Release 2.70.4

.github/.cspell/project-dictionary.txt

@@ -27,6 +27,7 @@ pluginconf
 ppcle
 prek
 quickinstall
+rclone
 rdme
 rootfs
 sccache

.github/dependabot.yml

@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: cargo
+  - package-ecosystem: cargo # zizmor: ignore[dependabot-cooldown] # Unless dependencies are pinned/locked, the effect is limited.
     directory: /
     schedule:
       interval: daily
@@ -14,6 +14,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: ''
     labels: []

.github/workflows/ci.yml

@@ -51,7 +51,8 @@ jobs:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
       security-events: write # for github/codeql-action/*
-    secrets: inherit
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
 
   test:
     strategy:
@@ -99,7 +100,11 @@ jobs:
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.bash }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "${TOOL}" "${OS}" "${BASH}" >>"${GITHUB_OUTPUT}"
+        env:
+          TOOL: ${{ matrix.tool }}
+          OS: ${{ matrix.os }}
+          BASH: ${{ matrix.bash }}
       - run: |
           printf '%s\n' 'C:\msys64\mingw32\bin' >>"${GITHUB_PATH}"
           printf '%s\n' 'C:\msys64\usr\bin' >>"${GITHUB_PATH}"
@@ -155,7 +160,7 @@ jobs:
       - run: env
       - uses: ./
         with:
-          # NB: Update alias list in tools/publish.rs, case for aliases in main.sh,
+          # NB: Update alias list in release.yml, case for aliases in main.sh,
           # and match for alias for tools/codegen/src/tools-markdown.rs.
           tool: |
             nextest
@@ -215,6 +220,7 @@ jobs:
           - ubuntu:20.04 # glibc 2.31
           - ubuntu:22.04 # glibc 2.35
           - ubuntu:24.04 # glibc 2.39
+          - ubuntu:26.04 # glibc 2.42
           - debian:9-slim # glibc 2.24
           - debian:10-slim # glibc 2.28
           - debian:11-slim # glibc 2.31
@@ -263,7 +269,7 @@ jobs:
           sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
             -e 's!^#baseurl=http://mirror.centos.org/!baseurl=https://vault.centos.org/!'
           sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
-          if [[ "${{ matrix.container }}" == "centos:6" ]]; then
+          if [[ "${CONTAINER}" == "centos:6" ]]; then
             # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
             yum install -y gcc openssl-devel
             curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
@@ -277,13 +283,17 @@ jobs:
               https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
               https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
           fi
+        env:
+          CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
       - uses: taiki-e/checkout-action@v1
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "" "${{ matrix.container }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "" "${CONTAINER}" >>"${GITHUB_OUTPUT}"
+        env:
+          CONTAINER: ${{ matrix.container }}
       # remove bash installed by checkout-action
       - run: apk --no-cache del bash
         shell: sh

.github/workflows/manifest.yml

@@ -37,7 +37,8 @@ jobs:
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
-    secrets: inherit
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
     with:
       script: tools/manifest.sh
       commit-script: tools/ci/manifest.sh

.github/workflows/release.yml

@@ -26,6 +26,10 @@ defaults:
   run:
     shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   prepare:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
@@ -91,7 +95,6 @@ jobs:
           printf '%s\n' "release-date=${release_date}" >>"${GITHUB_OUTPUT}"
 
           # Get the current revision.
-          retry git fetch origin &>/dev/null
           rev=$(git rev-parse HEAD)
           printf '%s\n' "rev: ${rev}"
           printf '%s\n' "rev=${rev}" >>"${GITHUB_OUTPUT}"
@@ -259,7 +262,9 @@ jobs:
           release_date="${RELEASE_DATE}"
 
           # Make sure the current revision is same as prepare step.
-          retry git fetch origin &>/dev/null
+          # --unshallow is necessary to successfully push the
+          # "releases/${major_version_tag}" branch in the subsequent step.
+          retry git fetch origin --unshallow &>/dev/null
           rev=$(git rev-parse HEAD)
           if [[ "${rev}" != "${PREPARE_REV}" ]]; then
             bail "revision difference between prepare step"
@@ -324,12 +329,11 @@ jobs:
             set -x
             git tag "${tag}"
             retry git push origin HEAD
-            retry git push origin refs/tags/"${tag}"
 
             major_version_tag="v${version%%.*}"
             git branch "releases/${major_version_tag}"
             git tag -f "${major_version_tag}"
-            refs=("refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
+            refs=("refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
 
             tools=()
             for tool in tools/codegen/base/*.json; do
@@ -358,7 +362,7 @@ jobs:
               git add action.yml
               git commit -m "${tool}"
               git tag -f "${tool}"
-              git checkout main
+              git checkout refs/tags/"${tag}"
               refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
               branches+=("releases/${tool}")
             done
@@ -435,7 +439,8 @@ jobs:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action
       attestations: write # unused (used when options for uploading binaries are set)
-    secrets: inherit
+    secrets:
+      PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
     with:
       version: ${{ inputs.version }}
       tag-prefix: install-action-manifest-schema-

.github/zizmor.yml

@@ -2,10 +2,8 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  dependabot-cooldown: { disable: true } # Unless dependencies are pinned/locked, the effect is limited.
-  secrets-inherit: { disable: true }
+  anonymous-definition: { disable: true }
   unpinned-uses:
     config:
       policies:
         taiki-e/*: any
-        '*': ref-pin

