Skip to content

chore(deps): update support-deps - #1581

Merged
bradclawsie merged 1 commit into
mainfrom
renovate/support-deps
Sep 28, 2026
Merged

chore(deps): update support-deps#1581
bradclawsie merged 1 commit into
mainfrom
renovate/support-deps

Conversation

@renovate

@renovate renovate Bot commented Sep 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
github/codeql-action action patch v4.38.1 → v4.38.2
golangci-lint tools minor 2.13.2 → 2.14.0
hk tools minor 2.0.1 → 2.2.0 2.4.0 (+2)
jdx/mise uses-with patch 2026.9.13 → 2026.9.16
prometheus-node-exporter (source) minor 4.57.0 → 4.59.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

github/codeql-action (github/codeql-action)

v4.38.2

Compare Source

golangci/golangci-lint (golangci-lint)

v2.14.0

Compare Source

Released on 2026-09-24

  1. Bug fixes
    • fix: cache of facts reloading
  2. Linters new features or changes
    • bodyclose: from 73d1f95 to 857993a (new directive handled)
    • exhaustive: from 0.12.0 to 0.13.0
    • exhaustruct_v5: from 5.0.3 to 5.2.0 (new option: allow-empty-blank-assignments)
    • go-check-sumtype: from 0.3.1 to ae6904d
    • gocritic: from 0.14.4 to 0.15.0
    • gofumpt: from 0.11.0 to 0.12.0
    • gomoddirectives: from 0.9.0 to 0.10.0
    • gosec: from 2.28.0 to 2.29.0 (re-enable G407)
    • govet-modernize: from 0.49.0 to 0.50.0
    • loggercheck: from 0.11.0 to 0.12.0
    • revive: from 1.15.0 to 1.17.0 (new rules: marshal-receiver, multiline-if-init, use-slices-concat)
    • tagliatelle: from 0.7.2 to 0.8.0
  3. Linters bug fixes
    • fatcontext: from 0.10.0 to 0.10.1
    • flock: from 0.13.0 to 0.13.1
    • godoclint: from 0.11.2 to 0.11.4
    • protogetter: from 0.3.21 to 1.0.1
    • recvcheck: from 0.3.0 to 0.3.1
    • tagalign: from 1.4.3 to 1.4.4
jdx/hk (hk)

v2.2.0

Compare Source

🚀 Features
  • (config) add batch_min_files to set the fewest files per batch by @​jdx in #​1475
🐛 Bug Fixes
  • (builtins) apply jq and yq check_diff patches instead of rerunning the tool by @​jdx in #​1468
  • (stash) skip stashing before the first commit with the git CLI backend by @​jdx in #​1469
  • (step) stop git from crashing with SIGBUS while another step rewrites a file by @​jdx in #​1476
📚 Documentation
  • (benchmarks) compare only configurations that are safe by design by @​jdx in #​1465
  • (benchmarks) lead with results and simplify the method on the benchmarks page by @​jdx in #​1472
  • refresh competitor benchmark for v2.2.0 by @​jdx in #​1462
⚡ Performance
  • (release) PGO-optimize the x86_64 musl and macOS arm64 binaries by @​jdx in #​1470
  • (step) stage each fixer's files as soon as it finishes by @​jdx in #​1466
  • (step) release a job slot while waiting for another step's files by @​jdx in #​1473
🛡️ Security
  • (benchmark) show each scenario's mode on the benchmarks page by @​jdx in #​1467
🔍 Other Changes
  • (benchmark) run competitors' whitespace fixers from pre-commit-hooks and isolate black's cache by @​jdx in #​1463
  • (benchmark) measure hk's yq builtin as shipped by @​jdx in #​1474
  • accept pull request titles whose description starts with an acronym by @​jdx in 32f72df
📦️ Dependency Updates

v2.1.0

Compare Source

🚀 Features
🐛 Bug Fixes
🧪 Testing
  • (bats) preinstall builtin tool stubs to stop spurious symlink failures by @​jdx in #​1396
🛡️ Security
🔍 Other Changes
  • (ci) comment on a discussion when the PR implementing it merges by @​jdx in #​1413
  • re-pin aube-lock reusable workflow to current renovate-config main by @​jdx in #​1388
  • regenerate mise.lock on renovate branches so tool bumps stop failing every job by @​jdx in #​1389
  • fix macOS bats attempt-1 timeouts and publish builtin test timings by @​jdx in #​1395
  • remove entire and codex agent hooks by @​jdx in b23b605
  • re-pin renovate-config reusable workflows to current main by @​jdx in #​1408
  • stop compiling cargo-edit and rebuilding hk in every CI job by @​jdx in #​1410
  • re-pin renovate-config reusable workflows to current main by @​jdx in 24fe99e
📦️ Dependency Updates
New Contributors
jdx/mise (jdx/mise)

v2026.9.16: : Per-tool libc for aqua tools, monorepo task path aliases, and packslip pins that survive repo renames

Compare Source

Aqua tools can now choose glibc or musl builds one tool at a time, and monorepo roots can get short task path aliases. Packslip tools keep installing after their GitHub or GitLab repository is renamed, because mise now pins them by repository ID, recorded in a new lockfile revision 3. SLSA provenance checks now require the expected signer identity. This release also fixes regressions in mise run --no-timings, cargo +nightly and the outdated/upgrade version comparison, and speeds up shims and config loading.

