6f4af61d2e77ff436b53c70f8b1f5cceb70ef9d18a1615c985bbf27f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE3440E1CE6A60",
+      "checksum": "b11e15e335910facc003394ad8a4419238dab0705e5102aaedfba1fefdce2743"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE34415EAD8642",
+      "checksum": "1fe491b0e923464cbcf9e825485614eaa0160bd474aa16865bae6c0730d2433c"
+    }
   },
   "0.3.149": {
     "x86_64_linux_musl": {

manifests/trivy.json

@@ -32,7 +32,40 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)",
   "latest": {
-    "version": "0.67.2"
+    "version": "0.68.1"
+  },
+  "0.68": {
+    "version": "0.68.1"
+  },
+  "0.68.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE3251848BE364",
+      "checksum": "63e37242088e418651931f891963c19554faa19f0591fe6b40b606152051df2f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE3251830BD5BF",
+      "checksum": "d5b5bd3b3c3626d223c3981cc40f4709f00a6327a681b588d2fc64a3aa9d02c5"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE325185F54E47",
+      "checksum": "600fc65bdb486e160efeedf8fff8ef6be8e9d2e82f2ea4db82ad23263ed5f902"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE325182E5186B",
+      "checksum": "b29ea550f573afbcae3c86fb2b5e0ebba76b7cb0965e3787c4e8cb884d2c1d57"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE32518617A3C8",
+      "checksum": "4dd3d2e74e1b6f6f7fd5fbf55489727698f586d6a6a0cff3421031a05b80bcac"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE325182EA1BD7",
+      "checksum": "85fad2f54d695044ff4c7cfbf527a339bbba624e248ca78c81b24d3ff505ec36"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE325184AA45AE",
+      "checksum": "5fd10a554ffc2a82bdc0212112352f0641d1ccf46b60f7c3be8b1f6c9e98a291"
+    }
   },
   "0.67": {
     "version": "0.67.2"

manifests/uv.json

@@ -40,10 +40,86 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.9.14"
+    "version": "0.9.16"
   },
   "0.9": {
-    "version": "0.9.14"
+    "version": "0.9.16"
+  },
+  "0.9.16": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE34D2D524A50C",
+      "checksum": "35a26bea6aad2c8eb468cdf69baccc7ab79b3d0971a76a6741a687535a2acfad"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE34D2D4A776A5",
+      "checksum": "e1ba1992e163f8b9d54d1cd1501002f019f4b729dec2a197e79a56d354ec2773"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE34D2D4E4AFD5",
+      "checksum": "e498a1d5983da7727af96b63ddfcd52ee883173552664ad0b629b3d4c7a46e91"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE34D2D2912A08",
+      "checksum": "cb6730e083f17b38aea88c2bdfc3d4c834a832444087d30d7914bd460ae15b79"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE34D2D1F241B7",
+      "checksum": "db6d7fb299c35dc9bbbeb89cfa9aa55a9584f637d370c0a4c62a50df9c9294a7"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE34D2D2690EBC",
+      "checksum": "591c73f47dfec72f9d242eebcb36197f27ad652a59d70e70db5c52018684d78e"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE34D2D42B5882",
+      "checksum": "982167ebae22efbda212ccbacc582b00486150695d83fca94d39c3422a0f8865"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE34D2D43F6626",
+      "checksum": "b94ef3afa9bc94288e069162143ec20ed1d103d7631a17ca14c6ac28e8825baa"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE34D2D4670CC2",
+      "checksum": "cd32014282b2d2de53eb0176004dffddec77f0afbe76713f57c245e08cdf2b21"
+    }
+  },
+  "0.9.15": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE320C0CDF1726",
+      "checksum": "7037889adb182ce50379b3a789154ad6be00397b892fec9e93e11c457945aec0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE320C0C5D32FD",
+      "checksum": "a7d9ae35ce2d192cb0356f07439cfc6768d4dff8e95ae69f821e8fbe7bcb0e09"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE320C0C99A9C9",
+      "checksum": "a6887c93a54c46de7dcc0bc798f84a130d7f411124ad43252716f75d0c2c33e0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE320C0A36F269",
+      "checksum": "41f6ef4f86e9f8015bc31e9ca4fd44a6e2c80fc0b75d6eb74063f64ca15177c7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE320C0995E95E",
+      "checksum": "388029510fdf64771745e9fb85cd6ec042580678a9e61c90fe355301f1c42f1e"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE320C09D7FF2D",
+      "checksum": "19422893deba37feb4b4191b43be89525ac48bd378f9fdbf2d5bca44319f8c19"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE320C0BC93AB9",
+      "checksum": "880b977489a0a580df04cf9020968bf05553bccd8dd48375a0c7cb6dd8048f58"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE320C0C042C97",
+      "checksum": "cb993da480f90b226bca66a1f54c4a0419a245d07d3d0e30a3f8c9a5b1f8fd2a"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE320C0C18612F",
+      "checksum": "e0cac629299a49336e92a13684671bbf50933749412f480e051a4071a619fcd8"
+    }
   },
   "0.9.14": {
     "x86_64_linux_musl": {