CHANGELOG.md

@@ -10,6 +10,56 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.70.4] - 2026-04-01
+
+- Update `wasm-bindgen@latest` to 0.2.117.
+
+- Update `vacuum@latest` to 0.25.5.
+
+- Update `tombi@latest` to 0.9.13.
+
+- Update `mise@latest` to 2026.3.18.
+
+## [2.70.3] - 2026-03-31
+
+- Update `wasm-bindgen@latest` to 0.2.116.
+
+- Update `cargo-insta@latest` to 1.47.2.
+
+- Update `tombi@latest` to 0.9.12.
+
+- Update `biome@latest` to 2.4.10.
+
+## [2.70.2] - 2026-03-30
+
+- Update `vacuum@latest` to 0.25.3.
+
+- Update `tombi@latest` to 0.9.11.
+
+## [2.70.1] - 2026-03-29
+
+- Update `cargo-insta@latest` to 1.47.1.
+
+- Update `cargo-binstall@latest` to 1.17.9.
+
+- Update `tombi@latest` to 0.9.10.
+
+## [2.70.0] - 2026-03-28
+
+- Install `uv`, `uvw` (Windows-only), and `uvx` binaries when installing `uv`. Previously, only `uv` binary was installed. ([#1632](https://github.com/taiki-e/install-action/pull/1632))
+
+## [2.69.14] - 2026-03-28
+
+- Update `just@latest` to 1.48.1.
+
+- Update `wasm-bindgen@latest` to 0.2.115.
+
+## [2.69.13] - 2026-03-27
+
+- Update `mise@latest` to 2026.3.17.
+
+- Update `cargo-insta@latest` to 1.47.0.
+
 ## [2.69.12] - 2026-03-27
 
 - Update `uv@latest` to 0.11.2.
@@ -6041,7 +6091,14 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.69.12...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.70.4...HEAD
+[2.70.4]: https://github.com/taiki-e/install-action/compare/v2.70.3...v2.70.4
+[2.70.3]: https://github.com/taiki-e/install-action/compare/v2.70.2...v2.70.3
+[2.70.2]: https://github.com/taiki-e/install-action/compare/v2.70.1...v2.70.2
+[2.70.1]: https://github.com/taiki-e/install-action/compare/v2.70.0...v2.70.1
+[2.70.0]: https://github.com/taiki-e/install-action/compare/v2.69.14...v2.70.0
+[2.69.14]: https://github.com/taiki-e/install-action/compare/v2.69.13...v2.69.14
+[2.69.13]: https://github.com/taiki-e/install-action/compare/v2.69.12...v2.69.13
 [2.69.12]: https://github.com/taiki-e/install-action/compare/v2.69.11...v2.69.12
 [2.69.11]: https://github.com/taiki-e/install-action/compare/v2.69.10...v2.69.11
 [2.69.10]: https://github.com/taiki-e/install-action/compare/v2.69.9...v2.69.10

README.md

@@ -100,6 +100,12 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 ## Security
 
+The `@v<major>` and `@<tool_name>` tags are updated with each release. To enhance workflow stability and security against supply chain attacks, use the `@v<major>.<minor>.<patch>` tag or their hash to pin the version. Since all releases are immutable, pinning the version in either way should have the same effect.
+
+When installing the tool from GitHub Releases, the tool version that install-action installs with `tool: <tool_name>@latest` or `tool: <tool_name>@<omitted_version>` is associated with the install-action version, so pinning install-action version with the above ways also pins the version of the tool being installed. This also means that if a [dependency cooldown](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) applies to the action itself, a cooldown of the same duration or a few days longer will apply to the tools installed by that action.
+
+### Security on tool installation
+
 When installing the tool from GitHub Releases, this action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
 
 Additionally, this action will also verify SHA256 checksums for downloaded files in all tools installed from GitHub Releases. This is enabled by default and can be disabled by setting the `checksum` input option to `false`.

main.sh

@@ -179,7 +179,7 @@ download_and_extract() {
     else
       case "${url}" in
         *.zip)
-          unzip -q tmp "${bin_in_archive#\./}"
+          unzip -q tmp
           for tmp in "${bin_in_archive[@]}"; do
             case "${tool}" in
               editorconfig-checker) mv -- "${tmp}" "${bin_dir}/${tool}${exe}" ;;
@@ -763,7 +763,7 @@ for tool in "${tools[@]}"; do
       ;;
     *)
       # Handle aliases.
-      # NB: Update alias list in tools/publish.rs, tool input option in test-alias in .github/workflows/ci.yml,
+      # NB: Update alias list in .github/workflows/release.yml, tool input option in test-alias in .github/workflows/ci.yml,
       # and match for alias for tools/codegen/src/tools-markdown.rs.
       # TODO(codegen): auto-detect cases where crate name and tool name are different.
       case "${tool}" in

