Harden npm install defaults (#1026 )

CI already disables npm lifecycle scripts, but ordinary installs from the repository still run them. Set `ignore-scripts = true` in `.npmrc` so developer and maintenance installs use the same default. Keep the existing seven-day `min-release-age` policy for new resolutions. Require `npm>=11.10.0` through `engines.npm` and `engine-strict`, while retaining `devEngines` for newer clients; older installers can otherwise ignore `devEngines` and the age setting. Pin the build and checksum workflows to Node.js `24.19.0` so their bundled `npm` supports the policy. Explicit project commands such as `npm run package` remain available. Related: astral-sh/ruff-action#401 applies the matching `npm` defaults, and astral-sh/ruff-action#411 adds the same legacy-aware version floor. astral-sh/ruff#27837 applies the install-script default to Ruff's JavaScript projects. astral-sh/setup-uv#1027 separately adds registry-signature and provenance verification. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
Use JSON + a typed wrapper instead of TS codegen (#1025 )
2026-08-25 19:43:50 +00:00 · 2026-08-20 17:38:03 +02:00 · 2026-08-19 17:54:07 -04:00 · 2026-08-16 22:24:06 +02:00 · 2026-08-16 22:14:36 +02:00 · 2026-08-16 21:44:17 +02:00
23 changed files with 5359 additions and 10485 deletions
@@ -1,2 +1,3 @@
 * text=auto eol=lf
 dist/** -diff linguist-generated=true
+src/download/checksum/known-checksums.json linguist-generated=true
@@ -8,6 +8,10 @@ self-hosted-runner:
 # Empty array means no configuration variable is allowed.
 config-variables: null
 paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - 'specifying action "\$/" in invalid format because ref is missing'
+      - 'reusable workflow call "\$/.+" at "uses" is not following the format'
  .github/workflows/test.yml:
    ignore:
      - 'invalid runner name.+'
@@ -5,11 +5,11 @@ updates:
    schedule:
      interval: daily
    cooldown:
-      default-days: 7
+      default-days: 30

  - package-ecosystem: npm
    directory: /
    schedule:
      interval: daily
    cooldown:
-      default-days: 7
+      default-days: 30
@@ -116,7 +116,7 @@ jobs:
    name: Update docs
    needs:
      - release
-    uses: ./.github/workflows/update-docs.yml
+    uses: $/.github/workflows/update-docs.yml
    permissions:
      contents: write
      pull-requests: write
@@ -56,7 +56,7 @@ jobs:
          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
      - run: uv sync
        working-directory: __tests__/fixtures/uv-project
        shell: bash
@@ -81,7 +81,7 @@ jobs:
          persist-credentials: false
      - name: Install with UV_NO_MODIFY_PATH set
        id: setup-uv
-        uses: ./
+        uses: $/
        env:
          UV_NO_MODIFY_PATH: 1
      - run: |
@@ -130,7 +130,7 @@ jobs:
          persist-credentials: false
      - name: Install version ${{ matrix.input.version-input }} with strategy ${{ matrix.input.resolution-strategy || 'highest' }}
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          version: ${{ matrix.input.version-input }}
          resolution-strategy: ${{ matrix.input.resolution-strategy || 'highest' }}
@@ -154,11 +154,8 @@ jobs:
      matrix:
        version-input: ["latest", ">=0.8"]
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install version ${{ matrix.version-input }}
-        uses: ./
+        uses: $/
        with:
          version: ${{ matrix.version-input }}
      - name: Latest version gets installed
@@ -198,7 +195,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install version from ${{ matrix.input.working-directory }}
-        uses: ./
+        uses: $/
        with:
          working-directory: ${{ matrix.input.working-directory }}
      - name: Correct version gets installed
@@ -224,7 +221,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install version from ${{ matrix.input.version-file }}
-        uses: ./
+        uses: $/
        with:
          version-file: ${{ matrix.input.version-file }}
      - name: Correct version gets installed
@@ -242,7 +239,7 @@ jobs:
          persist-credentials: false
      - name: Install versions from .tool-versions
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          version-file: "__tests__/fixtures/.tool-versions"
      - name: Verify Python version from .tool-versions
@@ -267,7 +264,7 @@ jobs:
          persist-credentials: false
      - name: Install using malformed pyproject.toml
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          working-directory: "__tests__/fixtures/malformed-pyproject-toml-project"
      - run: uv --help
@@ -286,7 +283,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Checksum matches expected
-        uses: ./
+        uses: $/
        with:
          version: "0.3.2"
          checksum: ${{ matrix.inputs.checksum }}
@@ -300,7 +297,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install default version
-        uses: ./
+        uses: $/
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - run: uv sync
@@ -309,12 +306,9 @@ jobs:
  test-uvx:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install default version
-        uses: ./
-      - run: uvx ruff --version
+        uses: $/
+      - run: uvx ruff@0.14.10 --version

