Visitar URL original
Avoid rebuilding a Windows relative path into an absolute form by astral-automations-bot[bot] · Pull Request #21923 · astral-sh/uv · GitHub
Skip to content

Avoid rebuilding a Windows relative path into an absolute form - #21923

Merged
woodruffw merged 1 commit into
mainfrom
ww/fix-drive-windows
Sep 22, 2026
Merged

Avoid rebuilding a Windows relative path into an absolute form#21923
woodruffw merged 1 commit into
mainfrom
ww/fix-drive-windows

Conversation

@astral-automations-bot

@astral-automations-bot astral-automations-bot Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Summary

TL;DR: SanitizedArchivePath can introduce a Windows drive prefix when rebuilding a path during normalization. For example, ./C:foo and parent/../C:foo contain a Component::Normal("C:foo"), but passing that component to PathBuf::push interprets it as the drive-relative path C:foo.

See #19693 for the introduction point.

Test Plan

Added unit tests.

@woodruffw
Avoid rebuilding a path into a drive-relative form
16e7d01 
Signed-off-by: William Woodruff <william@yossarian.net>
@woodruffw
woodruffw enabled auto-merge (squash) September 22, 2026 20:27
@woodruffw
woodruffw merged commit 6716964 into main Sep 22, 2026
59 checks passed
@woodruffw
woodruffw deleted the ww/fix-drive-windows branch September 22, 2026 20:31
@woodruffw woodruffw changed the title Avoid rebuilding a path into an absolute form Avoid rebuilding a Windows relative path into an absolute form Sep 22, 2026
@BrewTestBot BrewTestBot mentioned this pull request Sep 22, 2026
Merged
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Sep 23, 2026
hayden-bot git.hayden.moe Instance
fix(github-release): update release uv (0.12.17 → 0.12.18) (#734)
76db898 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.17` → `0.12.18` |

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.12.18`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01218)

[Compare Source](astral-sh/uv@0.12.17...0.12.18)

Released on 2026-09-22.

##### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`, including for `--dry-run` and `--check` ([#&#8203;21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned changes without modifying the environment ([#&#8203;21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in build errors ([#&#8203;21881](astral-sh/uv#21881))

##### Preview features

- Validate build requirements for `uv build --no-build-isolation` with `--preview-features build-dependency-check`; use `--skip-dependency-check` to opt out ([#&#8203;21880](astral-sh/uv#21880))

##### Performance

- Speed up `uv_build` editable wheel creation by omitting compression from temporary wheels ([#&#8203;21918](astral-sh/uv#21918))

##### Bug fixes

- Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags ([#&#8203;21835](astral-sh/uv#21835), [#&#8203;21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or `uv version` fails or is interrupted ([#&#8203;21860](astral-sh/uv#21860), [#&#8203;21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed requirements are satisfied ([#&#8203;21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths ([#&#8203;21923](astral-sh/uv#21923))
- Recognize distribution filenames and archive extensions when URL fragments contain `?` ([#&#8203;21920](astral-sh/uv#21920))
- Generate correctly lowercased platform tags for BSD and Haiku releases ([#&#8203;21853](astral-sh/uv#21853))
- Avoid rebuilding a Windows relative path into an absolute form ([#&#8203;21923](astral-sh/uv#21923))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDguMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEwOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItcmVsZWFzZSIsInR5cGUvcGF0Y2giXX0=-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/734
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Sep 23, 2026
renovate[bot] @luketainton
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.18 (#49)
2109bfc 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.17` → `0.12.18` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.18`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01218)

[Compare Source](astral-sh/uv@0.12.17...0.12.18)

Released on 2026-09-22.

##### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`, including for `--dry-run` and `--check` ([#&#8203;21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned changes without modifying the environment ([#&#8203;21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in build errors ([#&#8203;21881](astral-sh/uv#21881))

##### Preview features

- Validate build requirements for `uv build --no-build-isolation` with `--preview-features build-dependency-check`; use `--skip-dependency-check` to opt out ([#&#8203;21880](astral-sh/uv#21880))

##### Performance

- Speed up `uv_build` editable wheel creation by omitting compression from temporary wheels ([#&#8203;21918](astral-sh/uv#21918))

##### Bug fixes

- Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags ([#&#8203;21835](astral-sh/uv#21835), [#&#8203;21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or `uv version` fails or is interrupted ([#&#8203;21860](astral-sh/uv#21860), [#&#8203;21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed requirements are satisfied ([#&#8203;21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths ([#&#8203;21923](astral-sh/uv#21923))
- Recognize distribution filenames and archive extensions when URL fragments contain `?` ([#&#8203;21920](astral-sh/uv#21920))
- Generate correctly lowercased platform tags for BSD and Haiku releases ([#&#8203;21853](astral-sh/uv#21853))
- Avoid rebuilding a Windows relative path into an absolute form ([#&#8203;21923](astral-sh/uv#21923))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDcuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjEwNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/49
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Sep 23, 2026
renovate[bot] @luketainton
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.18 (#60)
987a5de 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.17` → `0.12.18` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.18`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01218)

[Compare Source](astral-sh/uv@0.12.17...0.12.18)

Released on 2026-09-22.

##### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`, including for `--dry-run` and `--check` ([#&#8203;21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned changes without modifying the environment ([#&#8203;21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in build errors ([#&#8203;21881](astral-sh/uv#21881))

##### Preview features

- Validate build requirements for `uv build --no-build-isolation` with `--preview-features build-dependency-check`; use `--skip-dependency-check` to opt out ([#&#8203;21880](astral-sh/uv#21880))

##### Performance

- Speed up `uv_build` editable wheel creation by omitting compression from temporary wheels ([#&#8203;21918](astral-sh/uv#21918))

##### Bug fixes

- Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags ([#&#8203;21835](astral-sh/uv#21835), [#&#8203;21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or `uv version` fails or is interrupted ([#&#8203;21860](astral-sh/uv#21860), [#&#8203;21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed requirements are satisfied ([#&#8203;21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths ([#&#8203;21923](astral-sh/uv#21923))
- Recognize distribution filenames and archive extensions when URL fragments contain `?` ([#&#8203;21920](astral-sh/uv#21920))
- Generate correctly lowercased platform tags for BSD and Haiku releases ([#&#8203;21853](astral-sh/uv#21853))
- Avoid rebuilding a Windows relative path into an absolute form ([#&#8203;21923](astral-sh/uv#21923))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDcuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjEwNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/60
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Sep 23, 2026
Merged
1 task
This was referenced Sep 28, 2026
Merged
Merged
Merged
Merged
Merged
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Sep 28, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#100)
a98d19e 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint aube
editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl
shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (3 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `pipx:gh-action-pulse` | `1.5.0` → `1.5.3` | `1.5.0` → `1.5.3` |
| `rumdl` | `0.2.74` → `0.2.77` | `0.2.74` → `0.2.77` |
| `uv` | `0.12.17` → `0.12.19` | `0.12.17` → `0.12.19` |

</details>

<details>
<summary>Release notes (2 tools)</summary>

<details>
<summary>rumdl: `0.2.74` → `0.2.77` (rvben/rumdl)</summary>

### v0.2.75

### Added

- **md093**: add opt-in rule for inline formatting in headings
([ed627ef](rvben/rumdl@ed627ef))

### Fixed

- **md013**: add opt-in link text wrapping
([effdb6a](rvben/rumdl@effdb6a))
- **MD013**: protect opt-in bracket display math during reflow
([e2c7fe8](rvben/rumdl@e2c7fe8))
- **MD044**: add opt-in whole-word matching for identifiers
([013621e](rvben/rumdl@013621e))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/…
(truncated)

### v0.2.76

### Added

- **MD094**: report each invalid UTF-8 sequence, with its position
([6c25d76](rvben/rumdl@6c25d76))
- **encoding**: lint files containing invalid UTF-8 instead of skipping
them
([f531bf4](rvben/rumdl@f531bf4))