manifests/biome.json

@@ -3,13 +3,51 @@
   "template": null,
   "license_markdown": "[Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "2.4.9"
+    "version": "2.4.10"
   },
   "2": {
-    "version": "2.4.9"
+    "version": "2.4.10"
   },
   "2.4": {
-    "version": "2.4.9"
+    "version": "2.4.10"
+  },
+  "2.4.10": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-linux-x64-musl",
+      "etag": "0x8DE8E7705F6C243",
+      "hash": "897a1eb7be2bcc6dfa596f4c786014f82fd60615c7a2726241eb0bafc228f82c",
+      "bin": "biome"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-darwin-x64",
+      "etag": "0x8DE8E7705A3CF6D",
+      "hash": "8269b5ef30bbc1fcf0cff5695bdc3733d417744ae638df70e7dabc3b82590fca",
+      "bin": "biome"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-win32-x64.exe",
+      "etag": "0x8DE8E77063F8765",
+      "hash": "a2bdc915914114c09a6f38ea092af2e450953bf3ace76bc143f2ab4d5a17b238",
+      "bin": "biome.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-linux-arm64-musl",
+      "etag": "0x8DE8E7705851F43",
+      "hash": "dfabcbc165bd077464244fe2f73eceb7148219566a3ad94ddf7510e663675045",
+      "bin": "biome"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-darwin-arm64",
+      "etag": "0x8DE8E7705839A5F",
+      "hash": "c6782336dff872beec7d34e1b801c533bd296b5dcf2a30d3cf6335bca975e984",
+      "bin": "biome"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-win32-arm64.exe",
+      "etag": "0x8DE8E77061B8612",
+      "hash": "4285a020237cdb93e6c42cf8af12b3bb2614ecccaeec283dc89f4e092577a3b7",
+      "bin": "biome.exe"
+    }
   },
   "2.4.9": {
     "x86_64_linux_musl": {

manifests/cargo-binstall.json

@@ -22,32 +22,32 @@
   },
   "license_markdown": "[GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE)",
   "latest": {
-    "version": "1.17.8"
+    "version": "1.17.9"
   },
-  "1.17.8": {
+  "1.17.9": {
     "x86_64_linux_musl": {
-      "etag": "0x8DE8715DB8A1417",
-      "hash": "1da1ef72448db667cc4ae6d48e37451087602c8c07dc61782a4a5e538303e015"
+      "etag": "0x8DE8D54CBD7C8ED",
+      "hash": "bdea3fd820b118576316bf69c8240f454857287717809e6ecef010faace901ff"
     },
     "x86_64_macos": {
-      "etag": "0x8DE8715E03D9720",
-      "hash": "db353e01b582c97382178db9b4dfe22d81109782e480a38f3db953e62f569952"
+      "etag": "0x8DE8D54D0C7EA49",
+      "hash": "1d4fbd74c15274a029dd92e19a0ead8e1831b6e6b60f0f5c3690ef517022c41c"
     },
     "x86_64_windows": {
-      "etag": "0x8DE8715DEAA171B",
-      "hash": "fef07560d4e391812091bb30c6ed1bd5289f74403a0c947b47b8a8c7a597b51b"
+      "etag": "0x8DE8D54CF270B9E",
+      "hash": "d17b413a19592af2cf57f9f742d49bef8837099e1407d73e79de5bc7834c4fd6"
     },
     "aarch64_linux_musl": {
-      "etag": "0x8DE8715E6784BD0",
-      "hash": "81d6245bd1a7a89e914d29af81d82280540e94927e61492a0fc359820cd97abb"
+      "etag": "0x8DE8D54D9B48785",
+      "hash": "89df253cc00a307209daee7648272bba4d8a342fce084d5922f6b3f4e4db0e25"
     },
     "aarch64_macos": {
-      "etag": "0x8DE8715EBEC4A3F",
-      "hash": "af87346fdb186f0a2333bc0a30cfddd6faa98b31145ef1bb19c284aedea65972"
+      "etag": "0x8DE8D54DF4E885F",
+      "hash": "021d537caa2071bbcd8ec50b210ea45af68a6983cca7780918b3603ef68d2585"
     },
     "aarch64_windows": {
-      "etag": "0x8DE8715EA179DDA",
-      "hash": "2270a5a7a8b3e85bd5fe32ac3fbd48cfd32d6f468a8c35499af8b65b806d271d"
+      "etag": "0x8DE8D54DD746155",
+      "hash": "37295aa1c3aed07bda2b757f613477c8ca2de1208ec360c7d00238b6886de780"
     }
   }
 }

manifests/cargo-insta.json

@@ -20,10 +20,67 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/mitsuhiko/insta/blob/master/LICENSE)",
   "latest": {
-    "version": "1.46.3"
+    "version": "1.47.2"
   },
   "1": {
-    "version": "1.46.3"
+    "version": "1.47.2"
+  },
+  "1.47": {
+    "version": "1.47.2"
+  },
+  "1.47.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8E9EE7357F8F",
+      "hash": "1c2a2e82200b430f6fa27b6d0ba0059573eae2f32b0b8aa54446184ab7b46ee7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8E9EE6D41E0F",
+      "hash": "62efa25c4e9f8182c16ae46f58bc3e9c8fdbe74aaf0409d3ed06909a70d128a5"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8E9EE705F287",
+      "hash": "2f2ffcdda5608f78de53509bdd6a5feba185dad9490b5aad951c35bf8c37fa9e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8E9EE6D1FDA1",
+      "hash": "4876319b5201b875188351445b754db09f7674b506daa983634c95d6d44ca51e"
+    }
+  },
+  "1.47.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8D549F25E618",
+      "hash": "b5c162d25f477f0a7989edc5b82297a63c69d764c3c6f2839f12a546a00c188a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8D549EDE5832",
+      "hash": "3197c099ca857e36211b7b10d383404f305e036181ca2cb42495c8d08e4dcc86"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8D549EF37620",
+      "hash": "7d6cad4a8768abc2bda8f0ea244f51ae077d426e6e7bc6561503876b4eba18e8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8D549ED08513",
+      "hash": "b92971f37be1e22401de1187ee842a7e15f936838bdce06fb9d3582dd538efa7"
+    }
+  },
+  "1.47.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8B9FBE3D26E2",
+      "hash": "fcd8a57fb21e5446c12002c0f967e7630a9e4f317814427dbf35faff3797c1d9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8B9FBDBE4C61",
+      "hash": "55db1160ab8db370d3a03491a291f04e52837b4bea13b2919068a10700b085b2"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8B9FBDFA9C5D",
+      "hash": "ecdab0fe43537a15ef6bd4628d91cddd3c26ddb3fd60f9c89d5d40904139649e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8B9FBDB8AD65",
+      "hash": "579f62ab41187c8494ca8572b4d0db51e0c9b9275064758999b27fc900c9c60c"
+    }
   },
   "1.46": {
     "version": "1.46.3"