  test-tool-install:
    runs-on: ${{ matrix.os }}
@@ -322,12 +316,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, macos-14, windows-latest]
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install default version
-        uses: ./
-      - run: uv tool install ruff
+        uses: $/
+      - run: uv tool install ruff==0.14.10
      - run: ruff --version

  test-python-version:
@@ -341,7 +332,7 @@ jobs:
          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          python-version: 3.13.1t
      - name: Verify UV_PYTHON is set to correct version
@@ -368,12 +359,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          python-version: 3.13.1t
          activate-environment: true
@@ -407,12 +395,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          python-version: 3.13.1t
          activate-environment: true
@@ -458,9 +443,6 @@ jobs:
  test-activate-environment-no-project:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Create incompatible pyproject.toml
        run: |
          cat > pyproject.toml <<'EOF'
@@ -476,7 +458,7 @@ jobs:
        shell: bash
      - name: Install latest version with no-project
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          python-version: 3.13.1t
          activate-environment: true
@@ -506,7 +488,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install latest version
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
      - run: uv sync
@@ -521,7 +503,7 @@ jobs:
          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
      - name: Verify cache key contains alpine
@@ -555,12 +537,9 @@ jobs:
          - os: windows-2025
            expected-os: "windows-2025"
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Setup uv
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
      - name: Verify cache key contains OS version
@@ -585,7 +564,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: ${{ matrix.enable-cache }}
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-${{ matrix.os }}-${{ matrix.enable-cache }}
@@ -605,7 +584,7 @@ jobs:
          persist-credentials: false
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: ${{ matrix.enable-cache }}
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-${{ matrix.os }}-${{ matrix.enable-cache }}
@@ -638,7 +617,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-requirements-txt
@@ -655,7 +634,7 @@ jobs:
          persist-credentials: false
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-requirements-txt
@@ -678,7 +657,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -700,7 +679,7 @@ jobs:
          echo 'dev-dependencies = []' >> __tests__/fixtures/uv-project/pyproject.toml
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-dependency-glob: |
@@ -723,7 +702,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          save-cache: false
@@ -740,7 +719,7 @@ jobs:
          persist-credentials: false
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-save-cache-false
@@ -759,7 +738,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-setup-cache-restore-cache-false
@@ -775,7 +754,7 @@ jobs:
          persist-credentials: false
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          restore-cache: false
@@ -798,11 +777,8 @@ jobs:
            expected-cache-dir: "D:\\a\\_temp\\setup-uv-cache"
    runs-on: ${{ matrix.inputs.os }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-cache-local
@@ -816,11 +792,8 @@ jobs:
  test-cache-local-cache-disabled:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Setup without cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: false

