Release 2.75.11

https://github.com/cargo-bins/cargo-binstall/pull/2533

.github/.cspell/project-dictionary.txt

@@ -36,6 +36,7 @@ sccache
 SHASUMS
 shortstat
 sigstore
+startswith
 syft
 tombi
 udeps

.github/workflows/ci.yml

@@ -181,9 +181,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        fallback:
-          - none
-          - cargo-install
+        include:
+          - fallback: none
+          - fallback: cargo-install
+          - fallback: cargo-binstall
+          - fallback: cargo-binstall
+            version: 0.3
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 60
     steps:
@@ -195,7 +198,7 @@ jobs:
         id: install
         continue-on-error: ${{ matrix.fallback == 'none' }}
         with:
-          tool: parse-changelog@0.4.6
+          tool: parse-changelog@${{ matrix.version || '0.4.6' }}
           fallback: ${{ matrix.fallback }}
       - run: exit 1
         if: matrix.fallback == 'none' && steps.install.outcome != 'failure'

CHANGELOG.md

@@ -10,6 +10,24 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.75.11] - 2026-04-14
+
+- Update `prek@latest` to 0.3.9.
+
+- Update `mise@latest` to 2026.4.11.
+
+- Update `zizmor@latest` to 1.24.0.
+
+## [2.75.10] - 2026-04-13
+
+- Update `tombi@latest` to 0.9.17.
+
+- Update `mise@latest` to 2026.4.10.
+
+## [2.75.9] - 2026-04-13
+
+- Enhance security when cargo-binstall fallback is used. ([acc1621b](https://github.com/taiki-e/install-action/commit/acc1621b4419c9cf5d2361f3dd3bedcc288c6c43))
+
 ## [2.75.8] - 2026-04-13
 
 - Update `vacuum@latest` to 0.25.8.
@@ -6231,7 +6249,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.8...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.11...HEAD
+[2.75.11]: https://github.com/taiki-e/install-action/compare/v2.75.10...v2.75.11
+[2.75.10]: https://github.com/taiki-e/install-action/compare/v2.75.9...v2.75.10
+[2.75.9]: https://github.com/taiki-e/install-action/compare/v2.75.8...v2.75.9
 [2.75.8]: https://github.com/taiki-e/install-action/compare/v2.75.7...v2.75.8
 [2.75.7]: https://github.com/taiki-e/install-action/compare/v2.75.6...v2.75.7
 [2.75.6]: https://github.com/taiki-e/install-action/compare/v2.75.5...v2.75.6

main.sh

@@ -928,11 +928,64 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
       # By default, cargo-binstall enforce downloads over secure transports only.
       # As a result, http will be disabled, and it will also set
       # min tls version to be 1.2
-      binstall_args=(--force --no-confirm --locked "${unsupported_tools[@]}")
-      if [[ -n "${token}" ]]; then
-        cargo-binstall binstall --github-token "${token}" "${binstall_args[@]}"
-      else
-        cargo-binstall binstall "${binstall_args[@]}"
+      binstall_args=(
+        --force
+        --no-confirm
+        --locked
+        # Since the build script can access the token when `cargo install` is called
+        # within `cargo-binstall`, disables building from source in cargo-binstall
+        # and fallback to `cargo install` which doesn't need the token.
+        # TODO: once https://github.com/cargo-bins/cargo-binstall/pull/2533 merged,
+        # we can remove this and use batch install again.
+        --disable-strategies compile
+      )
+      unsupported_tools2=()
+      for tool in "${unsupported_tools[@]}"; do
+        if [[ -n "${token}" ]]; then
+          if ! GITHUB_TOKEN="${token}" cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        else
+          if ! cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        fi
+      done
+      if [[ ${#unsupported_tools2[@]} -gt 0 ]]; then
+        for tool in "${unsupported_tools2[@]}"; do
+          # This logic is from cache-cargo-install-action.
+          cargo_args=(--locked)
+          if [[ "${tool}" == *"@"* ]]; then
+            version="${tool#*@}"
+            tool="${tool%@*}"
+            if [[ ! "${version}" =~ ^([1-9][0-9]*\.[0-9]+\.[0-9]+|0\.[1-9][0-9]*\.[0-9]+|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+              if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${tool}")
+              if [[ ! "${version}" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              # shellcheck disable=SC2207
+              versions=($(jq -r --arg start "${version}." '.versions[] | select(.num | startswith($start)) | select(.yanked == false) | .num' <<<"${crate_info}"))
+              full_version=''
+              for v in ${versions[@]+"${versions[@]}"}; do
+                if [[ "${v}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z\.-]+)?$ ]]; then
+                  full_version="${v}"
+                  break
+                fi
+              done
+              if [[ -z "${full_version}" ]]; then
+                bail "no stable version found for ${tool} that match with '${version}.*'; if you want to install a pre-release version, please specify the full version"
+              fi
+              version="${full_version}"
+            fi
+            cargo_args+=(--version "${version}")
+          fi
+          cargo install "${cargo_args[@]}" "${tool}"
+        done
       fi
       if ! type -P cargo >/dev/null; then
         _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")

