Bump dependencies and actions (#311 )

Bump actions/checkout from 5.0.0 to 6.0.1 (#278 )
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>v6-beta by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li> <li>update readme/changelog for v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p> <h2>v6-beta</h2> <h2>What's Changed</h2> <p>Updated persist-credentials to store the credentials under <code>$RUNNER_TEMP</code> instead of directly in the local git config.</p> <p>This requires a minimum Actions Runner version of <a href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a> to access the persisted credentials for <a href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker container action</a> scenarios.</p> <h2>v5.0.1</h2> <h2>What's Changed</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> <li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li> </ul> <h2>v4.1.6</h2> <ul> <li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li> </ul> <h2>v4.1.5</h2> <ul> <li>Update NPM dependencies by <a href="https://github.com/cory-miller"><code>@cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li> <li>Bump github/codeql-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li> <li>Bump actions/setup-node from 1 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li> <li>Bump actions/upload-artifact from 2 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a> Clarify v6 README (<a href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li> <li><a href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a> Add worktree support for persist-credentials includeIf (<a href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li> <li><a href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a> Update all references from v5 and v4 to v6 (<a href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a> update readme/changelog for v6 (<a href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li> <li><a href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a> v6-beta (<a href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li> <li><a href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a> Persist creds to a separate file (<a href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a> Update README to include Node.js 24 support details and requirements (<a href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...8e8c483db84b4bee98b60c0593521ed34d9990e8">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=5.0.0&new-version=6.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-08 02:07:02 +00:00 · 2026-01-30 09:31:31 +01:00 · 2026-01-28 18:31:29 +01:00 · 2026-01-28 18:30:14 +01:00 · 2026-01-28 18:30:02 +01:00 · 2026-01-28 11:38:26 +01:00
17 changed files with 694 additions and 152 deletions
@@ -39,13 +39,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+        uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
        with:
          languages: ${{ matrix.language }}
          source-root: src
@@ -57,7 +57,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+        uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl
@@ -71,4 +71,4 @@ jobs:
      #   make release

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+        uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
@@ -17,6 +17,6 @@ jobs:
      pull-requests: read
    steps:
      - name: 🚀 Run Release Drafter
-        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
+        uses: release-drafter/release-drafter@6db134d15f3909ccc9eefd369f02bd1e9cffdf97 # v6.2.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -16,12 +16,12 @@ jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Actionlint
        uses: eifinger/actionlint-action@447fbfe7533062b7a9ea55f790f2396fba6d052a  # v1.10.0
-      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: "20"
      - run: |
@@ -42,7 +42,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use latest version
@@ -57,7 +57,7 @@ jobs:
        ruff-version: ["0.1.7", "0.1.8", "0.4.7", "0.4.10", "0.7", "0.7.x", ">=0.7.0"]
        os: [ ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-14, windows-latest ]
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version ${{ matrix.ruff-version }}
@@ -68,7 +68,7 @@ jobs:
  test-unsupported-version:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Try install old version
@@ -88,7 +88,7 @@ jobs:
  test-version-from-version-file-pyproject:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version from pyproject.toml
@@ -107,7 +107,7 @@ jobs:
  test-default-version-from-pyproject:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml
@@ -125,7 +125,7 @@ jobs:
  test-default-version-from-pyproject-dev-group:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml dev group
@@ -144,7 +144,7 @@ jobs:
  test-default-version-from-pyproject-dependency-groups:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml dependency groups
@@ -163,7 +163,7 @@ jobs:
  test-default-version-from-pyproject-dependency-groups-with-env-marker:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml with environment marker
@@ -174,7 +174,8 @@ jobs:
          version-file: __tests__/fixtures/pyproject-dependency-groups-with-env-marker/pyproject.toml
      - name: Correct version gets installed
        run: |
-          if [ "$RUFF_VERSION" != "0.14.11" ]; then
+          if [ "$RUFF_VERSION" != "0.13.3" ]; then
+            echo "Expected version 0.13.3 but got $RUFF_VERSION"
            exit 1
          fi
        env:
@@ -182,7 +183,7 @@ jobs:
  test-default-version-from-pyproject-poetry-groups:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml poetry group dependencies
@@ -201,7 +202,7 @@ jobs:
  test-default-version-from-pyproject-poetry:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml poetry dependencies
@@ -220,7 +221,7 @@ jobs:
  test-default-version-from-pyproject-optional-dependencies:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from pyproject.toml optional dependencies
@@ -239,7 +240,7 @@ jobs:
  test-default-version-from-requirements:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from requirements.txt
@@ -258,7 +259,7 @@ jobs:
  test-default-version-from-requirements-with-hash:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version from requirements-with-hash.txt
@@ -277,7 +278,7 @@ jobs:
  test-semver-range:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use version 0.7
@@ -296,7 +297,7 @@ jobs:
  test-pep440-version-specifier:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install version 0.9.10
@@ -322,7 +323,7 @@ jobs:
          - os: macos-latest
            checksum: "af9583bff12afbca5d5670334e0187dd60c4d91bc71317d1b2dde70cb1200ba9"
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Checksum matches expected
@@ -334,7 +335,7 @@ jobs:
  test-with-explicit-token:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use default version
@@ -348,7 +349,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use args
@@ -359,7 +360,7 @@ jobs:
  test-failure:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Format should fail
@@ -395,7 +396,7 @@ jobs:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Use args
@@ -405,6 +406,25 @@ jobs:
          src: >-
            __tests__/fixtures/python-project/src/python_project/__init__.py
            __tests__/fixtures/python-project/src/python_project/hello_world.py
+  test-parent-directory-pyproject:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Use version from parent directory pyproject.toml
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/parent-config-project/subproject
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.10.0" ]; then
+            echo "Expected version 0.10.0 but got $RUFF_VERSION"
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}

  all-tests-passed:
    runs-on: ubuntu-latest
@@ -430,6 +450,7 @@ jobs:
      - test-args
      - test-failure
      - test-multiple-src
+      - test-parent-directory-pyproject
    if: always()
    steps:
      - name: All tests passed
@@ -11,10 +11,10 @@ jobs:
      contents: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
-      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: "20"
      - name: Update known checksums
@@ -24,7 +24,7 @@ jobs:
          src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }}
      - run: npm ci --ignore-scripts && npm run all
      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          commit-message: "chore: update known checksums"
          title:
@@ -16,7 +16,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Update Major Minor Tags
@@ -0,0 +1,13 @@
+[project]
+name = "parent-config-project"
+version = "0.1.0"
+description = "Test fixture for parent directory pyproject.toml search"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "ruff==0.10.0",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
@@ -0,0 +1,3 @@
+"""Hello world example."""
+
+print("Hello, world!")