@@ -835,11 +808,8 @@ jobs:
  test-cache-local-cache-disabled-but-explicit-path:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Setup without cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: false
          cache-local-path: /tmp/uv-cache-disabled
@@ -861,7 +831,7 @@ jobs:
      - name: Fake pyproject.toml at root
        run: cp __tests__/fixtures/old-python-constraint-project/pyproject.toml pyproject.toml
      - name: Setup with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
      - run: uv sync
@@ -874,7 +844,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Install from custom manifest file
-        uses: ./
+        uses: $/
        with:
          manifest-file: "https://raw.githubusercontent.com/astral-sh/setup-uv/${{ github.ref }}/__tests__/download/custom-manifest.ndjson"
      - run: uv sync
@@ -889,12 +859,9 @@ jobs:
  test-download-from-astral-mirror-false:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install with download-from-astral-mirror disabled
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          download-from-astral-mirror: false
      - name: Verify uv is installed
@@ -903,14 +870,11 @@ jobs:
  test-absolute-path:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Create requirements.txt
        run: echo "uv==0.6.17" > /tmp/setup-uv-requirements.txt
      - name: Install from requirements file
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          version-file: "/tmp/setup-uv-requirements.txt"
      - name: Correct version gets installed
@@ -923,16 +887,13 @@ jobs:
  test-relative-path:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: mkdir
        run: mkdir -p /tmp/setup-uv-test-relative-path
      - name: Create requirements.txt
        run: echo "uv==0.6.17" > /tmp/setup-uv-test-relative-path/setup-uv-requirements.txt
      - name: Install from requirements file
        id: setup-uv
-        uses: ./
+        uses: $/
        with:
          version-file: "./setup-uv-requirements.txt"
          working-directory: "/tmp/setup-uv-test-relative-path"
@@ -951,7 +912,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup uv
-        uses: ./
+        uses: $/
        with:
          cache-suffix: ${{ github.run_id }}-${{ github.run_attempt }}-test-cache-prune-force
      - name: Create long running python script
@@ -974,7 +935,7 @@ jobs:
            exit 1
          fi
      - name: Setup uv
-        uses: ./
+        uses: $/
        with:
          working-directory: __tests__/fixtures/cache-dir-defined-project
      - run: uv sync
@@ -995,7 +956,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Setup uv with cache and python cache enabled
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-python: true
@@ -1022,7 +983,7 @@ jobs:
            exit 1
          fi
      - name: Setup uv with cache
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-python: true
@@ -1050,7 +1011,7 @@ jobs:
          fi
      - name: Restore with cache
        id: restore
-        uses: ./
+        uses: $/
        with:
          enable-cache: true
          cache-python: true
@@ -1081,12 +1042,9 @@ jobs:
            expected-python-dir: "D:\\a\\_temp\\uv-python-dir"
    runs-on: ${{ matrix.inputs.os }}
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
      - name: Install latest version
        id: setup-uv
-        uses: ./
+        uses: $/
      - name: Check Python dir is expected dir
        run: |
          if [ "$UV_PYTHON_INSTALL_DIR" != "${{ matrix.inputs.expected-python-dir }}" ]; then
@@ -1097,21 +1055,6 @@ jobs:
      - name: Install python works
        run: uv python install

-  test-act:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install act
-        run: gh extension install https://github.com/nektos/gh-act
-        env:
-          GH_TOKEN: ${{ github.token }}
-      - name: Run test-uvx with act
-        run: gh act -j test-uvx -P ubuntu-latest=catthehacker/ubuntu:act-latest
-        env:
-          GH_TOKEN: ${{ github.token }}
-
  test-workflow-run:
    runs-on: ubuntu-latest
    steps:
@@ -1187,7 +1130,6 @@ jobs:
      - test-cache-python-installs
      - test-restore-python-installs
      - test-python-install-dir
-      - test-act
      - test-workflow-run
      - validate-typings
    if: always()
@@ -60,20 +60,8 @@ jobs:
          else
              echo "changes-exist=false" >> "$GITHUB_OUTPUT"
          fi
-      - name: Commit and push changes
-        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
-        id: commit-and-push
-        continue-on-error: true
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git add .
-          git commit -m "docs: update version references to $NEW_VERSION"
-          git push origin HEAD:refs/heads/main
-        env:
-          NEW_VERSION: ${{ steps.tag-info.outputs.tag }}
      - name: Create Pull Request
-        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "docs: update version references to ${{ steps.tag-info.outputs.tag }}"
@@ -26,7 +26,7 @@ jobs:
        id: update-known-checksums
        run:
          node dist/update-known-checksums/index.cjs
-          src/download/checksum/known-checksums.ts
+          src/download/checksum/known-checksums.json
      - name: Check for changes
        id: changes-exist
        run: |
@@ -39,21 +39,8 @@ jobs:
      - name: Compile changes
        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
        run: npm ci --ignore-scripts && npm run all
-      - name: Commit and push changes
-        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
-        id: commit-and-push
-        continue-on-error: true
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git add .
-          git commit -m "chore: update known checksums for $LATEST_VERSION"
-          git push origin HEAD:refs/heads/main
-        env:
-          LATEST_VERSION: ${{ steps.update-known-checksums.outputs.latest-version }}
-
      - name: Create Pull Request
-        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' && steps.commit-and-push.outcome != 'success' }}
+        if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "chore: update known checksums"
@@ -0,0 +1,3 @@
+engine-strict = true
+ignore-scripts = true
+min-release-age = 7
@@ -1 +1 @@
-24
+24.19.0
@@ -26,7 +26,7 @@ Set up your GitHub Actions workflow with a specific version of [uv](https://docs

