Release 2.75.7

Update covgate@latest to 0.1.4
Update wasm-bindgen@latest to 0.2.118
2026-04-28 18:10:26 +00:00 · 2026-04-11 18:33:12 +00:00 · 2026-04-11 18:29:28 +00:00 · 2026-04-11 17:20:44 +00:00 · 2026-04-11 17:05:39 +00:00 · 2026-04-11 12:30:04 +00:00
33 changed files with 1267 additions and 157 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,3 +21,7 @@ updates:
    commit-message:
      prefix: ''
    labels: []
+    groups:
+      github-actions:
+        patterns:
+          - '*'
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,20 +33,20 @@ concurrency:

 jobs:
  miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@dec917193d835117a7238865adf83273d9fcd27a # main
    with:
      # NB: sync with test job's --exclude option
      args: --exclude install-action-internal-codegen
  msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@dec917193d835117a7238865adf83273d9fcd27a # main
  test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@dec917193d835117a7238865adf83273d9fcd27a # main
    with:
      # NB: sync with miri job's --exclude option
      test-args: --exclude install-action-internal-codegen
      no-std: false
  tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@dec917193d835117a7238865adf83273d9fcd27a # main
    permissions:
      contents: write # for creating branch for pr
      pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -95,7 +95,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - name: Generate tool list
@@ -154,7 +154,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - run: env
@@ -187,7 +187,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - run: env
@@ -298,7 +298,7 @@ jobs:
        env:
          CONTAINER: ${{ matrix.container }}
        if: startsWith(matrix.container, 'centos')
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - name: Generate tool list
--- a/.github/workflows/manifest.yml
+++ b/.github/workflows/manifest.yml
@@ -33,7 +33,7 @@ concurrency:

 jobs:
  manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@dec917193d835117a7238865adf83273d9fcd27a # main
    permissions:
      contents: write # for creating branch for pr
      pull-requests: write # for gh pr review --approve
@@ -46,3 +46,4 @@ jobs:
      branch: update-manifest
      automerge: true
      install-rust: true
+      install-cosign: true
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,8 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
        with:
          tool: parse-changelog
          fallback: none
@@ -62,19 +62,6 @@ jobs:
            printf '::error::%s\n' "$*"
            exit 1
          }
-          normalize_comma_or_space_separated() {
-            # Normalize whitespace characters into space because it's hard to handle single input contains lines with POSIX sed alone.
-            local list="${1//[$'\r\n\t']/ }"
-            if [[ "${list}" == *","* ]]; then
-              # If a comma is contained, consider it is a comma-separated list.
-              # Drop leading and trailing whitespaces in each element.
-              sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
-            else
-              # Otherwise, consider it is a whitespace-separated list.
-              # Convert whitespace characters into comma.
-              sed -E 's/ +/,/g; s/^.//' <<<" ${list} "
-            fi
-          }
          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
            in_place=(-i '')
          else
@@ -220,11 +207,16 @@ jobs:
    permissions:
      contents: write # for taiki-e/create-gh-release-action
    steps:
-      - uses: taiki-e/checkout-action@v1
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
        with:
          tool: parse-changelog
          fallback: none
+      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        id: push-token
+        with:
+          app-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
      - name: Create and push release commit and tag
        id: push
        run: |
@@ -312,6 +304,50 @@ jobs:
            )
          fi

+          major_version_tag="v${version%%.*}"
+          (
+            set -x
+            git tag "${tag}"
+            git branch "releases/${major_version_tag}"
+            git tag -f "${major_version_tag}"
+          )
+          refs=("refs/heads/${BRANCH}" "refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
+
+          tools=()
+          for tool in tools/codegen/base/*.json; do
+            tool="${tool##*/}"
+            tools+=("${tool%.*}")
+          done
+          # Aliases.
+          # NB: Update case for aliases in main.sh, tool input option in test-alias job
+          # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
+          tools+=(
+            nextest
+            taplo-cli
+            typos-cli
+            wasm-bindgen-cli
+            wasmtime-cli
+          )
+          # Non-manifest-based tools.
+          tools+=(valgrind)
+
+          branches=()
+          for tool in "${tools[@]}"; do
+            (
+              set -x
+              git checkout -b "releases/${tool}"
+              sed -E "${in_place[@]}" action.yml \
+                -e "s/required: true/required: false/g" \
+                -e "s/# default: #publish:tool/default: ${tool}/g"
+              git add action.yml
+              git commit -m "${tool}"
+              git tag -f "${tool}"
+              git checkout refs/tags/"${tag}"
+            )
+            refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
+            branches+=("releases/${tool}")
+          done
+
          prev_credential_helper=$(git config get --local credential.helper || true)
          if [[ -n "${prev_credential_helper}" ]]; then
            printf 'credential helper is already set (%s)\n' "${prev_credential_helper}"
@@ -334,46 +370,6 @@ jobs:

          (
            set -x
-            git tag "${tag}"
-            retry git push origin HEAD
-
-            major_version_tag="v${version%%.*}"
-            git branch "releases/${major_version_tag}"
-            git tag -f "${major_version_tag}"
-            refs=("refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
-
-            tools=()
-            for tool in tools/codegen/base/*.json; do
-              tool="${tool##*/}"
-              tools+=("${tool%.*}")
-            done
-            # Aliases.
-            # NB: Update case for aliases in main.sh, tool input option in test-alias job
-            # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
-            tools+=(
-              nextest
-              taplo-cli
-              typos-cli
-              wasm-bindgen-cli
-              wasmtime-cli
-            )
-            # Non-manifest-based tools.
-            tools+=(valgrind)
-
-            branches=()
-            for tool in "${tools[@]}"; do
-              git checkout -b "releases/${tool}"
-              sed -E "${in_place[@]}" action.yml \
-                -e "s/required: true/required: false/g" \
-                -e "s/# default: #publish:tool/default: ${tool}/g"
-              git add action.yml
-              git commit -m "${tool}"
-              git tag -f "${tool}"
-              git checkout refs/tags/"${tag}"
-              refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
-              branches+=("releases/${tool}")
-            done
-
            retry git push origin --atomic "${refs[@]}"
            git branch -d "releases/${major_version_tag}"
            git branch -D "${branches[@]}"
@@ -430,8 +426,8 @@ jobs:
          BRANCH: main
          PREPARE_REV: ${{ needs.prepare.outputs.rev }}
          # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
-          PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
-      - uses: taiki-e/create-gh-release-action@v1
+          PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
+      - uses: taiki-e/create-gh-release-action@f67cf7b2dadd83d36b981e674a6b08063997ce68 # v1.10.0
        with:
          changelog: CHANGELOG.md
          title: $version
@@ -440,13 +436,14 @@ jobs:

  release-manifest-schema:
    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@dec917193d835117a7238865adf83273d9fcd27a # main
    permissions:
      contents: write # for taiki-e/create-gh-release-action
      id-token: write # for rust-lang/crates-io-auth-action
      attestations: write # unused (used when options for uploading binaries are set)
    secrets:
-      PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
    with:
      version: ${{ inputs.version }}
      tag-prefix: install-action-manifest-schema-
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,9 +2,5 @@
 # https://docs.zizmor.sh/configuration/

 rules:
-  anonymous-definition: { disable: true }
+  anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
  dependabot-cooldown: { config: { days: 14 } }
-  unpinned-uses:
-    config:
-      policies:
-        taiki-e/*: any
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,72 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com

 ## [Unreleased]

+## [2.75.7] - 2026-04-11
+
+- Update `covgate@latest` to 0.1.4.
+
+- Update `wasm-bindgen@latest` to 0.2.118.
+
+## [2.75.6] - 2026-04-11
+
+- Update `mise@latest` to 2026.4.8.
+
+- Update `cargo-deny@latest` to 0.19.1.
+
+## [2.75.5] - 2026-04-10
+
+- Update `biome@latest` to 2.4.11.
+
+- Update `wasmtime@latest` to 43.0.1.
+
+- Update `uv@latest` to 0.11.6.
+
+- Update `mise@latest` to 2026.4.7.
+
+- Update `gungraun-runner@latest` to 0.18.0.
+
+## [2.75.4] - 2026-04-10
+
+- Enhance security when cargo-binstall fallback is enabled. ([08a38582](https://github.com/taiki-e/install-action/commit/08a38582e35739e1fda5e4cd298e348536a1ddaa), [ba626b4d](https://github.com/taiki-e/install-action/commit/ba626b4d71edcae17f6ca956b7b81e925b2d24ef))
+
+- Update `martin@latest` to 1.5.0.
+
+- Update `uv@latest` to 0.11.5.
+
+- Update `syft@latest` to 1.42.4.
+
+- Update `dprint@latest` to 0.54.0.
+
+## [2.75.3] - 2026-04-09
+
+- Enhance security when cargo-binstall fallback is disabled. ([77557fa3](https://github.com/taiki-e/install-action/commit/77557fa3993e075c27572045b0d159865c23016b))
+
+- Update `rclone@latest` to 1.73.4.
+
+## [2.75.2] - 2026-04-09
+
+- Update `uv@latest` to 0.11.4.
+
+- Update `tombi@latest` to 0.9.16.
+
+- Update `mise@latest` to 2026.4.6.
+
+## [2.75.1] - 2026-04-08
+
+- Update `shfmt@latest` to 3.13.1.
+
+- Update `cosign@latest` to 3.0.6.
+
+## [2.75.0] - 2026-04-07
+
+- Support `cosign`. ([#1677](https://github.com/taiki-e/install-action/pull/1677))
+
+## [2.74.1] - 2026-04-07
+
+- Update `mise@latest` to 2026.4.5.
+
+- Update `tombi@latest` to 0.9.15.
+
 ## [2.74.0] - 2026-04-06