manifests/cargo-deny.json

@@ -29,6 +29,28 @@
   "0.19": {
     "version": "0.19.1"
   },
+  "0.19.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE99FE8DE28F6D",
+      "hash": "0c722daba6e38497a008c75f9232578481f0a1ad621d99865024a68204f18cc7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99FE88C77055",
+      "hash": "b73dc84685920324f0092e2ade445be5d8d2581f409454241c38135b1a34ff68"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE99FECCC8BC39",
+      "hash": "27d2584ad4edee4d481852a5b62748059863c9fb623d238a76c87b0c1cf4dca6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE99FEAFD6114C",
+      "hash": "8de0b4774ed6236a21dd5a4407bd98acf814073b58fbe4fb60a792e5bacac07b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE99FE6BE18845",
+      "hash": "35e715486a78c0583c05a8cfe136c54b7e4e20e43bf01d91d345f80dfd345076"
+    }
+  },
   "0.19.1": {
     "x86_64_linux_musl": {
       "etag": "0x8DE96F183A112FE",

manifests/cargo-xwin.json

@@ -21,6 +21,24 @@
   "0.21": {
     "version": "0.21.4"
   },
+  "0.21.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE996AB7D4D4DC",
+      "hash": "42928296cfaaede33b85cc1b96c0db424070f32dfbd5c0a2abbd6d0d64f05334"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE996A9D6EC9D6",
+      "hash": "68824cbab61a1f16b9648eb82637de2ecb4b1e7b590e10808b7f11fb60c5a5b0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE996A6C11905B",
+      "hash": "05664cc1dcebb2529a26c876957738abc7bf9e5bad53c8de82e0696bb68cacd5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE996A75B99E58",
+      "hash": "5af6421d4970a0c289d60f5cd79023cade9a83ba25a8495e8d401a45095ffcc1"
+    }
+  },
   "0.21.4": {
     "x86_64_linux_musl": {
       "etag": "0x8DE600B46A93E96",

manifests/mise.json

@@ -28,13 +28,39 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2026.4.9"
+    "version": "2026.4.11"
   },
   "2026": {
-    "version": "2026.4.9"
+    "version": "2026.4.11"
   },
   "2026.4": {
-    "version": "2026.4.9"
+    "version": "2026.4.11"
+  },
+  "2026.4.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE99529B2B70CC",
+      "hash": "e5950f11eaf8b6dfa9779b16b60c16e77581e9e3c2ca6ee6d0fcdbac4213755c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99529E24DCBF",
+      "hash": "560f1de4717b1b112e715f2e7b8e42b4ff42cff30974b4d5af6a2beee49d0fa8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE99529F6DEBAC",
+      "hash": "bd3f65b704b3eb7ca149796cb4884f1a2cd5303095955a90cf2960226c3abf4d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE995297A42038",
+      "hash": "7d81786e18d807e99e441e1a519abf47a5dd02b4beb7c1eb4c6ec8e4f4d7519e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE99529D304581",
+      "hash": "0058795c35854976d5e0cd6cb1cb644cd7d5d5a9c57989e4a696f0555dd6ceeb"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE99529F21813E",
+      "hash": "0595c0ace18209519cdb98b15b8e4aeba48b8dbe56a2ce5483baa3464e4c13f5"
+    }
   },
   "2026.4.10": {
     "x86_64_linux_musl": {

