diff --git a/.mise/lib/jmx_exporter_compat.py b/.mise/lib/jmx_exporter_compat.py
index be29a2715..dd364e064 100755
--- a/.mise/lib/jmx_exporter_compat.py
+++ b/.mise/lib/jmx_exporter_compat.py
@@ -7,8 +7,6 @@
 import subprocess
 import xml.etree.ElementTree as ET
 from pathlib import Path
-from typing import Optional
-
 
 DEFAULT_JMX_EXPORTER_DIR = Path(
     os.environ.get("JMX_EXPORTER_DIR", "/tmp/jmx-exporter-compat")
@@ -34,8 +32,8 @@
 
 def run_cmd(
     cmd: list[str],
-    cwd: Optional[Path] = None,
-    env: Optional[dict[str, str]] = None,
+    cwd: Path | None = None,
+    env: dict[str, str] | None = None,
 ) -> None:
     subprocess.run(cmd, cwd=cwd, check=True, env=env)
 
@@ -59,10 +57,12 @@ def check_clean_worktree(jmx_exporter_dir: Path) -> None:
         )
 
 
-def get_prom_version(root_dir: Path = Path.cwd()) -> str:
+def get_prom_version(root_dir: Path | None = None) -> str:
     configured_version = DEFAULT_PROM_VERSION
     if configured_version:
         return configured_version
+    if root_dir is None:
+        root_dir = Path.cwd()
     pom = ET.parse(root_dir / "pom.xml")
     root = pom.getroot()
     version = root.findtext("./{*}version")
@@ -96,7 +96,9 @@ def prepare_repo(
     )
 
 
-def install_local_artifacts(root_dir: Path = Path.cwd()) -> None:
+def install_local_artifacts(root_dir: Path | None = None) -> None:
+    if root_dir is None:
+        root_dir = Path.cwd()
     run_cmd(
         [
             "./mvnw",
@@ -141,7 +143,7 @@ def quick_test_images(
 
 def run_maven_test(
     jmx_exporter_dir: Path = DEFAULT_JMX_EXPORTER_DIR,
-    prom_version: Optional[str] = None,
+    prom_version: str | None = None,
 ) -> None:
     if prom_version is None:
         prom_version = get_prom_version()
diff --git a/.mise/lib/micrometer_compat.py b/.mise/lib/micrometer_compat.py
index dc3b9191f..b1c50d49f 100755
--- a/.mise/lib/micrometer_compat.py
+++ b/.mise/lib/micrometer_compat.py
@@ -6,8 +6,6 @@
 import subprocess
 import xml.etree.ElementTree as ET
 from pathlib import Path
-from typing import Optional
-
 
 DEFAULT_MICROMETER_DIR = Path(
     os.environ.get("MICROMETER_DIR", "/tmp/micrometer-compat")
@@ -27,7 +25,7 @@
 DEFAULT_PROM_VERSION = os.environ.get("PROM_VERSION")
 
 
-def run_cmd(cmd: list[str], cwd: Optional[Path] = None) -> None:
+def run_cmd(cmd: list[str], cwd: Path | None = None) -> None:
     subprocess.run(cmd, cwd=cwd, check=True)
 
 
@@ -49,10 +47,12 @@ def check_clean_worktree(micrometer_dir: Path) -> None:
         )
 
 
-def get_prom_version(root_dir: Path = Path.cwd()) -> str:
+def get_prom_version(root_dir: Path | None = None) -> str:
     configured_version = DEFAULT_PROM_VERSION
     if configured_version:
         return configured_version
+    if root_dir is None:
+        root_dir = Path.cwd()
     pom = ET.parse(root_dir / "pom.xml")
     root = pom.getroot()
     version = root.findtext("./{*}version")
@@ -64,7 +64,7 @@ def get_prom_version(root_dir: Path = Path.cwd()) -> str:
 
 
 def write_init_script(
-    init_script: Path = DEFAULT_INIT_SCRIPT, prom_version: Optional[str] = None
+    init_script: Path = DEFAULT_INIT_SCRIPT, prom_version: str | None = None
 ) -> None:
     if prom_version is None:
         prom_version = get_prom_version()
@@ -120,7 +120,9 @@ def prepare_repo(
     )
 
 
-def install_local_artifacts(root_dir: Path = Path.cwd()) -> None:
+def install_local_artifacts(root_dir: Path | None = None) -> None:
+    if root_dir is None:
+        root_dir = Path.cwd()
     run_cmd(
         [
             "./mvnw",
@@ -144,7 +146,7 @@ def install_local_artifacts(root_dir: Path = Path.cwd()) -> None:
 
 
 def run_gradle_test(
-    test_selector: Optional[str] = None,
+    test_selector: str | None = None,
     micrometer_dir: Path = DEFAULT_MICROMETER_DIR,
     init_script: Path = DEFAULT_INIT_SCRIPT,
 ) -> None:
diff --git a/.mise/tasks/generate_benchmark_summary.py b/.mise/tasks/generate_benchmark_summary.py
old mode 100644
new mode 100755
index e37f1e09c..3a1929b49
--- a/.mise/tasks/generate_benchmark_summary.py
+++ b/.mise/tasks/generate_benchmark_summary.py
@@ -18,12 +18,13 @@
 
 import argparse
 import json
+import math
 import os
 import shutil
+import subprocess
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Dict, List, Optional, Tuple
 
 
 def parse_args():
@@ -83,7 +84,7 @@ def parse_args():
     return parser.parse_args()
 