 - Support `cargo-deb`. ([#1669](https://github.com/taiki-e/install-action/pull/1669))
@@ -6155,7 +6221,16 @@ Note: This release is considered a breaking change because installing on version

 Initial release

-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.74.0...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.7...HEAD
+[2.75.7]: https://github.com/taiki-e/install-action/compare/v2.75.6...v2.75.7
+[2.75.6]: https://github.com/taiki-e/install-action/compare/v2.75.5...v2.75.6
+[2.75.5]: https://github.com/taiki-e/install-action/compare/v2.75.4...v2.75.5
+[2.75.4]: https://github.com/taiki-e/install-action/compare/v2.75.3...v2.75.4
+[2.75.3]: https://github.com/taiki-e/install-action/compare/v2.75.2...v2.75.3
+[2.75.2]: https://github.com/taiki-e/install-action/compare/v2.75.1...v2.75.2
+[2.75.1]: https://github.com/taiki-e/install-action/compare/v2.75.0...v2.75.1
+[2.75.0]: https://github.com/taiki-e/install-action/compare/v2.74.1...v2.75.0
+[2.74.1]: https://github.com/taiki-e/install-action/compare/v2.74.0...v2.74.1
 [2.74.0]: https://github.com/taiki-e/install-action/compare/v2.73.0...v2.74.0
 [2.73.0]: https://github.com/taiki-e/install-action/compare/v2.72.0...v2.73.0
 [2.72.0]: https://github.com/taiki-e/install-action/compare/v2.71.3...v2.72.0
--- a/README.md
+++ b/README.md
@@ -102,6 +102,10 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.

 The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.

+The default fallback (cargo-binstall) is often affected by GitHub's API rate limits, so we [pass the `${{ github.token }}` to cargo-binstall](https://github.com/taiki-e/install-action/issues/561). Disabling the cargo-binstall fallback prevent passing token so helps enhance security.
+
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
+
 <!-- omit in toc -->
 ### Security on installation from GitHub Releases

--- a/TOOLS.md
+++ b/TOOLS.md
@@ -47,6 +47,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-xwin**](https://github.com/rust-cross/cargo-xwin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-xwin/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE) |
 | [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
 | [**coreutils**](https://github.com/uutils/coreutils) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/uutils/coreutils/releases) | Linux, macOS, Windows | [MIT](https://github.com/uutils/coreutils/blob/main/LICENSE) |
+| [**cosign**](https://github.com/sigstore/cosign) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/sigstore/cosign/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE) |
 | [**covgate**](https://github.com/jesse-black/covgate) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jesse-black/covgate/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
 | [**cyclonedx**](https://github.com/CycloneDX/cyclonedx-cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-cli/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE) |
--- a/action.yml
+++ b/action.yml
@@ -47,7 +47,7 @@ runs:
        INPUT_TOOL: ${{ inputs.tool }}
        INPUT_CHECKSUM: ${{ inputs.checksum }}
        INPUT_FALLBACK: ${{ inputs.fallback }}
-        DEFAULT_GITHUB_TOKEN: ${{ github.token }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
      if: runner.os != 'Windows'
    # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
@@ -77,6 +77,6 @@ runs:
        INPUT_TOOL: ${{ inputs.tool }}
        INPUT_CHECKSUM: ${{ inputs.checksum }}
        INPUT_FALLBACK: ${{ inputs.fallback }}
-        DEFAULT_GITHUB_TOKEN: ${{ github.token }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
      if: runner.os == 'Windows'
--- a/main.sh
+++ b/main.sh
@@ -236,7 +236,7 @@ read_manifest() {
  local version="$2"
  local manifest
  rust_crate=$(jq -r '.rust_crate' "${manifest_dir}/${tool}.json")
-  manifest=$(jq -r ".[\"${version}\"]" "${manifest_dir}/${tool}.json")
+  manifest=$(jq -r --arg version "${version}" '.[$version]' "${manifest_dir}/${tool}.json")
  if [[ "${manifest}" == "null" ]]; then
    download_info="null"
    return 0
@@ -245,7 +245,7 @@ read_manifest() {
  if [[ "${exact_version}" == "null" ]]; then
    exact_version="${version}"
  else
-    manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+    manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
    if [[ "${rust_crate}" != "null" ]]; then
      # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
      case "${tool}" in
@@ -253,7 +253,7 @@ read_manifest() {
          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
          if [[ -n "${crate_info}" ]]; then
            while true; do
-              yanked=$(jq -r ".versions[] | select(.num == \"${exact_version}\") | .yanked" <<<"${crate_info}")
+              yanked=$(jq -r --arg version "${exact_version}" '.versions[] | select(.num == $version) | .yanked' <<<"${crate_info}")
              if [[ "${yanked}" != "true" ]]; then
                break
              fi
@@ -263,7 +263,7 @@ read_manifest() {
              fi
              info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
              exact_version="${previous_stable_version}"
-              manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+              manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
            done
          fi
          ;;
@@ -277,14 +277,14 @@ read_manifest() {
      # usually preferred over linux-gnu binaries because they can avoid glibc version issues.
      # (rustc enables statically linking for linux-musl by default, except for mips.)
      host_platform="${host_arch}_linux_musl"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
      if [[ "${download_info}" == "null" ]]; then
        # Even if host_env is musl, we won't issue an error here because it seems that in
        # some cases linux-gnu binaries will work on linux-musl hosts.
        # https://wiki.alpinelinux.org/wiki/Running_glibc_programs
        # TODO: However, a warning may make sense.
        host_platform="${host_arch}_linux_gnu"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
      elif [[ "${host_env}" == "gnu" ]]; then
        # TODO: don't hardcode tool name and use 'prefer_linux_gnu' field in base manifest.
        case "${tool}" in
@@ -296,7 +296,7 @@ read_manifest() {
              # musl build of nextest is slow, so use glibc build if host_env is gnu.
              # https://github.com/taiki-e/install-action/issues/13
              host_platform="${host_arch}_linux_gnu"
-              download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+              download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
            fi
            ;;
        esac
@@ -306,10 +306,10 @@ read_manifest() {
      # Binaries compiled for x86_64 macOS will usually also work on AArch64 macOS.
      # Binaries compiled for x86_64 Windows will usually also work on AArch64 Windows 11+.
      host_platform="${host_arch}_${host_os}"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
      if [[ "${download_info}" == "null" ]] && [[ "${host_arch}" != "x86_64" ]]; then
        host_platform="x86_64_${host_os}"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
      fi
      ;;
    *) bail "unsupported OS type '${host_os}' for ${tool}" ;;
@@ -327,7 +327,7 @@ read_download_info() {
  bin_in_archive=()
  if [[ "${url}" == "null" ]]; then
    local template
-    template=$(jq -c ".template.${host_platform}" "${manifest_dir}/${tool}.json")
+    template=$(jq -c --arg p "${host_platform}" '.template[$p]' "${manifest_dir}/${tool}.json")
    template="${template//\$\{version\}/${exact_version}}"
    url=$(jq -r '.url' <<<"${template}")
    tmp=$(jq -r '.bin' <<<"${template}")
@@ -466,7 +466,13 @@ case "$(uname -s)" in
      host_env=gnu
      host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed -E "s/.* //g")
    fi
-    if [[ -e /etc/os-release ]]; then
+    if [[ -e /etc/redhat-release ]]; then
+      # /etc/os-release is available on RHEL/CentOS 7+
+      base_distro=fedora
+    elif [[ -e /etc/debian_version ]]; then
+      # /etc/os-release is available on Debian 7+
+      base_distro=debian
+    elif [[ -e /etc/os-release ]]; then
      if grep -Eq '^ID_LIKE=' /etc/os-release; then
        base_distro=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2)
        case "${base_distro}" in
@@ -480,12 +486,6 @@ case "$(uname -s)" in
        base_distro=$(grep -E '^ID=' /etc/os-release | cut -d= -f2)
      fi
      base_distro="${base_distro//\"/}"
-    elif [[ -e /etc/redhat-release ]]; then
-      # /etc/os-release is available on RHEL/CentOS 7+
-      base_distro=fedora
-    elif [[ -e /etc/debian_version ]]; then
-      # /etc/os-release is available on Debian 7+
-      base_distro=debian
    fi
    case "${base_distro}" in
      fedora)
@@ -627,6 +627,14 @@ case "${fallback}" in
  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
 esac

+# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
+# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
+token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
+# This prevents tokens from being exposed to subprocesses via environment variables.
+# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
+# set in the first place) remains the best practice from a security standpoint, as readme says.
+unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
+
 case "${host_os}" in
  linux)
    if ! type -P jq >/dev/null || ! type -P curl >/dev/null || ! type -P tar >/dev/null; then
@@ -875,8 +883,8 @@ for tool in "${tools[@]}"; do
      iai-callgrind-runner) ;;
      # cargo-zigbuild/cargo-insta has no --version flag on `cargo $tool_bin_stem` subcommand.
      cargo-zigbuild | cargo-insta) rx "${tool_bin_stem}" --version ;;
-      # deepsource has version command instead of --version flag.
-      deepsource | vacuum) rx "${tool_bin_stem}" version ;;
+      # these packages have version command instead of --version flag.
+      cosign | deepsource | vacuum) rx "${tool_bin_stem}" version ;;
      cargo-*)
        case "${tool_bin_stem}" in
          # cargo-valgrind 2.1.0's --version flag just calls cargo's --version flag
@@ -917,13 +925,15 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
  case "${fallback}" in
    cargo-binstall)
      install_cargo_binstall
-      if [[ -z "${GITHUB_TOKEN:-}" ]] && [[ -n "${DEFAULT_GITHUB_TOKEN:-}" ]]; then
-        export GITHUB_TOKEN="${DEFAULT_GITHUB_TOKEN}"
-      fi
      # By default, cargo-binstall enforce downloads over secure transports only.
      # As a result, http will be disabled, and it will also set
      # min tls version to be 1.2
-      cargo-binstall binstall --force --no-confirm --locked "${unsupported_tools[@]}"
+      binstall_args=(--force --no-confirm --locked "${unsupported_tools[@]}")
+      if [[ -n "${token}" ]]; then
+        cargo-binstall binstall --github-token "${token}" "${binstall_args[@]}"
+      else
+        cargo-binstall binstall "${binstall_args[@]}"
+      fi
      if ! type -P cargo >/dev/null; then
        _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
        # TODO: avoid this when already added
--- a/manifests/biome.json
+++ b/manifests/biome.json
@@ -3,13 +3,51 @@
  "template": null,
  "license_markdown": "[Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT)",
  "latest": {
-    "version": "2.4.10"
+    "version": "2.4.11"
  },
  "2": {
-    "version": "2.4.10"
+    "version": "2.4.11"
  },
  "2.4": {
-    "version": "2.4.10"
+    "version": "2.4.11"
+  },
+  "2.4.11": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-linux-x64-musl",
+      "etag": "0x8DE9656A2924E77",
+      "hash": "f10d041ae17c8d4d659950941fec862dc342945ab3af811e3e90bd93770c08e6",
+      "bin": "biome"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-darwin-x64",
+      "etag": "0x8DE9656A24F9CFE",
+      "hash": "9069156955cfd53efc273cfcd4ece85a7af2ed715d20a8717a63bde3e05b5a40",
+      "bin": "biome"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-win32-x64.exe",
+      "etag": "0x8DE9656A2C64373",
+      "hash": "6c626fdf119215234cbe51455b07995eb67b24ada85819d9273a02b7c6770fbd",
+      "bin": "biome.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-linux-arm64-musl",
+      "etag": "0x8DE9656A253B713",
+      "hash": "f58e2abd4fa737b90d1d9a4f2a3e87af1583df064b9ec14a10b34f4f34f61d88",
+      "bin": "biome"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-darwin-arm64",
+      "etag": "0x8DE9656A22891CD",
+      "hash": "9de8fa513c170b33933f397e4906eb4f8af21890aa5f36a36db22df3d9ed1978",
+      "bin": "biome"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.11/biome-win32-arm64.exe",
+      "etag": "0x8DE9656A280D5F1",
+      "hash": "a0b928f3894dfaea97906974e30785948e44e9fbab8b3d86897fb7da55ab36a9",
+      "bin": "biome.exe"
+    }
  },
  "2.4.10": {
    "x86_64_linux_musl": {
--- a/manifests/cargo-deny.json
+++ b/manifests/cargo-deny.json
@@ -24,10 +24,32 @@
  },
  "license_markdown": "[MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE)",
  "latest": {
-    "version": "0.19.0"
+    "version": "0.19.1"
  },
  "0.19": {
-    "version": "0.19.0"
+    "version": "0.19.1"
+  },
+  "0.19.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE96F183A112FE",
+      "hash": "baa0d618ce06bd1fb352115de47e31acba439c3e639b990dc43429c948364d70"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96F1880BF6C5",
+      "hash": "aaf5970ea5241cbf552fc14dea1e8cc788b25a6b3d77f2729692964d0f4142c8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96F1B5ECB7E2",
+      "hash": "0b60886df60629e68511bc2445d249d3646390db47e78f60ea8094606f4b606a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96F18AF78F66",
+      "hash": "8f09b71258750bc58c828e47bb73d75500a43feea3c07af923002ca4869c2be1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96F1661BFBFD",
+      "hash": "d8a162b2595117101b6769ba678bd3396e5d3fcb49612f385d7a9f6acf1c30b4"
+    }
  },
  "0.19.0": {
    "x86_64_linux_musl": {
--- a/manifests/coreutils.json
+++ b/manifests/coreutils.json
@@ -5,6 +5,50 @@
  "latest": {
    "version": "0.6.0"
  },
+  "0.8.0": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941D3DECEE20",
+      "hash": "b8977997a49b677169f7ce65bfc2ad658d4943c4f02f0493b1a802137202b0bf",
+      "bin": "coreutils-0.8.0-x86_64-unknown-linux-musl/coreutils"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DE941DCF25AA9A",
+      "hash": "8ac6299b298eb3ba995973b42aece162578e19f9243425a5945d9c4bd8135b0a",
+      "bin": "coreutils-0.8.0-x86_64-apple-darwin/coreutils"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE941D6E03C003",
+      "hash": "db464cf2a6ecbfd42c85f46ed2d749be574df4df47feca1f08988fd760f324f3",
+      "bin": "coreutils-0.8.0-x86_64-pc-windows-msvc/coreutils.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941C4BA7DC07",
+      "hash": "e592200ef784deecc5ac2328b0617422c89f62b9bb841eb114528ed938ccb725",
+      "bin": "coreutils-0.8.0-aarch64-unknown-linux-musl/coreutils"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DE941D614F7398",
+      "hash": "add95b420f9f1b69a0a7cb7b2672648fc72cf1294384344791e8e064bdc5e8c2",
+      "bin": "coreutils-0.8.0-aarch64-apple-darwin/coreutils"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DE941BAE10C59A",
+      "hash": "1dfa62f18b64c70b664936b06fb1be20f0f6afa9ff041dd95dda629e987435a9",
+      "bin": "coreutils-0.8.0-aarch64-pc-windows-msvc/coreutils.exe"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-riscv64gc-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941BF13F7832",
+      "hash": "6e6c8823d7319f0d83a932515e248df0eb531e07f3a9193aaf05fdfb9dd63698",
+      "bin": "coreutils-0.8.0-riscv64gc-unknown-linux-musl/coreutils"
+    }
+  },
  "0.7.0": {
    "x86_64_linux_musl": {
      "url": "https://github.com/uutils/coreutils/releases/download/0.7.0/coreutils-0.7.0-x86_64-unknown-linux-musl.tar.gz",
--- a/manifests/cosign.json
+++ b/manifests/cosign.json
@@ -0,0 +1,243 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-amd64"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-arm64"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-s390x"
+    }
+  },
+  "license_markdown": "[Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE)",
+  "latest": {
+    "version": "3.0.6"
+  },
+  "3": {
+    "version": "3.0.6"
+  },
+  "3.0": {
+    "version": "3.0.6"
+  },
+  "3.0.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9427E4F4F66D",
+      "hash": "c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE942809604B8D",
+      "hash": "4c3e7af8372d3ca3296e62fa56f23fcbb5721cc6ac1827900d398f110d7cd280"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9427FF1A8F49",
+      "hash": "9b85a88ebff2d9dd30ff4984a6f61f2cedc232dd87d81fa7f2ff3c0ed96c241c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE94280251A997",
+      "hash": "bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9427F9B353E4",
+      "hash": "5fadd012ae6381a6a29ff86a7d39aa873878852f1073fc90b15995961ecfb084"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE9427F2F77DC2",
+      "hash": "08c3e5e0a09c440f49e9a69d8639d37fbec522ec8c5c0ac805243b098e6ea512"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9427F6775D14",
+      "hash": "e25952e798958b0f9168d044153ccc353f5469ca4b71a1707dffad0534d27017"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE9427EF733685",
+      "hash": "3cf4b769258ed9cc3c2a93268c0d5c1cc3fbd094af8df21035cbac8fb0d7c088"
+    }
+  },
+  "3.0.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE6FF25F78B056",
+      "hash": "db15cc99e6e4837daabab023742aaddc3841ce57f193d11b7c3e06c8003642b2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE6FF25A90279D",
+      "hash": "e032c44d3f7c247bbb2966b41239f88ffba002497a4516358d327ad5693c386f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE6FF2745A020C",
+      "hash": "44e9e44202b67ddfaaf5ea1234f5a265417960c4ae98c5b57c35bc40ba9dd714"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE6FF265833D25",
+      "hash": "d098f3168ae4b3aa70b4ca78947329b953272b487727d1722cb3cb098a1a20ab"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE6FF25CFDD02F",
+      "hash": "4888c898e2901521a6bd4cf4f0383c9465588a6a46ecd2465ad34faf13f09eb7"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE6FF26DA417A7",
