cargo-audit

https://github.com/cargo-bins/cargo-binstall/pull/2533 has been released
in 1.18.1.

.github/.cspell/project-dictionary.txt

@@ -34,7 +34,6 @@ rdme
 sccache
 SHASUMS
 sigstore
-startswith
 syft
 tombi
 udeps

CHANGELOG.md

@@ -10,6 +10,26 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.79.12] - 2026-05-28
+
+- Update `prek@latest` to 0.4.3.
+
+- Remove uses of crates.io API, which potentially cases 403 error.
+
+## [2.79.11] - 2026-05-28
+
+- Update `vacuum@latest` to 0.26.8.
+
+- Update `cargo-nextest@latest` to 0.9.137.
+
+## [2.79.10] - 2026-05-27
+
+- Update `tombi@latest` to 1.1.0.
+
+- Update `prek@latest` to 0.4.2.
+
+- Update `editorconfig-checker@latest` to 3.7.0.
+
 ## [2.79.9] - 2026-05-26
 
 - Update `vacuum@latest` to 0.26.7.
@@ -6658,7 +6678,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.79.9...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.79.12...HEAD
+[2.79.12]: https://github.com/taiki-e/install-action/compare/v2.79.11...v2.79.12
+[2.79.11]: https://github.com/taiki-e/install-action/compare/v2.79.10...v2.79.11
+[2.79.10]: https://github.com/taiki-e/install-action/compare/v2.79.9...v2.79.10
 [2.79.9]: https://github.com/taiki-e/install-action/compare/v2.79.8...v2.79.9
 [2.79.8]: https://github.com/taiki-e/install-action/compare/v2.79.7...v2.79.8
 [2.79.7]: https://github.com/taiki-e/install-action/compare/v2.79.6...v2.79.7

action.yml

@@ -4,8 +4,8 @@ description: GitHub Action for installing development tools
 inputs:
   tool:
     description: Tools to install (whitespace or comma separated list)
-    required: true
-    # default: #publish:tool
+    required: false
+    default: cargo-audit
   checksum:
     description: Whether to enable checksums (strongly discouraged to disable)
     required: false

main.sh

@@ -254,29 +254,6 @@ read_manifest() {
     exact_version="${version}"
   else
     manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
-    if [[ "${rust_crate}" != "null" ]]; then
-      # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
-      case "${tool}" in
-        cargo-nextest)
-          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
-          if [[ -n "${crate_info}" ]]; then
-            while true; do
-              yanked=$(jq -r --arg version "${exact_version}" '.versions[] | select(.num == $version) | .yanked' <<<"${crate_info}")
-              if [[ "${yanked}" != "true" ]]; then
-                break
-              fi
-              previous_stable_version=$(jq -r '.previous_stable_version' <<<"${manifest}")
-              if [[ "${previous_stable_version}" == "null" ]]; then
-                break
-              fi
-              info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
-              exact_version="${previous_stable_version}"
-              manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
-            done
-          fi
-          ;;
-      esac
-    fi
   fi
 
   case "${host_os}" in
@@ -1090,66 +1067,18 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
     cargo-binstall)
       install_cargo_binstall
       # By default, cargo-binstall enforce downloads over secure transports only.
-      # As a result, http will be disabled, and it will also set
-      # min tls version to be 1.2
+      # As a result, http will be disabled, and it will also set min tls version
+      # to be 1.2
       binstall_args=(
         --force
         --no-confirm
         --locked
-        # Since the build script can access the token when `cargo install` is called
-        # within `cargo-binstall`, disables building from source in cargo-binstall
-        # and fallback to `cargo install` which doesn't need the token.
-        # TODO: once https://github.com/cargo-bins/cargo-binstall/pull/2533 merged,
-        # we can remove this and use batch install again.
-        --disable-strategies compile
       )
-      unsupported_tools2=()
-      for tool in "${unsupported_tools[@]}"; do
-        if [[ -n "${token}" ]]; then
-          if ! GITHUB_TOKEN="${token}" cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
-            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
-            unsupported_tools2+=("${tool}")
-          fi
-        else
-          if ! cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
-            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
-            unsupported_tools2+=("${tool}")
-          fi
-        fi
-      done
-      if [[ ${#unsupported_tools2[@]} -gt 0 ]]; then
-        for tool in "${unsupported_tools2[@]}"; do
-          # This logic is from cache-cargo-install-action.
-          cargo_args=(--locked)
-          if [[ "${tool}" == *"@"* ]]; then
-            version="${tool#*@}"
-            tool="${tool%@*}"
-            if [[ ! "${version}" =~ ^([1-9][0-9]*\.[0-9]+\.[0-9]+|0\.[1-9][0-9]*\.[0-9]+|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
-              if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
-                bail "install-action does not support non-semver version: '${version}'"
-              fi
-              crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${tool}")
-              if [[ ! "${version}" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
-                bail "install-action does not support non-semver version: '${version}'"
-              fi
-              # shellcheck disable=SC2207
-              versions=($(jq -r --arg start "${version}." '.versions[] | select(.num | startswith($start)) | select(.yanked == false) | .num' <<<"${crate_info}"))
-              full_version=''
-              for v in ${versions[@]+"${versions[@]}"}; do
-                if [[ "${v}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z\.-]+)?$ ]]; then
-                  full_version="${v}"
-                  break
-                fi
-              done
-              if [[ -z "${full_version}" ]]; then
-                bail "no stable version found for ${tool} that match with '${version}.*'; if you want to install a pre-release version, please specify the full version"
-              fi
-              version="${full_version}"
-            fi
-            cargo_args+=(--version "${version}")
-          fi
-          cargo install "${cargo_args[@]}" "${tool}"
-        done
+      if [[ -n "${token}" ]]; then
+        GITHUB_TOKEN="${token}" \
+          cargo-binstall binstall "${binstall_args[@]}" "${unsupported_tools[@]}"
+      else
+        cargo-binstall binstall "${binstall_args[@]}" "${unsupported_tools[@]}"
       fi
       if [[ -z "${cargo_path}" ]]; then
         _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")