### Fixed

- **MD013**: leave definition lists as written when reflowing, instead
of moving a definition's later paragraph out of the list
([93ab135](rvben/rumdl@93ab135))
- **MD013**: keep every block of consecutive mkdocstrings blocks out of
reflow
([7199b0a](rvben/rumdl@7199b0a))
- **MD013**: recognize mkdocstrings blocks whose identifier has no dot
([31b56ea](rvben/rumdl@31b56ea))
- **cli**: report a skipped file on the same stream as the run's other
findings, not always stderr
([9558bc5](rvben/rumdl@9558bc5))
- **MD092**: follow the invocation's rule selection
([b0dfbe2](rvben/rumdl@b0dfbe2))
- **lint-context**: record only CommonMark headings as headings
([1479a1e](rvben/rumdl@1479a1e))
- **cli**: name every ignore file --respect-gitignore controls
([268a54d](rvben/rumdl@268a54d))
- **discovery**: attribute empty runs to .markdownlintignore separately
([834e10c](rvben/rumdl@834e10c))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.76/rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 | [checksum](https://gith… (truncated)

### v0.2.77

### Fixed

- **release**: never replace published GitHub Release assets
([471d97e](rvben/rumdl@471d97e))

### Performance

- **release**: cut published wheel size 6% with fat LTO
([7605780](rvben/rumdl@7605780))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz)
| macOS x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/…
(truncated)

</details>
<details>
<summary>uv: `0.12.17` → `0.12.19` (astral-sh/uv)</summary>

### 0.12.18

## Release Notes

Released on 2026-09-22.

This release addresses
[GHSA-2cv4-cqwr-gwf7](GHSA-2cv4-cqwr-gwf7),
which is a path traversal weakness during wheel installation on Windows.
No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`,
including for `--dry-run` and `--check`
([#21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned
changes without modifying the environment
([#21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in
build errors ([#21881](astral-sh/uv#21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with
`--preview-features build-dependency-check`; use
`--skip-dependency-check` to opt out
([#21880](astral-sh/uv#21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression
from temporary wheels
([#21918](astral-sh/uv#21918))

### Bug fixes

- Select package versions with wheels compatible with each Python
resolution fork, correctly interpreting generic and stable-ABI wheel
tags ([#21835](astral-sh/uv#21835),
[#21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or
`uv version` fails or is interrupted
([#21860](astral-sh/uv#21860),
[#21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed
requirements are satisfied
([#21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths
([#21923](astral-sh/uv#21923))
- Recognize distribution fil… (truncated)

### 0.12.19

## Release Notes

Released on 2026-09-24.

### Python

- Add PyPy 3.11.16 and 3.12.14
([#21847](astral-sh/uv#21847))
- Update GraalPy 3.13.0 to build 25.4.4
([#21847](astral-sh/uv#21847))

### Enhancements

- Format upload URLs with backticks in `uv publish` errors
([#21934](astral-sh/uv#21934))

### Preview features

- Run build-backend hooks with lazy imports on CPython 3.15 and later
using the `build-lazy-imports` preview feature
([#21967](astral-sh/uv#21967))
- Omit unused resolution settings from `uv.lock` and ignore changes to
them when checking lockfile freshness with the `resolution-inputs`
preview feature ([#21913](astral-sh/uv#21913))

### Bug fixes

- Preserve signed and encoded query parameters in direct-URL metadata to
avoid reinstalling unchanged packages
([#21971](astral-sh/uv#21971))
- Recognize `1.0.0` as satisfying `===1` during installed-package
checks, matching resolution
([#21931](astral-sh/uv#21931))
- Avoid collisions between Git checkout readiness markers and `.ok`
files in dependencies
([#21891](astral-sh/uv#21891))
- Preserve always-false `python_version` markers when parsing their
serialized form ([#21939](astral-sh/uv#21939))

### Rust API

- Restore the public `FlatDistributions` export and its `BTreeMap`
conversion for downstream resolvers
([#21965](astral-sh/uv#21965))

### Documentation

- Make individual preview-feature reference entries linkable by name
([#21950](astral-sh/uv#21950))

## Install uv 0.12.19

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -Execut… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Sep 28, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade uv (#265)
597a77c 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.17` → `0.12.19` | `0.12.17` → `0.12.19` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.17` → `0.12.19` (astral-sh/uv)</summary>

### 0.12.18

## Release Notes

Released on 2026-09-22.