+      "hash": "ccd07709a25fd549dc3987eb378c4fecc1d7b851c904a59528cae8144f725c36"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE6FF27042D22A",
+      "hash": "9d108e72249dacb6ef5685320f34efcd0d85b842df90552b8fd7903a39a11c98"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE6FF26AFDC493",
+      "hash": "45ebd52e4cb3c1c5dc0661f76728fa9ee7a510ae211b0cde3c43e4d8bebade86"
+    }
+  },
+  "3.0.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE4FCA2BF218E5",
+      "hash": "10dab2fd2170b5aa0d5c0673a9a2793304960220b314f6a873bf39c2f08287aa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE4FCA39840E0E",
+      "hash": "4dbafca16d29be06a6a740d517a9f63de67c78be3a64d048e42520401d88facc"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE4FCA28D7404D",
+      "hash": "a3a0dc4e8c745f9bd855ec18db346538b78ab2c4d6d510ae4186bb4a03f35438"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE4FCA1C26496E",
+      "hash": "c12fc6150195758ec0b1aeb1aade3381a1d3a299584982b66543f22bab04535b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE4FCA3CB7AA05",
+      "hash": "7098c46809c0818d970e63f7acd10f44c6919d3b4a261a63972a60694a9c9f66"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE4FCA2210A074",
+      "hash": "784dc5461a588dd8611e7969a4c988620f08bcb7f173beb77321b7acfc9a2b5f"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE4FCA250DB25B",
+      "hash": "9ec0c4ec477aaed0dbf6d3a294405441b2cc93fff0d23482eba5c2e84af5aba4"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE4FCA35FC9609",
+      "hash": "0516fe2ea7d3c039cb6ed99aefbd86b69d661ff35956484c16fb480c29f3897d"
+    }
+  },
+  "3.0.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE378193840B57",
+      "hash": "052363a0e23e2e7ed53641351b8b420918e7e08f9c1d8a42a3dd3877a78a2e10"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE378184E3D243",
+      "hash": "6c75981e85e081a73f0b4087f58e0ad5fd4712c71b37fa0b6ad774c1f965bafa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE37818A249E3E",
+      "hash": "2593655025b52b5b1c99e43464459b645a3acbe5d4a5a9f3a766e77beec5a441"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE37819892DC0D",
+      "hash": "81398231362031e3c7afd6a7508c57049460cd7e02736f1ebe89a452102253e5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE378186BF54D2",
+      "hash": "38349e45a8bb0d1ed3a7affb8bdd2e9d597cee08b6800c395a926b4d9adb84d2"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE37819135D5B6",
+      "hash": "6af9ed378d289ffd1bce9b6de02a47a25f9bf32d01a2f6b0f43f0fbb544f14c6"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE3781829B3B92",
+      "hash": "86bbb2c0da0a80107fbe6d500da4148c3f84fa2595f76db68d4499664da2b90d"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE37818ED171E1",
+      "hash": "e8cda1bb6b6719e46fe72a89789852971a228d364063cc961d065c3cd4e3db4b"
+    }
+  },
+  "3.0.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE082BF53266ED",
+      "hash": "46dbdcb5467a3dfec2526923d0b3365e40c8d9dc00ec23d5aca3437449e8cbfd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE082BF2D094CE",
+      "hash": "0fc2b6f16b900abdfda3153b11fc435a8cbe3830e8e820fe8ad5fe4149a5b472"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE082C03974CE8",
+      "hash": "7a137280d8686665ceb4d8565df2a0ac63f28031e014cdcae5d56891a6c8a400"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE082C0648458F",
+      "hash": "17fd784737ca54d7d8a343c82da6c5d6dbdee971e66644d923d1b057fb97d7ed"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE082C0064BD15",
+      "hash": "3823b044de184da21e300bc5e20dd29d3fa9243af3ba70c4a5da1712f3385d46"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE082C0B62CF31",
+      "hash": "650aefe9d2bf0ee5282e8e40a7fc93ef6d66ef718a83ac3c3ec06b22b797ff00"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE082C0E28E598",
+      "hash": "0ffd9125ada732d3d3f0f1702fefd8031c04383d070cda895c5df2dfaca6e7b8"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE082BFDC4C845",
+      "hash": "f45331cfa5dfb6f908a5ed4f20f6fda4f31716028d6f0dcff9c775f006d486df"
+    }
+  },
+  "3.0.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE05F22B41933C",
+      "hash": "23c9ff889672f03676b673539de07d5ad4e8efc8247a3ad55c9bc00169aa2305"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE05F23E3EC0F5",
+      "hash": "260c174b80d6401a7d2703109eb32f6a0bdbddd2ac91d3268dc96a51238d96ab"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE05F21CA08FF9",
+      "hash": "21843dbb2e910097531ca23e9f87d0ca2ae9a412e056009eae670b090418e8ed"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE05F232E5B6D9",
+      "hash": "8f5bb6899118d521d7b12252f06d5808fba4e6cb0a23ff120ed6c14d7c87863a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE05F2419FF210",
+      "hash": "dad2a161d91fba199d1ebae7e5652a4c2dd412cbb1ab6b4cc8ad6a15378319fe"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE05F2278FB689",
+      "hash": "82ed1e2c4b37927fc39c488dd1871f2a51ea40140a8c7911ed90026b8d8bf2cd"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE05F23A221742",
+      "hash": "07b7ce941bf9918bf245153bf029d53873f4f0b1bc5e8f9141876b3523c1de0b"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE05F22438B32A",
+      "hash": "6e30ae5e33014197a888b9492728e49aaf72343e31e26da8f7b3720518e8f6df"
+    }
+  }
+}
--- a/manifests/covgate.json
+++ b/manifests/covgate.json
@@ -20,10 +20,28 @@
  },
  "license_markdown": "[Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE)",
  "latest": {
-    "version": "0.1.3"
+    "version": "0.1.4"
  },
  "0.1": {
-    "version": "0.1.3"
+    "version": "0.1.4"
+  },
+  "0.1.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE97290157DE06",
+      "hash": "443bcdb2d5bd550c374f9721a6663a42d0d402955cbd32bb61b3b875a04bc80f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9729014F3532",
+      "hash": "fcd6971cbcb58181b85042f6f80eb2a4e05bccfa1450aa203083dd6f95a14254"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE97290159FE80",
+      "hash": "15477ecb35695955ebaf6677a18a94fe5ac50dadc9985f277651e5c9b0ea4471"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9729015A4C45",
+      "hash": "af6713df579260053b1b5054f0750febc8e456ba54041154900fe19cf51f3160"
+    }
  },
  "0.1.3": {
    "x86_64_linux_musl": {
--- a/manifests/dprint.json
+++ b/manifests/dprint.json
@@ -28,7 +28,36 @@
  },
  "license_markdown": "[MIT](https://github.com/dprint/dprint/blob/main/LICENSE)",
  "latest": {
-    "version": "0.53.2"
+    "version": "0.54.0"
+  },
+  "0.54": {
+    "version": "0.54.0"
+  },
+  "0.54.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95A483BDB8E6",
+      "hash": "859ae94e596105201faa59a3fb4bedc8316e226e3e154ae410f9373461e1e41c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95A483D34B85",
+      "hash": "fdbffa16cf0890ca30e958ffdabe7748e733867651a438ede1501f0e1a7b5e91"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95A483BAAF19",
+      "hash": "3fd881acaf7fd4fbc5d07c3030ce79b965a4cb7128fe0eb1ebe725188ccd2715"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95A483BBBF52",
+      "hash": "9a66b5931ca30402a3dd2933c432c6b6316eedd08037ab0aeb8d24cd17b2a301"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95A483BA138A",
+      "hash": "1d6a8fb14d66cba0f049738edd4ab3b1afc1de6d936cd32e483e33284cfd1ade"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE95A483C85B52",
+      "hash": "9aa7df605ade001ada4154e24f2806527d0be45ba0f465422efa62a23316f305"
+    }
  },
  "0.53": {
    "version": "0.53.2"
--- a/manifests/gungraun-runner.json
+++ b/manifests/gungraun-runner.json
@@ -24,7 +24,54 @@
  },
  "license_markdown": "[Apache-2.0](https://github.com/gungraun/gungraun/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/gungraun/gungraun/blob/main/LICENSE-MIT)",
  "latest": {
-    "version": "0.17.2"
+    "version": "0.18.0"
+  },
+  "0.18": {
+    "version": "0.18.0"
+  },
+  "0.18.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9748264D41CC",
+      "hash": "8e085908f9de28f4e4b599f171aff61e72342481c5af3a8086ed800be8e17a35"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE97471C4DE6D4",
+      "hash": "46b29d7bb529062256b28eca27d26c6f5ca1943a627f9dd024d7641b604ecf11"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE974857C237F9",
+      "hash": "c7833abfdd55440b8be85e854e7b673c6cd8933c85517eb6309dfee31079f4a7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE974839AFEA4F",
+      "hash": "3374713f6e77b0f5329674a9d03bc0ed9ee5e899a9ad0d23382cff247097e8e0"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE97483DFFED3C",
+      "hash": "997d992f59088c1d7b77cc4906f5c28fcbc1c59e01ecd5442ebcdeae9e47d87c"
+    }
+  },
+  "0.18.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9642F0CF107C",
+      "hash": "6bc46e9b0b9df0a13897c277c9c529488e1746b5f6ad6fa33b966f4f395bec28"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9642F5351AC4",
+      "hash": "9ffe79ab8523c1ada9a52c1352333d6499cd26fabb60d9ba6a8eeb1ab4102dc2"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9642F38861F9",
+      "hash": "6b2ddd799fec1517aee95fd03eb021e125b46690c679d29d54824b87b97c61fe"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9642EC2FBFDC",
+      "hash": "8bf2263ac4a41cb9132df94d4e570eb3e310e2afc970ff6581ccc6a32fc66c22"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9642EE460E79",
+      "hash": "e540f51a2621fe1a69cf9e7d0acf97d0e1c8b11866ba1ef08564614c496c5259"
+    }
  },
  "0.17": {