manifests/just.json

@@ -22,13 +22,39 @@
   },
   "license_markdown": "[CC0-1.0](https://github.com/casey/just/blob/master/LICENSE)",
   "latest": {
-    "version": "1.48.0"
+    "version": "1.48.1"
   },
   "1": {
-    "version": "1.48.0"
+    "version": "1.48.1"
   },
   "1.48": {
-    "version": "1.48.0"
+    "version": "1.48.1"
+  },
+  "1.48.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8C6D748DA58F",
+      "hash": "9293e553ce401d1b524bf4e104918f72f268e3f9c6827e0055fe98d84a1b2522"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8C6D697B40B5",
+      "hash": "4c3e9c880b8fc93d7fc24abfde3c36b0cc59f6e9f8b31f7175095700f64125a7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8C6DC96FB40D",
+      "hash": "368cd9ca827cba04d9e6fc00f7ad840773c4605b6f64b9f87bdb00325d351029"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8C6D791ED527",
+      "hash": "3308721b991cf88cf2b9bbb3b31ac40550ec61a0c9b6fc011564e25e87964030"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8C6D73E04DFD",
+      "hash": "03a73339ff55bcf7411a3c940cdcb0a726d98134b87203c83a9008575434e2a8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8C6DB1FA1AAD",
+      "hash": "ed9cd54e46d65770bf0b79c051761b29f0b89a88e56e8cae4454ec7246c82160"
+    }
   },
   "1.48.0": {
     "x86_64_linux_musl": {

