chore(mise): upgrade local tools

[ghappforreleaseplease]

Automated mise tool upgrades from local config.

mise-managed tools:

• action-validator
• editorconfig-checker
• ghalint
• jactionlint
• lychee
• pipx:gh-action-pulse
• prek
• rumdl
• shellcheck
• shfmt
• tombi
• uv
• yamlfmt
• yamllint
• zizmor

Command: mise upgrade --bump --local action-validator editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor

Version changelog (6 tools)

Tool	Requested	Installed
jactionlint	2.0.2 → 2.1.0	2.0.2 → 2.1.0
pipx:gh-action-pulse	1.5.3 → 1.5.4	1.5.3 → 1.5.4
prek	0.5.4 → 0.5.5	0.5.4 → 0.5.5
rumdl	0.2.78 → 0.2.79	0.2.78 → 0.2.79
tombi	1.7.1 → 1.8.1	1.7.1 → 1.8.1
uv	0.12.23 → 0.13.0	0.12.23 → 0.13.0

Release notes (5 tools)

jactionlint: `2.0.2` → `2.1.0` (jdx/jactionlint)

v2.1.0

jactionlint 2.1.0 adds an environment variable that turns on the online checks, a new workflow-secret-scope rule, and machine-readable reasons when a finding has no fix. Many security rules now produce fewer false positives, especially in reusable workflows and release pipelines. Some rules now report things they did not report before, so an existing clean run can show new findings (see Changed).

Added

• JACTIONLINT_ONLINE environment variable. It turns on the online checks without changing the command, so CI can run them while local pre-commit hooks stay offline. 1, true or on works like --online, and cache, strict or cache,strict select a mode. 0, false, off or no works like --no-online and overrides online: true in the config file. The --online/--no-online flags override the variable, and the variable overrides the config file. An invalid value exits with status 2. (#155, @​jdx)

  - run: hk check --all
    env:
      JACTIONLINT_ONLINE: 1
      GITHUB_TOKEN: ${{ github.token }}

• New workflow-secret-scope rule (security, pedantic profile, warning, no autofix). It reports a named secret in workflow-level env: when steps in two or more jobs can see it. The rule skips single-job workflows, GITHUB_TOKEN, jobs or steps that override the variable, and jobs that call reusable workflows. (#136, @​jdx)
• background-step-not-waited (correctness profile, from parallel-steps). It reports reads of a background step's outputs, outcome or conclusion before a wait or wait-all covers that step. Those reads evaluate to an empty string. Steps with background: ${{ ... }} are not tracked. (#132, @​jdx)
• Reasons for missing fixes. When a fixable rule has no fix for a finding, the finding now says why. This applies to missing-timeout, dependabot-cooldown, unpinned-uses, template-injection and artipacked. The reason appears as no_fix in JSON and template output, and… (truncated)

prek: `0.5.4` → `0.5.5` (j178/prek)

v0.5.5

Release Notes

Released on 2026-10-05.

Enhancements

• Add Nushell completion generation (#2785)
• Add ppc64le wheel and binary builds (#2809)

Performance

• Avoid JSON imports when querying Python interpreters (#2790)
• Avoid duplicate diffs after hooks rewrite files (#2815)
• Batch file reads in shebang checks (#2793)
• Check cached hook environments concurrently (#2797)
• Overlap Git discovery with worktree status checks (#2821)
• Query staged additions only for case conflicts (#2802)
• Reduce worker overhead in XML and pygrep checks (#2789)
• Reuse Git worktree state during hook startup (#2787)
• Reuse intent-to-add paths when saving unstaged changes (#2788)
• Run Git queries concurrently for case-conflict checks (#2792)
• Share Bun and Deno version queries across environments (#2795)
• Share Lua runtime probes across hook environments (#2796)
• Share Ruby version queries across hook environments (#2794)
• Share mise version queries across hook environments (#2798)
• Skip site initialization in Python interpreter probes (#2822)
• Skip untracked files in destroyed symlink checks (#2799)
• Skip unused file input for always-run hooks (#2813)

Bug fixe… (truncated)

rumdl: `0.2.78` → `0.2.79` (rvben/rumdl)

v0.2.79

Added

• MD095: detect confusable link destinations with accurate source spans (7937059)
• MD060: add stable configurable table-cell padding (b2323fd)
• MD013: add opt-in sentence-pack reflow (#915) (d736ced)
• code-block-tools: add format-mode = "pipeline" to chain formatters (b1da3de)
• docs: add question search and aggregate usage tracking (aaabeaa)

Fixed

• MD013: count only rewritten prose in list sentence warnings (276f266)
• MD013: preserve reflow structure and expand scheduled fuzz coverage (73a9731)
• MD013: preserve source sentence breaks and emphasis step labels (042d304)
• MD013: keep emphasized step labels within their sentence (c1d1073)
• MD013: keep a deep continuation line from setting a list item's indent (fc8cacd)
• MD013: preserve document structure during reflow (79e8b95)
• preserve Markdown content across lint fixes (37dc5e7)
• MD013: read the code spans of a paragraph whose first line is indented ([4879938](htt… (truncated)

tombi: `1.7.1` → `1.8.1` (tombi-toml/tombi)

v1.7.2

What's Changed

🛠️ Other Changes

• fix(lsp): show per-value descriptions of oneOf/anyOf const enums consistently by @​ya7010 in fix(lsp): show per-value descriptions of oneOf/anyOf const enums consistently tombi-toml/tombi#2268