 
-def get_system_info() -> Dict[str, str]:
+def get_system_info() -> dict[str, str]:
     """Capture system hardware information."""
     import multiprocessing
     import platform
@@ -92,7 +93,7 @@ def get_system_info() -> Dict[str, str]:
 
     try:
         info["cpu_cores"] = str(multiprocessing.cpu_count())
-    except Exception:
+    except NotImplementedError:
         pass
 
     try:
@@ -104,17 +105,16 @@ def get_system_info() -> Dict[str, str]:
     except FileNotFoundError:
         # macOS
         try:
-            import subprocess
-
             result = subprocess.run(
                 ["sysctl", "-n", "machdep.cpu.brand_string"],
                 capture_output=True,
+                check=False,
                 text=True,
                 timeout=5,
             )
             if result.returncode == 0:
                 info["cpu_model"] = result.stdout.strip()
-        except Exception:
+        except (OSError, subprocess.SubprocessError):
             pass
 
     try:
@@ -127,18 +127,17 @@ def get_system_info() -> Dict[str, str]:
     except FileNotFoundError:
         # macOS
         try:
-            import subprocess
-
             result = subprocess.run(
                 ["sysctl", "-n", "hw.memsize"],
                 capture_output=True,
+                check=False,
                 text=True,
                 timeout=5,
             )
             if result.returncode == 0:
                 bytes_mem = int(result.stdout.strip())
                 info["memory_gb"] = str(round(bytes_mem / 1024 / 1024 / 1024))
-        except Exception:
+        except (OSError, ValueError, subprocess.SubprocessError):
             pass
 
     info["os"] = f"{platform.system()} {platform.release()}"
@@ -146,7 +145,7 @@ def get_system_info() -> Dict[str, str]:
     return info
 
 
-def read_system_info(path: Optional[str]) -> Dict[str, str]:
+def read_system_info(path: str | None) -> dict[str, str]:
     """Read system info from JSON, or capture it from the current host."""
     if not path:
         return get_system_info()
@@ -163,7 +162,7 @@ def write_system_info(path: str) -> None:
         f.write("\n")
 
 
-def format_system_info(sysinfo: Optional[Dict[str, str]]) -> str:
+def format_system_info(sysinfo: dict[str, str] | None) -> str:
     """Format captured system info for markdown."""
     if not sysinfo:
         return "unknown"
@@ -179,23 +178,22 @@ def format_system_info(sysinfo: Optional[Dict[str, str]]) -> str:
     return ", ".join(parts) if parts else "unknown"
 
 
-def get_commit_sha(provided_sha: Optional[str]) -> str:
+def get_commit_sha(provided_sha: str | None) -> str:
     """Get commit SHA from argument, git, or return 'local'."""
     if provided_sha:
         return provided_sha
 
     try:
-        import subprocess
-
         result = subprocess.run(
             ["git", "rev-parse", "HEAD"],
             capture_output=True,
+            check=False,
             text=True,
             timeout=5,
         )
         if result.returncode == 0:
             return result.stdout.strip()
-    except Exception:
+    except (OSError, subprocess.SubprocessError):
         pass
 
     return "local"
@@ -221,7 +219,7 @@ def format_error(error) -> str:
     """Format error value, handling NaN."""
     try:
         error_val = float(error)
-        if error_val != error_val:  # NaN check
+        if math.isnan(error_val):
             return ""
         elif error_val >= 1_000:
             return f"± {error_val / 1_000:.2f}K"
@@ -244,18 +242,18 @@ def short_benchmark_name(name: str) -> str:
     return name.replace("io.prometheus.metrics.benchmarks.", "")
 
 
-def metric_score(result: Dict) -> Optional[float]:
+def metric_score(result: dict) -> float | None:
     """Extract a benchmark score as a finite float."""
     try:
         score = float(result.get("primaryMetric", {}).get("score"))
-        if score == score:
+        if not math.isnan(score):
             return score
     except (ValueError, TypeError):
         pass
     return None
 