    "version": "0.17.2"
--- a/manifests/martin.json
+++ b/manifests/martin.json
@@ -32,10 +32,31 @@
  },
  "license_markdown": "[MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE)",
  "latest": {
-    "version": "1.4.0"
+    "version": "1.5.0"
  },
  "1": {
-    "version": "1.4.0"
+    "version": "1.5.0"
+  },
+  "1.5": {
+    "version": "1.5.0"
+  },
+  "1.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9606A16881B6",
+      "hash": "29cebebba0bc6bc8cd3f089d4c8e06abecef1a1754b9c816ef4dbf6ae41b6f63"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9606A093D120",
+      "hash": "c50589f9fd2ad018adb3c085b9f31fe73b9b5587949cc04f6ae37c18cd0cc390"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9606A0994946",
+      "hash": "11b9305afc987e71d0edc0a7454d1b3f9a7b42d3b2603870729c21bba924ad20"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9606A08CFAF6",
+      "hash": "c52a2851aae177cfdcd2adf019e391ac4512eaa1566c4f7de3bd4a4746bb60d7"
+    }
  },
  "1.4": {
    "version": "1.4.0"
--- a/manifests/mise.json
+++ b/manifests/mise.json
@@ -28,13 +28,91 @@
  },
  "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
  "latest": {
-    "version": "2026.4.4"
+    "version": "2026.4.8"
  },
  "2026": {
-    "version": "2026.4.4"
+    "version": "2026.4.8"
  },
  "2026.4": {
-    "version": "2026.4.4"
+    "version": "2026.4.8"
+  },
+  "2026.4.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE96FA8585A4DB",
+      "hash": "9d670988a11e6af1a478fc2037b55af90c51e4f3bc538fe684b18b71c5a5fc4e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96FA882F0282",
+      "hash": "b8dd35a066ed7ccfba1c9217db04cd15f0f3976f06b1c59b99a9f38122a35bd6"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96FA88E8CF31",
+      "hash": "6bc622404bcfda0bca3f87a69dfd3ea83b2da92a0e06596c2fd4953b4ab10c5a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96FA8212FBA0",
+      "hash": "a5be964c2e29237dc6808c237793c73732db29877aa135b2457345f5d788b436"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96FA8721A766",
+      "hash": "b27b067d5dc5ad208eabffffb001d87d1edee82d2140ebdc35332ec434ea8e98"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96FA888159DE",
+      "hash": "0a13e8ec7dbacd13b4eeb88ffdfd8800c5646be9592a4e2781d3f92b97ab18b1"
+    }
+  },
+  "2026.4.7": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE962B67CA1C09",
+      "hash": "494865907326bb864a31e4ca22bf6ed7572ceedea14ff8e82c783f604551dde3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE962B6A6B1EA5",
+      "hash": "fdffa9feeba79fd0d87494fa61af0d8b32b9e54c8200d5157a0365302ad531c1"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE962B6B48C5C8",
+      "hash": "86ee64104d1d4202cc2347a325ed22b53fe28462519079b005d95a144de73933"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE962B6482E5D0",
+      "hash": "58040a3fd0d8ac18ce99e7e5ebe79be50d49dc8a5a57f7e48441ab42c083cde0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE962B698763DB",
+      "hash": "311c41004d74519f97d180f404a623f8945366d9747d3c7b1c545a291d2c168e"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE962B6AD54FFD",
+      "hash": "98ab2597f455e8e114445e30547a89007188cb57a4a2d3211cd7ae159cd2f72a"
+    }
+  },
+  "2026.4.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9505278268D0",
+      "hash": "a99603adb9b185da342a1ff81e93390c42e6a90737086d130e929ddc6af774cc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE950529B1EF40",
+      "hash": "8c38ef6bdbe87a007d4e428d3974ab4e7b657c5dcf61d288edb69882070e2d0b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95052A93FE38",
+      "hash": "1ccca1e747e1e5ddf0621b1a19cc02bd33f740542f0c3e5481ffa26062c05d01"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE950524131738",
+      "hash": "bf5877c2ff7fd734f22ab1ed055f557d4bc865a54810fb59c3ebb175b238e6e7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95052911F638",
+      "hash": "3f3e5584a9d563b62d07e0422100be5a9f7f56f0fc5555d4f0a17c3661757107"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95052A84A627",
+      "hash": "a2bb99b42571471a6bc5ff333a50841b3c8965db79e1a79644082cc7c05904a6"
+    }
  },
  "2026.4.5": {
    "x86_64_linux_musl": {
--- a/manifests/rclone.json
+++ b/manifests/rclone.json
@@ -28,13 +28,39 @@
  },
  "license_markdown": "[MIT](https://github.com/rclone/rclone/blob/master/COPYING)",
  "latest": {
-    "version": "1.73.3"
+    "version": "1.73.4"
  },
  "1": {
-    "version": "1.73.3"
+    "version": "1.73.4"
  },
  "1.73": {
-    "version": "1.73.3"
+    "version": "1.73.4"
+  },
+  "1.73.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9573A5AC74E7",
+      "hash": "abc0e6e0f275a469d94645f7ef92c7c7673eed20b6558acec5ff48b74641213c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE957478A87CEE",
+      "hash": "4ef15279d857372f3ff84b967ad68fc1c3b113d631effb9c09a18e40f8a78fa7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9574B24AE740",
+      "hash": "4ad32977eec7f77aef98c035865c333f2005be2478dd6b04c9456d1df7b326bf"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9573BDB7D24C",
+      "hash": "00c9e230f0004ab5e3b45c00edf7238ba5bff5fc7ea80f5a86a7da5568de6d1c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9574816FB321",
+      "hash": "8cfffacc3ce732b1960645a2f7d2ce97c2ac9ba4f2221c13af6378c199a078f9"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9574BA07586F",
+      "hash": "db0cbec2eee4e852762d65afc5fe1c06cee5ba246c0ea8b765f4a5cf2aaa009a"
+    }
  },
  "1.73.3": {
    "x86_64_linux_musl": {
--- a/manifests/shfmt.json
+++ b/manifests/shfmt.json
@@ -19,13 +19,35 @@
  },
  "license_markdown": "[BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE)",
  "latest": {
-    "version": "3.13.0"
+    "version": "3.13.1"
  },
  "3": {
-    "version": "3.13.0"
+    "version": "3.13.1"
  },
  "3.13": {
-    "version": "3.13.0"
+    "version": "3.13.1"
+  },
+  "3.13.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9425968D392A",
+      "hash": "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9425982BD0F0",
+      "hash": "6feedafc72915794163114f512348e2437d080d0047ef8b8fa2ec63b575f12af"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE942594A8E60E",
+      "hash": "60cd368533d0ad73fa86d93d5bbf95ef40587245ce684ed138c1b31557b5fe97"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE942595A9A537",
+      "hash": "32d92acaa5cd8abb29fc49dac123dc412442d5713967819d8af2c29f1b3857c7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9425979B56CB",
+      "hash": "9680526be4a66ea1ffe988ed08af58e1400fe1e4f4aef5bd88b20bb9b3da33f8"
+    }
  },
  "3.13.0": {
    "x86_64_linux_musl": {
--- a/manifests/syft.json
+++ b/manifests/syft.json
@@ -36,13 +36,47 @@
  },
  "license_markdown": "[Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE)",
  "latest": {
-    "version": "1.42.3"
+    "version": "1.42.4"
  },
  "1": {
-    "version": "1.42.3"
+    "version": "1.42.4"
  },
  "1.42": {
-    "version": "1.42.3"
+    "version": "1.42.4"
+  },
+  "1.42.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95AFF8B22211",
+      "hash": "590650c2743b83f327d1bf9bec64f6f83b7fec504187bb84f500c862bf8f2a0f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95AFF8BA2F4D",
+      "hash": "4a14affad1b90f0bfa38fdb784279f01598b6099df40686391d814620e9de226"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95AFF8B46965",
+      "hash": "a712f912e8fc83ce2bf6a7cea213c2d5185778d66ea2e07d42c767817f77e381"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95AFF85E45C7",
+      "hash": "5029bad1ed372649527b1e443cbceef7f5d6ae1cfe52c16e721559f94267128b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95AFF7CD5703",
+      "hash": "0797b64cf8841c904682e6007a695f9cd3e72103f064dd286723c0a56a2273e2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95AFF8296773",
+      "hash": "6596227b24729d54e727917d5d59e3a6a49fc59cd505aae5a6d7eb630d871e82"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE95AFF78EE682",
+      "hash": "9a54460ae5f6c3484c6f9913187306e4996ba21267e185434783872856dc836d"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE95AFF8AF65FA",
+      "hash": "8b2d019bbed41cc991be32f5c2a630b3dfb8cd76f8c45d815f18c4afd56b280e"
+    }
  },
  "1.42.3": {
    "x86_64_linux_musl": {
--- a/manifests/tombi.json
+++ b/manifests/tombi.json
@@ -22,10 +22,36 @@
  },
  "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
  "latest": {
-    "version": "0.9.14"
+    "version": "0.9.16"
  },
  "0.9": {
-    "version": "0.9.14"
+    "version": "0.9.16"
+  },
+  "0.9.16": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95275403B11A",
+      "hash": "93f0b5febc18f60c172a7d4008325183f6b90d3c2a2454e27bbc7aaa662c25de"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE952753DFFD89",
+      "hash": "847a696cf655e642d7402560badde15c6fbb2b34a7e21fa33ba2614d74816a4e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE952754763D72",
+      "hash": "a08e144e55fa8b998e46bf2923c9d8fae1f454771c6411fd213febd9e182ae48"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE952754627D8A",
+      "hash": "0549ee34fbbaf462ae8b17c41fc30dbfdada8e2adadc058b1f92d6d0070ca70e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE952753D14101",
+      "hash": "4a33dff421e644c03708b26cf73b235f7f146ef6af9ba631b66aa97cb10244ae"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE952753D6E00A",
+      "hash": "1002d0cff2b146eb70d6670e20f8417a31a15a620755ec7b182f35b4f8816f68"