Full Changelog: tombi-toml/tombi@v1.7.1...v1.7.2

v1.7.3

What's Changed

🦅 New Features

• feat: fetch private GitHub schemas using local credentials by @​ya7010 in feat: fetch private GitHub schemas using local credentials tombi-toml/tombi#2273

🐝 Bug Fixes

• fix(pyproject): enforce required metadata constraints by @​ya7010 in fix(pyproject): enforce required metadata constraints tombi-toml/tombi#2271
• fix(pyproject): align schema with mandatory metadata rules by @​ya7010 in fix(pyproject): align schema with mandatory metadata rules tombi-toml/tombi#2272

Full Changelog: tombi-toml/tombi@v1.7.2...v1.7.3

v1.8.0

What's Changed

🦅 New Features

• feat(config): add global schema deprecation severity by @​ya7010 in feat(config): add global schema deprecation severity tombi-toml/tombi#2278
• feat(config): add global schema format rules by @​ya7010 in feat(config): add global schema format rules tombi-toml/tombi#2284

🛠️ Other Changes

• fix(lsp): reload config changed outside the editor by @​ya7010 in fix(lsp): reload config changed outside the editor tombi-toml/tombi#2280
• fix(lsp): reload local schema files changed outside the editor by @​ya7010 in fix(lsp): reload local schema files changed outside the editor tombi-toml/tombi#2281
• fix(schema-store): block schema fetches to non-public addresses by @​ya7010 in fix(schema-store): block schema fetches to non-public addresses tombi-toml/tombi#2283
• docs(formatter): explain disabling auto sorting globally by @​ya7010 in docs(formatter): explain disabling auto sorting globally tombi-toml/tombi#2285
• fix(deps): bump seroval, source-map-js and vue overrides by @​ya7010 in fix(deps): bump seroval, source-map-js and vue overrides tombi-toml/tombi#2286

Full Changelog: tombi-toml/tombi@v1.7.3...v1.8.0

v1.8.1

What's Changed

🦅 New Features

• feat(lsp): fold # region / # endregion comment markers by @​ya7010 in feat(lsp): fold # region / # endregion comment markers tombi-toml/tombi#2290

🛠️ Other Changes

• refactor(schema-store): make SchemaStore options immutable by @​ya7010 in refactor(schema-store): make SchemaStore options immutable tombi-toml/tombi#2289

Full Changelog: tombi-toml/tombi@v1.8.0...v1.8.1

uv: `0.12.23` → `0.13.0` (astral-sh/uv)

0.12.24

Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#22171)
• Accept PEP 508 marker operators directly before grouped expressions (#22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#22362)
• Identify the invalid source URL in Python mirror errors (#22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)

Configuration

• Support custom installation mirrors for GraalPy (#22269)
• Support custom installation mirrors for Pyodide (#22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support ([#22242](https:/… (truncated)

0.13.0

Release Notes

Released on 2026-10-09.

uv 0.13.0 makes Python 3.15 the default stable Python version. We've also included several breaking changes to improve correctness, performance, and compatibility, described below.

We expect most users to be able to upgrade without making changes.

While not a breaking change, this release also updates the format of many of uv's cache entries to improve performance. uv may download or rebuild dependencies after upgrading, because some cached entries from earlier versions cannot be reused. Multiple versions of uv can still safely share the same cache directory.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.13, e.g., uv_build>=0.13.0,<0.14.

Breaking changes

• Use Python 3.15 as the default stable version

  The default stable Python version has changed from 3.14 to 3.15. This affects Python downloads when no version is requested or pinned, e.g., when running uv python install.

  uv continues to use compatible Python installations that are already present. For example, uv venv can still use an installed Python 3.14. If no suitable interpreter is installed and automatic downloads are enabled, commands such as uv venv and uvx python can now download Python 3.15.

  You can opt out of this behavior by requesting Python 3.14 explicitly, e.g., uv venv --python 3.14. For projects, use uv python pin 3.14 to record the version in .python-version.

• Honor --require-hashes in included constraints files (#22275)

  Previously, uv ignored --require-hashes in constraints files included with -c from a requirements file. Now, uv honors the directive and requires hashes for all requirements in the installation. Installs that previously succeeded can now fa… (truncated)

Modified files:

• .mise.toml

[github-actions]

Commit Check

✅ All 5 checks passed

Show all 5 checks

Commit message
  ✔ Commit 1/2 (a2b9bb7) (chore(mise): upgrade local tools)
  ✔ Commit 2/2 (d8003b9) (chore(ci): correct permission workflow)
Branch
  ✔ Branch (chore/mise-tool-updates-20261012155300)
Author
  ✔ Author name (jylenhof)
  ✔ Author email (jygithub@lenhof.eu.org)

commit-check 2.17.0 · Rules reference

[jylenhof]

LGTM

[jylenhof]

LGTM

[jylenhof]

LGTM