@@ -7,7 +7,7 @@ requires-python = ">=3.12"

 [dependency-groups]
 dev = [
-    "ruff>=0.14 ; python_version >= '3.11'",
+    "ruff~=0.13 ; python_version >= '3.11'",
 ]

 [build-system]
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.1.4/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.2/schema.json",
  "assist": {
    "actions": {
      "source": {
@@ -29071,6 +29071,42 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.KNOWN_CHECKSUMS = void 0;
 // AUTOGENERATED_DO_NOT_EDIT
 exports.KNOWN_CHECKSUMS = {
+    "aarch64-apple-darwin-0.14.14": "76a9b0ebe57d0eee56940dbe0b62462578d1369cca8314ed0d2a6f2102292d4f",
+    "aarch64-pc-windows-msvc-0.14.14": "449982699657bd68d170440dad958281b030bc05865fe012d043cd225e78eb79",
+    "aarch64-unknown-linux-gnu-0.14.14": "1eee1ce3467fb5f348738bb5e4598859b55816a79c3cd6a26ca0dae03d7e2672",
+    "aarch64-unknown-linux-musl-0.14.14": "a4d7302aa201a6f8e71dfa217cd8273fddd4e434a93ee3b4b07047fd7a684ac1",
+    "arm-unknown-linux-musleabihf-0.14.14": "c225db82587780d1675e220db02c5209f406b29afb0a525628e11ffaca537068",
+    "armv7-unknown-linux-gnueabihf-0.14.14": "cdc9596d6317e6cb32fbf3fd6c0e5817f96676b215957e6583db28abf4a15427",
+    "armv7-unknown-linux-musleabihf-0.14.14": "0f1938426c50500bac09a09df5396aa19d6ce9f01a3a18a531dfaee5cc0d93e8",
+    "i686-pc-windows-msvc-0.14.14": "4f6af9d82acae3d1308c55b0fa51b84d57eafc380aedf97a53a32314118c9a71",
+    "i686-unknown-linux-gnu-0.14.14": "5ceb5e2f1906d85e444cb71503379e14d96ded423bd68906f1a539b78d9fc2c3",
+    "i686-unknown-linux-musl-0.14.14": "878cebcaf3481295d22a1274cea94ec050455917669ccecac586dcfe6b4a557e",
+    "powerpc64-unknown-linux-gnu-0.14.14": "e01a6db6bbf15db82052269887fb49e6be79923d188f1f60ed74f93b6b9a90d4",
+    "powerpc64le-unknown-linux-gnu-0.14.14": "6048f270a46cce01228a53fde14fa6182a99d9e99169d7c252f706d7ba2a4845",
+    "riscv64gc-unknown-linux-gnu-0.14.14": "6eca650195a22c0a568adc923b645b6317dad3ecc8a3d5c02c08768d6b333393",
+    "s390x-unknown-linux-gnu-0.14.14": "dbde3ba91f84d8c183ed49bca0790777285d21381ad64a290584bd19038b83a4",
+    "x86_64-apple-darwin-0.14.14": "749396c675c6f07205be6c4ef89e2e95123d790062d681059a355030e9d7d119",
+    "x86_64-pc-windows-msvc-0.14.14": "81bfeed34f15296e6c81ecea912b6fff4430b957de8a1181ce9365434e3d6744",
+    "x86_64-unknown-linux-gnu-0.14.14": "9876634f799d933bdaa1de864f47d26f898b2e20aa8f4f85d63235c3a231068d",
+    "x86_64-unknown-linux-musl-0.14.14": "55a1ee65f5ac9416cc40f99c2df62f0d4525d40369fe371caff945c495174d57",
+    "aarch64-apple-darwin-0.14.13": "067d1a90da8add55614eff91990425883a092d8279d9e503258ff8be0f8e9c18",
+    "aarch64-pc-windows-msvc-0.14.13": "f7b5b9740ae893ac6abe9b9f68865073ffb9146a6f352ba9718d53b102ad02ef",
+    "aarch64-unknown-linux-gnu-0.14.13": "84ce8fe1ef9b2eba018ba396fd018ac2bc22865a9e2a02573899ea6ee8e1e5fd",
+    "aarch64-unknown-linux-musl-0.14.13": "25941b777ff712f4d9473d26c1b875034214a3d5de20ea99b2add939dcd0b367",
+    "arm-unknown-linux-musleabihf-0.14.13": "3d833d451accb334f9cb91141083bbee5b835dcf0b49d14e5ccb13e0b6a7c387",
+    "armv7-unknown-linux-gnueabihf-0.14.13": "90aa92a6de0f63eacb2d380c324039c101c6097956690fbaec05ed8d922f8766",
+    "armv7-unknown-linux-musleabihf-0.14.13": "192deb53946b4309c56c1ad7c401ddac7557d0a517da7addfc636f1188bab30d",
+    "i686-pc-windows-msvc-0.14.13": "4ead4d5fc89a1f02aa97dad944e69306ae4177a689a3818d3575fed11aa994fe",
+    "i686-unknown-linux-gnu-0.14.13": "a321fc4862748563a663472a4458fe514e34542d0fe8d767d67b1463d585fb2f",
+    "i686-unknown-linux-musl-0.14.13": "597541ac81d553c2fe97339680bfdb3e926714763ee37f0b5dbcc572d695e376",
+    "powerpc64-unknown-linux-gnu-0.14.13": "cad4c05db54969608ec292b695397ddaef7452f759b976a60b69d9fefc6c5724",
+    "powerpc64le-unknown-linux-gnu-0.14.13": "bc7faa37e496ae0198ee7e1c9e8958df3c55025ccf8be175b74533f87626e726",
+    "riscv64gc-unknown-linux-gnu-0.14.13": "d9c6fd360347b9b0079994246ed08186f64629529e2fd2dc1a97a31da2a214d5",
+    "s390x-unknown-linux-gnu-0.14.13": "1995227a65970cb2c1aa3b03c9a5418ee1fa56210c4577e6f8e1a14d1e79ed5d",
+    "x86_64-apple-darwin-0.14.13": "69e424a42ac3a7c6c7032ad96deb757c35c93c848b6ea329a3f4c605e6d89ef9",
+    "x86_64-pc-windows-msvc-0.14.13": "d2af4376053458f283d74980b49dc0d61d3ef9d9b8684c5b25bd64b73e11634a",
+    "x86_64-unknown-linux-gnu-0.14.13": "b1e03e4cf245411f184106ba3d973b3902021bf5327e2fde0cfad163aacdc2c1",
+    "x86_64-unknown-linux-musl-0.14.13": "2fe394f493318551f271277a2228e56b31ca69a4842483e5709af4548f342bc3",
    "aarch64-apple-darwin-0.14.11": "c3fab6bcad9cc2f8a342829dd4ea011c54b9671d023b71baac1cbf2b3526cefd",
    "aarch64-pc-windows-msvc-0.14.11": "43faade7e8f33a8ffab726aa44ee2b6bc1fd9d51407320db797dcb3dac068461",
    "aarch64-unknown-linux-gnu-0.14.11": "e5c018ac042ddeb9c02c3d96b6efe3a0dcd3406ba9bd695253d6111785f7abf6",
@@ -32110,7 +32146,6 @@ var __importStar = (this && this.__importStar) || (function () {
    };
 })();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const fs = __importStar(__nccwpck_require__(3024));
 const path = __importStar(__nccwpck_require__(6760));
 const core = __importStar(__nccwpck_require__(7484));
 const exec = __importStar(__nccwpck_require__(5236));
@@ -32119,6 +32154,7 @@ const download_version_1 = __nccwpck_require__(8255);
 const inputs_1 = __nccwpck_require__(9612);
 const platforms_1 = __nccwpck_require__(8361);
 const pyproject_1 = __nccwpck_require__(3929);
+const pyproject_finder_1 = __nccwpck_require__(6346);
 async function run() {
    const platform = (0, platforms_1.getPlatform)();
    const arch = (0, platforms_1.getArch)();
@@ -32175,9 +32211,9 @@ async function determineVersion() {
        }
        return await (0, download_version_1.resolveVersion)(versionFromPyproject || "latest", inputs_1.githubToken);
    }
-    const pyProjectPath = path.join(inputs_1.src, "pyproject.toml");
-    if (!fs.existsSync(pyProjectPath)) {
-        core.info(`Could not find ${pyProjectPath}. Using latest version.`);
+    const pyProjectPath = (0, pyproject_finder_1.findPyprojectToml)(inputs_1.src, process.env.GITHUB_WORKSPACE || ".");
+    if (!pyProjectPath) {
+        core.info(`Could not find pyproject.toml. Using latest version.`);
        return await (0, download_version_1.resolveVersion)("latest", inputs_1.githubToken);
    }
    const versionFromPyproject = (0, pyproject_1.getRuffVersionFromRequirementsFile)(pyProjectPath);
@@ -32305,6 +32341,110 @@ function getPlatform() {
 }


+/***/ }),
+
+/***/ 6346:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.findPyprojectToml = findPyprojectToml;
+const fs = __importStar(__nccwpck_require__(3024));
+const path = __importStar(__nccwpck_require__(6760));
+const core = __importStar(__nccwpck_require__(7484));
+/**
+ * Search for a pyproject.toml file starting from the given directory
+ * and traversing upwards through parent directories until reaching
+ * the GitHub workspace root.