This release addresses
[GHSA-2cv4-cqwr-gwf7](GHSA-2cv4-cqwr-gwf7),
which is a path traversal weakness during wheel installation on Windows.
No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`,
including for `--dry-run` and `--check`
([#21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned
changes without modifying the environment
([#21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in
build errors ([#21881](astral-sh/uv#21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with
`--preview-features build-dependency-check`; use
`--skip-dependency-check` to opt out
([#21880](astral-sh/uv#21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression
from temporary wheels
([#21918](astral-sh/uv#21918))

### Bug fixes

- Select package versions with wheels compatible with each Python
resolution fork, correctly interpreting generic and stable-ABI wheel
tags ([#21835](astral-sh/uv#21835),
[#21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or
`uv version` fails or is interrupted
([#21860](astral-sh/uv#21860),
[#21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed
requirements are satisfied
([#21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths
([#21923](astral-sh/uv#21923))
- Recognize distribution fil… (truncated)

### 0.12.19

## Release Notes

Released on 2026-09-24.

### Python

- Add PyPy 3.11.16 and 3.12.14
([#21847](astral-sh/uv#21847))
- Update GraalPy 3.13.0 to build 25.4.4
([#21847](astral-sh/uv#21847))

### Enhancements

- Format upload URLs with backticks in `uv publish` errors
([#21934](astral-sh/uv#21934))

### Preview features

- Run build-backend hooks with lazy imports on CPython 3.15 and later
using the `build-lazy-imports` preview feature
([#21967](astral-sh/uv#21967))
- Omit unused resolution settings from `uv.lock` and ignore changes to
them when checking lockfile freshness with the `resolution-inputs`
preview feature ([#21913](astral-sh/uv#21913))

### Bug fixes

- Preserve signed and encoded query parameters in direct-URL metadata to
avoid reinstalling unchanged packages
([#21971](astral-sh/uv#21971))
- Recognize `1.0.0` as satisfying `===1` during installed-package
checks, matching resolution
([#21931](astral-sh/uv#21931))
- Avoid collisions between Git checkout readiness markers and `.ok`
files in dependencies
([#21891](astral-sh/uv#21891))
- Preserve always-false `python_version` markers when parsing their
serialized form ([#21939](astral-sh/uv#21939))

### Rust API

- Restore the public `FlatDistributions` export and its `BTreeMap`
conversion for downstream resolvers
([#21965](astral-sh/uv#21965))

### Documentation

- Make individual preview-feature reference entries linkable by name
([#21950](astral-sh/uv#21950))

## Install uv 0.12.19

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -Execut… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Sep 28, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#109)
b92027c 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint
editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek
rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (4 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `pipx:gh-action-pulse` | `1.5.0` → `1.5.3` | `1.5.0` → `1.5.3` |
| `rumdl` | `0.2.74` → `0.2.77` | `0.2.74` → `0.2.77` |
| `tombi` | `1.5.5` → `1.5.6` | `1.5.5` → `1.5.6` |
| `uv` | `0.12.17` → `0.12.19` | `0.12.17` → `0.12.19` |

</details>

<details>
<summary>Release notes (3 tools)</summary>

<details>
<summary>rumdl: `0.2.74` → `0.2.77` (rvben/rumdl)</summary>

### v0.2.75

### Added

- **md093**: add opt-in rule for inline formatting in headings
([ed627ef](rvben/rumdl@ed627ef))

### Fixed

- **md013**: add opt-in link text wrapping
([effdb6a](rvben/rumdl@effdb6a))
- **MD013**: protect opt-in bracket display math during reflow
([e2c7fe8](rvben/rumdl@e2c7fe8))
- **MD044**: add opt-in whole-word matching for identifiers
([013621e](rvben/rumdl@013621e))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/…
(truncated)