+    }
  },
  "0.9.15": {
    "x86_64_linux_musl": {
--- a/manifests/uv.json
+++ b/manifests/uv.json
@@ -69,10 +69,124 @@
  },
  "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
  "latest": {
-    "version": "0.11.3"
+    "version": "0.11.6"
  },
  "0.11": {
-    "version": "0.11.3"
+    "version": "0.11.6"
+  },
+  "0.11.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE963141E5ABBF",
+      "hash": "aa342a53abe42364093506d7704214d2cdca30b916843e520bc67759a5d20132"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96314155CD4C",
+      "hash": "8e0ed5035eaa28c7c8cd2a46b5b9a05bfff1ef01dbdc090a010eb8fdf193a457"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9631418497F4",
+      "hash": "99aa60edd017a256dbf378f372d1cff3292dbc6696e0ea01716d9158d773ab77"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96313E817163",
+      "hash": "d14ebd6f200047264152daaf97b8bd36c7885a5033e9e8bba8366cb0049c0d00"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96313DD22057",
+      "hash": "4b69a4e366ec38cd5f305707de95e12951181c448679a00dce2a78868dfc9f5b"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96313E396EC1",
+      "hash": "bee7b25a7a999f17291810242b47565c3ef2b9205651a0fd02a086f261a7e167"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9631407C196A",
+      "hash": "153397d3d82e45e68fb1f4a40ee9898245ec8ed86fd03fcaacaf6e793316acf7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE963140D2B1B5",
+      "hash": "0e3ead8667b51b07b5fb9d114bcd1914a5fe3159e6959a584dc2f89c6724e123"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE963140E38EA9",
+      "hash": "6e3d4338da2db2c63326721f1eb3b4f32d9bde24aeff11208d397e1aeba8678e"
+    }
+  },
+  "0.11.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95AE7EB11D35",
+      "hash": "ee8a52743ce3979e52872b49c5e58ffa541048cb95132142bff23fe5608d73ea"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95AE7DE783E0",
+      "hash": "b8964bed538143f9016d807e421e28f0237a29589851fc79e8159751ac64779a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95AE7E0A74F6",
+      "hash": "3fa5b6ea9de9256a035e0471f5ef0bb5d95344659723d6eb063e27c76431515d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95AE7B8822B5",
+      "hash": "d73860013061c62d6a89f3370527d4c407214038af331147773ae2fd8f6394c1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95AE7A8FE593",
+      "hash": "470993e87503874c7c48861daa308b48a7c367e117235bbecf19368b9fdd35b2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95AE7AE8EC23",
+      "hash": "9b9b99a985cccf249225aaad76412823e9d9736d605dc2252151172a7f6ab3db"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE95AE7D14317E",
+      "hash": "c4dabaaa36a13989ab04389263064ca5c27093eb2e7c851ab62d50b6312d9800"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE95AE7D2FD7C9",
+      "hash": "6ae3ec3cf1aab72604bc6aa8486faf4b473066422c49d9c42ea8366ff3039de4"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE95AE7E0B8533",
+      "hash": "1309f1e462462dab2da6a55c37012a228d1c06a55c5b43f8ef901ba1599d9e12"
+    }
+  },
+  "0.11.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9512CAD2F111",
+      "hash": "36ce1c5d8997db9b6a24d0f41646d5509b6d1d8b9448c7325f8248a6ea5d4b00"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9512CA554DA7",
+      "hash": "c326edaf3fd492f53d1c58777f3459c0d87bf9dae8d89e80aec4b0da6622dcf3"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9512CAABBF06",
+      "hash": "26d84455a40b0272b2ab4785cad298ff2c89cd0765b482e9f85b5a1bd880a863"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9512C842305D",
+      "hash": "a02ec7667d7bb1d33cdb7e1de22f7e4242967e3df7e350bac6212515e3bce8ac"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9512C7959B5C",
+      "hash": "9b9cb6c6f58c3246dbf3351ed4e97c500bc3266f5f237d2fd620b66e1c31dc56"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9512C7C21EA2",
+      "hash": "708b1c210109e50ff520bcd9b6d29cbd8cee584bb55e84d3d1941bf75ab0893d"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9512C9A51354",
+      "hash": "3ddb764538a5dcb4967d7375fde193ce5391e37ddd4d1242012d04cf3848479f"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9512C9D2A6CB",
+      "hash": "93db93607a824d677c47003ee828936913cfdeb2c871bb34cd79c3ec4481e2b1"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9512CA14BCB1",
+      "hash": "07361e1fb32e870841a27d3d7b0b20c4a81e0cc25eeb8b9115425bfd227d2d05"
+    }
  },
  "0.11.3": {
    "x86_64_linux_musl": {
--- a/manifests/vacuum.json
+++ b/manifests/vacuum.json
@@ -27,6 +27,32 @@
  "0.25": {
    "version": "0.25.5"
  },
+  "0.25.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE97526EC427DE",
+      "hash": "a72c3012e3fe1eb7e653be75b041e648cdd6b4b365a0c51e1ca344f9a106c9a6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE97526F65311F",
+      "hash": "63362feaf01adec7d3a3ee557427acf6df32e2c3e1fa247e335e83d302dc2445"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE97526EBB3141",
+      "hash": "4663999cc8a5e10c2023129619af53340321cfb9c4eab963bf91f8edb1f320de"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE97526EA9440E",
+      "hash": "d48fdd661f4484bbb44940595ff7e13cb6782aacea540868d0d44a87b5c1860a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE97526F58BC05",
+      "hash": "77829aa18377f354d1629d7d069297b4a17597e20f7b6184d36744dc4c8358e5"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE97526EAE4774",
+      "hash": "18c9e645a1d97ebd333be634f960428d7f022dfa659ff8536673daf84b8c2a4a"
+    }
+  },
  "0.25.5": {
    "x86_64_linux_musl": {
      "etag": "0x8DE8F75CFD30677",
--- a/manifests/wasm-bindgen.json
+++ b/manifests/wasm-bindgen.json
@@ -44,10 +44,32 @@
  },
  "license_markdown": "[MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE)",
  "latest": {
-    "version": "0.2.117"
+    "version": "0.2.118"
  },
  "0.2": {
-    "version": "0.2.117"
+    "version": "0.2.118"
+  },
+  "0.2.118": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE972254F8FEF2",
+      "hash": "00b519c9fc2d6e087265da1a00f29160bfcc6a823993482bc2e691910287427b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE972254EED135",
+      "hash": "2f1c1586c0b5bad9a25e6704825d6b1a9ccdd7c6830d57198645411545b566ad"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE972254D6A966",
+      "hash": "075902fd092f8e2a223783ccb73697f7a619bfa02e166d3b68319924a19d5a08"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE972254FA0F29",
+      "hash": "e8b75bf5055c189af5e4842bf7c58f616880fb8505a10f7cd575353a9f4e2dba"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE972254EE5C7F",
+      "hash": "f76553ae8d084dc3e96a7cef748813bf2dac4d78326166409328fc74646eef76"
+    }
  },
  "0.2.117": {
    "x86_64_linux_musl": {
--- a/manifests/wasmtime.json
+++ b/manifests/wasmtime.json
@@ -36,13 +36,47 @@
  },
  "license_markdown": "[Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE)",
  "latest": {
-    "version": "43.0.0"
+    "version": "43.0.1"
  },
  "43": {
-    "version": "43.0.0"
+    "version": "43.0.1"
  },
  "43.0": {
-    "version": "43.0.0"
+    "version": "43.0.1"
+  },
+  "43.0.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE96545D60CB65",
+      "hash": "9f3cf977fc29e2ccab2d198435265b066dce3d608fc6692d700ed1b9b74c35a1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96545D950E1A",
+      "hash": "c6ac5b23b52cb78ea7759ce9bd33985c515f2b620b9385021e32e4f51cdc0aa7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE96545EE43160",
+      "hash": "cb627546a9f0f2f24f3d68fce34b40f13d6b1abe4b70f3afde0038ad9fe4e6ea"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE96545A4D6347",
+      "hash": "dbf36d4e9108df377ddfb88f2d8db4e07efce9726b68da53ae78ed5579293923"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96545A9C6308",
+      "hash": "c93751ee2f0ecd34c0e799c6261b06c6efeb3c35f2bdb884569ba37931144980"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96545AFDC4A6",
+      "hash": "0e8dc6155bda65e780279853af147b312fe62673e745a81a413b7a95be76c7ae"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE96545C448CDB",
+      "hash": "8ba5d2c2a9b613de09933998a91cae40a47fde78892f29144358f35ccf7e57c0"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE96545C86C9A4",
+      "hash": "d19c7662bf478d46c235442a2ea2f230b6cb1d98bf99dfe4fc8f8892d43a8fdf"
+    }
  },
  "43.0.0": {
    "x86_64_linux_gnu": {
@@ -79,10 +113,44 @@
    }
  },
  "42": {
-    "version": "42.0.1"
+    "version": "42.0.2"
  },
  "42.0": {
-    "version": "42.0.1"
+    "version": "42.0.2"
+  },
+  "42.0.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9657610D0674",
+      "hash": "4eca8d3d6898b94cff4103dafac40610d81aaa85c10f575f82da78a1553e176d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96576193C77A",
+      "hash": "2baed23bfc1612e475d2f0eac7b66d12789838ec645fe8bbcd2f589d732b178b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9657632D34D9",
+      "hash": "4a687cf2f020ff0071c664511d1d8be2ea99dc7956d4e07e7f03aaac62cd63fa"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE96575E5F1A28",
+      "hash": "9d55dbe5cec028692ea8dd5ceaf0250541e9b7cc50a9f22586bf3e130034ad60"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96575E85D785",
+      "hash": "94227ec56b07283c1184953c698a9b1d0cbac387a3b841e6c9dbddcd36d3a3c4"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96575F3611F8",