 
-def score_interval(result: Dict) -> Optional[Tuple[float, float]]:
+def score_interval(result: dict) -> tuple[float, float] | None:
     """Extract the JMH confidence interval for a benchmark result."""
     metric = result.get("primaryMetric", {})
     confidence = metric.get("scoreConfidence")
@@ -263,7 +261,7 @@ def score_interval(result: Dict) -> Optional[Tuple[float, float]]:
         try:
             low = float(confidence[0])
             high = float(confidence[1])
-            if low == low and high == high:
+            if not math.isnan(low) and not math.isnan(high):
                 return min(low, high), max(low, high)
         except (ValueError, TypeError):
             pass
@@ -273,21 +271,21 @@ def score_interval(result: Dict) -> Optional[Tuple[float, float]]:
         return None
     try:
         error = float(metric.get("scoreError"))
-        if error == error:
+        if not math.isnan(error):
             return score - error, score + error
     except (ValueError, TypeError):
         pass
     return None
 
 
-def lower_is_better(result: Dict) -> bool:
+def lower_is_better(result: dict) -> bool:
     """Return true for JMH modes where lower score is better."""
     mode = str(result.get("mode", ""))
     unit = str(result.get("primaryMetric", {}).get("scoreUnit", ""))
     return mode in {"avgt", "sample", "ss"} or unit.endswith("/op")
 
 
-def comparison_status(head: Dict, baseline: Dict) -> str:
+def comparison_status(head: dict, baseline: dict) -> str:
     """Classify a benchmark comparison using confidence intervals."""
     head_interval = score_interval(head)
     baseline_interval = score_interval(baseline)
@@ -317,7 +315,7 @@ def comparison_status(head: Dict, baseline: Dict) -> str:
     return "faster" if head_score > baseline_score else "slower"
 
 
-def performance_change(head: Dict, baseline: Dict) -> Optional[float]:
+def performance_change(head: dict, baseline: dict) -> float | None:
     """Return percent performance change, with positive meaning faster."""
     head_score = metric_score(head)
     baseline_score = metric_score(baseline)
@@ -328,7 +326,7 @@ def performance_change(head: Dict, baseline: Dict) -> Optional[float]:
     return (head_score / float(baseline_score) - 1) * 100
 
 
-def format_change(change: Optional[float]) -> str:
+def format_change(change: float | None) -> str:
     """Format a percent performance change."""
     if change is None:
         return ""
@@ -336,16 +334,16 @@ def format_change(change: Optional[float]) -> str:
 
 
 def generate_comparison_section(
-    results: List,
-    baseline_results: List,
+    results: list,
+    baseline_results: list,
     commit_sha: str,
     baseline_sha: str,
     repo: str,
     baseline_repo: str,
-    comparison_note: Optional[str] = None,
-    system_info: Optional[Dict[str, str]] = None,
-    baseline_system_info: Optional[Dict[str, str]] = None,
-) -> List[str]:
+    comparison_note: str | None = None,
+    system_info: dict[str, str] | None = None,
+    baseline_system_info: dict[str, str] | None = None,
+) -> list[str]:
     """Generate a base-vs-head benchmark comparison section."""
     by_name = {b.get("benchmark", ""): b for b in results if b.get("benchmark")}
     baseline_by_name = {
@@ -408,15 +406,15 @@ def generate_comparison_section(
 
 
 def generate_markdown(
-    results: List,
+    results: list,
     commit_sha: str,
     repo: str,
-    baseline_results: Optional[List] = None,
-    baseline_sha: Optional[str] = None,
-    baseline_repo: Optional[str] = None,
-    comparison_note: Optional[str] = None,
-    system_info: Optional[Dict[str, str]] = None,
-    baseline_system_info: Optional[Dict[str, str]] = None,
+    baseline_results: list | None = None,
+    baseline_sha: str | None = None,
+    baseline_repo: str | None = None,
+    comparison_note: str | None = None,
+    system_info: dict[str, str] | None = None,
+    baseline_system_info: dict[str, str] | None = None,
 ) -> str:
     """Generate markdown summary from JMH results."""
     datetime_str = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
@@ -477,12 +475,12 @@ def generate_markdown(
         )
 
     # Group by benchmark class
-    benchmarks_by_class: Dict[str, List] = {}
+    benchmarks_by_class: dict[str, list] = {}
     for b in results:
         name = b.get("benchmark", "")
         parts = name.rsplit(".", 1)
         if len(parts) == 2:
-            class_name, method = parts
+            class_name, _method = parts
             class_short = class_name.split(".")[-1]
         else:
             class_short = "Other"
@@ -563,7 +561,7 @@ def generate_markdown(
 
         try:
             error_val = float(error)
-            if error_val != error_val:  # NaN
+            if math.isnan(error_val):
                 error_str = ""
             else:
                 error_str = f"± {error_val:.3f}"
diff --git a/.mise/tasks/jmx-exporter/prepare.py b/.mise/tasks/jmx-exporter/prepare.py
index 348415f7f..845b76661 100755
--- a/.mise/tasks/jmx-exporter/prepare.py
+++ b/.mise/tasks/jmx-exporter/prepare.py
@@ -5,7 +5,6 @@
 
 import sys
 
-
 sys.path.insert(0, ".mise/lib")
 