+ *
+ * @param startDir The directory to start the search from (e.g., the src input)
+ * @param workspaceRoot The GitHub workspace directory (GITHUB_WORKSPACE)
+ * @returns The path to the found pyproject.toml, or undefined if not found
+ */
+function findPyprojectToml(startDir, workspaceRoot) {
+    let currentDir = path.resolve(startDir);
+    const resolvedWorkspaceRoot = path.resolve(workspaceRoot);
+    while (true) {
+        const pyprojectPath = path.join(currentDir, "pyproject.toml");
+        core.debug(`Checking for ${pyprojectPath}`);
+        if (fs.existsSync(pyprojectPath)) {
+            core.info(`Found pyproject.toml at ${pyprojectPath}`);
+            return pyprojectPath;
+        }
+        // Check if we've reached the workspace root
+        if (currentDir === resolvedWorkspaceRoot) {
+            // If we're at workspace root and didn't find it, stop searching
+            break;
+        }
+        // Move up to parent directory
+        const parentDir = path.dirname(currentDir);
+        // If parent is the same as current, we've reached the filesystem root
+        if (parentDir === currentDir) {
+            break;
+        }
+        currentDir = parentDir;
+        // If we've gone past the workspace root, stop searching
+        if (isPathWithinWorkspace(currentDir, resolvedWorkspaceRoot) === false) {
+            break;
+        }
+    }
+    return undefined;
+}
+/**
+ * Check if a given path is within or equal to the workspace root.
+ *
+ * @param checkPath The path to check
+ * @param workspaceRoot The workspace root directory
+ * @returns true if within or equal to workspace, false if outside, undefined if can't determine
+ */
+function isPathWithinWorkspace(checkPath, workspaceRoot) {
+    try {
+        const checkPathResolved = path.resolve(checkPath);
+        const workspaceRootResolved = path.resolve(workspaceRoot);
+        // Check if checkPath starts with workspaceRoot (case-insensitive on Windows)
+        const relativePath = path.relative(workspaceRootResolved, checkPathResolved);
+        return !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+    }
+    catch {
+        return undefined;
+    }
+}
+
+
 /***/ }),

 /***/ 3929:
@@ -34586,6 +34726,12 @@ ${codeblock}`, options);
 };

 // dist/util.js
+function isEscaped(str, ptr) {
+  let i = 0;
+  while (str[ptr - ++i] === "\\")
+    ;
+  return --i && i % 2;
+}
 function indexOfNewline(str, start = 0, end = str.length) {
  let idx = str.indexOf("\n", start);
  if (str[idx - 1] === "\r")
@@ -34640,7 +34786,7 @@ function getStringEnd(str, seek) {
  seek += target.length - 1;
  do
    seek = str.indexOf(target, ++seek);
-  while (seek > -1 && first !== "'" && str[seek - 1] === "\\" && (str[seek - 2] !== "\\" || str[seek - 3] === "\\"));
+  while (seek > -1 && first !== "'" && isEscaped(str, seek));
  if (seek > -1) {
    seek += target.length;
    if (target.length > 1) {
@@ -34654,7 +34800,7 @@ function getStringEnd(str, seek) {
 }

 // dist/date.js
-var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}:\d{2}(?:\.\d+)?)?(Z|[-+]\d{2}:\d{2})?$/i;
+var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
 var TomlDate = class _TomlDate extends Date {
  #hasDate = false;
  #hasTime = false;
@@ -34749,13 +34895,14 @@ var TomlDate = class _TomlDate extends Date {
 var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
 var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
 var LEADING_ZERO = /^[+-]?0[0-9_]/;
-var ESCAPE_REGEX = /^[0-9a-f]{4,8}$/i;
+var ESCAPE_REGEX = /^[0-9a-f]{2,8}$/i;
 var ESC_MAP = {
  b: "\b",
  t: "	",
  n: "\n",
  f: "\f",
  r: "\r",
+  e: "\x1B",
  '"': '"',
  "\\": "\\"
 };
@@ -34790,8 +34937,8 @@ function parseString(str, ptr = 0, endPtr = str.length) {
    }
    if (isEscape) {
      isEscape = false;
-      if (c === "u" || c === "U") {
-        let code = str.slice(ptr, ptr += c === "u" ? 4 : 8);
+      if (c === "x" || c === "u" || c === "U") {
+        let code = str.slice(ptr, ptr += c === "x" ? 2 : c === "u" ? 4 : 8);
        if (!ESCAPE_REGEX.test(code)) {
          throw new TomlError("invalid unicode escape", {
            toml: str,
@@ -34884,24 +35031,14 @@ function parseValue(value, toml, ptr, integersAsBigInt) {
 }

 // dist/extract.js
-function sliceAndTrimEndOf(str, startPtr, endPtr, allowNewLines) {
+function sliceAndTrimEndOf(str, startPtr, endPtr) {
  let value = str.slice(startPtr, endPtr);
  let commentIdx = value.indexOf("#");
  if (commentIdx > -1) {
    skipComment(str, commentIdx);
    value = value.slice(0, commentIdx);
  }
-  let trimmed = value.trimEnd();
-  if (!allowNewLines) {
-    let newlineIdx = value.indexOf("\n", trimmed.length);
-    if (newlineIdx > -1) {
-      throw new TomlError("newlines are not allowed in inline tables", {
-        toml: str,
-        ptr: startPtr + newlineIdx
-      });
-    }
-  }
-  return [trimmed, commentIdx];
+  return [value.trimEnd(), commentIdx];
 }
 function extractValue(str, ptr, end, depth, integersAsBigInt) {
  if (depth === 0) {
@@ -34913,24 +35050,25 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
  let c = str[ptr];
  if (c === "[" || c === "{") {
    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
-    let newPtr = end ? skipUntil(str, endPtr2, ",", end) : endPtr2;
-    if (endPtr2 - newPtr && end === "}") {
-      let nextNewLine = indexOfNewline(str, endPtr2, newPtr);
-      if (nextNewLine > -1) {
-        throw new TomlError("newlines are not allowed in inline tables", {
+    if (end) {
+      endPtr2 = skipVoid(str, endPtr2);
+      if (str[endPtr2] === ",")
+        endPtr2++;
+      else if (str[endPtr2] !== end) {
+        throw new TomlError("expected comma or end of structure", {
          toml: str,
-          ptr: nextNewLine
+          ptr: endPtr2
        });
      }
    }
-    return [value, newPtr];
+    return [value, endPtr2];
  }
  let endPtr;