tools/codegen/Cargo.toml

@@ -14,7 +14,7 @@ serde = "1"
 serde_derive = "1"
 serde_json = "1"
 sha2 = "0.10"
-spdx = "0.12"
+spdx = "0.13"
 tar = "0.4"
 toml = { version = "0.9", default-features = false, features = ["parse", "serde"] }
 # TODO: call curl command instead of using ureq?

tools/publish.sh

@@ -191,7 +191,7 @@ cp -- ./manifests/* "${schema_workspace}"
   # Stage changes
   git add .
   # Detect changes, then commit and push if changes exist
-  if [[ "$(git status --porcelain=v1 | wc -l)" != "0" ]]; then
+  if [[ "$(git status --porcelain=v1 | LC_ALL=C wc -l)" != "0" ]]; then
     git commit -m 'Update manifest schema'
     retry git push origin HEAD
   fi

tools/tidy.sh

@@ -118,11 +118,11 @@ check_alt() {
 check_hidden() {
   local res
   for file in "$@"; do
-    check_alt ".${file}" "${file}" "$(comm -23 <(ls_files "*${file}") <(ls_files "*.${file}"))"
+    check_alt ".${file}" "${file}" "$(LC_ALL=C comm -23 <(ls_files "*${file}") <(ls_files "*.${file}"))"
   done
 }
 sed_rhs_escape() {
-  sed 's/\\/\\\\/g; s/\&/\\\&/g; s/\//\\\//g' <<<"$1"
+  sed -E 's/\\/\\\\/g; s/\&/\\\&/g; s/\//\\\//g' <<<"$1"
 }
 
 if [[ $# -gt 0 ]]; then
@@ -137,12 +137,8 @@ py_suffix=''
 if type -P python3 >/dev/null; then
   py_suffix=3
 fi
-yq() {
-  pipx run yq "$@"
-}
-tomlq() {
-  pipx run --spec yq tomlq "$@"
-}
+yq() { pipx run yq "$@"; }
+tomlq() { pipx run --spec yq tomlq "$@"; }
 case "$(uname -s)" in
   Linux)
     if [[ "$(uname -o)" == 'Android' ]]; then
@@ -167,10 +163,11 @@ case "$(uname -s)" in
       if [[ "${PATH}" != *'/usr/xpg4/bin'* ]]; then
         export PATH="/usr/xpg4/bin:${PATH}"
       fi
-      # GNU/BSD grep/sed is required to run some checks, but most checks are okay with other POSIX grep/sed.
+      # GNU/BSD sed is required.
+      # GNU/BSD grep is required by some checks, but most checks are okay with other POSIX grep.
       # Solaris /usr/xpg4/bin/grep has -q, -E, -F, but no -o (non-POSIX).
       # Solaris /usr/xpg4/bin/sed has no -E (POSIX.1-2024) yet.
-      for tool in sed grep; do
+      for tool in 'grep' 'sed'; do
         if type -P "g${tool}" >/dev/null; then
           eval "${tool}() { g${tool} \"\$@\"; }"
         fi
@@ -189,12 +186,8 @@ case "$(uname -s)" in
         else
           jq() { command jq "$@" | tr -d '\r'; }
         fi
-        yq() {
-          pipx run yq "$@" | tr -d '\r'
-        }
-        tomlq() {
-          pipx run --spec yq tomlq "$@" | tr -d '\r'
-        }
+        yq() { pipx run yq "$@" | tr -d '\r'; }
+        tomlq() { pipx run --spec yq tomlq "$@" | tr -d '\r'; }
       fi
     fi
     ;;
@@ -203,25 +196,34 @@ esac
 