Added

  • Per-tool libc for aqua tools. On glibc Linux, mise prefers a release's gnu build even when the aqua registry names the musl one. That breaks tools whose musl build is the fully static one, such as aqua:domcyrus/rustnet. You can now pick the build for a single tool instead of changing the global libc setting. #​13701

    [tools]
"aqua:domcyrus/rustnet" = { version = "latest", libc = "musl" }

    The option accepts glibc (or gnu) and musl. mise never falls back to the other libc for that tool. The option applies to install, mise lock, and checksum, signature and provenance lookups, and it is recorded in the lockfile's tool options. A platform that already names a libc (a musl host or a linux-*-musl lockfile platform) still wins. A version that is already installed keeps its build until you run mise install --force. mise ls-remote still uses the host libc. If a registry template uses a variable named libc, set it as vars.libc.

  • Path aliases for monorepo tasks. Deeply nested config roots can now have a short name. #​13756

    monorepo_root = true

[monorepo]
config_roots = ["foo/bar/baz/abc/123"]

[monorepo.path_aliases]
"123" = "foo/bar/baz/abc/123"

    mise run //123:build runs //foo/bar/baz/abc/123:build. Aliases also work in task dependencies, in patterns like //123:*, and in child paths like //123/sub:build. Each alias must be a single path segment, must point at a configured root, and can't overlap an existing root path. A task's full path is still its canonical name.

  • Packslip tools keep installing after a repository rename. mise now pins GitHub and GitLab packslip projects by the repository ID recorded in the signing certificate, not only by name. If old/tool is renamed to new/tool under the same owner, packslip:github.com/old/tool keeps installing and prints a warning once, asking you to update the config. You don't need mise packslip forget. mise refuses a transfer to another owner. It also refuses a different repository that takes over a pinned name, which is how a deleted and re-created name looks. To accept either one, run mise packslip forget for the old name, and for a re-created repository also remove the tool's mise.lock entries. #​13702, #​13738

    In lockfile revision 3, the IDs are stored as:

    [tools.hk."platforms.linux-x64"]
repository_ids = { repository = "922514152", owner = "216188" }

  • mise dot track --allow-plaintext. Directly tracking a file with a credential-like name (for example ~/commit-mossy-token.md) used to report success while every history save quietly left the file out. mise dot track now asks whether to save the file in plaintext, and the default answer is No. In non-interactive use, pass --allow-plaintext. --yes does not approve plaintext. The choice is saved as allow_plaintext = true on the [dotfiles] entry. For real credentials, use --encrypt. #​13749

  • Registry: mise use mbx now resolves to mr-boxington. #​13752

Fixed
  • mise outdated and upgrade warnings no longer offer an older release as an update when the installed version has a v or V prefix. For example, v2.1.280 → 2.1.278 was shown as an update. Versions that differ only in build metadata (for example 1.36.4+k3s1 and 1.36.4+k3s2) are now treated as equal. #​13690 (@​himkt)
  • mise run --no-cache and mise tasks run --no-cache now clone remote git:: task includes again, and fetch remote tasks that run as dependencies again. Before, both kept using the cached copy. #​13697 (@​irisTa56)
  • mise run --no-timings hides each task's "Finished in …" line again, not only the run total. It also overrides MISE_TASK_TIMINGS=1. This had regressed in v2025.11.2. #​13718
  • cargo +nightly works again with rust = "nightly". Since 2026.8.6 mise installs a dated nightly, so rustup had no toolchain named nightly. Depending on rustup's auto-install setting, cargo +nightly then either failed or downloaded a second, unpinned nightly. mise now also sets up rustup's nightly-<host> toolchain from the pinned nightly, using reflinks or hardlinks. It leaves alone a rustup nightly that is newer or has extra components or targets. Explicitly dated requests such as nightly-2026-08-13 don't touch it. Existing installs pick this up on their next nightly install, or right away with mise install -f rust. #​13707
  • Running mise dot track again on a path that is already tracked now reports "already tracked". It no longer prompts, rewrites the config, or records an empty checkpoint. Changed file contents and flags that change the declaration (such as --no-autosave) are still saved. #​13648
  • Blob-pack downloads from the remote cache now retry transient stream errors, the same way single blob downloads do. #​13715
Security

  • SLSA provenance must come from the expected signer. Before, any valid Sigstore signature, even from an unrelated workflow, passed SLSA verification. mise now checks the certificate's URI identity and OIDC issuer against the values configured for the tool:

    • aqua registry entries: signer_identity and signer_issuer under slsa_provenance
    • github: tools: the slsa_signer_identity and slsa_signer_issuer tool options (the identity supports {{version}} templating)
    • vfox plugins: slsa_signer_identity and slsa_signer_issuer returned from PreInstall

    If a tool doesn't configure both values, mise skips the SLSA check and uses any other verification available. For now this applies to the bundled aqua packages that have SLSA metadata but no signer fields. SLSA lock entries are checked again on every install, even when a checksum is present. #​13725