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 ```

 If you do not specify a version, this action will look for a [required-version](https://docs.astral.sh/uv/reference/settings/#required-version)
@@ -42,7 +42,7 @@ Have a look under [Advanced Configuration](#advanced-configuration) for detailed

 ```yaml
 - name: Install uv with all available options
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    # The version of uv to install, e.g., "0.5.0", "latest", or "latest-known" (default: searches for version in config files, then latest)
    version: ""
@@ -156,7 +156,7 @@ python 3.13
 ```

 ```yaml
- uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+- uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version-file: ".tool-versions"
 ```
@@ -167,7 +167,7 @@ a warning.

 ```yaml
 - name: Install the latest version of uv and set the python version to 3.13t
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    python-version: 3.13t
 - run: uv pip install --python=3.13t pip
@@ -185,7 +185,7 @@ jobs:
    steps:
      - uses: actions/checkout@v5
      - name: Install the latest version of uv and set the python version
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          python-version: ${{ matrix.python-version }}
      - name: Test with python ${{ matrix.python-version }}
@@ -202,7 +202,7 @@ It also controls where [the venv gets created](#activate-environment), unless `v

 ```yaml
 - name: Install uv based on the config files in the working-directory
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    working-directory: my/subproject/dir
 ```
@@ -244,7 +244,7 @@ For example:
 - name: Checkout the repository
  uses: actions/checkout@main
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
 - name: Test
@@ -256,7 +256,7 @@ To install a specific version of Python, use

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
 - name: Install Python 3.12
@@ -275,7 +275,7 @@ output:
  uses: actions/checkout@main
 - name: Install the default version of uv
  id: setup-uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 - name: Print the installed version
  run: echo "Installed uv version is ${{ steps.setup-uv.outputs.uv-version }}"
 ```
@@ -0,0 +1,27 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { expect, test } from "@jest/globals";
+import { updateChecksums } from "../../../src/download/checksum/update-known-checksums";
+
+test("serializes checksum entries as JSON data", async () => {
+  const tempDirectory = await fs.mkdtemp(
+    path.join(os.tmpdir(), "setup-uv-checksums-test-"),
+  );
+  const outputPath = path.join(tempDirectory, "known-checksums.json");
+  const key = 'platform-1.0.0"\n};\nglobalThis.compromised = true;';
+  const checksum = 'checksum"\\\nvalue';
+
+  try {
+    await updateChecksums(outputPath, [
+      { checksum, key },
+      { checksum: "duplicate", key },
+    ]);
+
+    const content = await fs.readFile(outputPath, "utf8");
+    expect(JSON.parse(content)).toEqual({ [key]: checksum });
+    expect(content.endsWith("\n")).toBe(true);
+  } finally {
+    await fs.rm(tempDirectory, { force: true, recursive: true });
+  }
+});
@@ -94506,8 +94506,26 @@ var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/uv/releases/downlo
 var crypto6 = __toESM(require("node:crypto"), 1);
 var fs10 = __toESM(require("node:fs"), 1);