manifests/mise.json

@@ -28,13 +28,65 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2026.3.16"
+    "version": "2026.3.18"
   },
   "2026": {
-    "version": "2026.3.16"
+    "version": "2026.3.18"
   },
   "2026.3": {
-    "version": "2026.3.16"
+    "version": "2026.3.18"
+  },
+  "2026.3.18": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8F16236336C0",
+      "hash": "46c5c69eb04b8695189d530782a8778c390c3fbcea04bbe01eb321f1fb0f09ab"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8F1625C18807",
+      "hash": "55ca4c1b201dff443e9d12119c957874ff61915bf297eeacda8ec5e3ed7f931d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8F16267EAC4F",
+      "hash": "7c50c4588f1b85944a5d9e5640998459b8a1360574a1617a5590f055e1b3caea"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8F161FB2DF40",
+      "hash": "2cae8fe34edab073f7e8794d30bc7419bebd0391fdc73decc51b4ed1d3f62a32"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8F1625132034",
+      "hash": "f387b7ed21afede268daccceb54d62905e2b7bab081bc17dc37c1077f0d17e69"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8F162692E0ED",
+      "hash": "7ee025648c1efbf7fd927079b07af26a7bc89e62fea8c889c4186cabe22ab671"
+    }
+  },
+  "2026.3.17": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8BF1812CA605",
+      "hash": "f416a2d27f69173b22551429d2bc712c40fc3fb639112cf76ae817baae3772e2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8BF1834954DF",
+      "hash": "bd120908c1476f6f27ae27f4214bdbc3fb0e81b9671aaba720b994a217d28e39"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8BF1841058BD",
+      "hash": "a5e0a77fe5ac6397d6bd3413b6c9b39ac06f24649a88eed526173062960f7b85"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8BF17E0B455B",
+      "hash": "7ef20440c3e1d9f0db69e57e68e6833a9cade44fd1e97384a279660e48091f97"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8BF18293F06F",
+      "hash": "6d98cedb9c92bd7a1694c9efedc035288da87f6e19c79d15bf91449474c37ce9"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8BF183D566EE",
+      "hash": "98772d1d68d23e8f1040c62501bcd0d136cf2db3b995a5e7b6f77aca93aef060"
+    }
   },
   "2026.3.16": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -22,10 +22,114 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.9"
+    "version": "0.9.13"
   },
   "0.9": {
-    "version": "0.9.9"
+    "version": "0.9.13"
+  },
+  "0.9.13": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8F7844A7DC4C",
+      "hash": "55023b6a24f12c5be2fb6dd826a5f3763e701d4175352619518ac5092540d61a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8F7844169FFC",
+      "hash": "00232564a55f84a19b571769207ce319056b96800e25ed2fab44203e71e38443"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8F78442C32A0",
+      "hash": "b886f817ea20a561ca330c9bc4097392c5d6471d94faabad41283763044b79cc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8F78441175B8",
+      "hash": "db2bf291f42193a4bd5aebbddd37f1154f7a179b8952ea1ca20290800f0d344d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8F784480359A",
+      "hash": "608e397c0b1a874814113cd337464589db858364aad26146ce5c778d4cbcbdea"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8F784435C4C1",
+      "hash": "21d83ec6a1526c601bfcafdd7a5890d96710d80a2b84e62c6edacdc9a1c92f70"
+    }
+  },
+  "0.9.12": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8E7577C157C6",
+      "hash": "79236f1175331e3d189e54103d12ed957eed53d4ccc0a0eb9299f30102c7dda1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8E7577BA0D09",
+      "hash": "9a1b1463135f88493500dc1abfea9777a6e2f4f980dcfbe7b150cc41f4ccb474"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8E7577D14B62",
+      "hash": "f60bd33e0bddaaa4ca556d82229ff7a833119b63accfca14f62c0175a2f5b4d0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8E7577C413D4",
+      "hash": "e0d333c04d75980a6f28d1f476e8b2182e03f58c74cfbe0706e2249d1d666dc8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8E7578A33F60",
+      "hash": "98c6d08b6102ce0498208ef55d14861c197f131a42a9add020aa0d076636d166"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8E7578703417",
+      "hash": "55b186788381c89ad1a18b8bf0c2ffe9cb0eb270efe1cab406edb845b3743a50"
+    }
+  },
+  "0.9.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8D9EC510FD7C",
+      "hash": "a26165a20198b7af772c1abafebac31fe70ea76de438cdc14975d451ef9282a3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8D9EC4ABF6BC",
+      "hash": "80c70ef17dc76a0f997d8284911a178f90d4c3d04354eaa653b5dd3e15efff44"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8D9EC53C498A",
+      "hash": "f073c5aa5cfdf291023207a58390a4593b7774ccd8a49d12fdefa2d859285f95"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8D9EC4A89F22",
+      "hash": "1a4cdb63e5ab57d0eb12f170493a7902c3244572b6a3052ae894d06c082d4ddc"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8D9EC4AC1DA5",
+      "hash": "1c3b3335f3feeda3f7676d90ffb6463ee2bca5a5393b1bbae76926e3fdb2b514"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8D9EC4BA8C4E",
+      "hash": "85624e7e2f0bac43d8267c88a767afbb18ca338b72cf45c879046fc3a23a2e89"
+    }
+  },
+  "0.9.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8CEDFE4FEBC7",
+      "hash": "eddad889a7194e6b993015475ccd6303edb06f076b632b3a1b134936e280b103"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8CEDFECFAF7A",
+      "hash": "8421af429bec96ec09b621267d3ad505d202dc1ac8e3e5f2677dca0efa348395"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8CEDFE5E3394",
+      "hash": "f6a722ef9f1a5d3656338cf45f88a35aebd29d6bf045b1dd2e91d0dcb356a92e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8CEDFE539126",
+      "hash": "5373de8f10af1e626bbedc2beb46fbc7dd8bb3ccd73517b45108e165469e69e6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8CEDFE6E9BDE",
+      "hash": "1c7fcccf0c14d4c3189cfc405357f524b8db0ac7278bee434212f6c113070eb4"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8CEDFED8CCF3",
+      "hash": "e3a5ce5bb2f4071974250b27dd8cc9df76c1feaa1be7c5a7e814191d9999311f"
+    }
   },
   "0.9.9": {
     "x86_64_linux_musl": {

manifests/uv.json

@@ -1,41 +1,70 @@
 {
-  "rust_crate": null,
+  "rust_crate": "uv",
   "template": {
     "x86_64_linux_musl": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-x86_64-unknown-linux-musl.tar.gz",
-      "bin": "uv-x86_64-unknown-linux-musl/uv"
+      "bin": [
+        "uv-x86_64-unknown-linux-musl/uv",
+        "uv-x86_64-unknown-linux-musl/uvx"
+      ]
     },
     "x86_64_macos": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-x86_64-apple-darwin.tar.gz",
-      "bin": "uv-x86_64-apple-darwin/uv"
+      "bin": [
+        "uv-x86_64-apple-darwin/uv",
+        "uv-x86_64-apple-darwin/uvx"
+      ]
     },
     "x86_64_windows": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-x86_64-pc-windows-msvc.zip",
-      "bin": "uv.exe"
+      "bin": [
+        "uv.exe",
+        "uvw.exe",
+        "uvx.exe"
+      ]
     },
     "aarch64_linux_musl": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-aarch64-unknown-linux-musl.tar.gz",
-      "bin": "uv-aarch64-unknown-linux-musl/uv"
+      "bin": [
+        "uv-aarch64-unknown-linux-musl/uv",
+        "uv-aarch64-unknown-linux-musl/uvx"
+      ]
     },
     "aarch64_macos": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-aarch64-apple-darwin.tar.gz",
-      "bin": "uv-aarch64-apple-darwin/uv"
+      "bin": [
+        "uv-aarch64-apple-darwin/uv",
+        "uv-aarch64-apple-darwin/uvx"
+      ]
     },
     "aarch64_windows": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-aarch64-pc-windows-msvc.zip",
-      "bin": "uv.exe"
+      "bin": [
+        "uv.exe",
+        "uvw.exe",
+        "uvx.exe"
+      ]
     },
     "powerpc64le_linux_gnu": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-powerpc64le-unknown-linux-gnu.tar.gz",
-      "bin": "uv-powerpc64le-unknown-linux-gnu/uv"
+      "bin": [
+        "uv-powerpc64le-unknown-linux-gnu/uv",
+        "uv-powerpc64le-unknown-linux-gnu/uvx"
+      ]
     },
     "riscv64_linux_gnu": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-riscv64gc-unknown-linux-gnu.tar.gz",
-      "bin": "uv-riscv64gc-unknown-linux-gnu/uv"
+      "bin": [
+        "uv-riscv64gc-unknown-linux-gnu/uv",
+        "uv-riscv64gc-unknown-linux-gnu/uvx"
+      ]
     },
     "s390x_linux_gnu": {
       "url": "https://github.com/astral-sh/uv/releases/download/${version}/uv-s390x-unknown-linux-gnu.tar.gz",
-      "bin": "uv-s390x-unknown-linux-gnu/uv"
+      "bin": [
+        "uv-s390x-unknown-linux-gnu/uv",
+        "uv-s390x-unknown-linux-gnu/uvx"
+      ]
     }
   },
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",

