Repository navigation
Avoid JSON imports when querying Python interpreters - #2790
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2790 +/- ##
==========================================
+ Coverage 94.23% 94.26% +0.02%
==========================================
Files 142 142
Lines 30729 30747 +18
==========================================
+ Hits 28959 28985 +26
+ Misses 1770 1762 -8 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
📦 Cargo Bloat Comparison
Expand for cargo-bloat outputHead Branch ResultsBase Branch Results |
⚡️ Hyperfine BenchmarksSummary: 0 regressions, 0 improvements above the 10% threshold. Environment
CLI CommandsBenchmarking basic commands in the main repo:
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base --version |
2.2 ± 0.1 | 2.1 | 2.6 | 1.03 ± 0.07 |
prek-head --version |
2.1 ± 0.1 | 2.0 | 2.6 | 1.00 |
prek list
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base list |
8.9 ± 0.1 | 8.7 | 9.2 | 1.00 |
prek-head list |
9.0 ± 0.1 | 8.8 | 9.3 | 1.01 ± 0.01 |
prek validate-config .pre-commit-config.yaml
⏭️ Skipped: .pre-commit-config.yaml not found
prek sample-config
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base sample-config |
2.5 ± 0.1 | 2.4 | 3.2 | 1.02 ± 0.05 |
prek-head sample-config |
2.5 ± 0.1 | 2.4 | 2.6 | 1.00 |
Cold vs Warm Runs
Comparing first run (cold) vs subsequent runs (warm cache):
prek run --all-files (cold - no cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
19.4 ± 1.2 | 18.3 | 22.1 | 1.03 ± 0.07 |
prek-head run --all-files |
18.8 ± 0.3 | 18.4 | 19.4 | 1.00 |
prek run --all-files (warm - with cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
18.6 ± 0.2 | 18.0 | 19.0 | 1.00 |
prek-head run --all-files |
18.8 ± 0.4 | 18.4 | 20.5 | 1.01 ± 0.03 |
Full Hook Suite
Running the builtin hook suite on the benchmark workspace:
prek run --all-files (full builtin hook suite)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --all-files |
18.9 ± 0.3 | 18.3 | 19.7 | 1.00 ± 0.02 |
prek-head run --all-files |
18.9 ± 0.3 | 18.1 | 19.6 | 1.00 |
Individual Hook Performance
Benchmarking each hook individually on the test repo:
prek run trailing-whitespace --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run trailing-whitespace --all-files |
8.1 ± 0.1 | 7.9 | 8.4 | 1.01 ± 0.02 |
prek-head run trailing-whitespace --all-files |
8.1 ± 0.1 | 7.8 | 8.2 | 1.00 |
prek run end-of-file-fixer --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run end-of-file-fixer --all-files |
7.4 ± 0.1 | 7.2 | 7.5 | 1.00 |
prek-head run end-of-file-fixer --all-files |
7.4 ± 0.1 | 7.3 | 7.6 | 1.00 ± 0.01 |
prek run check-json --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-json --all-files |
6.6 ± 0.3 | 6.4 | 7.8 | 1.02 ± 0.04 |
prek-head run check-json --all-files |
6.5 ± 0.1 | 6.4 | 6.6 | 1.00 |
prek run check-yaml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-yaml --all-files |
6.8 ± 0.1 | 6.7 | 7.4 | 1.01 ± 0.02 |
prek-head run check-yaml --all-files |
6.8 ± 0.1 | 6.6 | 6.9 | 1.00 |
prek run check-toml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-toml --all-files |
6.6 ± 0.1 | 6.5 | 6.7 | 1.00 |
prek-head run check-toml --all-files |
6.6 ± 0.1 | 6.4 | 6.7 | 1.00 ± 0.01 |
prek run check-xml --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-xml --all-files |
7.4 ± 0.3 | 7.1 | 8.3 | 1.00 |
prek-head run check-xml --all-files |
7.5 ± 0.5 | 7.0 | 9.2 | 1.02 ± 0.08 |
prek run detect-private-key --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run detect-private-key --all-files |
7.0 ± 0.1 | 6.8 | 7.2 | 1.00 ± 0.02 |
prek-head run detect-private-key --all-files |
7.0 ± 0.1 | 6.8 | 7.2 | 1.00 |
prek run fix-byte-order-marker --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run fix-byte-order-marker --all-files |
7.1 ± 0.3 | 6.9 | 8.5 | 1.02 ± 0.05 |
prek-head run fix-byte-order-marker --all-files |
7.0 ± 0.1 | 6.8 | 7.1 | 1.00 |
Installation Performance
Benchmarking hook installation (fast path hooks skip Python setup):
prek install-hooks (cold - no cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base install-hooks |
4.4 ± 0.0 | 4.3 | 4.4 | 1.01 ± 0.02 |
prek-head install-hooks |
4.3 ± 0.1 | 4.3 | 4.4 | 1.00 |
prek install-hooks (warm - with cache)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base install-hooks |
4.4 ± 0.1 | 4.3 | 4.4 | 1.00 |
prek-head install-hooks |
4.4 ± 0.1 | 4.4 | 4.5 | 1.01 ± 0.02 |
File Filtering/Scoping Performance
Testing different file selection modes:
prek run (staged files only)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run |
19.4 ± 0.2 | 19.2 | 19.9 | 1.00 |
prek-head run |
19.6 ± 0.2 | 19.3 | 20.1 | 1.01 ± 0.01 |
prek run --files '*.json' (specific file type)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --files '*.json' |
5.1 ± 0.1 | 5.0 | 5.3 | 1.01 ± 0.02 |
prek-head run --files '*.json' |
5.1 ± 0.1 | 4.9 | 5.2 | 1.00 |
Workspace Discovery & Initialization
Benchmarking hook discovery and initialization overhead:
prek run --dry-run --all-files (measures init overhead)
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run --dry-run --all-files |
6.7 ± 0.1 | 6.6 | 6.8 | 1.00 |
prek-head run --dry-run --all-files |
6.7 ± 0.1 | 6.6 | 6.8 | 1.00 ± 0.01 |
Meta Hooks Performance
Benchmarking meta hooks separately:
prek run check-hooks-apply --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-hooks-apply --all-files |
7.9 ± 0.1 | 7.8 | 8.0 | 1.00 ± 0.01 |
prek-head run check-hooks-apply --all-files |
7.9 ± 0.1 | 7.8 | 8.0 | 1.00 |
prek run check-useless-excludes --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run check-useless-excludes --all-files |
7.8 ± 0.1 | 7.7 | 8.1 | 1.00 |
prek-head run check-useless-excludes --all-files |
7.8 ± 0.1 | 7.7 | 8.0 | 1.00 ± 0.02 |
prek run identity --all-files
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
prek-base run identity --all-files |
6.9 ± 0.1 | 6.8 | 7.1 | 1.01 ± 0.02 |
prek-head run identity --all-files |
6.8 ± 0.1 | 6.8 | 6.9 | 1.00 |
Automated mise tool upgrades from local config. mise-managed tools: - `prek` Command: `mise upgrade --bump --local prek` <details> <summary>Version changelog (prek)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `prek` | `0.5.4` → `0.5.5` | `0.5.4` → `0.5.5` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>prek: `0.5.4` → `0.5.5` (j178/prek)</summary> ### v0.5.5 ## Release Notes Released on 2026-10-05. ### Enhancements - Add Nushell completion generation ([#2785](j178/prek#2785)) - Add `ppc64le` wheel and binary builds ([#2809](j178/prek#2809)) ### Performance - Avoid JSON imports when querying Python interpreters ([#2790](j178/prek#2790)) - Avoid duplicate diffs after hooks rewrite files ([#2815](j178/prek#2815)) - Batch file reads in shebang checks ([#2793](j178/prek#2793)) - Check cached hook environments concurrently ([#2797](j178/prek#2797)) - Overlap Git discovery with worktree status checks ([#2821](j178/prek#2821)) - Query staged additions only for case conflicts ([#2802](j178/prek#2802)) - Reduce worker overhead in XML and pygrep checks ([#2789](j178/prek#2789)) - Reuse Git worktree state during hook startup ([#2787](j178/prek#2787)) - Reuse intent-to-add paths when saving unstaged changes ([#2788](j178/prek#2788)) - Run Git queries concurrently for case-conflict checks ([#2792](j178/prek#2792)) - Share Bun and Deno version queries across environments ([#2795](j178/prek#2795)) - Share Lua runtime probes across hook environments ([#2796](j178/prek#2796)) - Share Ruby version queries across hook environments ([#2794](j178/prek#2794)) - Share mise version queries across hook environments ([#2798](j178/prek#2798)) - Skip site initialization in Python interpreter probes ([#2822](j178/prek#2822)) - Skip untracked files in destroyed symlink checks ([#2799](j178/prek#2799)) - Skip unused file input for always-run hooks ([#2813](j178/prek#2813)) ### Bug fixe… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `pipx:gh-action-pulse` | `1.5.3` → `1.5.4` | `1.5.3` → `1.5.4` | | `prek` | `0.5.4` → `0.5.5` | `0.5.4` → `0.5.5` | | `rumdl` | `0.2.78` → `0.2.79` | `0.2.78` → `0.2.79` | | `tombi` | `1.7.1` → `1.8.1` | `1.7.1` → `1.8.1` | | `uv` | `0.12.23` → `0.13.0` | `0.12.23` → `0.13.0` | </details> <details> <summary>Release notes (4 tools)</summary> <details> <summary>prek: `0.5.4` → `0.5.5` (j178/prek)</summary> ### v0.5.5 ## Release Notes Released on 2026-10-05. ### Enhancements - Add Nushell completion generation ([#2785](j178/prek#2785)) - Add `ppc64le` wheel and binary builds ([#2809](j178/prek#2809)) ### Performance - Avoid JSON imports when querying Python interpreters ([#2790](j178/prek#2790)) - Avoid duplicate diffs after hooks rewrite files ([#2815](j178/prek#2815)) - Batch file reads in shebang checks ([#2793](j178/prek#2793)) - Check cached hook environments concurrently ([#2797](j178/prek#2797)) - Overlap Git discovery with worktree status checks ([#2821](j178/prek#2821)) - Query staged additions only for case conflicts ([#2802](j178/prek#2802)) - Reduce worker overhead in XML and pygrep checks ([#2789](j178/prek#2789)) - Reuse Git worktree state during hook startup ([#2787](j178/prek#2787)) - Reuse intent-to-add paths when saving unstaged changes ([#2788](j178/prek#2788)) - Run Git queries concurrently for case-conflict checks ([#2792](j178/prek#2792)) - Share Bun and Deno version queries across environments ([#2795](j178/prek#2795)) - Share Lua runtime probes across hook environments ([#2796](j178/prek#2796)) - Share Ruby version queries across hook environments ([#2794](j178/prek#2794)) - Share mise version queries across hook environments ([#2798](j178/prek#2798)) - Skip site initialization in Python interpreter probes ([#2822](j178/prek#2822)) - Skip untracked files in destroyed symlink checks ([#2799](j178/prek#2799)) - Skip unused file input for always-run hooks ([#2813](j178/prek#2813)) ### Bug fixe… (truncated) </details> <details> <summary>rumdl: `0.2.78` → `0.2.79` (rvben/rumdl)</summary> ### v0.2.79 ### Added - **MD095**: detect confusable link destinations with accurate source spans ([7937059](rvben/rumdl@7937059)) - **MD060**: add stable configurable table-cell padding ([b2323fd](rvben/rumdl@b2323fd)) - **MD013**: add opt-in sentence-pack reflow (#915) ([d736ced](rvben/rumdl@d736ced)) - **code-block-tools**: add format-mode = "pipeline" to chain formatters ([b1da3de](rvben/rumdl@b1da3de)) - **docs**: add question search and aggregate usage tracking ([aaabeaa](rvben/rumdl@aaabeaa)) ### Fixed - **MD013**: count only rewritten prose in list sentence warnings ([276f266](rvben/rumdl@276f266)) - **MD013**: preserve reflow structure and expand scheduled fuzz coverage ([73a9731](rvben/rumdl@73a9731)) - **MD013**: preserve source sentence breaks and emphasis step labels ([042d304](rvben/rumdl@042d304)) - **MD013**: keep emphasized step labels within their sentence ([c1d1073](rvben/rumdl@c1d1073)) - **MD013**: keep a deep continuation line from setting a list item's indent ([fc8cacd](rvben/rumdl@fc8cacd)) - **MD013**: preserve document structure during reflow ([79e8b95](rvben/rumdl@79e8b95)) - preserve Markdown content across lint fixes ([37dc5e7](rvben/rumdl@37dc5e7)) - **MD013**: read the code spans of a paragraph whose first line is indented ([4879938](htt… (truncated) </details> <details> <summary>tombi: `1.7.1` → `1.8.1` (tombi-toml/tombi)</summary> ### v1.7.2 <!-- Release notes generated using configuration in .github/release.yml at v1.7.2 --> ## What's Changed ### 🛠️ Other Changes * fix(lsp): show per-value descriptions of oneOf/anyOf const enums consistently by @ya7010 in tombi-toml/tombi#2268 **Full Changelog**: tombi-toml/tombi@v1.7.1...v1.7.2 ### v1.7.3 <!-- Release notes generated using configuration in .github/release.yml at v1.7.3 --> ## What's Changed ### 🦅 New Features * feat: fetch private GitHub schemas using local credentials by @ya7010 in tombi-toml/tombi#2273 ### 🐝 Bug Fixes * fix(pyproject): enforce required metadata constraints by @ya7010 in tombi-toml/tombi#2271 * fix(pyproject): align schema with mandatory metadata rules by @ya7010 in tombi-toml/tombi#2272 **Full Changelog**: tombi-toml/tombi@v1.7.2...v1.7.3 ### v1.8.0 <!-- Release notes generated using configuration in .github/release.yml at v1.8.0 --> ## What's Changed ### 🦅 New Features * feat(config): add global schema deprecation severity by @ya7010 in tombi-toml/tombi#2278 * feat(config): add global schema format rules by @ya7010 in tombi-toml/tombi#2284 ### 🛠️ Other Changes * fix(lsp): reload config changed outside the editor by @ya7010 in tombi-toml/tombi#2280 * fix(lsp): reload local schema files changed outside the editor by @ya7010 in tombi-toml/tombi#2281 * fix(schema-store): block schema fetches to non-public addresses by @ya7010 in tombi-toml/tombi#2283 * docs(formatter): explain disabling auto sorting globally by @ya7010 in tombi-toml/tombi#2285 * fix(deps): bump seroval, source-map-js and vue overrides by @ya7010 in tombi-toml/tombi#2286 **Full Changelog**: tombi-toml/tombi@v1.7.3...v1.8.0 ### v1.8.1 <!-- Release notes generated using configuration in .github/release.yml at v1.8.1 --> ## What's Changed ### 🦅 New Features * feat(lsp): fold `# region` / `# endregion` comment markers by @ya7010 in tombi-toml/tombi#2290 ### 🛠️ Other Changes * refactor(schema-store): make SchemaStore options immutable by @ya7010 in tombi-toml/tombi#2289 **Full Changelog**: tombi-toml/tombi@v1.8.0...v1.8.1 </details> <details> <summary>uv: `0.12.23` → `0.13.0` (astral-sh/uv)</summary> ### 0.12.24 ## Release Notes Released on 2026-10-08. ### Enhancements - Remove orphaned temporary build environments with `uv cache prune` ([#22171](astral-sh/uv#22171)) - Accept PEP 508 marker operators directly before grouped expressions ([#22309](astral-sh/uv#22309)) - Reject malformed requirements-file options instead of partially parsing or ignoring them ([#22317](astral-sh/uv#22317)) - Show underlying filesystem and registry errors when managed Python uninstallation fails ([#22362](astral-sh/uv#22362)) - Identify the invalid source URL in Python mirror errors ([#22364](astral-sh/uv#22364)) ### Preview features - Display preferred advisory IDs in `uv audit` reports, prioritizing PYSEC, GHSA, then CVE identifiers ([#22292](astral-sh/uv#22292)) ### Configuration - Support custom installation mirrors for GraalPy ([#22269](astral-sh/uv#22269)) - Support custom installation mirrors for Pyodide ([#22271](astral-sh/uv#22271)) - Allow `UV_NO_CACHE=false` to override `no-cache = true` in configuration ([#22324](astral-sh/uv#22324)) - Report more precise error locations for invalid trusted-host ports and preview-feature list entries ([#22144](astral-sh/uv#22144)) ### Performance - Speed up later commands after creating an environment by warming its interpreter cache ([#21304](astral-sh/uv#21304)) - Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages ([#22246](astral-sh/uv#22246)) - Enforce resource limits when parsing package indexes and `--find-links` pages with `astral-html` ([#22203](astral-sh/uv#22203)) - Reduce standalone `uv-build` executable size by 7.5% by omitting unused Zstandard support ([#22242](https:/… (truncated) ### 0.13.0 ## Release Notes Released on 2026-10-09. uv 0.13.0 makes Python 3.15 the default stable Python version. We've also included several breaking changes to improve correctness, performance, and compatibility, described below. **We expect most users to be able to upgrade without making changes.