 
diff --git a/.mise/tasks/jmx-exporter/test.py b/.mise/tasks/jmx-exporter/test.py
index 3e3989300..0f7694c19 100755
--- a/.mise/tasks/jmx-exporter/test.py
+++ b/.mise/tasks/jmx-exporter/test.py
@@ -5,7 +5,6 @@
 
 import sys
 
-
 sys.path.insert(0, ".mise/lib")
 
 
diff --git a/.mise/tasks/lint/bom.py b/.mise/tasks/lint/bom.py
index d77b88e23..e4c70988c 100755
--- a/.mise/tasks/lint/bom.py
+++ b/.mise/tasks/lint/bom.py
@@ -7,7 +7,6 @@
 import sys
 from fnmatch import fnmatch
 from pathlib import Path
-from typing import List
 
 ROOT = Path(__file__).resolve().parents[3]  # repo root (.. from .mise/tasks/lint)
 IGNORE_DIRS = {"prometheus-metrics-parent"}
@@ -31,7 +30,7 @@ def first_artifact_id(pom_file: Path) -> str:
     return matches[1].strip()
 
 
-def add_dir(dir_path: Path, want: List[str]):
+def add_dir(dir_path: Path, want: list[str]):
     if not dir_path.is_dir():
         raise FileNotFoundError(f"Directory {dir_path} does not exist.")
 
@@ -49,8 +48,8 @@ def add_dir(dir_path: Path, want: List[str]):
     want.append(artifact_id)
 
 
-def collect_want(root: Path) -> List[str]:
-    want: List[str] = []
+def collect_want(root: Path) -> list[str]:
+    want: list[str] = []
     # top-level prometheus-metrics*
     for entry in sorted(root.iterdir()):
         if entry.is_dir() and fnmatch(entry.name, f"{MODULE_PREFIX}*"):
@@ -68,14 +67,15 @@ def collect_want(root: Path) -> List[str]:
     return want_unique
 
 
-def collect_have(bom_pom: Path) -> List[str]:
+def collect_have(bom_pom: Path) -> list[str]:
     if not bom_pom.is_file():
         raise FileNotFoundError(f"BOM file {bom_pom} does not exist.")
 
     text = bom_pom.read_text(encoding="utf-8")
     # find artifactId values that start with MODULE_PREFIX
     matches = re.findall(
-        r"<artifactId>\s*(%s[^<\s]*)\s*</artifactId>" % re.escape(MODULE_PREFIX), text
+        rf"<artifactId>\s*({re.escape(MODULE_PREFIX)}[^<\s]*)\s*</artifactId>",
+        text,
     )
     return sorted(matches)
 
@@ -108,7 +108,7 @@ def main() -> int:
         else:
             return 0
 
-    except Exception as e:
+    except (OSError, RuntimeError) as e:
         print(e, file=sys.stderr)
         return 1
 
diff --git a/.mise/tasks/micrometer/prepare.py b/.mise/tasks/micrometer/prepare.py
index ba13acf69..c4fbf2208 100755
--- a/.mise/tasks/micrometer/prepare.py
+++ b/.mise/tasks/micrometer/prepare.py
@@ -5,7 +5,6 @@
 
 import sys
 
-
 sys.path.insert(0, ".mise/lib")
 
 
diff --git a/.mise/tasks/micrometer/test.py b/.mise/tasks/micrometer/test.py
index 40316f569..68fb3f661 100755
--- a/.mise/tasks/micrometer/test.py
+++ b/.mise/tasks/micrometer/test.py
@@ -5,7 +5,6 @@
 
 import sys
 
-
 sys.path.insert(0, ".mise/lib")
 
 
diff --git a/.mise/tasks/test_update-benchmarks.py b/.mise/tasks/test_update-benchmarks.py
index 3d80b4983..a42091ef1 100644
--- a/.mise/tasks/test_update-benchmarks.py
+++ b/.mise/tasks/test_update-benchmarks.py
@@ -66,7 +66,7 @@ def test_update_only_inserts_matching_class_lines(self):
         updated = update_pre_blocks_under_module(self.module_path, self.table)
         # All three files should be updated
         self.assertEqual(
-            set(os.path.basename(p) for p in updated),
+            {os.path.basename(p) for p in updated},
             {
                 os.path.basename(self.files["CounterBenchmark"]),
                 os.path.basename(self.files["HistogramBenchmark"]),
diff --git a/.mise/tasks/update_benchmarks.py b/.mise/tasks/update_benchmarks.py
index b6eeba53c..6f7f788dd 100755
--- a/.mise/tasks/update_benchmarks.py
+++ b/.mise/tasks/update_benchmarks.py
@@ -29,10 +29,9 @@
 import shlex
 import subprocess
 import sys
-from typing import List, Optional
 
 
-def run_cmd(cmd: List[str], cwd: Optional[str] = None) -> str:
+def run_cmd(cmd: list[str], cwd: str | None = None) -> str:
     """Run a command, stream stdout/stderr to the console for progress, and return the full output.
 