-// src/download/checksum/known-checksums.ts
-var KNOWN_CHECKSUMS = {
+// src/download/checksum/known-checksums.json
+var known_checksums_default = {
+  "aarch64-apple-darwin-0.12.5": "5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62",
+  "aarch64-pc-windows-msvc-0.12.5": "724279317fee6e5fa8ad1908e4eba2bbe764ef1ece5b3f4597927b62b1fe562a",
+  "aarch64-unknown-linux-gnu-0.12.5": "9bf43b4d1a07665bf64d4c4e710930b382321a785e0eb10aac07f46471f86a31",
+  "aarch64-unknown-linux-musl-0.12.5": "8767a0e77f2cd45436401b1b42bf7e9ed5a4a91a74a5305d6fe93249d0f6dbc5",
+  "arm-unknown-linux-musleabihf-0.12.5": "970f86ddcd1373120c1e7ee246b533c2e75366294098e1406f07ecf3bb55d260",
+  "armv7-unknown-linux-gnueabihf-0.12.5": "63f86f3cd92de223c2680dee5149ed3f317ad7aeac774fd7e6fe1f86f53e85da",
+  "armv7-unknown-linux-musleabihf-0.12.5": "62f838f29cad6fda061b1566168555978c544a4107697cd1967398b7f8efea84",
+  "i686-pc-windows-msvc-0.12.5": "a5993a7c2e75b418e60d5ed733204222330085b14e85269545b084c273c1629b",
+  "i686-unknown-linux-gnu-0.12.5": "4875a06092c3b0aa8ece5265a42b053dfef649adba26434b5e40eeb58c2a2aa5",
+  "i686-unknown-linux-musl-0.12.5": "b920f32f0910be363f770485117e08494eec0b09abb4f3f9f1f9b9f53a29394c",
+  "powerpc64le-unknown-linux-gnu-0.12.5": "af3f868fc8af2c3a688b1a202cbed507ec5bb32522876141f1b7f4200ed0395f",
+  "riscv64gc-unknown-linux-gnu-0.12.5": "2a6fe4a685225082d82f8afba169d038d669f85bf6cff7f5f733079a7b7282d5",
+  "riscv64gc-unknown-linux-musl-0.12.5": "c7fc653d16f0214eaaf2b3af537ec917af4861e3d00c0f10e0784fe4cbc1dcd6",
+  "s390x-unknown-linux-gnu-0.12.5": "858d51fd178fe99c69923cef568fbac3f297f3767c0e0d985aa172bc1f3e2274",
+  "x86_64-apple-darwin-0.12.5": "b3b2137477cf96c9686ebfb71524614cec780c673fd73e59bce099aef02e70e8",
+  "x86_64-pc-windows-msvc-0.12.5": "4c4d49d8738847d9b71ba319e49a5688c93eac0fe6204b1df24e98528dddf39a",
+  "x86_64-unknown-linux-gnu-0.12.5": "68a509da24b06b4223a1c0175fb5eb5bc79342b76cbeff0cfe51ac3f5b17b6b2",
+  "x86_64-unknown-linux-musl-0.12.5": "a4742988791c9aeae68c78150d6cba762062ad2a47e53738c2779d2b596bfcdb",
  "aarch64-apple-darwin-0.12.4": "99a913b606194867b43086404412c1afe079547fee72ecfb6af7e7b0dd54b0c6",
  "aarch64-pc-windows-msvc-0.12.4": "3290abffee78c30e3113f5113e26684fd057287e89124a588dcdcdd6ceec0fea",
  "aarch64-unknown-linux-gnu-0.12.4": "49d881b3403187e1f1789720881e77e4251ad4259d86c4844862657d2a35d13f",
@@ -99654,6 +99672,9 @@ var KNOWN_CHECKSUMS = {
  "x86_64-unknown-linux-musl-0.0.5": "705bbe04a93a9d4d9db5224c2f980a88bba272538a33a78ea2e966f46b4d5eb7"
 };

+// src/download/checksum/known-checksums.ts
+var KNOWN_CHECKSUMS = known_checksums_default;
+
 // src/download/checksum/checksum.ts
 async function validateChecksum(checksum, downloadPath, arch3, platform2, version3) {
  const key = `${arch3}-${platform2}-${version3}`;
@@ -47180,8 +47180,26 @@ var semver2 = __toESM(require_semver(), 1);
 // src/download/checksum/known-version.ts
 var semver = __toESM(require_semver(), 1);