### v0.2.76

### Added

- **MD094**: report each invalid UTF-8 sequence, with its position
([6c25d76](rvben/rumdl@6c25d76))
- **encoding**: lint files containing invalid UTF-8 instead of skipping
them
([f531bf4](rvben/rumdl@f531bf4))

### Fixed

- **MD013**: leave definition lists as written when reflowing, instead
of moving a definition's later paragraph out of the list
([93ab135](rvben/rumdl@93ab135))
- **MD013**: keep every block of consecutive mkdocstrings blocks out of
reflow
([7199b0a](rvben/rumdl@7199b0a))
- **MD013**: recognize mkdocstrings blocks whose identifier has no dot
([31b56ea](rvben/rumdl@31b56ea))
- **cli**: report a skipped file on the same stream as the run's other
findings, not always stderr
([9558bc5](rvben/rumdl@9558bc5))
- **MD092**: follow the invocation's rule selection
([b0dfbe2](rvben/rumdl@b0dfbe2))
- **lint-context**: record only CommonMark headings as headings
([1479a1e](rvben/rumdl@1479a1e))
- **cli**: name every ignore file --respect-gitignore controls
([268a54d](rvben/rumdl@268a54d))
- **discovery**: attribute empty runs to .markdownlintignore separately
([834e10c](rvben/rumdl@834e10c))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.76/rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 | [checksum](https://gith… (truncated)

### v0.2.77

### Fixed

- **release**: never replace published GitHub Release assets
([471d97e](rvben/rumdl@471d97e))

### Performance

- **release**: cut published wheel size 6% with fat LTO
([7605780](rvben/rumdl@7605780))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz)
| macOS x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/…
(truncated)

</details>
<details>
<summary>tombi: `1.5.5` → `1.5.6` (tombi-toml/tombi)</summary>

### v1.5.6

<!-- Release notes generated using configuration in .github/release.yml
at v1.5.6 -->

## What's Changed
### 🦅 New Features
* feat(schema): support JSON Schema compound documents with embedded $id
by @​ya7010 in tombi-toml/tombi#2181
* feat(test): add Definition A JSON Schema Test Suite runner by @​ya7010
in tombi-toml/tombi#2182
* perf(schema): reduce resource index lock overhead by @​ya7010 in
tombi-toml/tombi#2223
* perf(comment): reuse cached directive schemas by @​ya7010 in
tombi-toml/tombi#2224
### 🐝 Bug Fixes
* fix(schema): honor disabled validation vocabulary by @​ya7010 in
tombi-toml/tombi#2212
### 🛠️ Other Changes
* fix(deps): resolve OSV scanner vulnerabilities by @​ya7010 in
tombi-toml/tombi#2180
* Ya7010/json schema suite gap by @​ya7010 in
tombi-toml/tombi#2193
* fix(validator): validate sibling oneOf/anyOf/allOf when one is not the
primary SchemaView by @​ya7010 in
tombi-toml/tombi#2194
* fix: update rustls for security advisory by @​ya7010 in
tombi-toml/tombi#2195
* update: status bar name. by @​ya7010 in
tombi-toml/tombi#2199
* chore: update pnpm to version 12.5.1 and adjust dependencies in
package.json and pnpm-lock.yaml; add new tumbi-lib module with initial
implementation by @​ya7010 in
tombi-toml/tombi#2208
* Add py tombi lib by @​ya7010 in
tombi-toml/tombi#2209
* fix: preserve sibling assertions beside schema combinators by @​ya7010
in tombi-toml/tombi#2211
* fix(schema): preserve dynamic reference annotations by @​ya7010 in
tombi-toml/tombi#2214
* fix(schema): honor disabled validation vocabulary by @​ya7010 in
tombi-toml/tombi#2215
* ci: gate JSON Schema Test Suite on PRs b… (truncated)

</details>
<details>
<summary>uv: `0.12.17` → `0.12.19` (astral-sh/uv)</summary>

### 0.12.18

## Release Notes

Released on 2026-09-22.