manifests/vacuum.json

@@ -22,10 +22,88 @@
   },
   "license_markdown": "[MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE)",
   "latest": {
-    "version": "0.25.2"
+    "version": "0.25.5"
   },
   "0.25": {
-    "version": "0.25.2"
+    "version": "0.25.5"
+  },
+  "0.25.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8F75CFD30677",
+      "hash": "3a57b95dc9b7a1b9284960ece8f67d00dd5f60797603c86e0e691ec81ddac22e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8F75CEF73215",
+      "hash": "94bb05d54b6531c7e1ec45bf510b4ac14889484b6f95b284e4e9f9638ec746b5"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8F75CF9054FD",
+      "hash": "cc0e8d39730b5fafff5ce03ec8922ab05dcd6e011ec4de07541948ee89414c45"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8F75CF41C9ED",
+      "hash": "b6b0657bdfff8c9fc88d1d2f9ceabe26ae9ff3be2667d4c8e205f50339c6c6d3"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8F75CEFBC0DD",
+      "hash": "f5908142b05ea00216a2dfc355b740bc11b2ac992e68c730968758aecb1b98cb"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8F75CF91D9E5",
+      "hash": "73f85e4d47c80e8a6a62e731c8440c822d22c701f6fe5fab2149b24e20e9cc3a"
+    }
+  },
+  "0.25.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8F73C968CC4B",
+      "hash": "7d9f7bafe07b05944f742003501e2bcd8c53f982b10115110285b71f0953858c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8F73C8D5BD15",
+      "hash": "705579f63829e521012d5e8f9dbd74e459083406b9fe9fbb36372cc66b96facb"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8F73C95CA4ED",
+      "hash": "23ed2c24f0188470a620ff0533f33b1aa7c3355efe55dea32115e8fc8d36b793"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8F73C9D7B33F",
+      "hash": "03310fb5e120676eb37be9048a8c60fe8168218253253516a165be4738ba7dd7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8F73C8C96ED4",
+      "hash": "5d55f77a76ca52c5a7bacc248a240996fb7ae1adb38de0fd31681537870118aa"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8F73C9A93662",
+      "hash": "9749e518ad1a7329d3b1abdd7ed976180436c103a09d13a284b0d1166b471d29"
+    }
+  },
+  "0.25.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8DEA35C78445",
+      "hash": "dbcd9ea50b0ac74c181d905a1d162e2457f8bbc619d0f8e974ff3b38dcd23384"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8DEA3675C50B",
+      "hash": "450964b9f2cbe9b63403bfe7b07cd2b3fb16eded4668c9e5749b9b469d288290"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8DEA35DB442D",
+      "hash": "00a1a230fe2dbd45ee11e579d7d8d00daf83fa83a083fd66044514fdfd73e993"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8DEA35C7AB2A",
+      "hash": "a2db87faa3e04c2e0f8b5dd2c9162a33829eda0a1196ed49e3562a1a9434d3e0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8DEA367A7AB1",
+      "hash": "9ab96a00628c69c6aa4a62fcafb6d8cb8de792db94adb53c00344d19ff0c4af6"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8DEA36512824",
+      "hash": "ed70ee1e9af46ba69c79b8d4bddea59c0bcc37613f92d12a77fe327f4832089d"
+    }
   },
   "0.25.2": {
     "x86_64_linux_musl": {