  if (c === '"' || c === "'") {
    endPtr = getStringEnd(str, ptr);
    let parsed = parseString(str, ptr, endPtr);
    if (end) {
-      endPtr = skipVoid(str, endPtr, end !== "]");
+      endPtr = skipVoid(str, endPtr);
      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
        throw new TomlError("unexpected character encountered", {
          toml: str,
@@ -34942,7 +35080,7 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
    return [parsed, endPtr];
  }
  endPtr = skipUntil(str, ptr, ",", end);
-  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","), end === "]");
+  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","));
  if (!slice[0]) {
    throw new TomlError("incomplete key-value declaration: no value specified", {
      toml: str,
@@ -35032,17 +35170,16 @@ function parseInlineTable(str, ptr, depth, integersAsBigInt) {
  let res = {};
  let seen = /* @__PURE__ */ new Set();
  let c;
-  let comma = 0;
  ptr++;
  while ((c = str[ptr++]) !== "}" && c) {
-    let err = { toml: str, ptr: ptr - 1 };
-    if (c === "\n") {
-      throw new TomlError("newlines are not allowed in inline tables", err);
-    } else if (c === "#") {
-      throw new TomlError("inline tables cannot contain comments", err);
-    } else if (c === ",") {
-      throw new TomlError("expected key-value, found comma", err);
-    } else if (c !== " " && c !== "	") {
+    if (c === ",") {
+      throw new TomlError("expected value, found comma", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    } else if (c === "#")
+      ptr = skipComment(str, ptr);
+    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
      let k;
      let t = res;
      let hasOwn = false;
@@ -35071,15 +35208,8 @@ function parseInlineTable(str, ptr, depth, integersAsBigInt) {
      seen.add(value);
      t[k] = value;
      ptr = valueEndPtr;
-      comma = str[ptr - 1] === "," ? ptr - 1 : 0;
    }
  }
-  if (comma) {
-    throw new TomlError("trailing commas are not allowed in inline tables", {
-      toml: str,
-      ptr: comma
-    });
-  }
  if (!c) {
    throw new TomlError("unfinished table encountered", {
      toml: str,
@@ -35331,14 +35461,13 @@ function stringifyArrayTable(array, key, depth, numberAsFloat) {
  }
  let res = "";
  for (let i = 0; i < array.length; i++) {
-    res += `[[${key}]]
+    res += `${res && "\n"}[[${key}]]
 `;
-    res += stringifyTable(array[i], key, depth, numberAsFloat);
-    res += "\n\n";
+    res += stringifyTable(0, array[i], key, depth, numberAsFloat);
  }
  return res;
 }
-function stringifyTable(obj, prefix, depth, numberAsFloat) {
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
  if (depth === 0) {
    throw new Error("Could not stringify the object: maximum object depth exceeded");
  }
@@ -35354,13 +35483,10 @@ function stringifyTable(obj, prefix, depth, numberAsFloat) {
      }
      let key = BARE_KEY.test(k) ? k : formatString(k);
      if (type === "array" && isArrayOfTables(obj[k])) {
-        tables += stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
      } else if (type === "object") {
        let tblKey = prefix ? `${prefix}.${key}` : key;
-        tables += `[${tblKey}]
-`;
-        tables += stringifyTable(obj[k], tblKey, depth - 1, numberAsFloat);
-        tables += "\n\n";
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
      } else {
        preamble += key;
        preamble += " = ";
@@ -35369,14 +35495,20 @@ function stringifyTable(obj, prefix, depth, numberAsFloat) {
      }
    }
  }
-  return `${preamble}
-${tables}`.trim();
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
 }
 function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
  if (extendedTypeOf(obj) !== "object") {
    throw new TypeError("stringify can only be called with an object");
  }
-  return stringifyTable(obj, "", maxDepth, numbersAsFloat);
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
 }

 // dist/index.js
@@ -28205,6 +28205,42 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.KNOWN_CHECKSUMS = void 0;
 // AUTOGENERATED_DO_NOT_EDIT
 exports.KNOWN_CHECKSUMS = {
+    "aarch64-apple-darwin-0.14.14": "76a9b0ebe57d0eee56940dbe0b62462578d1369cca8314ed0d2a6f2102292d4f",
+    "aarch64-pc-windows-msvc-0.14.14": "449982699657bd68d170440dad958281b030bc05865fe012d043cd225e78eb79",
+    "aarch64-unknown-linux-gnu-0.14.14": "1eee1ce3467fb5f348738bb5e4598859b55816a79c3cd6a26ca0dae03d7e2672",
+    "aarch64-unknown-linux-musl-0.14.14": "a4d7302aa201a6f8e71dfa217cd8273fddd4e434a93ee3b4b07047fd7a684ac1",
+    "arm-unknown-linux-musleabihf-0.14.14": "c225db82587780d1675e220db02c5209f406b29afb0a525628e11ffaca537068",
+    "armv7-unknown-linux-gnueabihf-0.14.14": "cdc9596d6317e6cb32fbf3fd6c0e5817f96676b215957e6583db28abf4a15427",
+    "armv7-unknown-linux-musleabihf-0.14.14": "0f1938426c50500bac09a09df5396aa19d6ce9f01a3a18a531dfaee5cc0d93e8",
+    "i686-pc-windows-msvc-0.14.14": "4f6af9d82acae3d1308c55b0fa51b84d57eafc380aedf97a53a32314118c9a71",
+    "i686-unknown-linux-gnu-0.14.14": "5ceb5e2f1906d85e444cb71503379e14d96ded423bd68906f1a539b78d9fc2c3",
+    "i686-unknown-linux-musl-0.14.14": "878cebcaf3481295d22a1274cea94ec050455917669ccecac586dcfe6b4a557e",
+    "powerpc64-unknown-linux-gnu-0.14.14": "e01a6db6bbf15db82052269887fb49e6be79923d188f1f60ed74f93b6b9a90d4",
+    "powerpc64le-unknown-linux-gnu-0.14.14": "6048f270a46cce01228a53fde14fa6182a99d9e99169d7c252f706d7ba2a4845",
+    "riscv64gc-unknown-linux-gnu-0.14.14": "6eca650195a22c0a568adc923b645b6317dad3ecc8a3d5c02c08768d6b333393",
+    "s390x-unknown-linux-gnu-0.14.14": "dbde3ba91f84d8c183ed49bca0790777285d21381ad64a290584bd19038b83a4",
+    "x86_64-apple-darwin-0.14.14": "749396c675c6f07205be6c4ef89e2e95123d790062d681059a355030e9d7d119",
+    "x86_64-pc-windows-msvc-0.14.14": "81bfeed34f15296e6c81ecea912b6fff4430b957de8a1181ce9365434e3d6744",
+    "x86_64-unknown-linux-gnu-0.14.14": "9876634f799d933bdaa1de864f47d26f898b2e20aa8f4f85d63235c3a231068d",