     This replaces the previous blocking subprocess.run approach so users can see build / JMH
@@ -47,7 +46,7 @@ def run_cmd(cmd: List[str], cwd: Optional[str] = None) -> str:
         print(f"Command not found: {cmd[0]}")
         raise
 
-    output_lines: List[str] = []
+    output_lines: list[str] = []
     try:
         assert proc.stdout is not None
         # Stream lines as they appear and capture them for returning
@@ -94,7 +93,7 @@ def find_benchmarks_jar(module: str) -> str:
     return jar
 
 
-def run_jmh(jar: str, java_cmd: str, extra_args: Optional[str]) -> str:
+def run_jmh(jar: str, java_cmd: str, extra_args: str | None) -> str:
     args = [java_cmd, "-jar", jar, "-rf", "text"]
     if extra_args:
         args += shlex.split(extra_args)
@@ -128,7 +127,7 @@ def extract_first_table(jmh_output: str) -> str:
     return table
 
 
-def filter_table_for_class(table: str, class_name: str) -> Optional[str]:
+def filter_table_for_class(table: str, class_name: str) -> str | None:
     """
     Return a table string that contains only the header and the lines belonging to `class_name`.
     If no matching lines are found, return None.
@@ -157,16 +156,19 @@ def filter_table_for_class(table: str, class_name: str) -> Optional[str]:
     return header + "\n" + "\n".join(matched)
 
 
-def update_pre_blocks_under_module(module: str, table: str) -> List[str]:
+def update_pre_blocks_under_module(module: str, table: str) -> list[str]:
     # Find files under module and update any <pre>...</pre> block that contains 'thrpt'
     updated_files = []
     for path in glob.glob(os.path.join(module, "**"), recursive=True):
         if os.path.isdir(path):
             continue
+        content = None
         try:
             with open(path, "r", encoding="utf-8") as f:
                 content = f.read()
-        except Exception:
+        except (OSError, UnicodeError):
+            pass
+        if content is None:
             continue
         # quick filter
         if "<pre>" not in content or "thrpt" not in content:
@@ -188,10 +190,10 @@ def update_pre_blocks_under_module(module: str, table: str) -> List[str]:
         # This will match patterns like: " * <pre>... </pre>" and capture the prefix (e.g. " * ")
         pattern = re.compile(r"(?m)^(?P<prefix>[ \t]*\*[ \t]*)<pre>[\s\S]*?</pre>")
 
-        def repl(m: re.Match) -> str:
+        def repl(m: re.Match, replacement_table: str = filtered_table) -> str:
             prefix = m.group("prefix")
             # Build the new block with the same prefix on each line
-            lines = filtered_table.splitlines()
+            lines = replacement_table.splitlines()
             replaced = prefix + "<pre>\n"
             for ln in lines:
                 replaced += prefix + ln.rstrip() + "\n"
@@ -207,7 +209,7 @@ def repl(m: re.Match) -> str:
     return updated_files
 
 
-def main(argv: List[str]):
+def main(argv: list[str]):
     parser = argparse.ArgumentParser()
     parser.add_argument("--mvnw", default="./mvnw", help="Path to maven wrapper")
     parser.add_argument(
diff --git a/mise.lock b/mise.lock
index 179dfef1d..8809f7764 100644
--- a/mise.lock
+++ b/mise.lock
@@ -172,43 +172,43 @@ url_api = "https://api.github.com/repos/grafana/oats/releases/assets/487171324"
 provenance = "github-attestations"
 
 [[tools."aqua:jonwiggins/xmloxide"]]
-version = "v0.4.3"
+version = "v0.4.4"
 backend = "aqua:jonwiggins/xmloxide"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.linux-arm64"]
-checksum = "sha256:abb840c558fdc94b4c1eddb1e4a3901d6c8129dcb76f387428dc2b30a7364967"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_linux-aarch64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587060"
+checksum = "sha256:ec79d70f3e0483a54f1873b5ba36c3908c10eb77dd6c764363d232ed30c07809"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_linux-aarch64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020867"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.linux-arm64-musl"]
-checksum = "sha256:abb840c558fdc94b4c1eddb1e4a3901d6c8129dcb76f387428dc2b30a7364967"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_linux-aarch64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587060"
+checksum = "sha256:ec79d70f3e0483a54f1873b5ba36c3908c10eb77dd6c764363d232ed30c07809"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_linux-aarch64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020867"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.linux-x64"]
-checksum = "sha256:46ccd30ff3a242b3d01ab72366cc3b6762882be604ebceaa32123a40d0af2dfc"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_linux-x86-64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587058"
+checksum = "sha256:43220f57c69d0b8b10b883f11c2da17f66e854639aab84d331631d02ac220ff2"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_linux-x86-64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020866"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.linux-x64-musl"]
-checksum = "sha256:46ccd30ff3a242b3d01ab72366cc3b6762882be604ebceaa32123a40d0af2dfc"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_linux-x86-64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587058"
+checksum = "sha256:43220f57c69d0b8b10b883f11c2da17f66e854639aab84d331631d02ac220ff2"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_linux-x86-64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020866"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.macos-arm64"]
-checksum = "sha256:6a2cb055e63ae97d75cd346c34138a9e31626e1dfc0983006c422c203b5cc288"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_darwin-aarch64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587063"
+checksum = "sha256:bc93bca8c3d64d1aac2d0844966750b8d4529902624a46e42ea9b5ee9a99b0df"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_darwin-aarch64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020870"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.macos-x64"]
-checksum = "sha256:e83cbba88862d009405b5ce9e48025ff84b683a39a0832dde2db5395cb54734f"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_darwin-x86-64"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587061"
+checksum = "sha256:0f1d5955e8af0197e17f0da199321ef5f54adeb9c0f6a5acc35e122559239cb3"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_darwin-x86-64"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020868"
 