-// src/download/checksum/known-checksums.ts
-var KNOWN_CHECKSUMS = {
+// src/download/checksum/known-checksums.json
+var known_checksums_default = {
+  "aarch64-apple-darwin-0.12.5": "5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62",
+  "aarch64-pc-windows-msvc-0.12.5": "724279317fee6e5fa8ad1908e4eba2bbe764ef1ece5b3f4597927b62b1fe562a",
+  "aarch64-unknown-linux-gnu-0.12.5": "9bf43b4d1a07665bf64d4c4e710930b382321a785e0eb10aac07f46471f86a31",
+  "aarch64-unknown-linux-musl-0.12.5": "8767a0e77f2cd45436401b1b42bf7e9ed5a4a91a74a5305d6fe93249d0f6dbc5",
+  "arm-unknown-linux-musleabihf-0.12.5": "970f86ddcd1373120c1e7ee246b533c2e75366294098e1406f07ecf3bb55d260",
+  "armv7-unknown-linux-gnueabihf-0.12.5": "63f86f3cd92de223c2680dee5149ed3f317ad7aeac774fd7e6fe1f86f53e85da",
+  "armv7-unknown-linux-musleabihf-0.12.5": "62f838f29cad6fda061b1566168555978c544a4107697cd1967398b7f8efea84",
+  "i686-pc-windows-msvc-0.12.5": "a5993a7c2e75b418e60d5ed733204222330085b14e85269545b084c273c1629b",
+  "i686-unknown-linux-gnu-0.12.5": "4875a06092c3b0aa8ece5265a42b053dfef649adba26434b5e40eeb58c2a2aa5",
+  "i686-unknown-linux-musl-0.12.5": "b920f32f0910be363f770485117e08494eec0b09abb4f3f9f1f9b9f53a29394c",
+  "powerpc64le-unknown-linux-gnu-0.12.5": "af3f868fc8af2c3a688b1a202cbed507ec5bb32522876141f1b7f4200ed0395f",
+  "riscv64gc-unknown-linux-gnu-0.12.5": "2a6fe4a685225082d82f8afba169d038d669f85bf6cff7f5f733079a7b7282d5",
+  "riscv64gc-unknown-linux-musl-0.12.5": "c7fc653d16f0214eaaf2b3af537ec917af4861e3d00c0f10e0784fe4cbc1dcd6",
+  "s390x-unknown-linux-gnu-0.12.5": "858d51fd178fe99c69923cef568fbac3f297f3767c0e0d985aa172bc1f3e2274",
+  "x86_64-apple-darwin-0.12.5": "b3b2137477cf96c9686ebfb71524614cec780c673fd73e59bce099aef02e70e8",
+  "x86_64-pc-windows-msvc-0.12.5": "4c4d49d8738847d9b71ba319e49a5688c93eac0fe6204b1df24e98528dddf39a",
+  "x86_64-unknown-linux-gnu-0.12.5": "68a509da24b06b4223a1c0175fb5eb5bc79342b76cbeff0cfe51ac3f5b17b6b2",
+  "x86_64-unknown-linux-musl-0.12.5": "a4742988791c9aeae68c78150d6cba762062ad2a47e53738c2779d2b596bfcdb",
  "aarch64-apple-darwin-0.12.4": "99a913b606194867b43086404412c1afe079547fee72ecfb6af7e7b0dd54b0c6",
  "aarch64-pc-windows-msvc-0.12.4": "3290abffee78c30e3113f5113e26684fd057287e89124a588dcdcdd6ceec0fea",
  "aarch64-unknown-linux-gnu-0.12.4": "49d881b3403187e1f1789720881e77e4251ad4259d86c4844862657d2a35d13f",
@@ -52328,6 +52346,9 @@ var KNOWN_CHECKSUMS = {
  "x86_64-unknown-linux-musl-0.0.5": "705bbe04a93a9d4d9db5224c2f980a88bba272538a33a78ea2e966f46b4d5eb7"
 };

+// src/download/checksum/known-checksums.ts
+var KNOWN_CHECKSUMS = known_checksums_default;
+
 // src/download/checksum/known-version.ts
 var VERSION_IN_CHECKSUM_KEY_PATTERN = /-(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
 function getLatestKnownVersion() {
@@ -52355,9 +52376,8 @@ async function updateChecksums(filePath, checksumEntries) {
    }
    deduplicatedEntries.set(entry.key, entry.checksum);
  }
-  const body = [...deduplicatedEntries.entries()].map(([key, checksum]) => `  "${key}":
-    "${checksum}"`).join(",\n");
-  const content = "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n" + body + (body === "" ? "" : ",\n") + "};\n";
+  const content = `${JSON.stringify(Object.fromEntries(deduplicatedEntries), null, 2)}
+`;
  await import_node_fs.promises.writeFile(filePath, content);
 }