manifests/wasm-bindgen.json

@@ -44,10 +44,76 @@
   },
   "license_markdown": "[MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.2.114"
+    "version": "0.2.117"
   },
   "0.2": {
-    "version": "0.2.114"
+    "version": "0.2.117"
+  },
+  "0.2.117": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8F7E2EE60139",
+      "hash": "97f527f7c7956f69a88a4bdb5176142ebc4e255c2dbe3805ec4f373421028240"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8F7E2EE9CD88",
+      "hash": "17d991583d7036cd773b62eb8c0f295dd31cde7bf9ab250276be56f9138723d3"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8F7E2EFCCAF2",
+      "hash": "54d52650adcf93e332d1d02c94c81925dfbda1f1292cecf276a0507263a4936f"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE8F7E2EEADDCE",
+      "hash": "27f9914864d02240e62e460860b015293e540217d9da2d8e699a1a6ee88bb326"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8F7E2EBEF61F",
+      "hash": "d7691b221163d68884ef0a893cb57d3372f1100789dbf0cc2c9260a7f253a497"
+    }
+  },
+  "0.2.116": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8EBB3A19D512",
+      "hash": "f10d233eb87aaaed4a6a3af3d52ab9a3420ab35103c18fe2c6a69527bfbf7035"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8EBB3A196060",
+      "hash": "811350ef3e971a1a34b2a1bcf37de7fd9918f335179a016f7ea9cc1334127c3a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8EBB39E62DFC",
+      "hash": "5316001ffb87739b41fe9f82804ea5e35e8ef6545687ffef2453120f479702e4"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE8EBB3A270C9F",
+      "hash": "87627d66c72d43521a69dac489ba1cc2ab241c3281755a9f0e9f0e1a2c9ff3a6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8EBB39FF65FE",
+      "hash": "f101dfe093f1e7462c4157a1db0f121f07883009b5159a1b6bd997cf7f4341a6"
+    }
+  },
+  "0.2.115": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8C5096D0CA3A",
+      "hash": "494df943e4e30a48ea2832e5a299e0e0f52d23f1e037b052cf401f467b820316"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8C5096BDCCC1",
+      "hash": "bc9ba4f200a7a7132b61a28d0fc93692caeb880c1547fb4369f18baa3285eb91"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8C5096A81344",
+      "hash": "370ebd36ffc110346956407793064e3d0b5e77c83ca69ef127a286a665d13636"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE8C5096CD7296",
+      "hash": "f4cc35232554e04d72b61158bcd314ef2b1aa28e7c45d7aad8e76eb01b42c299"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8C5096F6C51A",
+      "hash": "1184392b5468ca63b65f75f95f38110005aa168f6d9c39ca70c0585044d6508b"
+    }
   },
   "0.2.114": {
     "x86_64_linux_musl": {

tools/codegen/base/uv.json

@@ -2,6 +2,7 @@
   "repository": "https://github.com/astral-sh/uv",
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
   "tag_prefix": "",
+  "rust_crate": "${package}",
   "version_range": ">= 0.8.16",
   "signing": {
     "version_range": ">= 0.9.13",
@@ -11,42 +12,26 @@
       }
     }
   },
+  "asset_name": "${package}-${rust_target}.tar.gz",
+  "bin": [
+    "${package}-${rust_target}/${package}${exe}",
+    "${package}-${rust_target}/${package}x${exe}"
+  ],
   "platform": {
-    "x86_64_linux_musl": {
-      "asset_name": "${package}-x86_64-unknown-linux-musl.tar.gz",
-      "bin": "${package}-x86_64-unknown-linux-musl/${package}${exe}"
-    },
-    "x86_64_macos": {
-      "asset_name": "${package}-x86_64-apple-darwin.tar.gz",
-      "bin": "${package}-x86_64-apple-darwin/${package}${exe}"
-    },
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {},
     "x86_64_windows": {
-      "asset_name": "${package}-x86_64-pc-windows-msvc.zip",
-      "bin": "${package}${exe}"
-    },
-    "aarch64_linux_musl": {
-      "asset_name": "${package}-aarch64-unknown-linux-musl.tar.gz",
-      "bin": "${package}-aarch64-unknown-linux-musl/${package}${exe}"
-    },
-    "aarch64_macos": {
-      "asset_name": "${package}-aarch64-apple-darwin.tar.gz",
-      "bin": "${package}-aarch64-apple-darwin/${package}${exe}"
+      "asset_name": "${package}-${rust_target}.zip",
+      "bin": ["${package}${exe}", "${package}w${exe}", "${package}x${exe}"]
     },
+    "aarch64_linux_musl": {},
+    "aarch64_macos": {},
     "aarch64_windows": {
-      "asset_name": "${package}-aarch64-pc-windows-msvc.zip",
-      "bin": "${package}${exe}"
+      "asset_name": "${package}-${rust_target}.zip",
+      "bin": ["${package}${exe}", "${package}w${exe}", "${package}x${exe}"]
     },
-    "powerpc64le_linux_gnu": {
-      "asset_name": "${package}-powerpc64le-unknown-linux-gnu.tar.gz",
-      "bin": "${package}-powerpc64le-unknown-linux-gnu/${package}${exe}"
-    },
-    "riscv64_linux_gnu": {
-      "asset_name": "${package}-riscv64gc-unknown-linux-gnu.tar.gz",
-      "bin": "${package}-riscv64gc-unknown-linux-gnu/${package}${exe}"
-    },
-    "s390x_linux_gnu": {
-      "asset_name": "${package}-s390x-unknown-linux-gnu.tar.gz",
-      "bin": "${package}-s390x-unknown-linux-gnu/${package}${exe}"
-    }
+    "powerpc64le_linux_gnu": {},
+    "riscv64_linux_gnu": {},
+    "s390x_linux_gnu": {}
   }
 }

tools/tidy.sh

@@ -7,13 +7,13 @@ trap -- 'printf >&2 "%s\n" "${0##*/}: trapped SIGINT"; exit 1' SIGINT
 cd -- "$(dirname -- "$0")"/..
 