+    "x86_64-unknown-linux-musl-0.14.14": "55a1ee65f5ac9416cc40f99c2df62f0d4525d40369fe371caff945c495174d57",
+    "aarch64-apple-darwin-0.14.13": "067d1a90da8add55614eff91990425883a092d8279d9e503258ff8be0f8e9c18",
+    "aarch64-pc-windows-msvc-0.14.13": "f7b5b9740ae893ac6abe9b9f68865073ffb9146a6f352ba9718d53b102ad02ef",
+    "aarch64-unknown-linux-gnu-0.14.13": "84ce8fe1ef9b2eba018ba396fd018ac2bc22865a9e2a02573899ea6ee8e1e5fd",
+    "aarch64-unknown-linux-musl-0.14.13": "25941b777ff712f4d9473d26c1b875034214a3d5de20ea99b2add939dcd0b367",
+    "arm-unknown-linux-musleabihf-0.14.13": "3d833d451accb334f9cb91141083bbee5b835dcf0b49d14e5ccb13e0b6a7c387",
+    "armv7-unknown-linux-gnueabihf-0.14.13": "90aa92a6de0f63eacb2d380c324039c101c6097956690fbaec05ed8d922f8766",
+    "armv7-unknown-linux-musleabihf-0.14.13": "192deb53946b4309c56c1ad7c401ddac7557d0a517da7addfc636f1188bab30d",
+    "i686-pc-windows-msvc-0.14.13": "4ead4d5fc89a1f02aa97dad944e69306ae4177a689a3818d3575fed11aa994fe",
+    "i686-unknown-linux-gnu-0.14.13": "a321fc4862748563a663472a4458fe514e34542d0fe8d767d67b1463d585fb2f",
+    "i686-unknown-linux-musl-0.14.13": "597541ac81d553c2fe97339680bfdb3e926714763ee37f0b5dbcc572d695e376",
+    "powerpc64-unknown-linux-gnu-0.14.13": "cad4c05db54969608ec292b695397ddaef7452f759b976a60b69d9fefc6c5724",
+    "powerpc64le-unknown-linux-gnu-0.14.13": "bc7faa37e496ae0198ee7e1c9e8958df3c55025ccf8be175b74533f87626e726",
+    "riscv64gc-unknown-linux-gnu-0.14.13": "d9c6fd360347b9b0079994246ed08186f64629529e2fd2dc1a97a31da2a214d5",
+    "s390x-unknown-linux-gnu-0.14.13": "1995227a65970cb2c1aa3b03c9a5418ee1fa56210c4577e6f8e1a14d1e79ed5d",
+    "x86_64-apple-darwin-0.14.13": "69e424a42ac3a7c6c7032ad96deb757c35c93c848b6ea329a3f4c605e6d89ef9",
+    "x86_64-pc-windows-msvc-0.14.13": "d2af4376053458f283d74980b49dc0d61d3ef9d9b8684c5b25bd64b73e11634a",
+    "x86_64-unknown-linux-gnu-0.14.13": "b1e03e4cf245411f184106ba3d973b3902021bf5327e2fde0cfad163aacdc2c1",
+    "x86_64-unknown-linux-musl-0.14.13": "2fe394f493318551f271277a2228e56b31ca69a4842483e5709af4548f342bc3",
    "aarch64-apple-darwin-0.14.11": "c3fab6bcad9cc2f8a342829dd4ea011c54b9671d023b71baac1cbf2b3526cefd",
    "aarch64-pc-windows-msvc-0.14.11": "43faade7e8f33a8ffab726aa44ee2b6bc1fd9d51407320db797dcb3dac068461",
    "aarch64-unknown-linux-gnu-0.14.11": "e5c018ac042ddeb9c02c3d96b6efe3a0dcd3406ba9bd695253d6111785f7abf6",
@@ -16,14 +16,14 @@
        "@octokit/plugin-paginate-rest": "^13.1.1",
        "@octokit/plugin-rest-endpoint-methods": "^16.0.0",
        "@renovatebot/pep440": "^4.2.1",
-        "smol-toml": "^1.4.1"
+        "smol-toml": "^1.6.0"
      },
      "devDependencies": {
-        "@biomejs/biome": "2.1.4",
+        "@biomejs/biome": "2.3.2",
        "@types/jest": "^29.5.14",
        "@types/js-yaml": "^4.0.9",
-        "@types/node": "^24.2.1",
-        "@types/semver": "^7.7.0",
+        "@types/node": "^24.10.9",
+        "@types/semver": "^7.7.1",
        "@vercel/ncc": "^0.38.3",
        "jest": "^29.7.0",
        "js-yaml": "^4.1.0",
@@ -571,9 +571,9 @@
      "license": "MIT"
    },
    "node_modules/@biomejs/biome": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.1.4.tgz",
-      "integrity": "sha512-QWlrqyxsU0FCebuMnkvBIkxvPqH89afiJzjMl+z67ybutse590jgeaFdDurE9XYtzpjRGTI1tlUZPGWmbKsElA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.3.2.tgz",
+      "integrity": "sha512-8e9tzamuDycx7fdrcJ/F/GDZ8SYukc5ud6tDicjjFqURKYFSWMl0H0iXNXZEGmcmNUmABgGuHThPykcM41INgg==",
      "dev": true,
      "license": "MIT OR Apache-2.0",
      "bin": {
@@ -587,20 +587,20 @@
        "url": "https://opencollective.com/biome"
      },
      "optionalDependencies": {
-        "@biomejs/cli-darwin-arm64": "2.1.4",
-        "@biomejs/cli-darwin-x64": "2.1.4",
-        "@biomejs/cli-linux-arm64": "2.1.4",
-        "@biomejs/cli-linux-arm64-musl": "2.1.4",
-        "@biomejs/cli-linux-x64": "2.1.4",
-        "@biomejs/cli-linux-x64-musl": "2.1.4",
-        "@biomejs/cli-win32-arm64": "2.1.4",
-        "@biomejs/cli-win32-x64": "2.1.4"
+        "@biomejs/cli-darwin-arm64": "2.3.2",
+        "@biomejs/cli-darwin-x64": "2.3.2",
+        "@biomejs/cli-linux-arm64": "2.3.2",
+        "@biomejs/cli-linux-arm64-musl": "2.3.2",
+        "@biomejs/cli-linux-x64": "2.3.2",
+        "@biomejs/cli-linux-x64-musl": "2.3.2",
+        "@biomejs/cli-win32-arm64": "2.3.2",
+        "@biomejs/cli-win32-x64": "2.3.2"
      }
    },
    "node_modules/@biomejs/cli-darwin-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.1.4.tgz",
-      "integrity": "sha512-sCrNENE74I9MV090Wq/9Dg7EhPudx3+5OiSoQOkIe3DLPzFARuL1dOwCWhKCpA3I5RHmbrsbNSRfZwCabwd8Qg==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.3.2.tgz",
+      "integrity": "sha512-4LECm4kc3If0JISai4c3KWQzukoUdpxy4fRzlrPcrdMSRFksR9ZoXK7JBcPuLBmd2SoT4/d7CQS33VnZpgBjew==",
      "cpu": [
        "arm64"
      ],
@@ -615,9 +615,9 @@
      }
    },
    "node_modules/@biomejs/cli-darwin-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.1.4.tgz",
-      "integrity": "sha512-gOEICJbTCy6iruBywBDcG4X5rHMbqCPs3clh3UQ+hRKlgvJTk4NHWQAyHOXvaLe+AxD1/TNX1jbZeffBJzcrOw==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.3.2.tgz",
+      "integrity": "sha512-jNMnfwHT4N3wi+ypRfMTjLGnDmKYGzxVr1EYAPBcauRcDnICFXN81wD6wxJcSUrLynoyyYCdfW6vJHS/IAoTDA==",
      "cpu": [
        "x64"
      ],
@@ -632,9 +632,9 @@
      }
    },
    "node_modules/@biomejs/cli-linux-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.1.4.tgz",
-      "integrity": "sha512-juhEkdkKR4nbUi5k/KRp1ocGPNWLgFRD4NrHZSveYrD6i98pyvuzmS9yFYgOZa5JhaVqo0HPnci0+YuzSwT2fw==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.3.2.tgz",
+      "integrity": "sha512-amnqvk+gWybbQleRRq8TMe0rIv7GHss8mFJEaGuEZYWg1Tw14YKOkeo8h6pf1c+d3qR+JU4iT9KXnBKGON4klw==",
      "cpu": [
        "arm64"
      ],
@@ -649,9 +649,9 @@