** While not a breaking change, this release also updates the format of many of uv's cache entries to improve performance. **uv may download or rebuild dependencies after upgrading**, because some cached entries from earlier versions cannot be reused. Multiple versions of uv can still safely share the same cache directory. There are no breaking changes to the configuration of the [uv build backend](https://docs.astral.sh/uv/concepts/build-backend/). If your `[build-system]` table includes an upper bound on `uv_build`, update it to allow `uv_build` 0.13, e.g., `uv_build>=0.13.0,<0.14`. ### Breaking changes - **Use Python 3.15 as the default stable version** The default stable Python version has changed from 3.14 to 3.15. This affects Python downloads when no version is requested or pinned, e.g., when running `uv python install`. uv continues to use compatible Python installations that are already present. For example, `uv venv` can still use an installed Python 3.14. If no suitable interpreter is installed and automatic downloads are enabled, commands such as `uv venv` and `uvx python` can now download Python 3.15. You can opt out of this behavior by requesting Python 3.14 explicitly, e.g., `uv venv --python 3.14`. For projects, use `uv python pin 3.14` to record the version in `.python-version`. - **Honor `--require-hashes` in included constraints files** ([#22275](astral-sh/uv#22275)) Previously, uv ignored `--require-hashes` in constraints files included with `-c` from a requirements file. Now, uv honors the directive and requires hashes for all requirements in the installation. Installs that previously succeeded can now fa… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (6 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.0.2` → `2.1.0` | `2.0.2` → `2.1.0` |
| `pipx:gh-action-pulse` | `1.5.3` → `1.5.4` | `1.5.3` → `1.5.4` |
| `prek` | `0.5.4` → `0.5.5` | `0.5.4` → `0.5.5` |
| `rumdl` | `0.2.78` → `0.2.79` | `0.2.78` → `0.2.79` |
| `tombi` | `1.7.1` → `1.8.1` | `1.7.1` → `1.8.1` |
| `uv` | `0.12.23` → `0.13.0` | `0.12.23` → `0.13.0` |
</details>
<details>
<summary>Release notes (5 tools)</summary>
<details>
<summary>jactionlint: `2.0.2` → `2.1.0` (jdx/jactionlint)</summary>
### v2.1.0
jactionlint 2.1.0 adds an environment variable that turns on the online
checks, a new `workflow-secret-scope` rule, and machine-readable reasons
when a finding has no fix. Many security rules now produce fewer false
positives, especially in reusable workflows and release pipelines. Some
rules now report things they did not report before, so an existing clean
run can show new findings (see **Changed**).
## Added
- **`JACTIONLINT_ONLINE` environment variable.** It turns on the online
checks without changing the command, so CI can run them while local
pre-commit hooks stay offline. `1`, `true` or `on` works like
`--online`, and `cache`, `strict` or `cache,strict` select a mode. `0`,
`false`, `off` or `no` works like `--no-online` and overrides `online:
true` in the config file. The `--online`/`--no-online` flags override
the variable, and the variable overrides the config file. An invalid
value exits with status 2. (#155, @jdx)
```yaml
- run: hk check --all
env:
JACTIONLINT_ONLINE: 1
GITHUB_TOKEN: ${{ github.token }}
```
- **New `workflow-secret-scope` rule** (security, pedantic profile,
warning, no autofix). It reports a named secret in workflow-level `env:`
when steps in two or more jobs can see it. The rule skips single-job
workflows, `GITHUB_TOKEN`, jobs or steps that override the variable, and
jobs that call reusable workflows. (#136, @jdx)
- **`background-step-not-waited`** (correctness profile, from
`parallel-steps`). It reports reads of a background step's `outputs`,
`outcome` or `conclusion` before a `wait` or `wait-all` covers that
step. Those reads evaluate to an empty string. Steps with `background:
${{ ... }}` are not tracked. (#132, @jdx)
- **Reasons for missing fixes.** When a fixable rule has no fix for a
finding, the finding now says why. This applies to `missing-timeout`,
`dependabot-cooldown`, `unpinned-uses`, `template-injection` and
`artipacked`. The reason appears as `no_fix` in JSON and template
output, and… (truncated)
</details>
<details>
<summary>prek: `0.5.4` → `0.5.5` (j178/prek)</summary>
### v0.5.5
## Release Notes
Released on 2026-10-05.