 check_install git
 exclude_from_ls_files=()
-# - `find` lists symlinks. `! ( -name <dir> -prune )` (.i.e., ignore <dir>) are manually listed from .gitignore.
-# - `git submodule status` lists submodules. Use sed to remove the first character indicates status ( |+|-).
+# - `find` lists symlinks. `! ( -name <dir> -prune )` means recursively ignore <dir>. `cut` removes the leading `./`.
+#   This can be replaced with `fd -H -t l`.
+# - `git submodule status` lists submodules. The first `cut` removes the first character indicates status ( |+|-).
 # - `git ls-files --deleted` lists removed files.
-while IFS=$'\n' read -r line; do exclude_from_ls_files+=("${line}"); done < <({
-  find . \! \( -name .git -prune \) \! \( -name target -prune \) \! \( -name tmp -prune \) -type l | cut -c3-
-  git submodule status | sed 's/^.//' | cut -d' ' -f2
+find_prune=(\! \( -name .git -prune \))
+while IFS= read -r; do
+  find_prune+=(\! \( -name "${REPLY}" -prune \))
+done < <(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' .gitignore)
+while IFS=$'\n' read -r; do
+  exclude_from_ls_files+=("${REPLY}")
+done < <({
+  find . "${find_prune[@]}" -type l | cut -c3-
+  git submodule status | cut -c2- | cut -d' ' -f2
   git ls-files --deleted
 } | LC_ALL=C sort -u)
 exclude_from_ls_files_no_symlink=()
-while IFS=$'\n' read -r line; do exclude_from_ls_files_no_symlink+=("${line}"); done < <({
-  git submodule status | sed 's/^.//' | cut -d' ' -f2
+while IFS=$'\n' read -r; do
+  exclude_from_ls_files_no_symlink+=("${REPLY}")
+done < <({
+  git submodule status | cut -c2- | cut -d' ' -f2
   git ls-files --deleted
 } | LC_ALL=C sort -u)
 ls_files() {
   if [[ "${1:-}" == '--include-symlink' ]]; then
     shift
-    comm -23 <(git ls-files "$@" | LC_ALL=C sort) <(printf '%s\n' ${exclude_from_ls_files_no_symlink[@]+"${exclude_from_ls_files_no_symlink[@]}"})
+    LC_ALL=C comm -23 <(git ls-files "$@" | LC_ALL=C sort) <(printf '%s\n' ${exclude_from_ls_files_no_symlink[@]+"${exclude_from_ls_files_no_symlink[@]}"})
   else
-    comm -23 <(git ls-files "$@" | LC_ALL=C sort) <(printf '%s\n' ${exclude_from_ls_files[@]+"${exclude_from_ls_files[@]}"})
+    LC_ALL=C comm -23 <(git ls-files "$@" | LC_ALL=C sort) <(printf '%s\n' ${exclude_from_ls_files[@]+"${exclude_from_ls_files[@]}"})
   fi
 }
 