manifests/biome.json

@@ -10,6 +10,44 @@
   "2.4": {
     "version": "2.4.15"
   },
+  "2.4.16": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-linux-x64-musl",
+      "etag": "0x8DEBBF5E5A32262",
+      "hash": "e7102113e10c57772ce969ce088f54ec2cc37331bb4601e5f5369fd94a6fe1d9",
+      "bin": "biome"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-darwin-x64",
+      "etag": "0x8DEBBF5E52310BC",
+      "hash": "42329e159a2f35b3776a01e7a16a53582d53e126fbc55bfdd5825e873a87b338",
+      "bin": "biome"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-win32-x64.exe",
+      "etag": "0x8DEBBF5E5B6BB6E",
+      "hash": "1247239dae8f57aafeaeb9914e30b92efcc51c632eee3be4463a95969558f6a3",
+      "bin": "biome.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-linux-arm64-musl",
+      "etag": "0x8DEBBF5E56DA88F",
+      "hash": "f288ac4e33d35ef08ee333419525df8cf9e74a617447d651a3fad052a9612731",
+      "bin": "biome"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-darwin-arm64",
+      "etag": "0x8DEBBF5E4F81273",
+      "hash": "8cf9e92a161e26bdbfc0896c208864e1de8b160dfb90f61040609c2743cf433b",
+      "bin": "biome"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.16/biome-win32-arm64.exe",
+      "etag": "0x8DEBBF5E55D1958",
+      "hash": "fd0c02ad8b5bbbdd634b22d154b1076ba27624025b6ad1dd62838a179523e919",
+      "bin": "biome.exe"
+    }
+  },
   "2.4.15": {
     "x86_64_linux_musl": {
       "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.15/biome-linux-x64-musl",

manifests/cargo-deny.json

@@ -28,6 +28,28 @@
   "0.19": {
     "version": "0.19.7"
   },
+  "0.19.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEBC9143658A6A",
+      "hash": "70e769ae3872e34d45132b17040859175e11401dc12dddb0303e0b8c7d088f3f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEBC9158C150A8",
+      "hash": "dcd997dd8b7039015cd6f72d4feff64a21f5a6ec905e463751df80e70d82886c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEBC9184A543FA",
+      "hash": "7db40a864ea299304e3a6c1d9f647fa8f554bb0353e181f63955b21c0dc57cd0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEBC914C73B2AC",
+      "hash": "67ef48056523d27f58a527c5e49172bc24758f7b8147998d47219d45b181c354"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEBC9138285055",
+      "hash": "24bbdbe694f9b0cc00b721d94cbd5a8f967eb9a4d2ee99351aa246a69b33ae4f"
+    }
+  },
   "0.19.7": {
     "x86_64_linux_musl": {
       "etag": "0x8DEB7D6F3B4B3A3",

manifests/cargo-nextest.json

@@ -27,10 +27,45 @@
     }
   },
   "latest": {
-    "version": "0.9.136"
+    "version": "0.9.137"
   },
   "0.9": {
-    "version": "0.9.136"
+    "version": "0.9.137"
+  },
+  "0.9.137": {
+    "previous_stable_version": "0.9.136",
+    "x86_64_linux_gnu": {
+      "etag": "0x8DEBB6A74590433",
+      "hash": "38fd6275e111b200bbbed1bd2ae91cbb0d7edd28504879875cff2b3d96f3f311"
+    },
+    "x86_64_linux_musl": {
+      "etag": "0x8DEBB6AC178847F",
+      "hash": "d5a7d2e76a19b65006939e296eb19d776f820cfaa19514c01cf70a5185a885b8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEBB6AF4518457",
+      "hash": "94e89c20b233c29c042683e885131d76abf95e795c355a4fe7d64d4b128b90be"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEBB6B1E0B53E4",
+      "hash": "f32114ae7c9a1718fc95a6e18afb720c3aadc8510d1e838c2a2b60978c8ba464"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DEBB6A9C891E9D",
+      "hash": "8f878903d63a69dd0a8fba65d0dc871043423bd0591076f688023b862d58d1a6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEBB6A7790E2DF",
+      "hash": "cc8a61beed918e1e76f047243f8bb9fc90bad0e6b74b91b2f58b7397f912495a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEBB6B7EBCCCDC",
+      "hash": "27f1c452ee96ba852ba94569dc63ba720c1f209e0150967d3503ec7ced17f431"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEBB6A923FDF58",
+      "hash": "b1c235ea81560d0f0dee36053369ba6c8eda303183ff8603a9776fd28b946495"
+    }
   },
   "0.9.136": {
     "previous_stable_version": "0.9.135",