      }
    },
    "node_modules/@biomejs/cli-linux-arm64-musl": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.1.4.tgz",
-      "integrity": "sha512-nYr7H0CyAJPaLupFE2cH16KZmRC5Z9PEftiA2vWxk+CsFkPZQ6dBRdcC6RuS+zJlPc/JOd8xw3uCCt9Pv41WvQ==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.3.2.tgz",
+      "integrity": "sha512-2Zz4usDG1GTTPQnliIeNx6eVGGP2ry5vE/v39nT73a3cKN6t5H5XxjcEoZZh62uVZvED7hXXikclvI64vZkYqw==",
      "cpu": [
        "arm64"
      ],
@@ -666,9 +666,9 @@
      }
    },
    "node_modules/@biomejs/cli-linux-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.1.4.tgz",
-      "integrity": "sha512-Eoy9ycbhpJVYuR+LskV9s3uyaIkp89+qqgqhGQsWnp/I02Uqg2fXFblHJOpGZR8AxdB9ADy87oFVxn9MpFKUrw==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.3.2.tgz",
+      "integrity": "sha512-8BG/vRAhFz1pmuyd24FQPhNeueLqPtwvZk6yblABY2gzL2H8fLQAF/Z2OPIc+BPIVPld+8cSiKY/KFh6k81xfA==",
      "cpu": [
        "x64"
      ],
@@ -683,9 +683,9 @@
      }
    },
    "node_modules/@biomejs/cli-linux-x64-musl": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.1.4.tgz",
-      "integrity": "sha512-lvwvb2SQQHctHUKvBKptR6PLFCM7JfRjpCCrDaTmvB7EeZ5/dQJPhTYBf36BE/B4CRWR2ZiBLRYhK7hhXBCZAg==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.3.2.tgz",
+      "integrity": "sha512-gzB19MpRdTuOuLtPpFBGrV3Lq424gHyq2lFj8wfX9tvLMLdmA/R9C7k/mqBp/spcbWuHeIEKgEs3RviOPcWGBA==",
      "cpu": [
        "x64"
      ],
@@ -700,9 +700,9 @@
      }
    },
    "node_modules/@biomejs/cli-win32-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.1.4.tgz",
-      "integrity": "sha512-3WRYte7orvyi6TRfIZkDN9Jzoogbv+gSvR+b9VOXUg1We1XrjBg6WljADeVEaKTvOcpVdH0a90TwyOQ6ue4fGw==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.3.2.tgz",
+      "integrity": "sha512-lCruqQlfWjhMlOdyf5pDHOxoNm4WoyY2vZ4YN33/nuZBRstVDuqPPjS0yBkbUlLEte11FbpW+wWSlfnZfSIZvg==",
      "cpu": [
        "arm64"
      ],
@@ -717,9 +717,9 @@
      }
    },
    "node_modules/@biomejs/cli-win32-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.1.4.tgz",
-      "integrity": "sha512-tBc+W7anBPSFXGAoQW+f/+svkpt8/uXfRwDzN1DvnatkRMt16KIYpEi/iw8u9GahJlFv98kgHcIrSsZHZTR0sw==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.3.2.tgz",
+      "integrity": "sha512-6Ee9P26DTb4D8sN9nXxgbi9Dw5vSOfH98M7UlmkjKB2vtUbrRqCbZiNfryGiwnPIpd6YUoTl7rLVD2/x1CyEHQ==",
      "cpu": [
        "x64"
      ],
@@ -1399,19 +1399,19 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "24.2.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.2.1.tgz",
-      "integrity": "sha512-DRh5K+ka5eJic8CjH7td8QpYEV6Zo10gfRkjHCO3weqZHWDtAaSTFtl4+VMqOJ4N5jcuhZ9/l+yy8rVgw7BQeQ==",
+      "version": "24.10.9",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.9.tgz",
+      "integrity": "sha512-ne4A0IpG3+2ETuREInjPNhUGis1SFjv1d5asp8MzEAGtOZeTeHVDOYqOgqfhvseqg/iXty2hjBf1zAOb7RNiNw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": "~7.10.0"
+        "undici-types": "~7.16.0"
      }
    },
    "node_modules/@types/semver": {
-      "version": "7.7.0",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.0.tgz",
-      "integrity": "sha512-k107IF4+Xr7UHjwDc7Cfd6PRQfbdkiRabXGRjo07b4WyPahFBZCZ1sE+BNxYIJPPg73UkfOsVOLwqVc/6ETrIA==",
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
      "dev": true,
      "license": "MIT"
    },
@@ -3778,9 +3778,9 @@
      }
    },
    "node_modules/smol-toml": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.4.1.tgz",
-      "integrity": "sha512-CxdwHXyYTONGHThDbq5XdwbFsuY4wlClRGejfE2NtwUtiHYsP1QtNsHb/hnj31jKYSchztJsaA8pSQoVzkfCFg==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz",
+      "integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==",
      "license": "BSD-3-Clause",
      "engines": {
        "node": ">= 18"
@@ -4117,9 +4117,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "7.10.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.10.0.tgz",
-      "integrity": "sha512-t5Fy/nfn+14LuOc2KNYg75vZqClpAiqscVvMygNnlsHBFpSXdJaYtXMcdNLpl/Qvc3P2cB3s6lOV51nqsFq4ag==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
      "dev": true,
      "license": "MIT"
    },
@@ -33,14 +33,14 @@
    "@octokit/plugin-paginate-rest": "^13.1.1",
    "@octokit/plugin-rest-endpoint-methods": "^16.0.0",
    "@renovatebot/pep440": "^4.2.1",
-    "smol-toml": "^1.4.1"
+    "smol-toml": "^1.6.0"
  },
  "devDependencies": {
-    "@biomejs/biome": "2.1.4",
+    "@biomejs/biome": "2.3.2",
    "@types/jest": "^29.5.14",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.2.1",
-    "@types/semver": "^7.7.0",
+    "@types/node": "^24.10.9",
+    "@types/semver": "^7.7.1",
    "@vercel/ncc": "^0.38.3",
    "jest": "^29.7.0",
    "js-yaml": "^4.1.0",
@@ -1,5 +1,77 @@
 // AUTOGENERATED_DO_NOT_EDIT
 export const KNOWN_CHECKSUMS: { [key: string]: string } = {
+  "aarch64-apple-darwin-0.14.14":
+    "76a9b0ebe57d0eee56940dbe0b62462578d1369cca8314ed0d2a6f2102292d4f",
+  "aarch64-pc-windows-msvc-0.14.14":
+    "449982699657bd68d170440dad958281b030bc05865fe012d043cd225e78eb79",
+  "aarch64-unknown-linux-gnu-0.14.14":
+    "1eee1ce3467fb5f348738bb5e4598859b55816a79c3cd6a26ca0dae03d7e2672",
+  "aarch64-unknown-linux-musl-0.14.14":
+    "a4d7302aa201a6f8e71dfa217cd8273fddd4e434a93ee3b4b07047fd7a684ac1",
+  "arm-unknown-linux-musleabihf-0.14.14":
+    "c225db82587780d1675e220db02c5209f406b29afb0a525628e11ffaca537068",
+  "armv7-unknown-linux-gnueabihf-0.14.14":
+    "cdc9596d6317e6cb32fbf3fd6c0e5817f96676b215957e6583db28abf4a15427",
+  "armv7-unknown-linux-musleabihf-0.14.14":
+    "0f1938426c50500bac09a09df5396aa19d6ce9f01a3a18a531dfaee5cc0d93e8",
+  "i686-pc-windows-msvc-0.14.14":
+    "4f6af9d82acae3d1308c55b0fa51b84d57eafc380aedf97a53a32314118c9a71",
+  "i686-unknown-linux-gnu-0.14.14":
+    "5ceb5e2f1906d85e444cb71503379e14d96ded423bd68906f1a539b78d9fc2c3",
+  "i686-unknown-linux-musl-0.14.14":
+    "878cebcaf3481295d22a1274cea94ec050455917669ccecac586dcfe6b4a557e",