manifests/prek.json

@@ -40,10 +40,44 @@
   },
   "license_markdown": "[MIT](https://github.com/j178/prek/blob/master/LICENSE)",
   "latest": {
-    "version": "0.3.8"
+    "version": "0.3.9"
   },
   "0.3": {
-    "version": "0.3.8"
+    "version": "0.3.9"
+  },
+  "0.3.9": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9958BFB91B93",
+      "hash": "254b48c4b0d8c7da07d0f23144f55f8b56d3a83c416d17a25dbaaee2f721f231"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9958BF2DA54A",
+      "hash": "62b863b3cfcd56dec6a924acad0362594607c86cb773265e148acce252a5c4ac"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9958BF56354B",
+      "hash": "a260094190979a6b2aa6e0bef02121a21e8c2715c2d91603f2763123bfc7f902"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9958BDDB792E",
+      "hash": "b6153b0756a61fc45bf9e63aaf68661bdd9da03dfcf18e2509cedba445b6c4c9"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9958BDA9CBA2",
+      "hash": "0e52d21951d488a9db211c9ea35775614b3cbadc778247486c1e0e9fd0e106cc"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9958BD9BAACF",
+      "hash": "b2fa54c2c6c43cf447a043551e68201c103c2d22692345a29622db8af9c3ce4e"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9958BEFA4C07",
+      "hash": "28e3ba07248eb03f1cd57d6978fdf466eebdf3f69d6eb34b161af898ebb8b45d"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9958BF32A8AF",
+      "hash": "bde03bc2acad42eff7dc1579eceb98f1a0cd271dce7e76cf8a056e93e2b85bd9"
+    }
   },
   "0.3.8": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -22,10 +22,10 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.16"
+    "version": "0.9.17"
   },
   "0.9": {
-    "version": "0.9.16"
+    "version": "0.9.17"
   },
   "0.9.17": {
     "x86_64_linux_musl": {

manifests/typos.json

@@ -30,6 +30,28 @@
   "1.45": {
     "version": "1.45.0"
   },
+  "1.45.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE996D7794BF00",
+      "hash": "33447531a0eff29796d6fb9b555b4628723db72c6bad129e168d97ac86ceb0f1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE996DB81FBE55",
+      "hash": "70767b5d8d920cbb17b452a6b068e36e1b3fd649089bce883d3512eb85990326"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE996D7D9C1AAD",
+      "hash": "a4ae081cb7a403f2b75e8c066aa4a4484207547c4e9eb2b4df3f68ecdbc5dd3e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE996D52EE2586",
+      "hash": "0d3688c607a49ffb6dedaca6de44e4217abeaa5b93228d673dc5caf76f60489f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE996D9C9D7B7B",
+      "hash": "2c31ed16286f26c08ae477faf001af8542ff23aeb6e7323be5f620710c192fb5"
+    }
+  },
   "1.45.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DE8FF7414DC005",

manifests/zizmor.json

@@ -19,10 +19,35 @@
   },
   "license_markdown": "[MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE)",
   "latest": {
-    "version": "1.23.1"
+    "version": "1.24.0"
   },
   "1": {
-    "version": "1.23.1"
+    "version": "1.24.0"
+  },
+  "1.24": {
+    "version": "1.24.0"
+  },
+  "1.24.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE99859707E0A7",
+      "hash": "a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE99859704D6D9",
+      "hash": "721ba70d7fca753aeef1a4ee959a9bc20c55784d4faa6c56e66129a2611fd52f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE998597046237",
+      "hash": "b777ec2cb1098139ba74b32e30d11ed149c69ab692d23788c466d4a31704bd4b"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE998597142EDB",
+      "hash": "d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE998597093EA9",
+      "hash": "fc4ea59e18bc028dddb5f710b16dbc361b01ff1e7a20c03b8e5778366ca9f4e1"
+    }
   },
   "1.24.0": {
     "x86_64_linux_gnu": {

tools/codegen/src/main.rs

@@ -231,7 +231,11 @@ fn main() {
 
     let version_req: semver::VersionReq = match version_req {
         _ if latest_only => {
-            let req = format!("={}", releases.first_key_value().unwrap().0.0).parse().unwrap();
+            // Exclude very recently released version from candidate for latest version.
+            let req =
+                format!("={}", releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0)
+                    .parse()
+                    .unwrap();
             eprintln!("update manifest for versions '{req}'");
             req
         }