### Enhancements
- Add Nushell completion generation
([#2785](j178/prek#2785))
- Add `ppc64le` wheel and binary builds
([#2809](j178/prek#2809))
### Performance
- Avoid JSON imports when querying Python interpreters
([#2790](j178/prek#2790))
- Avoid duplicate diffs after hooks rewrite files
([#2815](j178/prek#2815))
- Batch file reads in shebang checks
([#2793](j178/prek#2793))
- Check cached hook environments concurrently
([#2797](j178/prek#2797))
- Overlap Git discovery with worktree status checks
([#2821](j178/prek#2821))
- Query staged additions only for case conflicts
([#2802](j178/prek#2802))
- Reduce worker overhead in XML and pygrep checks
([#2789](j178/prek#2789))
- Reuse Git worktree state during hook startup
([#2787](j178/prek#2787))
- Reuse intent-to-add paths when saving unstaged changes
([#2788](j178/prek#2788))
- Run Git queries concurrently for case-conflict checks
([#2792](j178/prek#2792))
- Share Bun and Deno version queries across environments
([#2795](j178/prek#2795))
- Share Lua runtime probes across hook environments
([#2796](j178/prek#2796))
- Share Ruby version queries across hook environments
([#2794](j178/prek#2794))
- Share mise version queries across hook environments
([#2798](j178/prek#2798))
- Skip site initialization in Python interpreter probes
([#2822](j178/prek#2822))
- Skip untracked files in destroyed symlink checks
([#2799](j178/prek#2799))
- Skip unused file input for always-run hooks
([#2813](j178/prek#2813))
### Bug fixe… (truncated)
</details>
<details>
<summary>rumdl: `0.2.78` → `0.2.79` (rvben/rumdl)</summary>
### v0.2.79
### Added
- **MD095**: detect confusable link destinations with accurate source
spans
([7937059](rvben/rumdl@7937059))
- **MD060**: add stable configurable table-cell padding
([b2323fd](rvben/rumdl@b2323fd))
- **MD013**: add opt-in sentence-pack reflow (#915)
([d736ced](rvben/rumdl@d736ced))
- **code-block-tools**: add format-mode = "pipeline" to chain formatters
([b1da3de](rvben/rumdl@b1da3de))
- **docs**: add question search and aggregate usage tracking
([aaabeaa](rvben/rumdl@aaabeaa))
### Fixed
- **MD013**: count only rewritten prose in list sentence warnings
([276f266](rvben/rumdl@276f266))
- **MD013**: preserve reflow structure and expand scheduled fuzz
coverage
([73a9731](rvben/rumdl@73a9731))
- **MD013**: preserve source sentence breaks and emphasis step labels
([042d304](rvben/rumdl@042d304))
- **MD013**: keep emphasized step labels within their sentence
([c1d1073](rvben/rumdl@c1d1073))
- **MD013**: keep a deep continuation line from setting a list item's
indent
([fc8cacd](rvben/rumdl@fc8cacd))
- **MD013**: preserve document structure during reflow
([79e8b95](rvben/rumdl@79e8b95))
- preserve Markdown content across lint fixes
([37dc5e7](rvben/rumdl@37dc5e7))
- **MD013**: read the code spans of a paragraph whose first line is
indented ([4879938](htt… (truncated)
</details>
<details>
<summary>tombi: `1.7.1` → `1.8.1` (tombi-toml/tombi)</summary>
### v1.7.2
<!-- Release notes generated using configuration in .github/release.yml
at v1.7.2 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): show per-value descriptions of oneOf/anyOf const enums
consistently by @ya7010 in
tombi-toml/tombi#2268
**Full Changelog**:
tombi-toml/tombi@v1.7.1...v1.7.2
### v1.7.3
<!-- Release notes generated using configuration in .github/release.yml
at v1.7.3 -->
## What's Changed
### 🦅 New Features
* feat: fetch private GitHub schemas using local credentials by @ya7010
in tombi-toml/tombi#2273
### 🐝 Bug Fixes
* fix(pyproject): enforce required metadata constraints by @ya7010 in
tombi-toml/tombi#2271
* fix(pyproject): align schema with mandatory metadata rules by @ya7010
in tombi-toml/tombi#2272
**Full Changelog**:
tombi-toml/tombi@v1.7.2...v1.7.3
### v1.8.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.0 -->
## What's Changed
### 🦅 New Features
* feat(config): add global schema deprecation severity by @ya7010 in
tombi-toml/tombi#2278
* feat(config): add global schema format rules by @ya7010 in
tombi-toml/tombi#2284
### 🛠️ Other Changes
* fix(lsp): reload config changed outside the editor by @ya7010 in
tombi-toml/tombi#2280
* fix(lsp): reload local schema files changed outside the editor by
@ya7010 in tombi-toml/tombi#2281
* fix(schema-store): block schema fetches to non-public addresses by
@ya7010 in tombi-toml/tombi#2283
* docs(formatter): explain disabling auto sorting globally by @ya7010
in tombi-toml/tombi#2285
* fix(deps): bump seroval, source-map-js and vue overrides by @ya7010
in tombi-toml/tombi#2286
**Full Changelog**:
tombi-toml/tombi@v1.7.3...v1.8.0
### v1.8.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.1 -->
## What's Changed
### 🦅 New Features
* feat(lsp): fold `# region` / `# endregion` comment markers by @ya7010
in tombi-toml/tombi#2290
### 🛠️ Other Changes
* refactor(schema-store): make SchemaStore options immutable by @ya7010
in tombi-toml/tombi#2289
**Full Changelog**:
tombi-toml/tombi@v1.8.0...v1.8.1
</details>
<details>
<summary>uv: `0.12.23` → `0.13.0` (astral-sh/uv)</summary>
### 0.12.24
## Release Notes
Released on 2026-10-08.