+  "powerpc64-unknown-linux-gnu-0.14.14":
+    "e01a6db6bbf15db82052269887fb49e6be79923d188f1f60ed74f93b6b9a90d4",
+  "powerpc64le-unknown-linux-gnu-0.14.14":
+    "6048f270a46cce01228a53fde14fa6182a99d9e99169d7c252f706d7ba2a4845",
+  "riscv64gc-unknown-linux-gnu-0.14.14":
+    "6eca650195a22c0a568adc923b645b6317dad3ecc8a3d5c02c08768d6b333393",
+  "s390x-unknown-linux-gnu-0.14.14":
+    "dbde3ba91f84d8c183ed49bca0790777285d21381ad64a290584bd19038b83a4",
+  "x86_64-apple-darwin-0.14.14":
+    "749396c675c6f07205be6c4ef89e2e95123d790062d681059a355030e9d7d119",
+  "x86_64-pc-windows-msvc-0.14.14":
+    "81bfeed34f15296e6c81ecea912b6fff4430b957de8a1181ce9365434e3d6744",
+  "x86_64-unknown-linux-gnu-0.14.14":
+    "9876634f799d933bdaa1de864f47d26f898b2e20aa8f4f85d63235c3a231068d",
+  "x86_64-unknown-linux-musl-0.14.14":
+    "55a1ee65f5ac9416cc40f99c2df62f0d4525d40369fe371caff945c495174d57",
+  "aarch64-apple-darwin-0.14.13":
+    "067d1a90da8add55614eff91990425883a092d8279d9e503258ff8be0f8e9c18",
+  "aarch64-pc-windows-msvc-0.14.13":
+    "f7b5b9740ae893ac6abe9b9f68865073ffb9146a6f352ba9718d53b102ad02ef",
+  "aarch64-unknown-linux-gnu-0.14.13":
+    "84ce8fe1ef9b2eba018ba396fd018ac2bc22865a9e2a02573899ea6ee8e1e5fd",
+  "aarch64-unknown-linux-musl-0.14.13":
+    "25941b777ff712f4d9473d26c1b875034214a3d5de20ea99b2add939dcd0b367",
+  "arm-unknown-linux-musleabihf-0.14.13":
+    "3d833d451accb334f9cb91141083bbee5b835dcf0b49d14e5ccb13e0b6a7c387",
+  "armv7-unknown-linux-gnueabihf-0.14.13":
+    "90aa92a6de0f63eacb2d380c324039c101c6097956690fbaec05ed8d922f8766",
+  "armv7-unknown-linux-musleabihf-0.14.13":
+    "192deb53946b4309c56c1ad7c401ddac7557d0a517da7addfc636f1188bab30d",
+  "i686-pc-windows-msvc-0.14.13":
+    "4ead4d5fc89a1f02aa97dad944e69306ae4177a689a3818d3575fed11aa994fe",
+  "i686-unknown-linux-gnu-0.14.13":
+    "a321fc4862748563a663472a4458fe514e34542d0fe8d767d67b1463d585fb2f",
+  "i686-unknown-linux-musl-0.14.13":
+    "597541ac81d553c2fe97339680bfdb3e926714763ee37f0b5dbcc572d695e376",
+  "powerpc64-unknown-linux-gnu-0.14.13":
+    "cad4c05db54969608ec292b695397ddaef7452f759b976a60b69d9fefc6c5724",
+  "powerpc64le-unknown-linux-gnu-0.14.13":
+    "bc7faa37e496ae0198ee7e1c9e8958df3c55025ccf8be175b74533f87626e726",
+  "riscv64gc-unknown-linux-gnu-0.14.13":
+    "d9c6fd360347b9b0079994246ed08186f64629529e2fd2dc1a97a31da2a214d5",
+  "s390x-unknown-linux-gnu-0.14.13":
+    "1995227a65970cb2c1aa3b03c9a5418ee1fa56210c4577e6f8e1a14d1e79ed5d",
+  "x86_64-apple-darwin-0.14.13":
+    "69e424a42ac3a7c6c7032ad96deb757c35c93c848b6ea329a3f4c605e6d89ef9",
+  "x86_64-pc-windows-msvc-0.14.13":
+    "d2af4376053458f283d74980b49dc0d61d3ef9d9b8684c5b25bd64b73e11634a",
+  "x86_64-unknown-linux-gnu-0.14.13":
+    "b1e03e4cf245411f184106ba3d973b3902021bf5327e2fde0cfad163aacdc2c1",
+  "x86_64-unknown-linux-musl-0.14.13":
+    "2fe394f493318551f271277a2228e56b31ca69a4842483e5709af4548f342bc3",
  "aarch64-apple-darwin-0.14.11":
    "c3fab6bcad9cc2f8a342829dd4ea011c54b9671d023b71baac1cbf2b3526cefd",
  "aarch64-pc-windows-msvc-0.14.11":
@@ -1,4 +1,3 @@
-import * as fs from "node:fs";
 import * as path from "node:path";
 import * as core from "@actions/core";
 import * as exec from "@actions/exec";
@@ -23,6 +22,7 @@ import {
  type Platform,
 } from "./utils/platforms";
 import { getRuffVersionFromRequirementsFile } from "./utils/pyproject";
+import { findPyprojectToml } from "./utils/pyproject-finder";

 async function run(): Promise<void> {
  const platform = getPlatform();
@@ -107,9 +107,12 @@ async function determineVersion(): Promise<string> {
    }
    return await resolveVersion(versionFromPyproject || "latest", githubToken);
  }
-  const pyProjectPath = path.join(src, "pyproject.toml");
-  if (!fs.existsSync(pyProjectPath)) {
-    core.info(`Could not find ${pyProjectPath}. Using latest version.`);
+  const pyProjectPath = findPyprojectToml(
+    src,
+    process.env.GITHUB_WORKSPACE || ".",
+  );
+  if (!pyProjectPath) {
+    core.info(`Could not find pyproject.toml. Using latest version.`);
    return await resolveVersion("latest", githubToken);
  }
  const versionFromPyproject =
@@ -0,0 +1,183 @@
+import * as path from "node:path";
+import * as core from "@actions/core";
+import { findPyprojectToml } from "./pyproject-finder";
+
+jest.mock("@actions/core", () => ({
+  debug: jest.fn(),
+  info: jest.fn(),
+}));
+
+describe("findPyprojectToml", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("when pyproject.toml exists in src directory", () => {
+    it("should return the exact path", () => {
+      const fixturesDir = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+      );
+      const workspaceRoot = path.join(__dirname, "..", "..");
+
+      const result = findPyprojectToml(fixturesDir, workspaceRoot);
+
+      expect(result).toContain("pyproject.toml");
+      expect(result).toContain("fixtures");
+      expect(core.info).toHaveBeenCalled();
+    });
+  });
+
+  describe("when pyproject.toml exists only in parent directory", () => {
+    it("should search upwards and find the parent's pyproject.toml", () => {
+      // subproject doesn't have a pyproject.toml, but its parent (parent-config-project) does
+      const subprojectDir = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+        "parent-config-project",
+        "subproject",
+      );
+      const workspaceRoot = path.join(__dirname, "..", "..");
+
+      const result = findPyprojectToml(subprojectDir, workspaceRoot);
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+      expect(result).toContain("parent-config-project");
+      expect(core.info).toHaveBeenCalled();
+    });
+  });
+
+  describe("boundary conditions", () => {
+    it("should stop searching at workspace root and return undefined when not found", () => {
+      // Create a path that won't have pyproject.toml above it