@@ -6,7 +6,7 @@ This document covers advanced options for configuring which version of uv to ins

 ```yaml
 - name: Install the latest version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: "latest"
 ```
@@ -19,7 +19,7 @@ When `manifest-file` is set, `latest-known` still selects a version from setup-u

 ```yaml
 - name: Install the latest version of uv known to setup-uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: "latest-known"
 ```
@@ -28,7 +28,7 @@ When `manifest-file` is set, `latest-known` still selects a version from setup-u

 ```yaml
 - name: Install a specific version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: "0.4.4"
 ```
@@ -41,21 +41,21 @@ to install the latest version that satisfies the range.

 ```yaml
 - name: Install a semver range of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: ">=0.4.0"
 ```

 ```yaml
 - name: Pinning a minor version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: "0.4.x"
 ```

 ```yaml
 - name: Install a pep440-specifier-satisfying version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: ">=0.4.25,<0.5"
 ```
@@ -67,7 +67,7 @@ You can change this behavior using the `resolution-strategy` input:

 ```yaml
 - name: Install the lowest compatible version of uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: ">=0.4.0"
    resolution-strategy: "lowest"
@@ -92,7 +92,7 @@ as `UV_PYTHON`. Only a single Python version is supported; multiple fallback ver

 ```yaml
 - name: Install uv based on the version defined in pyproject.toml
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version-file: "pyproject.toml"
 ```
@@ -103,7 +103,7 @@ silently picking up a newer uv until the lockfile is updated.

 ```yaml
 - name: Install uv based on the version locked in uv.lock
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version-file: "uv.lock"
 ```
@@ -23,7 +23,7 @@ The computed cache key is available as the `cache-key` output:
 ```yaml
 - name: Setup uv
  id: setup-uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
 - name: Print cache key
@@ -53,7 +53,7 @@ You can optionally define a custom cache key suffix.
 ```yaml
 - name: Enable caching and define a custom cache key suffix
  id: setup-uv
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-suffix: "optional-suffix"
@@ -92,7 +92,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define a cache dependency glob
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-dependency-glob: "**/pyproject.toml"
@@ -100,7 +100,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define a list of cache dependency globs
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-dependency-glob: |
@@ -110,7 +110,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Define an absolute cache dependency glob
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-dependency-glob: "/tmp/my-folder/requirements*.txt"
@@ -118,7 +118,7 @@ changes. If you use relative paths, they are relative to the working directory.

 ```yaml
 - name: Never invalidate the cache
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-dependency-glob: ""
@@ -131,7 +131,7 @@ By default, the cache will be restored.

 ```yaml
 - name: Don't restore an existing cache
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    restore-cache: false
@@ -145,7 +145,7 @@ By default, the cache will be saved.

 ```yaml
 - name: Don't save the cache after the run
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    save-cache: false
@@ -171,7 +171,7 @@ It defaults to `setup-uv-cache` in the `TMP` dir, `D:\a\_temp\setup-uv-cache` on

 ```yaml
 - name: Define a custom uv cache path
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    cache-local-path: "/path/to/cache"
 ```
@@ -188,7 +188,7 @@ If you want to prune the cache before saving it, enable cache pruning with the `

 ```yaml
 - name: Prune the cache before saving it
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    prune-cache: true
@@ -207,7 +207,7 @@ To force managed Python installs, set `UV_PYTHON_PREFERENCE=only-managed`.

 ```yaml
 - name: Cache Python installs
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    cache-python: true
@@ -225,7 +225,7 @@ If you want to ignore this, set the `ignore-nothing-to-cache` input to `true`.

 ```yaml
 - name: Ignore nothing to cache
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    enable-cache: true
    ignore-nothing-to-cache: true
@@ -10,7 +10,7 @@ are automatically verified by this action. The sha256 hashes can be found on the