+      "hash": "55ea7b324104bd55b3808129ad4159d719f0f8ef7378765b48e1e3ff0baebb2a"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE965760321B68",
+      "hash": "f0a344acd308c1d1a70466f3ec0225e1d563006cf8d21a5745eba6e529df2e3e"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE96576067BC3E",
+      "hash": "663181c75c3c773052669d6c2eb34f83f1ae4d2b73368240152e5f4cadc03733"
+    }
  },
  "42.0.1": {
    "x86_64_linux_gnu": {
@@ -897,10 +965,44 @@
    }
  },
  "36": {
-    "version": "36.0.6"
+    "version": "36.0.7"
  },
  "36.0": {
-    "version": "36.0.6"
+    "version": "36.0.7"
+  },
+  "36.0.7": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE9651FF60F756",
+      "hash": "13bd4d8865594a98811c4b5d577e30af6f6a1e3e64e2f211018963c456d4fe89"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE965200A57813",
+      "hash": "f6c21f1d69e68591bd3e0bfd72cef6a43c599db57d930fea96db89271505f782"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE965205C3F09A",
+      "hash": "02a8db01e9f6bb092c2eff51a710838f64370292ff126baac4a093b4b90cfb2d"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE9651EEFDD198",
+      "hash": "4f773bb8e587bc6d84f73aa5613fcec6e52368db452e5e13e38341e409d17a9a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9651F0509A53",
+      "hash": "5a2baa053e01d73f72282e3bd0b63f052f4fb41b9a690e87e3f0a0bdbb5c220c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9651F31EBBCD",
+      "hash": "749cbf0a84c9f347d6daff9024678e92f36bf7096ae0d24aba78c4e679f54ae0"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9651F86A7A04",
+      "hash": "61018afd8982f9614bd898848406a59d1b97c971e37405f6655c62ac6dfbbac9"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9651F9AD0148",
+      "hash": "f94dd38b9840cf2b9dacf20ecc2f47431ac16f0740ede6f471faaf344c60eeb3"
+    }
  },
  "36.0.6": {
    "x86_64_linux_gnu": {
@@ -2007,10 +2109,40 @@
    }
  },
  "24": {
-    "version": "24.0.6"
+    "version": "24.0.7"
  },
  "24.0": {
-    "version": "24.0.6"
+    "version": "24.0.7"
+  },
+  "24.0.7": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE964BC372C44C",
+      "hash": "98b00342031de99d5466fc3fe9b5749dc1bb1a83430a2e2335e187976a863422"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE964BC4D72C68",
+      "hash": "d8c6e8747b5f3779efff44bae34d2a9ad694a065552904611f76f6e4a7c29f01"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE964BCA6071C2",
+      "hash": "6797a846322909e61e472d2d0fa066fed301f684006133b88f6f5ab2a884603f"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE964BBA5101B4",
+      "hash": "b37d44a63237b24b86bbf891ab19ac66fcfeb6b15375d544cbc44d380a04853e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE964BBB6C2FF4",
+      "hash": "15e38b4f2e11bdfa4b5978888192f3f85b456a19c75565dcba087817bac15dd7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE964BBCC7C852",
+      "hash": "041d27633efdb8242dc9798e903e06a22622d7df7ccf300eb94c9435cf0fb4f6"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE964BBE2360B4",
+      "hash": "38aa619242a781d61175dc57410b03a6d0da30f16e03b5a6356951b16faa0adc"
+    }
  },
  "24.0.6": {
    "x86_64_linux_gnu": {
--- a/tools/ci/tool-list.sh
+++ b/tools/ci/tool-list.sh
@@ -147,12 +147,12 @@ for manifest in tools/codegen/base/*.json; do
  fi
  case "${host_os}" in
    linux*)
-      if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}_gnu" "${manifest}")" == "null" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}_musl" "${manifest}")" == "null" ]]; then
+      if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_gnu" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_musl" '.platform[$p]' "${manifest}")" == "null" ]]; then
        continue
      fi
      ;;
    *)
-      if [[ "$(jq -r ".platform.x86_64_${host_os}" "${manifest}")" == "null" ]] && [[ "$(jq -r ".platform.${host_arch}_${host_os}" "${manifest}")" == "null" ]]; then
+      if [[ "$(jq -r --arg p "x86_64_${host_os}" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}" '.platform[$p]' "${manifest}")" == "null" ]]; then
        continue
      fi
      ;;
--- a/tools/codegen/base/coreutils.json
+++ b/tools/codegen/base/coreutils.json
@@ -5,7 +5,7 @@
  "asset_name": "${package}-${version}-${rust_target}.tar.gz",
  "bin": "${package}-${version}-${rust_target}/${package}${exe}",
  "version_range": ">= 0.1.0",
-  "broken": ["0.7.0"],
+  "broken": ["0.7.0", "0.8.0"],
  "platform": {
    "x86_64_linux_musl": {},
    "x86_64_macos": {},
--- a/tools/codegen/base/cosign.json
+++ b/tools/codegen/base/cosign.json
@@ -0,0 +1,34 @@
+{
+  "repository": "https://github.com/sigstore/cosign",
+  "tag_prefix": "v",
+  "version_range": ">= 3.0.0",
+  "signing": {
+    "kind": "custom"
+  },
+  "platform": {
+    "x86_64_linux_musl": {
+      "asset_name": "${package}-linux-amd64"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "asset_name": "${package}-linux-arm64"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "asset_name": "${package}-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "asset_name": "${package}-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "asset_name": "${package}-linux-s390x"
+    }
+  }
+}
--- a/tools/codegen/src/main.rs
+++ b/tools/codegen/src/main.rs
@@ -385,6 +385,58 @@ fn main() {
                            );
                            eprintln!("done");
                        }
+                        "cosign" => {
+                            let [checksum, bundle] =
+                                ["cosign_checksums.txt", "cosign_checksums.txt.sigstore.json"].map(
+                                    |f| {
+                                        let asset = release
+                                            .assets
+                                            .iter()
+                                            .find(|asset| asset.name.ends_with(f))
+                                            .unwrap();
+                                        let download_cache =
+                                            download_cache_dir.join(format!("{version}-{f}"));
+                                        let url = &asset.browser_download_url;
+                                        eprint!(
+                                            "downloading {url} for signature verification ... "
+                                        );
+                                        if download_cache.is_file() {
+                                            eprintln!("already downloaded");
+                                        } else {
+                                            download_to_buf(url, &mut buf);
+                                            eprintln!("download complete");
+                                            fs::write(&download_cache, &buf).unwrap();
+                                            buf.clear();
+                                        }
+                                        download_cache
+                                    },
+                                );
+                            eprint!("verifying checksum file for {package}@{version} ... ");
+                            cmd!(
+                                "cosign",
+                                "verify-blob",
+                                &checksum,
+                                "--bundle",
+                                bundle,
+                                "--certificate-identity",
+                                "keyless@projectsigstore.iam.gserviceaccount.com",
+                                "--certificate-oidc-issuer",
+                                "https://accounts.google.com"
+                            )
+                            .run()
+                            .unwrap();
+                            verified_checksum = Some(
+                                fs::read_to_string(checksum)
+                                    .unwrap()
+                                    .lines()
+                                    .filter_map(|l| l.split_once("  "))
+                                    .map(|(h, f)| {
+                                        (f.trim_ascii().to_owned(), h.trim_ascii().to_owned())
+                                    })
+                                    .collect(),
+                            );
+                            eprintln!("done");
+                        }
                        "syft" => {
                            // Refs: https://oss.anchore.com/docs/installation/verification/
                            let [checksum, certificate, signature] =
@@ -572,10 +624,7 @@ fn main() {
                            );
                        };
                        let url = url.clone() + ".sig";
-                        let sig_download_cache = &download_cache.with_extension(format!(
-                            "{}.sig",
-                            download_cache.extension().unwrap_or_default().to_str().unwrap()
-                        ));
+                        let sig_download_cache = &download_cache.with_added_extension("sig");
                        eprint!("downloading {url} for signature validation ... ");
                        let sig = if sig_download_cache.is_file() {
                            eprintln!("already downloaded");
--- a/tools/manifest.sh
+++ b/tools/manifest.sh
@@ -11,11 +11,6 @@ cd -- "$(dirname -- "$0")"/..
 #    ./tools/manifest.sh [PACKAGE [VERSION_REQ]]
 #    ./tools/manifest.sh full