@@ -445,7 +447,7 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
       new+="${line}"$'\a'
     done < <(tr '\n' '\a' <"${markdown}" | grep -Eo '<!-- tidy:sync-markdown-to-rustdoc:start[^ ]* -->.*<!-- tidy:sync-markdown-to-rustdoc:end -->')
     new+='<!-- tidy:sync-markdown-to-rustdoc:end -->'
-    new=$(tr '\n' '\a' <"${lib}" | sed "s/<!-- tidy:sync-markdown-to-rustdoc:start[^ ]* -->.*<!-- tidy:sync-markdown-to-rustdoc:end -->/$(sed_rhs_escape "${new}")/" | tr '\a' '\n')
+    new=$(tr '\n' '\a' <"${lib}" | sed -E "s/<!-- tidy:sync-markdown-to-rustdoc:start[^ ]* -->.*<!-- tidy:sync-markdown-to-rustdoc:end -->/$(sed_rhs_escape "${new}")/" | tr '\a' '\n')
     printf '%s\n' "${new}" >|"${lib}"
     check_diff "${lib}"
   done
@@ -677,7 +679,7 @@ elif check_install shellcheck; then
         # Others: false negative
         trap -- 'rm -- ./tools/.tidy-tmp; printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
         printf '%s\n' "${text}" >|./tools/.tidy-tmp
-        if ! shellcheck --color="${color}" --exclude "${shellcheck_exclude}" ./tools/.tidy-tmp | sed "s/\.\/tools\/\.tidy-tmp/$(sed_rhs_escape "${display_path}")/g"; then
+        if ! shellcheck --color="${color}" --exclude "${shellcheck_exclude}" ./tools/.tidy-tmp | sed -E "s/\.\/tools\/\.tidy-tmp/$(sed_rhs_escape "${display_path}")/g"; then
           error "check failed; please resolve the above shellcheck error(s)"
         fi
         rm -- ./tools/.tidy-tmp
@@ -822,7 +824,7 @@ EOF
         # Others: false negative
         trap -- 'rm -- ./tools/.tidy-tmp; printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
         printf '%s\n' "${text}" >|./tools/.tidy-tmp
-        if ! shellcheck --color="${color}" --exclude "${shellcheck_exclude}" ./tools/.tidy-tmp | sed "s/\.\/tools\/\.tidy-tmp/$(sed_rhs_escape "${display_path}")/g"; then
+        if ! shellcheck --color="${color}" --exclude "${shellcheck_exclude}" ./tools/.tidy-tmp | sed -E "s/\.\/tools\/\.tidy-tmp/$(sed_rhs_escape "${display_path}")/g"; then
           error "check failed; please resolve the above shellcheck error(s)"
         fi
         rm -- ./tools/.tidy-tmp
@@ -833,7 +835,8 @@ EOF
         # The top-level permissions must be weak as they are referenced by all jobs.
         permissions=$(jq -c '.permissions' <<<"${workflow}")
         case "${permissions}" in
-          '{"contents":"read"}' | '{"contents":"none"}') ;;
+          # `permissions: {}` means "all none": https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
+          '{"contents":"read"}' | '{}') ;;
           null) error "${workflow_path}: top level permissions not found; it must be 'contents: read' or weaker permissions" ;;
           *) error "${workflow_path}: only 'contents: read' and weaker permissions are allowed at top level, but found '${permissions}'; if you want to use stronger permissions, please set job-level permissions" ;;
         esac
@@ -911,11 +914,13 @@ if [[ -e .github/dependabot.yml ]]; then
   zizmor_targets+=(.github/dependabot.yml)
 fi
 if [[ ${#zizmor_targets[@]} -gt 0 ]]; then
-  if check_install zizmor; then
+  if [[ "${ostype}" =~ ^(netbsd|openbsd|dragonfly|illumos|solaris)$ ]] && [[ -n "${CI:-}" ]] && ! type -P zizmor >/dev/null; then
+    warn "this check is skipped on NetBSD/OpenBSD/Dragonfly/illumos/Solaris due to installing zizmor is hard on these platform"
+  elif check_install zizmor; then
     IFS=' '
-    info "running \`zizmor ${zizmor_targets[*]}\`"
+    info "running \`zizmor -q ${zizmor_targets[*]}\`"
     IFS=$'\n\t'
-    zizmor "${zizmor_targets[@]}"
+    zizmor -q "${zizmor_targets[@]}"
   fi
 fi
 printf '\n'
@@ -926,7 +931,7 @@ check_alt '.sh extension' '*.bash extension' "$(ls_files '*.bash')"
 if [[ -f tools/.tidy-check-license-headers ]]; then
   info "checking license headers (experimental)"
   failed_files=''
-  for p in $(comm -12 <(eval $(<tools/.tidy-check-license-headers) | LC_ALL=C sort) <(ls_files | LC_ALL=C sort)); do
+  for p in $(LC_ALL=C comm -12 <(eval $(<tools/.tidy-check-license-headers) | LC_ALL=C sort) <(ls_files | LC_ALL=C sort)); do
     case "${p##*/}" in
       *.stderr | *.expanded.rs) continue ;; # generated files
       *.json) continue ;;                   # no comment support
@@ -998,8 +1003,8 @@ if [[ -f .cspell.json ]]; then
     printf '%s\n' "${config_old}" >|.cspell.json
     trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
     cat >|.github/.cspell/rust-dependencies.txt <<EOF
-// This file is @generated by ${0##*/}.
-// It is not intended for manual editing.
+# This file is @generated by ${0##*/}.
+# It is not intended for manual editing.
 EOF
     if [[ -n "${dependencies_words}" ]]; then
       LC_ALL=C sort -f >>.github/.cspell/rust-dependencies.txt <<<"${dependencies_words}"$'\n'
@@ -1019,7 +1024,7 @@ EOF
     if ! ls_files | npx -y cspell stdin --no-progress --no-summary --show-context; then
       error "spellcheck failed: please fix uses of below words in file names or add to ${project_dictionary} if correct"
       printf '=======================================\n'
-      { ls_files | npx -y cspell stdin --no-progress --no-summary --words-only || true; } | sed "s/'s$//g" | LC_ALL=C sort -f -u
+      { ls_files | npx -y cspell stdin --no-progress --no-summary --words-only || true; } | sed -E "s/'s$//g" | LC_ALL=C sort -f -u
       printf '=======================================\n\n'
     fi
     # Check file contains.
@@ -1027,7 +1032,7 @@ EOF
     if ! ls_files | npx -y cspell --file-list stdin --no-progress --no-summary; then
       error "spellcheck failed: please fix uses of below words or add to ${project_dictionary} if correct"
       printf '=======================================\n'
-      { ls_files | npx -y cspell --file-list stdin --no-progress --no-summary --words-only || true; } | sed "s/'s$//g" | LC_ALL=C sort -f -u
+      { ls_files | npx -y cspell --file-list stdin --no-progress --no-summary --words-only || true; } | sed -E "s/'s$//g" | LC_ALL=C sort -f -u
       printf '=======================================\n\n'
     fi
 