 ```yaml
 - name: Install a specific version and validate the checksum
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    version: "0.3.1"
    checksum: "e11b01402ab645392c7ad6044db63d37e4fd1e745e015306993b07695ea5f9f8"
@@ -39,7 +39,7 @@ The `archive_format` field is currently ignored.

 ```yaml
 - name: Use a custom manifest file
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    manifest-file: "https://example.com/my-custom-manifest.ndjson"
 ```
@@ -58,7 +58,7 @@ You can disable this by setting the `add-problem-matchers` input to `false`.

 ```yaml
 - name: Install the latest version of uv without problem matchers
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    add-problem-matchers: false
 ```
@@ -9,7 +9,7 @@ This allows directly using it in later steps:

 ```yaml
 - name: Install the latest version of uv and activate the environment
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    activate-environment: true
 - run: uv pip install pip
@@ -20,7 +20,7 @@ By default, the venv is created at `.venv` inside the `working-directory`.
 You can customize the venv location with `venv-path`, for example to place it in the runner temp directory:

 ```yaml
- uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+- uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    activate-environment: true
    venv-path: ${{ runner.temp }}/custom-venv
@@ -51,7 +51,7 @@ are not sufficient, you can provide a custom GitHub token with the necessary per

 ```yaml
 - name: Install the latest version of uv with a custom GitHub token
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
 ```
@@ -69,7 +69,7 @@ input:

 ```yaml
 - name: Install the latest version of uv with a custom tool dir
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    tool-dir: "/path/to/tool/dir"
 ```
@@ -88,7 +88,7 @@ If you want to change this behaviour (especially on self-hosted runners) you can

 ```yaml
 - name: Install the latest version of uv with a custom tool bin dir
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    tool-bin-dir: "/path/to/tool-bin/dir"
 ```
@@ -105,7 +105,7 @@ This action supports expanding the `~` character to the user's home directory fo

 ```yaml
 - name: Expand the tilde character
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    cache-local-path: "~/path/to/cache"
    tool-dir: "~/path/to/tool/dir"
@@ -122,7 +122,7 @@ If you want to ignore this, set the `ignore-empty-workdir` input to `true`.

 ```yaml
 - name: Ignore empty workdir
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    ignore-empty-workdir: true
 ```
@@ -146,7 +146,7 @@ This action sets several environment variables that influence uv's behavior and

 ```yaml
 - name: Example using environment variables
-  uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+  uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
  with:
    python-version: "3.12"
    tool-dir: "/custom/tool/dir"
@@ -30,6 +30,9 @@
        "js-yaml": "^5.2.3",
        "ts-jest": "^29.4.11",
        "typescript": "^6.0.3"
+      },
+      "engines": {
+        "npm": ">=11.10.0"
      }
    },
    "node_modules/@actions/cache": {
@@ -5,6 +5,16 @@
  "type": "module",
  "description": "Set up your GitHub Actions workflow with a specific version of uv",
  "main": "dist/setup/index.cjs",
+  "engines": {
+    "npm": ">=11.10.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=11.10.0",
+      "onFail": "error"
+    }
+  },
  "scripts": {
    "build": "tsc --noEmit",
    "check": "biome check --write",
@@ -12,7 +22,7 @@
    "test:unit": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js",
    "test": "npm run build && npm run test:unit",
    "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
-    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.ts",
+    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.json",
    "all": "npm run build && npm run check && npm run package && npm run test:unit"
  },
  "repository": {
@@ -19,16 +19,7 @@ export async function updateChecksums(
    deduplicatedEntries.set(entry.key, entry.checksum);
  }

-  const body = [...deduplicatedEntries.entries()]
-    .map(([key, checksum]) => `  "${key}":\n    "${checksum}"`)
-    .join(",\n");
-
-  const content =
-    "// AUTOGENERATED_DO_NOT_EDIT\n" +
-    "export const KNOWN_CHECKSUMS: { [key: string]: string } = {\n" +
-    body +
-    (body === "" ? "" : ",\n") +
-    "};\n";
+  const content = `${JSON.stringify(Object.fromEntries(deduplicatedEntries), null, 2)}\n`;

  await fs.writeFile(filePath, content);
 }
@@ -5,6 +5,7 @@
    "module": "esnext",
    "moduleResolution": "bundler",
    "noImplicitAny": true,
+    "resolveJsonModule": true,
    "strict": true,
    "target": "ES2022"
  },
@@ -1 +1 @@
 
 .19.0