 [tools."aqua:jonwiggins/xmloxide"."platforms.windows-x64"]
-checksum = "sha256:22872cad20b8ce8ccab28c42ce17acc9aa64b82cbad7d130ee74196cd74cd414"
-url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.3/xmllint_windows-x86-64.exe"
-url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/411587062"
+checksum = "sha256:be3928e8d12e791996e1746a78ad61370d2ad83ea3036a30bb882205575f6823"
+url = "https://github.com/jonwiggins/xmloxide/releases/download/v0.4.4/xmllint_windows-x86-64.exe"
+url_api = "https://api.github.com/repos/jonwiggins/xmloxide/releases/assets/484020865"
 
 [[tools."aqua:owenlamont/ryl"]]
 version = "0.21.0"
@@ -251,49 +251,49 @@ url_api = "https://api.github.com/repos/owenlamont/ryl/releases/assets/454375990
 provenance = "github-attestations"
 
 [[tools.biome]]
-version = "2.5.3"
+version = "2.5.5"
 backend = "aqua:biomejs/biome"
 
 [tools.biome."platforms.linux-arm64"]
-checksum = "sha256:b642ded43aebcad738926b40eefd4dc2187a206d1fbfb37a45f1db4986804dbd"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-linux-arm64"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058837"
+checksum = "sha256:836d16eea672a4e92966e019582f606ef4a687496abbf6d547f31a5ef8a33548"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-linux-arm64"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416084"
 provenance = "github-attestations"
 
 [tools.biome."platforms.linux-arm64-musl"]
-checksum = "sha256:1a69ea4eb55baaec0bedd7d6ada3b1e626e2b430ecfc9a8f1b90373ca78aeb70"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-linux-arm64-musl"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058836"
+checksum = "sha256:0f487c28eca2c87e0eb79b73ad84c9fc0bbab6a6cf3513f5fedbc74ef2ca2d0b"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-linux-arm64-musl"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416087"
 provenance = "github-attestations"
 
 [tools.biome."platforms.linux-x64"]
-checksum = "sha256:ab8e74af2366127306e250652d2f32bd193601f208fcd0604112080c0ca3245b"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-linux-x64"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058832"
+checksum = "sha256:12ecb833102c8bf8ab6ede7ecd5b6e6fc76e8af95b3ef356933a1f5330afc028"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-linux-x64"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416085"
 provenance = "github-attestations"
 
 [tools.biome."platforms.linux-x64-musl"]
-checksum = "sha256:03cf125720b1d791093c9c68be34875d08638c314b3e1e63db1a45f2b418b1ca"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-linux-x64-musl"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058833"
+checksum = "sha256:549fea27c74212aaeb2c737346028facbcca7a93f66cf4aa145388dd8b18d7bc"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-linux-x64-musl"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416086"
 provenance = "github-attestations"
 
 [tools.biome."platforms.macos-arm64"]
-checksum = "sha256:610d3e1e770d373368d4ccee5a19c5e1735b0235024fcbed6ae07eb080d3bb09"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-darwin-arm64"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058834"
+checksum = "sha256:6072d68d3a4faf74c2802c106654904f2052f85675a3d1632213dd977a4b64bb"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-darwin-arm64"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416090"
 provenance = "github-attestations"
 
 [tools.biome."platforms.macos-x64"]
-checksum = "sha256:4df90556830ed35e6238e4b976b942d369a5378447c8d68b260b7a38e08b26f9"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-darwin-x64"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058835"
+checksum = "sha256:81f7f09a1ffacd225a65a29e2506ad02013b95964e684554cc5cc7ae9db005b4"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-darwin-x64"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416089"
 provenance = "github-attestations"
 