### Enhancements
- Remove orphaned temporary build environments with `uv cache prune`
([#22171](astral-sh/uv#22171))
- Accept PEP 508 marker operators directly before grouped expressions
([#22309](astral-sh/uv#22309))
- Reject malformed requirements-file options instead of partially
parsing or ignoring them
([#22317](astral-sh/uv#22317))
- Show underlying filesystem and registry errors when managed Python
uninstallation fails
([#22362](astral-sh/uv#22362))
- Identify the invalid source URL in Python mirror errors
([#22364](astral-sh/uv#22364))
### Preview features
- Display preferred advisory IDs in `uv audit` reports, prioritizing
PYSEC, GHSA, then CVE identifiers
([#22292](astral-sh/uv#22292))
### Configuration
- Support custom installation mirrors for GraalPy
([#22269](astral-sh/uv#22269))
- Support custom installation mirrors for Pyodide
([#22271](astral-sh/uv#22271))
- Allow `UV_NO_CACHE=false` to override `no-cache = true` in
configuration ([#22324](astral-sh/uv#22324))
- Report more precise error locations for invalid trusted-host ports and
preview-feature list entries
([#22144](astral-sh/uv#22144))
### Performance
- Speed up later commands after creating an environment by warming its
interpreter cache ([#21304](astral-sh/uv#21304))
- Reduce code-signature verification work for ARM64 macOS releases with
16 KiB signature pages
([#22246](astral-sh/uv#22246))
- Enforce resource limits when parsing package indexes and
`--find-links` pages with `astral-html`
([#22203](astral-sh/uv#22203))
- Reduce standalone `uv-build` executable size by 7.5% by omitting
unused Zstandard support ([#22242](https:/… (truncated)
### 0.13.0
## Release Notes
Released on 2026-10-09.
uv 0.13.0 makes Python 3.15 the default stable Python version. We've
also included several breaking changes to improve correctness,
performance, and compatibility, described below.
**We expect most users to be able to upgrade without making changes.**
While not a breaking change, this release also updates the format of
many of uv's cache entries to improve performance. **uv may download or
rebuild dependencies after upgrading**, because some cached entries from
earlier versions cannot be reused. Multiple versions of uv can still
safely share the same cache directory.
There are no breaking changes to the configuration of the [uv build
backend](https://docs.astral.sh/uv/concepts/build-backend/). If your
`[build-system]` table includes an upper bound on `uv_build`, update it
to allow `uv_build` 0.13, e.g., `uv_build>=0.13.0,<0.14`.
### Breaking changes
- **Use Python 3.15 as the default stable version**
The default stable Python version has changed from 3.14 to 3.15. This
affects Python downloads when no version is requested or pinned, e.g.,
when running `uv python install`.
uv continues to use compatible Python installations that are already
present. For example, `uv venv` can still use an installed Python 3.14.
If no suitable interpreter is installed and automatic downloads are
enabled, commands such as `uv venv` and `uvx python` can now download
Python 3.15.
You can opt out of this behavior by requesting Python 3.14 explicitly,
e.g., `uv venv --python 3.14`. For projects, use `uv python pin 3.14` to
record the version in `.python-version`.
- **Honor `--require-hashes` in included constraints files**
([#22275](astral-sh/uv#22275))
Previously, uv ignored `--require-hashes` in constraints files included
with `-c` from a requirements file. Now, uv honors the directive and
requires hashes for all requirements in the installation. Installs that
previously succeeded can now fa… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
---------
Signed-off-by: jylenhof <jygithub@lenhof.eu.org>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: jylenhof <jygithub@lenhof.eu.org>
Automated mise tool upgrades from local config.
mise-managed tools:
- `action-validator`
- `editorconfig-checker`
- `ghalint`
- `jactionlint`
- `lychee`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator
editorconfig-checker ghalint jactionlint lychee pipx:gh-action-pulse
prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (6 tools)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `jactionlint` | `2.0.2` → `2.1.0` | `2.0.2` → `2.1.0` |
| `pipx:gh-action-pulse` | `1.5.3` → `1.5.4` | `1.5.3` → `1.5.4` |
| `prek` | `0.5.4` → `0.5.5` | `0.5.4` → `0.5.5` |
| `rumdl` | `0.2.78` → `0.2.79` | `0.2.78` → `0.2.79` |
| `tombi` | `1.7.1` → `1.8.1` | `1.7.1` → `1.8.1` |
| `uv` | `0.12.23` → `0.13.0` | `0.12.23` → `0.13.0` |
</details>
<details>
<summary>Release notes (5 tools)</summary>
<details>
<summary>jactionlint: `2.0.2` → `2.1.0` (jdx/jactionlint)</summary>
### v2.1.0
jactionlint 2.1.0 adds an environment variable that turns on the online
checks, a new `workflow-secret-scope` rule, and machine-readable reasons
when a finding has no fix. Many security rules now produce fewer false
positives, especially in reusable workflows and release pipelines. Some
rules now report things they did not report before, so an existing clean
run can show new findings (see **Changed**).