 # USAGE:
-#    GH_TOKEN=$(gh auth token) ./tools/tidy.sh
+#    GITHUB_TOKEN=$(gh auth token) ./tools/tidy.sh
 #
 # Note: This script requires the following tools:
 # - git 1.8+
 # - jq 1.6+
 # - npm (node 18+)
-# - python 3.6+, pipx
+# - python 3.6+, uv
 # - shfmt
 # - shellcheck
 # - zizmor
@@ -86,11 +86,6 @@ check_config() {
 check_install() {
   for tool in "$@"; do
     if ! type -P "${tool}" >/dev/null; then
-      if [[ "${tool}" == 'python3' ]]; then
-        if type -P python >/dev/null; then
-          continue
-        fi
-      fi
       error "'${tool}' is required to run this check"
       return 1
     fi
@@ -132,12 +127,8 @@ EOF
   exit 1
 fi
 
-py_suffix=''
-if type -P python3 >/dev/null; then
-  py_suffix=3
-fi
-yq() { pipx run yq "$@"; }
-tomlq() { pipx run --spec yq tomlq "$@"; }
+yq() { uvx yq "$@"; }
+tomlq() { uvx --from yq tomlq "$@"; }
 case "$(uname -s)" in
   Linux)
     if [[ "$(uname -o)" == 'Android' ]]; then
@@ -190,8 +181,8 @@ case "$(uname -s)" in
         else
           jq() { command jq "$@" | tr -d '\r'; }
         fi
-        yq() { pipx run yq "$@" | tr -d '\r'; }
-        tomlq() { pipx run --spec yq tomlq "$@" | tr -d '\r'; }
+        yq() { uvx yq "$@" | tr -d '\r'; }
+        tomlq() { uvx --from yq tomlq "$@" | tr -d '\r'; }
       fi
     fi
     ;;
@@ -248,7 +239,7 @@ if [[ ${#rust_files[@]} -gt 0 ]]; then
   info "checking Rust code style"
   check_config .rustfmt.toml "; consider adding with reference to https://github.com/taiki-e/cargo-hack/blob/HEAD/.rustfmt.toml"
   check_config .clippy.toml "; consider adding with reference to https://github.com/taiki-e/cargo-hack/blob/HEAD/.clippy.toml"
-  if check_install cargo jq pipx; then
+  if check_install cargo jq uv; then
     # `cargo fmt` cannot recognize files not included in the current workspace and modules
     # defined inside macros, so run rustfmt directly.
     # We need to use nightly rustfmt because we use the unstable formatting options of rustfmt.
@@ -700,7 +691,7 @@ elif check_install shellcheck; then
     # Exclude SC2096 due to the way the temporary script is created.
     shellcheck_exclude=SC2096
     info "running \`shellcheck --exclude ${shellcheck_exclude}\` for scripts in \`\$(git ls-files '*Dockerfile*')\`"
-    if check_install jq python3 parse-dockerfile; then
+    if check_install jq parse-dockerfile; then
       shellcheck_for_dockerfile() {
         local text=$1
         local shell=$2
@@ -833,7 +824,7 @@ elif check_install shellcheck; then
     # Exclude SC2096 due to the way the temporary script is created.
     shellcheck_exclude=SC2086,SC2096,SC2129
     info "running \`shellcheck --exclude ${shellcheck_exclude}\` for scripts in .github/workflows/*.yml and **/action.yml"
-    if check_install jq python3 pipx; then
+    if check_install jq uv; then
       shellcheck_for_gha() {
         local text=$1
         local shell=$2
@@ -846,16 +837,8 @@ elif check_install shellcheck; then
           *) return ;;
         esac
         text="#!/usr/bin/env ${shell%' {0}'}"$'\n'"${text}"
-        # Use python because sed doesn't support .*?.
-        text=$(
-          "python${py_suffix}" - <<EOF
-import re
-text = re.sub(r"\\\${{.*?}}", "\${__GHA_SYNTAX__}", r'''${text}''')
-print(text)
-EOF
-        )
         case "${ostype}" in
-          windows) text=${text//$'\r'/} ;; # Python print emits \r\n.
+          windows) text=${text//$'\r'/} ;; # Parse error on git bash/msys2 bash.
         esac
         local color=auto
         if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
@@ -988,11 +971,12 @@ if [[ ${#zizmor_targets[@]} -gt 0 ]]; then
   if [[ "${ostype}" =~ ^(netbsd|openbsd|dragonfly|illumos|solaris)$ ]] && [[ -n "${CI:-}" ]] && ! type -P zizmor >/dev/null; then
     warn "this check is skipped on NetBSD/OpenBSD/Dragonfly/illumos/Solaris due to installing zizmor is hard on these platform"
   elif check_install zizmor; then
-    # zizmor can also be used via pipx, but old version will be installed if glibc version is old.
+    # zizmor can also be used via uvx, but old version will be installed if glibc version is old.
+    # Do not use `zizmor .` here because it also attempts to check submodules.
     IFS=' '
-    info "running \`zizmor -q ${zizmor_targets[*]}\`"
+    info "running \`zizmor -q --pedantic ${zizmor_targets[*]}\`"
     IFS=$'\n\t'
-    zizmor -q "${zizmor_targets[@]}"
+    zizmor -q --pedantic "${zizmor_targets[@]}"
   fi
 fi
 printf '\n'
@@ -1045,7 +1029,7 @@ fi
 if [[ -f .cspell.json ]]; then
   info "spell checking"
   project_dictionary=.github/.cspell/project-dictionary.txt
-  if check_install npm jq pipx; then
+  if check_install npm jq uv; then
     has_rust=''
     if [[ -n "$(ls_files '*Cargo.toml')" ]]; then
       has_rust=1