+      const nodeModulesDir = path.join(
+        __dirname,
+        "..",
+        "..",
+        "node_modules",
+        "@actions",
+      );
+      const workspaceRoot = path.join(__dirname, "..", "..");
+
+      const result = findPyprojectToml(nodeModulesDir, workspaceRoot);
+
+      // Should return undefined since there's no pyproject.toml in the search path
+      expect(result).toBeUndefined();
+      expect(core.info).not.toHaveBeenCalledWith(
+        expect.stringContaining("Found pyproject.toml"),
+      );
+    });
+
+    it("should find pyproject.toml when it exists at workspace root", () => {
+      // Use parent-config-project as the "workspace root" for this test
+      // Start from subproject (which has no pyproject.toml) to search up to workspace root
+      const subprojectDir = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+        "parent-config-project",
+        "subproject",
+      );
+      const workspaceRoot = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+        "parent-config-project",
+      );
+
+      const result = findPyprojectToml(subprojectDir, workspaceRoot);
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+      expect(result).toContain("parent-config-project");
+    });
+
+    it("should stop at workspace root even if searching from it", () => {
+      const workspaceRoot = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+      );
+
+      const result = findPyprojectToml(workspaceRoot, workspaceRoot);
+
+      // Should find pyproject.toml at workspace root
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+      expect(result).toContain("fixtures");
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle relative paths", () => {
+      const srcDir = "./__tests__/fixtures";
+      const workspaceRoot = ".";
+
+      const result = findPyprojectToml(srcDir, workspaceRoot);
+
+      // Should work with relative paths
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+    });
+
+    it("should handle when src equals workspace root", () => {
+      const workspaceRoot = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+      );
+      const result = findPyprojectToml(workspaceRoot, workspaceRoot);
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+      expect(result).toContain("fixtures");
+    });
+
+    it("should log debug messages for each checked path", () => {
+      const pythonProjectDir = path.join(
+        __dirname,
+        "..",
+        "..",
+        "__tests__",
+        "fixtures",
+        "python-project",
+      );
+      const workspaceRoot = path.join(__dirname, "..", "..");
+
+      findPyprojectToml(pythonProjectDir, workspaceRoot);
+
+      expect(core.debug).toHaveBeenCalled();
+      const debugCalls = (core.debug as jest.Mock).mock.calls;
+      expect(debugCalls.length).toBeGreaterThan(0);
+
+      // First debug call should be for the starting directory
+      expect(debugCalls[0][0]).toContain("Checking for");
+      expect(debugCalls[0][0]).toContain("python-project");
+    });
+
+    it("should handle paths with trailing slashes", () => {
+      const fixturesDir = `${path.join(__dirname, "..", "..", "__tests__", "fixtures")}/`;
+      const workspaceRoot = path.join(__dirname, "..", "..");
+
+      const result = findPyprojectToml(fixturesDir, workspaceRoot);
+
+      expect(result).toBeTruthy();
+      expect(result).toContain("pyproject.toml");
+    });
+  });
+});
@@ -0,0 +1,79 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as core from "@actions/core";
+
+/**
+ * Search for a pyproject.toml file starting from the given directory
+ * and traversing upwards through parent directories until reaching
+ * the GitHub workspace root.
+ *
+ * @param startDir The directory to start the search from (e.g., the src input)
+ * @param workspaceRoot The GitHub workspace directory (GITHUB_WORKSPACE)
+ * @returns The path to the found pyproject.toml, or undefined if not found
+ */
+export function findPyprojectToml(
+  startDir: string,
+  workspaceRoot: string,
+): string | undefined {
+  let currentDir = path.resolve(startDir);
+  const resolvedWorkspaceRoot = path.resolve(workspaceRoot);
+
+  while (true) {
+    const pyprojectPath = path.join(currentDir, "pyproject.toml");
+    core.debug(`Checking for ${pyprojectPath}`);
+
+    if (fs.existsSync(pyprojectPath)) {
+      core.info(`Found pyproject.toml at ${pyprojectPath}`);
+      return pyprojectPath;
+    }
+
+    // Check if we've reached the workspace root
+    if (currentDir === resolvedWorkspaceRoot) {
+      // If we're at workspace root and didn't find it, stop searching
+      break;
+    }
+
+    // Move up to parent directory
+    const parentDir = path.dirname(currentDir);
+
+    // If parent is the same as current, we've reached the filesystem root
+    if (parentDir === currentDir) {
+      break;
+    }
+
+    currentDir = parentDir;
+
+    // If we've gone past the workspace root, stop searching
+    if (isPathWithinWorkspace(currentDir, resolvedWorkspaceRoot) === false) {
+      break;
+    }
+  }
+
+  return undefined;
+}
+
+/**
+ * Check if a given path is within or equal to the workspace root.
+ *
+ * @param checkPath The path to check
+ * @param workspaceRoot The workspace root directory
+ * @returns true if within or equal to workspace, false if outside, undefined if can't determine
+ */
+function isPathWithinWorkspace(
+  checkPath: string,
+  workspaceRoot: string,
+): boolean | undefined {
+  try {
+    const checkPathResolved = path.resolve(checkPath);
+    const workspaceRootResolved = path.resolve(workspaceRoot);
+
+    // Check if checkPath starts with workspaceRoot (case-insensitive on Windows)
+    const relativePath = path.relative(
+      workspaceRootResolved,
+      checkPathResolved,
+    );
+    return !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+  } catch {
+    return undefined;
+  }
+}