## Added
- **`JACTIONLINT_ONLINE` environment variable.** It turns on the online
checks without changing the command, so CI can run them while local
pre-commit hooks stay offline. `1`, `true` or `on` works like
`--online`, and `cache`, `strict` or `cache,strict` select a mode. `0`,
`false`, `off` or `no` works like `--no-online` and overrides `online:
true` in the config file. The `--online`/`--no-online` flags override
the variable, and the variable overrides the config file. An invalid
value exits with status 2. (#155, @jdx)
```yaml
- run: hk check --all
env:
JACTIONLINT_ONLINE: 1
GITHUB_TOKEN: ${{ github.token }}
```
- **New `workflow-secret-scope` rule** (security, pedantic profile,
warning, no autofix). It reports a named secret in workflow-level `env:`
when steps in two or more jobs can see it. The rule skips single-job
workflows, `GITHUB_TOKEN`, jobs or steps that override the variable, and
jobs that call reusable workflows. (#136, @jdx)
- **`background-step-not-waited`** (correctness profile, from
`parallel-steps`). It reports reads of a background step's `outputs`,
`outcome` or `conclusion` before a `wait` or `wait-all` covers that
step. Those reads evaluate to an empty string. Steps with `background:
${{ ... }}` are not tracked. (#132, @jdx)
- **Reasons for missing fixes.** When a fixable rule has no fix for a
finding, the finding now says why. This applies to `missing-timeout`,
`dependabot-cooldown`, `unpinned-uses`, `template-injection` and
`artipacked`. The reason appears as `no_fix` in JSON and template
output, and… (truncated)
</details>
<details>
<summary>prek: `0.5.4` → `0.5.5` (j178/prek)</summary>
### v0.5.5
## Release Notes
Released on 2026-10-05.
### Enhancements
- Add Nushell completion generation
([#2785](j178/prek#2785))
- Add `ppc64le` wheel and binary builds
([#2809](j178/prek#2809))
### Performance
- Avoid JSON imports when querying Python interpreters
([#2790](j178/prek#2790))
- Avoid duplicate diffs after hooks rewrite files
([#2815](j178/prek#2815))
- Batch file reads in shebang checks
([#2793](j178/prek#2793))
- Check cached hook environments concurrently
([#2797](j178/prek#2797))
- Overlap Git discovery with worktree status checks
([#2821](j178/prek#2821))
- Query staged additions only for case conflicts
([#2802](j178/prek#2802))
- Reduce worker overhead in XML and pygrep checks
([#2789](j178/prek#2789))
- Reuse Git worktree state during hook startup
([#2787](j178/prek#2787))
- Reuse intent-to-add paths when saving unstaged changes
([#2788](j178/prek#2788))
- Run Git queries concurrently for case-conflict checks
([#2792](j178/prek#2792))
- Share Bun and Deno version queries across environments
([#2795](j178/prek#2795))
- Share Lua runtime probes across hook environments
([#2796](j178/prek#2796))
- Share Ruby version queries across hook environments
([#2794](j178/prek#2794))
- Share mise version queries across hook environments
([#2798](j178/prek#2798))
- Skip site initialization in Python interpreter probes
([#2822](j178/prek#2822))
- Skip untracked files in destroyed symlink checks
([#2799](j178/prek#2799))
- Skip unused file input for always-run hooks
([#2813](j178/prek#2813))
### Bug fixe… (truncated)
</details>
<details>
<summary>rumdl: `0.2.78` → `0.2.79` (rvben/rumdl)</summary>
### v0.2.79
### Added
- **MD095**: detect confusable link destinations with accurate source
spans
([7937059](rvben/rumdl@7937059))
- **MD060**: add stable configurable table-cell padding
([b2323fd](rvben/rumdl@b2323fd))
- **MD013**: add opt-in sentence-pack reflow (#915)
([d736ced](rvben/rumdl@d736ced))
- **code-block-tools**: add format-mode = "pipeline" to chain formatters
([b1da3de](rvben/rumdl@b1da3de))
- **docs**: add question search and aggregate usage tracking
([aaabeaa](rvben/rumdl@aaabeaa))
### Fixed
- **MD013**: count only rewritten prose in list sentence warnings
([276f266](rvben/rumdl@276f266))
- **MD013**: preserve reflow structure and expand scheduled fuzz
coverage
([73a9731](rvben/rumdl@73a9731))
- **MD013**: preserve source sentence breaks and emphasis step labels
([042d304](rvben/rumdl@042d304))
- **MD013**: keep emphasized step labels within their sentence
([c1d1073](rvben/rumdl@c1d1073))
- **MD013**: keep a deep continuation line from setting a list item's
indent
([fc8cacd](rvben/rumdl@fc8cacd))
- **MD013**: preserve document structure during reflow
([79e8b95](rvben/rumdl@79e8b95))
- preserve Markdown content across lint fixes
([37dc5e7](rvben/rumdl@37dc5e7))
- **MD013**: read the code spans of a paragraph whose first line is
indented ([4879938](htt… (truncated)
</details>
<details>
<summary>tombi: `1.7.1` → `1.8.1` (tombi-toml/tombi)</summary>
### v1.7.2
<!-- Release notes generated using configuration in .github/release.yml
at v1.7.2 -->
## What's Changed
### 🛠️ Other Changes
* fix(lsp): show per-value descriptions of oneOf/anyOf const enums
consistently by @ya7010 in
tombi-toml/tombi#2268
**Full Changelog**:
tombi-toml/tombi@v1.7.1...v1.7.2
### v1.7.3
<!-- Release notes generated using configuration in .github/release.yml
at v1.7.3 -->
## What's Changed
### 🦅 New Features
* feat: fetch private GitHub schemas using local credentials by @ya7010
in tombi-toml/tombi#2273
### 🐝 Bug Fixes
* fix(pyproject): enforce required metadata constraints by @ya7010 in
tombi-toml/tombi#2271
* fix(pyproject): align schema with mandatory metadata rules by @ya7010
in tombi-toml/tombi#2272