@@ -1038,8 +1043,8 @@ EOF
       fi
       case "${ostype}" in
         # NetBSD uniq doesn't support -i flag.
-        netbsd) dup=$(sed '/^$/d; /^\/\//d' "${project_dictionary}" "${dictionary}" | LC_ALL=C sort -f | tr '[:upper:]' '[:lower:]' | LC_ALL=C uniq -d) ;;
-        *) dup=$(sed '/^$/d; /^\/\//d' "${project_dictionary}" "${dictionary}" | LC_ALL=C sort -f | LC_ALL=C uniq -d -i) ;;
+        netbsd) dup=$(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' "${project_dictionary}" "${dictionary}" | LC_ALL=C sort -f | tr '[:upper:]' '[:lower:]' | LC_ALL=C uniq -d) ;;
+        *) dup=$(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' "${project_dictionary}" "${dictionary}" | LC_ALL=C sort -f | LC_ALL=C uniq -d -i) ;;
       esac
       if [[ -n "${dup}" ]]; then
         error "duplicated words in dictionaries; please remove the following words from ${project_dictionary}"
@@ -1050,13 +1055,14 @@ EOF
     # Make sure the project-specific dictionary does not contain unused words.
     if [[ -n "${REMOVE_UNUSED_WORDS:-}" ]]; then
       grep_args=()
-      for word in $(grep -Ev '^//' "${project_dictionary}" || true); do
+      while IFS= read -r word; do
         if ! grep -Eqi "^${word}$" <<<"${all_words}"; then
-          grep_args+=(-e "^${word}$")
+          grep_args+=(-e "^[ \t]*${word}[ \t]*(#.*|$)")
         fi
-      done
+      done < <(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' "${project_dictionary}")
       if [[ ${#grep_args[@]} -gt 0 ]]; then
         info "removing unused words from ${project_dictionary}"
+        info "please commit changes made by the removal above"
         res=$(grep -Ev "${grep_args[@]}" "${project_dictionary}" || true)
         if [[ -n "${res}" ]]; then
           printf '%s\n' "${res}" >|"${project_dictionary}"
@@ -1066,11 +1072,11 @@ EOF
       fi
     else
       unused=''
-      for word in $(grep -Ev '^//' "${project_dictionary}" || true); do
+      while IFS= read -r word; do
         if ! grep -Eqi "^${word}$" <<<"${all_words}"; then
           unused+="${word}"$'\n'
         fi
-      done
+      done < <(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' "${project_dictionary}")
       if [[ -n "${unused}" ]]; then
         error "unused words in dictionaries; please remove the following words from ${project_dictionary} or run ${0##*/} locally"
         print_fenced "${unused}"