 [tools.biome."platforms.windows-x64"]
-checksum = "sha256:04c9ca46af43a0d060b22b21f94c7e1a9e8c57963a09778b8ff1d808ed536b31"
-url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.3/biome-win32-x64.exe"
-url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
+checksum = "sha256:f24c77f79d02dff42bfa4ee62e31b0522754d87eaaa3202435c7126cdb30ebd2"
+url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5.5/biome-win32-x64.exe"
+url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/484416083"
 provenance = "github-attestations"
 
 [[tools.editorconfig-checker]]
@@ -512,7 +512,7 @@ checksum = "sha256:0ae68406b42d7725661da979b1403ec9926da205c6770827f33aac9d8f26e
 url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip"
 
 [[tools."npm:renovate"]]
-version = "43.257.4"
+version = "43.279.1"
 backend = "npm:renovate"
 
 [[tools.protoc]]
@@ -555,95 +555,95 @@ url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/proto
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060259"
 
 [[tools.ruff]]
-version = "0.15.21"
+version = "0.16.0"
 backend = "aqua:astral-sh/ruff"
 
 [tools.ruff."platforms.linux-arm64"]
-checksum = "sha256:2ec7c0077431f96f74c3c72aea6505e902bc2ff47127653c8de1389ee30a3cb3"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700003"
+checksum = "sha256:7a6add3d38768dfa00c6d3853e9bd940b5526f3fbb76f02b1fe77ec0653f1e0e"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540070"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.linux-arm64-musl"]
-checksum = "sha256:2ec7c0077431f96f74c3c72aea6505e902bc2ff47127653c8de1389ee30a3cb3"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700003"
+checksum = "sha256:7a6add3d38768dfa00c6d3853e9bd940b5526f3fbb76f02b1fe77ec0653f1e0e"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540070"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.linux-x64"]
-checksum = "sha256:7e157ff9a2e13676118c587e6db0ec02d040e415b21014346d230e64789c0e78"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700081"
+checksum = "sha256:2138b7bc58ff877f5bba09aea4cc984ad5699433b6a3f811003527b8cff8e9ad"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540129"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.linux-x64-musl"]
-checksum = "sha256:7e157ff9a2e13676118c587e6db0ec02d040e415b21014346d230e64789c0e78"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700081"
+checksum = "sha256:2138b7bc58ff877f5bba09aea4cc984ad5699433b6a3f811003527b8cff8e9ad"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540129"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.macos-arm64"]
-checksum = "sha256:0452f9d5da6e8051d332cf21ae82a608d8e2cfeec5a71a46ffa9e50adbb2381d"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471699864"
+checksum = "sha256:ce6564491a2cc4b0659f45ee174dbef17e4dec24e03a9c03d313b5430bc21099"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540064"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.macos-x64"]
-checksum = "sha256:7e6ff3bd585b5b7c47634c957ac84fb5806d3c7ab4ef0e5ec1c53ce272f489da"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700061"
+checksum = "sha256:3d9ef6228c4eeb26d593c398b2dc5250e0f6d6425933db2993fcf30d49c78b69"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540116"
 provenance = "github-attestations"
 
 [tools.ruff."platforms.windows-x64"]
-checksum = "sha256:035c59abfd7bd1102e0b656f5771e6ae7a712a45ef54b5ab575541c7ff7d1eb0"
-url = "https://github.com/astral-sh/ruff/releases/download/0.15.21/ruff-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/471700068"
+checksum = "sha256:c5d1185c47261f86361d03b547da25be79120226a6f1721d623b2aba9d27668b"
+url = "https://github.com/astral-sh/ruff/releases/download/0.16.0/ruff-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/astral-sh/ruff/releases/assets/487540121"
 provenance = "github-attestations"
 
 [[tools.rumdl]]
-version = "v0.2.31"
+version = "v0.2.43"
 backend = "aqua:rvben/rumdl"
 
 [tools.rumdl."platforms.linux-arm64"]
-checksum = "sha256:d5aa4ac3f94de9b6508021f70d78be592c6dc8b67ea499c6e203c1e3daf044b0"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381480"
+checksum = "sha256:d5388225fa5e87c558c8d9bdc78dba515ce5ac2cbf8213fcc56ecdeabe534776"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745474"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.linux-arm64-musl"]
-checksum = "sha256:d5aa4ac3f94de9b6508021f70d78be592c6dc8b67ea499c6e203c1e3daf044b0"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381480"
+checksum = "sha256:d5388225fa5e87c558c8d9bdc78dba515ce5ac2cbf8213fcc56ecdeabe534776"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745474"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.linux-x64"]
-checksum = "sha256:5550f7954457248c6e29715b69d4ec2e9394613de51f98b50fa81f197a29af92"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381477"
+checksum = "sha256:e74e580aaf32698f61081ef1f6b9748f5c3fc1df311c14ab47ad3548a6a62f81"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745475"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.linux-x64-musl"]
-checksum = "sha256:5550f7954457248c6e29715b69d4ec2e9394613de51f98b50fa81f197a29af92"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381477"
+checksum = "sha256:e74e580aaf32698f61081ef1f6b9748f5c3fc1df311c14ab47ad3548a6a62f81"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745475"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.macos-arm64"]
-checksum = "sha256:368a02639247be530043abc36c40310090c09ef69b32f5744f9a0d9cc2673be5"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381484"
+checksum = "sha256:43b19e0783b68135029b4f58dcb5bb7bf571f498107f6dae107e08bc6fe07214"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745481"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.macos-x64"]
-checksum = "sha256:bc8933e04b5c83b8b14c21793c7f7902bc8b1a841bb1f1964c5f177b3cf7d05f"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381479"
+checksum = "sha256:9ae902fa12b095911a7568457afdcde73a5295b168a063cdf8d478a3728d6411"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745471"
 provenance = "github-attestations"
 