manifests/editorconfig-checker.json

@@ -2,10 +2,13 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "3.6.1"
+    "version": "3.7.0"
   },
   "3": {
-    "version": "3.6.1"
+    "version": "3.7.0"
+  },
+  "3.7": {
+    "version": "3.7.0"
   },
   "3.7.0": {
     "x86_64_linux_musl": {

manifests/gungraun-runner.json

@@ -28,6 +28,28 @@
   "0.19": {
     "version": "0.19.0"
   },
+  "0.19.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEBC4AE0ECBD5A",
+      "hash": "fadef57834f6b7a3514695eed65fce748efeb1e601073b40de3062df02894102"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DEBC4AE56BAF89",
+      "hash": "b8142d894bcb5bb66f7113b0b5cef4e861cc10399453312c977f9d564fdd951b"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DEBC4AA0A11589",
+      "hash": "96a3118c55ee7ed60982dd9f3611f930dc3da0b648d6bf8a2c8bffd7da0524e3"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEBC4AD908F661",
+      "hash": "00f70a4c20fc820a42a3d3c681169b028474528f324f9ea3bc29cdc5a8584997"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEBC4B0AA8CF46",
+      "hash": "2a460d5cf58e8332c4b5876f3c26203dfee898bd0411db9e9590bd03eb16c227"
+    }
+  },
   "0.19.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DEB2939FC5A8D0",

manifests/prek.json

@@ -39,10 +39,44 @@
     }
   },
   "latest": {
-    "version": "0.4.1"
+    "version": "0.4.3"
   },
   "0.4": {
-    "version": "0.4.1"
+    "version": "0.4.3"
+  },
+  "0.4.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEBB9EF576B921",
+      "hash": "509193a8cb4a3032dd9f732023466e4c6719cc758cd6f768a7218a702edb08ae"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEBB9EF51530C6",
+      "hash": "c2f1d49b20a2b10a147195d5e33b03ca51430a852ea6cac568853dda5b89fbb8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEBB9EF532D09C",
+      "hash": "8105cec75f5f60b2b1b499f9e57453dac1be835cf2e67ae141c47d6faa88b84d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEBB9EF39AE912",
+      "hash": "0a112f72c3e76d4bdea6a5f73788015579766f9a9a5ff827932f7a4685f87eb5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEBB9EF367DD89",
+      "hash": "80e10ab3961940ef4d5b0cde03ed670f8176dd60729a03e6a7d92ae00700e072"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEBB9EF37A3F5F",
+      "hash": "24498f658617ecc4b17ca1b23065bb7203bb756ecf9e93629c093ec46a40c548"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEBB9EF4D12171",
+      "hash": "60f895f3047cadd185eda52e8755d185d1bd05db6c3a2a23e2b27824d6b30ba3"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEBB9EF4E35C60",
+      "hash": "d4899d63448322f62dc874331cba4c7c0c0e98ce6a57e1d7b5af85b5987ffb42"
+    }
   },
   "0.4.2": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -2,10 +2,13 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "1.0.0"
+    "version": "1.1.0"
   },
   "1": {
-    "version": "1.0.0"
+    "version": "1.1.0"
+  },
+  "1.1": {
+    "version": "1.1.0"
   },
   "1.1.0": {
     "x86_64_linux_musl": {

manifests/vacuum.json

@@ -21,10 +21,36 @@
     }
   },
   "latest": {
-    "version": "0.26.7"
+    "version": "0.26.8"
+  },
+  "0.27.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEBC985A78A3AD",
+      "hash": "904c1187f9c1530a08250a4eb147ef0f78dd4a501e58bfd6330c6a4b2af00f06"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEBC9859848012",
+      "hash": "eb21f091626d12a162532462ff4c3decf098958edb9e20036b407abccc30c71d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEBC985A760E7B",
+      "hash": "b07f642723b73ecdeaae9d4e951d3f667569a3fc7cf30aeed9f32fcf54743dac"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEBC985A887073",
+      "hash": "a042fba6852813a5e7a1edd652f4d55b218a67249933ebe91b3cdbf714aa0727"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEBC98598935BC",
+      "hash": "684aeaeff2e1cb0c771e76448d183637529c1821162eb651a940274211da03e2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEBC98597AC6F8",
+      "hash": "d60003d000f9c5c981489d0fa45eccd0f65d846ffafe61b2070d902359640a3c"
+    }
   },
   "0.26": {
-    "version": "0.26.7"
+    "version": "0.26.8"
   },
   "0.26.8": {
     "x86_64_linux_musl": {