-if [[ -n "${GITHUB_ACTIONS:-}" ]] && ! type -P cosign; then
-  go install github.com/sigstore/cosign/v3/cmd/cosign@latest
-  sudo mv -- ~/go/bin/cosign /usr/local/bin
-fi
-
 if [[ $# -eq 1 ]] && [[ "$1" == "full" ]]; then
  for manifest in tools/codegen/base/*.json; do
    package="${manifest##*/}"
--- a/tools/tidy.sh
+++ b/tools/tidy.sh
@@ -27,15 +27,14 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
  image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:4552cbce9426e102f9650cd9f8381e836fc8fda081dcbddcc7f31b15d48d1654"
+  image="ghcr.io/taiki-e/tidy@sha256:bce85a4321f80c09f2b68420e9149bcf7c085130ab1e1fca54443f76833cd184"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
 tmp=$(mktemp -d)
 trap -- 'rm -rf -- "${tmp:?}"' EXIT
-mkdir -p -- "${tmp}/zizmor"
-touch -- "${tmp}/dummy"
-mkdir -- "${tmp}/dummy-dir"
+mkdir -p -- "${tmp}"/{pwsh-cache,pwsh-local,zizmor-cache,dummy-dir,tmp}
+touch -- "${tmp}"/dummy
 code=0
 color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
@@ -84,22 +83,25 @@ docker_run() {
 set +e
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \
+  --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
+  --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \
+  --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \
  --network=none \
  "${image}" \
  /checks/offline.sh
 # Some good audits requires access to GitHub API.
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \
-  --mount "type=bind,source=${tmp}/zizmor,target=/.cache/zizmor" \
+  --mount "type=bind,source=${tmp}/zizmor-cache,target=/.cache/zizmor" \
  --env GH_TOKEN --env GITHUB_TOKEN --env ZIZMOR_GITHUB_TOKEN \
  "${image}" \
  /checks/zizmor.sh
 # We use remote dictionary.
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \
-  --mount "type=bind,source=${workdir}/.cspell.json,target=${workdir}/.cspell.json" \
  --mount "type=bind,source=${workdir}/.github/.cspell/project-dictionary.txt,target=${workdir}/.github/.cspell/project-dictionary.txt" \
  --mount "type=bind,source=${workdir}/.github/.cspell/rust-dependencies.txt,target=${workdir}/.github/.cspell/rust-dependencies.txt" \
+  --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
  "${image}" \
  /checks/cspell.sh
Author	SHA1	Message	Date
Taiki Endo	0abfcd587b	Release 2.75.7	2026-04-11 18:33:12 +00:00
Taiki Endo	cf81fe383b	Update `covgate@latest` to 0.1.4	2026-04-11 18:29:28 +00:00
Taiki Endo	e8aec859b7	Update `wasm-bindgen@latest` to 0.2.118	2026-04-11 17:20:44 +00:00
Taiki Endo	d053c7f943	Release 2.75.6	2026-04-11 17:05:39 +00:00
Taiki Endo	9019f2ebb5	Update `mise@latest` to 2026.4.8	2026-04-11 12:30:04 +00:00
Taiki Endo	1b07fb7459	Update `cargo-deny@latest` to 0.19.1	2026-04-11 12:30:04 +00:00
Taiki Endo	be1e8a8637	Update vacuum manifest	2026-04-11 00:52:14 +00:00
Taiki Endo	1cc7501bf8	Update gungraun-runner manifest	2026-04-11 00:52:14 +00:00
Taiki Endo	44afe623be	Update covgate manifest	2026-04-10 18:37:40 +00:00
Taiki Endo	7a4939c096	Release 2.75.5	2026-04-10 17:38:05 +00:00
Taiki Endo	7e0318acc6	Update wasm-bindgen manifest	2026-04-10 17:27:32 +00:00
Taiki Endo	2cc23c5dad	Update `biome@latest` to 2.4.11	2026-04-10 17:27:32 +00:00
Taiki Endo	398d535c7e	Update wasmtime manifest	2026-04-11 02:14:03 +09:00
Taiki Endo	f5624998da	Update `uv@latest` to 0.11.6	2026-04-10 15:34:16 +00:00
Taiki Endo	992d50db8b	Update `mise@latest` to 2026.4.7	2026-04-10 15:34:16 +00:00
Taiki Endo	ea5c6b4f9e	Update `gungraun-runner@latest` to 0.18.0	2026-04-10 15:34:16 +00:00
Taiki Endo	10db9b5ea8	Update cargo-deny manifest	2026-04-10 15:34:16 +00:00
Taiki Endo	02cc5f8ca9	Touch up comment on unset	2026-04-10 16:52:13 +09:00
Taiki Endo	97a5807a60	Release 2.75.4	2026-04-10 07:36:08 +00:00
Taiki Endo	354932869f	Update changelog	2026-04-10 16:25:24 +09:00
Taiki Endo	ba626b4d71	Early unset tokens from env	2026-04-10 16:21:15 +09:00
Taiki Endo	befe16e822	Update `martin@latest` to 1.5.0	2026-04-10 06:58:49 +00:00
Taiki Endo	0620033eb0	Use --arg for jq more	2026-04-10 15:42:08 +09:00
Taiki Endo	08a38582e3	Do not expose GITHUB_TOKEN to cargo-binstall's subprocess	2026-04-10 14:47:32 +09:00
Taiki Endo	3c299a507e	ci: Update config	2026-04-10 14:47:26 +09:00
Taiki Endo	3c436a15a3	Use --arg for jq	2026-04-10 13:14:01 +09:00
Taiki Endo	0f9ae157f2	ci: Update release workflow	2026-04-10 13:14:01 +09:00
Taiki Endo	f69e524d67	Update readme	2026-04-10 13:14:01 +09:00
Taiki Endo	9c2513f9f4	Update `uv@latest` to 0.11.5	2026-04-09 21:32:20 +00:00
Taiki Endo	84505613db	Update `syft@latest` to 1.42.4	2026-04-09 21:32:20 +00:00
Taiki Endo	9cfc7fba65	Update `dprint@latest` to 0.54.0	2026-04-09 21:32:20 +00:00
Taiki Endo	b8be7f5e14	Release 2.75.3	2026-04-09 18:02:50 +00:00
Taiki Endo	d3bc52a8b2	Update wasmtime manifest	2026-04-09 17:51:32 +00:00
Taiki Endo	08d452d0b7	Update biome manifest	2026-04-09 17:51:32 +00:00
Taiki Endo	77557fa399	Do not set DEFAULT_GITHUB_TOKEN if cargo-binstall fallback is disabled	2026-04-10 02:37:36 +09:00
Taiki Endo	8f20d38f44	Update `rclone@latest` to 1.73.4	2026-04-09 15:48:55 +00:00
Taiki Endo	ae5d3f20c2	Update gungraun-runner manifest	2026-04-09 15:48:55 +00:00
Taiki Endo	089a51b004	Release 2.75.2	2026-04-09 12:54:56 +00:00
Taiki Endo	11416ea98a	Update uv manifest	2026-04-09 12:45:49 +00:00
Taiki Endo	39fec91e69	Update mise manifest	2026-04-09 12:45:49 +00:00
Taiki Endo	98dac18286	Update martin manifest	2026-04-09 09:48:44 +00:00
Taiki Endo	9371b89122	Update `uv@latest` to 0.11.4	2026-04-09 05:39:04 +00:00
Taiki Endo	302deb33ce	Update `tombi@latest` to 0.9.16	2026-04-09 05:39:04 +00:00
Taiki Endo	29a15ef9da	Update `mise@latest` to 2026.4.6	2026-04-09 00:49:13 +00:00
Taiki Endo	2604f17acf	Update uv manifest	2026-04-08 21:34:26 +00:00
Taiki Endo	213ef8999f	Update syft manifest	2026-04-08 21:34:26 +00:00
Taiki Endo	de2c0cd479	Update dprint manifest	2026-04-08 21:34:26 +00:00
Taiki Endo	0ac0f9c0a8	Update rclone manifest	2026-04-08 15:52:51 +00:00
Taiki Endo	80e6af7a2e	Release 2.75.1	2026-04-08 11:41:03 +00:00
Taiki Endo	6a86357e4b	Update uv manifest	2026-04-08 11:37:00 +00:00
Taiki Endo	1937fe5f4e	Update tombi manifest	2026-04-08 11:37:00 +00:00
Taiki Endo	4b8a8cad69	Update `shfmt@latest` to 3.13.1	2026-04-08 11:37:00 +00:00
Taiki Endo	b17ecabb43	Update mise manifest	2026-04-08 11:37:00 +00:00
Taiki Endo	53e0690e4b	Update `cosign@latest` to 3.0.6	2026-04-08 11:37:00 +00:00
Taiki Endo	0bb270a59a	codegen: Mark coreutils 0.8.0 as broken Same as `14ee01d8e3`.	2026-04-08 20:22:26 +09:00
Taiki Endo	408189eb2d	ci: Update config	2026-04-08 00:49:23 +09:00
Taiki Endo	cf39a74df4	Release 2.75.0	2026-04-07 15:35:56 +00:00
Taiki Endo	0486bdd90e	Support cosign	2026-04-08 00:33:03 +09:00
Taiki Endo	fbe29f7fa6	ci: Enable dependabot grouped update for github-actions This partially reverts `5f3e9b7a2d`.	2026-04-07 23:09:26 +09:00
Taiki Endo	2438243e4c	Enable "Require actions to be pinned to a full-length commit SHA" actions policy	2026-04-07 23:08:37 +09:00
Taiki Endo	850405699d	tools: Update tidy.sh	2026-04-07 22:55:56 +09:00
Taiki Endo	dcdbf46878	ci: Update release workflow	2026-04-07 22:55:44 +09:00
Taiki Endo	8002e0e61d	Release 2.74.1	2026-04-07 12:53:35 +00:00
Taiki Endo	025d8d1457	Update `mise@latest` to 2026.4.5	2026-04-07 12:43:36 +00:00
Taiki Endo	e83b58f811	Update `tombi@latest` to 0.9.15	2026-04-07 06:54:02 +00:00
Taiki Endo	ebe7e09a94	Update shfmt manifest	2026-04-07 01:14:18 +00:00
Taiki Endo	c24beccdbc	Update coreutils manifest	2026-04-07 01:14:18 +00:00
Taiki Endo	56bf508a3f	Adjust base distro detection code	2026-04-07 00:55:49 +09:00
Taiki Endo	f0e236a2f1	ci: Remove dead code	2026-04-07 00:17:21 +09:00