This release addresses
[GHSA-2cv4-cqwr-gwf7](GHSA-2cv4-cqwr-gwf7),
which is a path traversal weakness during wheel installation on Windows.
No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`,
including for `--dry-run` and `--check`
([#21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned
changes without modifying the environment
([#21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in
build errors ([#21881](astral-sh/uv#21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with
`--preview-features build-dependency-check`; use
`--skip-dependency-check` to opt out
([#21880](astral-sh/uv#21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression
from temporary wheels
([#21918](astral-sh/uv#21918))

### Bug fixes

- Select package versions with wheels compatible with each Python
resolution fork, correctly interpreting generic and stable-ABI wheel
tags ([#21835](astral-sh/uv#21835),
[#21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or
`uv version` fails or is interrupted
([#21860](astral-sh/uv#21860),
[#21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed
requirements are satisfied
([#21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths
([#21923](astral-sh/uv#21923))
- Recognize distribution fil… (truncated)

### 0.12.19

## Release Notes

Released on 2026-09-24.

### Python

- Add PyPy 3.11.16 and 3.12.14
([#21847](astral-sh/uv#21847))
- Update GraalPy 3.13.0 to build 25.4.4
([#21847](astral-sh/uv#21847))

### Enhancements

- Format upload URLs with backticks in `uv publish` errors
([#21934](astral-sh/uv#21934))

### Preview features

- Run build-backend hooks with lazy imports on CPython 3.15 and later
using the `build-lazy-imports` preview feature
([#21967](astral-sh/uv#21967))
- Omit unused resolution settings from `uv.lock` and ignore changes to
them when checking lockfile freshness with the `resolution-inputs`
preview feature ([#21913](astral-sh/uv#21913))

### Bug fixes

- Preserve signed and encoded query parameters in direct-URL metadata to
avoid reinstalling unchanged packages
([#21971](astral-sh/uv#21971))
- Recognize `1.0.0` as satisfying `===1` during installed-package
checks, matching resolution
([#21931](astral-sh/uv#21931))
- Avoid collisions between Git checkout readiness markers and `.ok`
files in dependencies
([#21891](astral-sh/uv#21891))
- Preserve always-false `python_version` markers when parsing their
serialized form ([#21939](astral-sh/uv#21939))

### Rust API

- Restore the public `FlatDistributions` export and its `BTreeMap`
conversion for downstream resolvers
([#21965](astral-sh/uv#21965))

### Documentation

- Make individual preview-feature reference entries linkable by name
([#21950](astral-sh/uv#21950))

## Install uv 0.12.19

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -Execut… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Sep 28, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade uv (#112)
135b1d5 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.17` → `0.12.19` | `0.12.17` → `0.12.19` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.17` → `0.12.19` (astral-sh/uv)</summary>

### 0.12.18

## Release Notes

Released on 2026-09-22.

This release addresses
[GHSA-2cv4-cqwr-gwf7](GHSA-2cv4-cqwr-gwf7),
which is a path traversal weakness during wheel installation on Windows.
No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`,
including for `--dry-run` and `--check`
([#21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned
changes without modifying the environment
([#21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in
build errors ([#21881](astral-sh/uv#21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with
`--preview-features build-dependency-check`; use
`--skip-dependency-check` to opt out
([#21880](astral-sh/uv#21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression
from temporary wheels
([#21918](astral-sh/uv#21918))

### Bug fixes

- Select package versions with wheels compatible with each Python
resolution fork, correctly interpreting generic and stable-ABI wheel
tags ([#21835](astral-sh/uv#21835),
[#21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or
`uv version` fails or is interrupted
([#21860](astral-sh/uv#21860),
[#21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed
requirements are satisfied
([#21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths
([#21923](astral-sh/uv#21923))
- Recognize distribution fil… (truncated)

### 0.12.19

## Release Notes

Released on 2026-09-24.