**Full Changelog**:
tombi-toml/tombi@v1.7.2...v1.7.3
### v1.8.0
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.0 -->
## What's Changed
### 🦅 New Features
* feat(config): add global schema deprecation severity by @ya7010 in
tombi-toml/tombi#2278
* feat(config): add global schema format rules by @ya7010 in
tombi-toml/tombi#2284
### 🛠️ Other Changes
* fix(lsp): reload config changed outside the editor by @ya7010 in
tombi-toml/tombi#2280
* fix(lsp): reload local schema files changed outside the editor by
@ya7010 in tombi-toml/tombi#2281
* fix(schema-store): block schema fetches to non-public addresses by
@ya7010 in tombi-toml/tombi#2283
* docs(formatter): explain disabling auto sorting globally by @ya7010
in tombi-toml/tombi#2285
* fix(deps): bump seroval, source-map-js and vue overrides by @ya7010
in tombi-toml/tombi#2286
**Full Changelog**:
tombi-toml/tombi@v1.7.3...v1.8.0
### v1.8.1
<!-- Release notes generated using configuration in .github/release.yml
at v1.8.1 -->
## What's Changed
### 🦅 New Features
* feat(lsp): fold `# region` / `# endregion` comment markers by @ya7010
in tombi-toml/tombi#2290
### 🛠️ Other Changes
* refactor(schema-store): make SchemaStore options immutable by @ya7010
in tombi-toml/tombi#2289
**Full Changelog**:
tombi-toml/tombi@v1.8.0...v1.8.1
</details>
<details>
<summary>uv: `0.12.23` → `0.13.0` (astral-sh/uv)</summary>
### 0.12.24
## Release Notes
Released on 2026-10-08.
### Enhancements
- Remove orphaned temporary build environments with `uv cache prune`
([#22171](astral-sh/uv#22171))
- Accept PEP 508 marker operators directly before grouped expressions
([#22309](astral-sh/uv#22309))
- Reject malformed requirements-file options instead of partially
parsing or ignoring them
([#22317](astral-sh/uv#22317))
- Show underlying filesystem and registry errors when managed Python
uninstallation fails
([#22362](astral-sh/uv#22362))
- Identify the invalid source URL in Python mirror errors
([#22364](astral-sh/uv#22364))
### Preview features
- Display preferred advisory IDs in `uv audit` reports, prioritizing
PYSEC, GHSA, then CVE identifiers
([#22292](astral-sh/uv#22292))
### Configuration
- Support custom installation mirrors for GraalPy
([#22269](astral-sh/uv#22269))
- Support custom installation mirrors for Pyodide
([#22271](astral-sh/uv#22271))
- Allow `UV_NO_CACHE=false` to override `no-cache = true` in
configuration ([#22324](astral-sh/uv#22324))
- Report more precise error locations for invalid trusted-host ports and
preview-feature list entries
([#22144](astral-sh/uv#22144))
### Performance
- Speed up later commands after creating an environment by warming its
interpreter cache ([#21304](astral-sh/uv#21304))
- Reduce code-signature verification work for ARM64 macOS releases with
16 KiB signature pages
([#22246](astral-sh/uv#22246))
- Enforce resource limits when parsing package indexes and
`--find-links` pages with `astral-html`
([#22203](astral-sh/uv#22203))
- Reduce standalone `uv-build` executable size by 7.5% by omitting
unused Zstandard support ([#22242](https:/… (truncated)
### 0.13.0
## Release Notes
Released on 2026-10-09.
uv 0.13.0 makes Python 3.15 the default stable Python version. We've
also included several breaking changes to improve correctness,
performance, and compatibility, described below.
**We expect most users to be able to upgrade without making changes.**
While not a breaking change, this release also updates the format of
many of uv's cache entries to improve performance. **uv may download or
rebuild dependencies after upgrading**, because some cached entries from
earlier versions cannot be reused. Multiple versions of uv can still
safely share the same cache directory.
There are no breaking changes to the configuration of the [uv build
backend](https://docs.astral.sh/uv/concepts/build-backend/). If your
`[build-system]` table includes an upper bound on `uv_build`, update it
to allow `uv_build` 0.13, e.g., `uv_build>=0.13.0,<0.14`.
### Breaking changes
- **Use Python 3.15 as the default stable version**
The default stable Python version has changed from 3.14 to 3.15. This
affects Python downloads when no version is requested or pinned, e.g.,
when running `uv python install`.
uv continues to use compatible Python installations that are already
present. For example, `uv venv` can still use an installed Python 3.14.
If no suitable interpreter is installed and automatic downloads are
enabled, commands such as `uv venv` and `uvx python` can now download
Python 3.15.
You can opt out of this behavior by requesting Python 3.14 explicitly,
e.g., `uv venv --python 3.14`. For projects, use `uv python pin 3.14` to
record the version in `.python-version`.
- **Honor `--require-hashes` in included constraints files**
([#22275](astral-sh/uv#22275))
Previously, uv ignored `--require-hashes` in constraints files included
with `-c` from a requirements file. Now, uv honors the directive and
requires hashes for all requirements in the installation. Installs that
previously succeeded can now fa… (truncated)
</details>
</details>
Modified files:
- `.mise.toml`
---------
Signed-off-by: jylenhof <jygithub@lenhof.eu.org>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: jylenhof <jygithub@lenhof.eu.org>
Query interpreter versions and installation paths without importing
jsonin Python and pygrep health checks. Preserve UTF-8 paths, including embedded newlines and trailing whitespace.