check_or_update_tool used find() on the glob result, so with several cached entries for the same tool (rat_eq_3.18.0, rat_star_, ...) it only ever checked the alphabetically first one. A hard-pinned =x.y.z entry sorting first made 'update rat -u' report 'Already up to date' while the entry actually being executed (*) was stale.

Now all matching entries are checked/updated, each reported with its version selector (rat@=3.18.0, rat@~3.22, ...) like the all-tools path.

Docker Hub rate-limits anonymous pulls from shared GitHub runner IPs, which made test-container jobs fail in 'Initialize containers' before any test ran (and fail-fast then cancelled innocent sibling jobs). The same official images are served by public.ecr.aws/docker/library without those limits. Also set fail-fast: false so one transient pull failure only needs a re-run of that single job.

Busybox-style escape hatch for renamed gg.cmd: 'node.cmd gg update' behaves as 'gg.cmd update'. This lets a tool launched via its own applet (e.g. a renamed postmortemthis.cmd) call back into gg through the same .cmd file, via the GG_CMD_PATH it inherits.

The jump-out word is strictly lowercase 'gg' and is stripped uniformly, so 'gg.cmd gg node' also means 'gg.cmd node'. Plain applet dispatch is unchanged.

The stage4 binary (reqwest) already reads the conventional proxy env vars, but both bootstrap downloaders ignored them:

• stage2.ps1 (Windows): Invoke-WebRequest only knows the system WinINET proxy, so pointing https_proxy at an alternative (e.g. unauthenticated corporate) proxy had no effect, and downloads died with errors like "Proxy Authorization Required". Now passes -Proxy plus -ProxyUseDefaultCredentials when https_proxy/all_proxy is set to an http(s) URL.

• stage3 (Linux/macOS C): always connected directly to the blob host on port 80. Now parses http_proxy/HTTP_PROXY/all_proxy/ALL_PROXY ([http://]host[:port]), connects through the proxy and sends an absolute-URI GET. Non-http schemes (socks) are ignored; credentials are stripped with a notice (no base64 in stage3).

Also check the HTTP status line in stage3: previously a 404/407/502 response body was downloaded and only failed later with a confusing "Hash did not match"; now it fails immediately with "HTTP error NNN". The first read is NUL-terminated before the strstr header parsing, which was relying on luck before.

Tested end-to-end against the live blob store with a real release hash: direct, via a local forwarding proxy (absolute-URI request verified), creds-stripping, socks ignored, unreachable proxy, and 404 on both paths. stage2.ps1 logic verified with pwsh.

create_isolated_test_dir() named its temp dir after the current nanosecond timestamp. Under parallel test execution two tests could get the same timestamp, share a dir, and have one delete it while another was still using it -- intermittently failing at fs::remove_dir_all (seen in CI on macos-14).

Switch to tempfile::tempdir() for guaranteed uniqueness and automatic cleanup on drop, dropping the manual remove_dir_all calls. Verified stable across 20 repeated parallel runs.

download() streamed the response body regardless of status code, so a rate-limited or forbidden source (403/503 with an HTML/text body) was saved as the archive and only blew up later during extraction with a misleading 'Invalid gzip header' or 'Could not find EOCD' panic.

Check res.status() right after the response and panic with the URL and status code instead. Added a regression test that serves a 403 from a local socket and asserts the download fails with the status message (verified it fails without the fix).

• rustls-webpki 0.103.10 -> 0.103.13: DoS via panic on malformed CRL BIT STRING (high), plus two low-severity name-constraint issues
• tar 0.4.45 -> 0.4.46: PAX header desynchronization (medium) - relevant since gg extracts downloaded archives with this crate
• rand 0.8.5 -> 0.8.6 and 0.9.2 -> 0.9.4: unsoundness with custom loggers using rand::rng() (low)

Lockfile-only change; all transitive.

stage3 (unix):

• Replace unchecked gethostbyname (NULL deref = segfault on DNS failure, IPv4-only) with getaddrinfo and a connect loop, matching main-win.c. Fixes silent crash on IPv6-only or DNS-less networks.
• Guard HTTP response parsing: missing Content-Length or header terminator no longer NULL-derefs; read errors no longer loop on a dead socket. Both now print an error and clean up stage4.tmp.

stage2.sh:

• Distinguish 'no stage3 binary could execute' (exit 126/127, truly unsupported system) from 'stage3 ran but failed' (network, hash mismatch). The latter now reports a download failure instead of the misleading 'Your system is not supported'.
• Document that glob order intentionally tries aarch64 before x86_64 (Apple Silicon picks native over Rosetta).

Fixes #248. gg has no 32-bit target, so assets like uv-i686-pc-windows-msvc.zip were being matched as Arch::Any and shadowing the real x86_64 asset on 64-bit Windows.