### Python

- Add PyPy 3.11.16 and 3.12.14
([#21847](astral-sh/uv#21847))
- Update GraalPy 3.13.0 to build 25.4.4
([#21847](astral-sh/uv#21847))

### Enhancements

- Format upload URLs with backticks in `uv publish` errors
([#21934](astral-sh/uv#21934))

### Preview features

- Run build-backend hooks with lazy imports on CPython 3.15 and later
using the `build-lazy-imports` preview feature
([#21967](astral-sh/uv#21967))
- Omit unused resolution settings from `uv.lock` and ignore changes to
them when checking lockfile freshness with the `resolution-inputs`
preview feature ([#21913](astral-sh/uv#21913))

### Bug fixes

- Preserve signed and encoded query parameters in direct-URL metadata to
avoid reinstalling unchanged packages
([#21971](astral-sh/uv#21971))
- Recognize `1.0.0` as satisfying `===1` during installed-package
checks, matching resolution
([#21931](astral-sh/uv#21931))
- Avoid collisions between Git checkout readiness markers and `.ok`
files in dependencies
([#21891](astral-sh/uv#21891))
- Preserve always-false `python_version` markers when parsing their
serialized form ([#21939](astral-sh/uv#21939))

### Rust API

- Restore the public `FlatDistributions` export and its `BTreeMap`
conversion for downstream resolvers
([#21965](astral-sh/uv#21965))

### Documentation

- Make individual preview-feature reference entries linkable by name
([#21950](astral-sh/uv#21950))

## Install uv 0.12.19

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -Execut… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Sep 28, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#74)
c245d29 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint
editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek
rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (3 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `pipx:gh-action-pulse` | `1.5.0` → `1.5.3` | `1.5.0` → `1.5.3` |
| `rumdl` | `0.2.74` → `0.2.77` | `0.2.74` → `0.2.77` |
| `uv` | `0.12.17` → `0.12.19` | `0.12.17` → `0.12.19` |

</details>

<details>
<summary>Release notes (2 tools)</summary>

<details>
<summary>rumdl: `0.2.74` → `0.2.77` (rvben/rumdl)</summary>

### v0.2.75

### Added

- **md093**: add opt-in rule for inline formatting in headings
([ed627ef](rvben/rumdl@ed627ef))

### Fixed

- **md013**: add opt-in link text wrapping
([effdb6a](rvben/rumdl@effdb6a))
- **MD013**: protect opt-in bracket display math during reflow
([e2c7fe8](rvben/rumdl@e2c7fe8))
- **MD044**: add opt-in whole-word matching for identifiers
([013621e](rvben/rumdl@013621e))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.75/rumdl-v0.2.75-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.75-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/…
(truncated)

### v0.2.76

### Added

- **MD094**: report each invalid UTF-8 sequence, with its position
([6c25d76](rvben/rumdl@6c25d76))
- **encoding**: lint files containing invalid UTF-8 instead of skipping
them
([f531bf4](rvben/rumdl@f531bf4))

### Fixed

- **MD013**: leave definition lists as written when reflowing, instead
of moving a definition's later paragraph out of the list
([93ab135](rvben/rumdl@93ab135))
- **MD013**: keep every block of consecutive mkdocstrings blocks out of
reflow
([7199b0a](rvben/rumdl@7199b0a))
- **MD013**: recognize mkdocstrings blocks whose identifier has no dot
([31b56ea](rvben/rumdl@31b56ea))
- **cli**: report a skipped file on the same stream as the run's other
findings, not always stderr
([9558bc5](rvben/rumdl@9558bc5))
- **MD092**: follow the invocation's rule selection
([b0dfbe2](rvben/rumdl@b0dfbe2))
- **lint-context**: record only CommonMark headings as headings
([1479a1e](rvben/rumdl@1479a1e))
- **cli**: name every ignore file --respect-gitignore controls
([268a54d](rvben/rumdl@268a54d))
- **discovery**: attribute empty runs to .markdownlintignore separately
([834e10c](rvben/rumdl@834e10c))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.76/rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 | [checksum](https://gith… (truncated)

### v0.2.77

### Fixed

- **release**: never replace published GitHub Release assets
([471d97e](rvben/rumdl@471d97e))

### Performance

- **release**: cut published wheel size 6% with fat LTO
([7605780](rvben/rumdl@7605780))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.77-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz)
| macOS x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.77/rumdl-v0.2.77-x86_64-apple-darwin.tar.gz.sha256)
|
|
[rumdl-v0.2.77-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/…
(truncated)

</details>
<details>
<summary>uv: `0.12.17` → `0.12.19` (astral-sh/uv)</summary>

### 0.12.18

## Release Notes

Released on 2026-09-22.