 [tools.rumdl."platforms.windows-x64"]
-checksum = "sha256:f8a4b2abf774301fd4ffd04f56e12fb0b2bf4357b28c63ec355405d57f0cfe88"
-url = "https://github.com/rvben/rumdl/releases/download/v0.2.31/rumdl-v0.2.31-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/474381488"
+checksum = "sha256:7cef2e64bba950f5425c2c46983b1ca4a5122a33ff60e2cf3ff001e24d0beb30"
+url = "https://github.com/rvben/rumdl/releases/download/v0.2.43/rumdl-v0.2.43-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/rvben/rumdl/releases/assets/488745485"
 provenance = "github-attestations"
 
 [[tools.shellcheck]]
@@ -796,41 +796,41 @@ url = "https://github.com/crate-ci/typos/releases/download/v1.48.0/typos-v1.48.0
 url_api = "https://api.github.com/repos/crate-ci/typos/releases/assets/462430871"
 
 [[tools.zizmor]]
-version = "1.26.1"
+version = "1.28.0"
 backend = "aqua:zizmorcore/zizmor"
 
 [tools.zizmor."platforms.linux-arm64"]
-checksum = "sha256:711f5af366b299128f9a04b1470e37d990b41fbd21f14a1a4148d25004a83762"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.26.1/zizmor-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/453417983"
+checksum = "sha256:324e43770cfacf4216f8aefb287263b5b5c733c85b03bf7583b5cc4a0460239e"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.28.0/zizmor-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/485211654"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-arm64-musl"]
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-x64"]
-checksum = "sha256:8556289a64e7aaf2400cd516f61a471aa91c5902cc56ad96a82fd12f90c2ef73"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.26.1/zizmor-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/453417985"
+checksum = "sha256:e87b67160194884e375a46a12c57ccc904f762b53845f254fab7f17d98809c09"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.28.0/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/485211657"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-x64-musl"]
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.macos-arm64"]
-checksum = "sha256:68ab2b37836bbd44f6cfffcc102b9ffffbc20c5d67d84293dafb63bd2775a1da"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.26.1/zizmor-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/453417984"
+checksum = "sha256:54949bbd6b4c8527046bb8990bac9e0dab3eec787640f4e6199ae121dd1040be"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.28.0/zizmor-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/485211655"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.macos-x64"]
-checksum = "sha256:2967414a561f8c1264121e8f723c3b5abcf3d1bf7ce5063114df99985dd75801"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.26.1/zizmor-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/453417982"
+checksum = "sha256:40a58d8560d65c71357b3977d0da425773bf8f10bf1ffd38099d963d3afdf3aa"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.28.0/zizmor-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/485211652"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.windows-x64"]
-checksum = "sha256:c6cea156935e3b9d36faeca4fd8f622d23f7a7578da26adb34e6456abd9beb9a"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.26.1/zizmor-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/453417981"
+checksum = "sha256:06e5b2345323201ed4c55897651862fee3b43f79ddced799f1236f0f0d1c1c0f"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.28.0/zizmor-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/485211651"
 provenance = "github-attestations"
diff --git a/mise.toml b/mise.toml
index 94c3beb17..497c10f19 100644
--- a/mise.toml
+++ b/mise.toml
@@ -9,20 +9,20 @@ protoc = "35.1"
 # Linters
 actionlint = "1.7.12"
 "aqua:grafana/flint" = "0.22.9"
-"aqua:jonwiggins/xmloxide" = "v0.4.3"
+"aqua:jonwiggins/xmloxide" = "v0.4.4"
 "aqua:owenlamont/ryl" = "0.21.0"
-biome = "2.5.3"
+biome = "2.5.5"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"
-"npm:renovate" = "43.257.4"
-ruff = "0.15.21"
-rumdl = "v0.2.31"
+"npm:renovate" = "43.279.1"
+ruff = "0.16.0"
+rumdl = "v0.2.43"
 shellcheck = "v0.11.0"
 shfmt = "3.13.1"
 taplo = "0.10.0"
 typos = "1.48.0"
-zizmor = "1.26.1"
+zizmor = "1.28.0"
 
 [env]
 FLINT_CONFIG_DIR = ".github/config"