This release addresses
[GHSA-2cv4-cqwr-gwf7](GHSA-2cv4-cqwr-gwf7),
which is a path traversal weakness during wheel installation on Windows.
No other platforms are affected by this advisory.

### Enhancements

- Add `--output-format json` to `uv pip install` and `uv pip sync`,
including for `--dry-run` and `--check`
([#21893](astral-sh/uv#21893))
- Add `--check` to `uv pip install` and `uv pip sync` to report planned
changes without modifying the environment
([#21844](astral-sh/uv#21844))
- Identify failures from `get_requires_for_build_*` hooks correctly in
build errors ([#21881](astral-sh/uv#21881))

### Preview features

- Validate build requirements for `uv build --no-build-isolation` with
`--preview-features build-dependency-check`; use
`--skip-dependency-check` to opt out
([#21880](astral-sh/uv#21880))

### Performance

- Speed up `uv_build` editable wheel creation by omitting compression
from temporary wheels
([#21918](astral-sh/uv#21918))

### Bug fixes

- Select package versions with wheels compatible with each Python
resolution fork, correctly interpreting generic and stable-ABI wheel
tags ([#21835](astral-sh/uv#21835),
[#21836](astral-sh/uv#21836))
- Restore project, script, and lock files when `uv add`, `uv remove`, or
`uv version` fails or is interrupted
([#21860](astral-sh/uv#21860),
[#21856](astral-sh/uv#21856))
- Use configured `dependency-metadata` when checking whether installed
requirements are satisfied
([#21843](astral-sh/uv#21843))
- Reject archive entries that normalize to absolute Windows paths
([#21923](astral-sh/uv#21923))
- Recognize distribution fil… (truncated)

### 0.12.19

## Release Notes

Released on 2026-09-24.

### Python

- Add PyPy 3.11.16 and 3.12.14
([#21847](astral-sh/uv#21847))
- Update GraalPy 3.13.0 to build 25.4.4
([#21847](astral-sh/uv#21847))

### Enhancements

- Format upload URLs with backticks in `uv publish` errors
([#21934](astral-sh/uv#21934))

### Preview features

- Run build-backend hooks with lazy imports on CPython 3.15 and later
using the `build-lazy-imports` preview feature
([#21967](astral-sh/uv#21967))
- Omit unused resolution settings from `uv.lock` and ignore changes to
them when checking lockfile freshness with the `resolution-inputs`
preview feature ([#21913](astral-sh/uv#21913))

### Bug fixes

- Preserve signed and encoded query parameters in direct-URL metadata to
avoid reinstalling unchanged packages
([#21971](astral-sh/uv#21971))
- Recognize `1.0.0` as satisfying `===1` during installed-package
checks, matching resolution
([#21931](astral-sh/uv#21931))
- Avoid collisions between Git checkout readiness markers and `.ok`
files in dependencies
([#21891](astral-sh/uv#21891))
- Preserve always-false `python_version` markers when parsing their
serialized form ([#21939](astral-sh/uv#21939))

### Rust API

- Restore the public `FlatDistributions` export and its `BTreeMap`
conversion for downstream resolvers
([#21965](astral-sh/uv#21965))

### Documentation

- Make individual preview-feature reference entries linkable by name
([#21950](astral-sh/uv#21950))

## Install uv 0.12.19

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -Execut… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This branch was successfully deployed

1 active deployment
automations — 16e7d01e Deployed Sep 22, 2026 by astral-automations-bot[bot] via review / security review #47404
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@charliermarsh charliermarsh charliermarsh approved these changes
@woodruffw woodruffw woodruffw approved these changes

Assignees

@woodruffw woodruffw

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@charliermarsh @woodruffw