  • Public-key DSSE bundles used by aqua and vfox verification must now have a SHA-256 subject digest that matches the downloaded artifact. Before, a valid bundle could be reused to verify a different download. #​13721

Performance
  • Shims no longer run rustup checks when rust is configured alongside other tools. The same goes for mise exec with auto-install disabled. One report measured the go shim at about 31 ms with rust in the config, compared with 12 ms without it. mise install, and mise exec with auto-install on, still detect and repair missing rustup components. #​13705
  • Config loading and fuzzy version resolution (for example node = "24") do less work: plugin shorthands are built without checking every registry tool's backends, global-config checks stop resolving symlinks for every tool, and fuzzy matching no longer compiles regexes. #​13694, #​13695, #​13696
Documentation
  • The task docs now give the correct default job count (8). They also describe the default output mode correctly: prefix when tasks run in parallel and interleave when they run in sequence. #​13716
Breaking Changes
  • Lockfile revision 3. New and empty mise.lock files are written as lockfile_version = 3, and older mise versions reject them. Existing lockfiles keep their revision when mise writes to them. When a revision 2 lockfile gets packslip repository IDs, mise warns and leaves them out. To store them, run mise lock --upgrade once everyone who shares the lockfile is on this release.
  • SLSA checks for locked tools. A lockfile entry that requires SLSA now fails with an explanation if the tool has no expected signer configured. To fix it, configure the signer or refresh the entry with mise lock.
  • Dotfiles history shared across machines. Older mise versions can't read enrollment metadata that includes allow_plaintext. Upgrade every machine that shares the history before you use --allow-plaintext.
New Contributors

Full Changelog: jdx/mise@vfox-v2026.9.17...v2026.9.16

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.9.15

Compare Source

v2026.9.14: : conf.d folder fragments, Stow-style dotfiles options, and mise-versions for any public GitHub repo

Compare Source

A folder inside any conf.d directory now loads as its own config fragment and serves as the config root for the files in it, which gives [bootstrap].config_roots users a direct migration path. [dotfiles] gains two GNU Stow-style options: relative symlinks and dot-<name> sources. Release metadata for any public github.com repo now comes from mise-versions, and the registry can require GitHub attestations for specific tools.

Added

  • conf.d folder fragments. A folder in a global, system, or project conf.d directory now loads as a fragment. Relative paths, {{ config_root }}, and task working directories resolve inside that folder, so a bundle can keep its files next to its config. Each folder can hold mise.toml, mise.local.toml, mise.<env>.toml, and mise.<env>.local.toml. Folders are not searched recursively, and folders whose names start with . are skipped. A folder can be a symlink. Folder fragments load after the single-file fragments in the same conf.d (in folder-name order) and before config.toml. mise use/mise set never write to them. #​13603

    ~/.config/mise/conf.d/
├── git.toml          # single-file fragment, unchanged
└── git-tools/        # folder fragment
    ├── mise.toml
    └── gitconfig

    # ~/.config/mise/conf.d/git-tools/mise.toml
[dotfiles]
"~/.gitconfig" = "gitconfig"   # resolves to conf.d/git-tools/gitconfig

    Compatibility: if a directory inside a conf.d that mise reads already contains a mise.toml, that file now loads.

  • Relative dotfile symlinks. symlink and symlink-each entries can now point at their source by a relative path, so links keep working when a home directory is mounted at a different path or moved. Turn this on for all entries with dotfiles.relative_symlinks = true (or MISE_DOTFILES_RELATIVE_SYMLINKS=1), or per entry with relative = true/false. When you turn it on, existing absolute links are re-pointed on the next apply. Turning it off does not convert relative links back to absolute ones. This option has no effect on Windows. #​13583

    [settings]
dotfiles.relative_symlinks = true

[dotfiles]
"~/.config/foo" = { source = "~/dotfiles/foo", mode = "symlink" }   # -> ../dotfiles/foo
"~/.bashrc"     = { source = "~/dotfiles/bashrc", relative = false } # stays absolute

  • dot_prefix for dotfiles. With dot_prefix = true on a symlink-each or directory copy entry, any path component named dot-<name> deploys as .<name> (for example, home/dot-config/foo deploys as ~/.config/foo). exclude and manifest = "git" still match source names. If two sources map to the same target, apply fails. mise dot add refuses to capture into dot_prefix entries, and mise oci builds use the same mapping. #​13585

    [dotfiles]
"~" = { source = "home", mode = "symlink-each", dot_prefix = true, exclude = ["README.md"] }

  • mise-versions for any public github.com repo. For github:, aqua:, and packslip: tools that aren't in the registry, version listing, release lookup, and attestation lookup now go through mise-versions, so they no longer use your GitHub API rate limit in the common case. Private repos still use your own token against api.github.com. #​13584

    • mise treats the mirror as untrusted. Download URLs must match the configured repo, release tag, and asset name, and mirrored attestations must name the requested repo.
    • In paranoid mode, mise checks a "no attestations" answer from the mirror against GitHub before skipping verification.
    • If url_replacements reroutes GitHub API paths, mise skips mise-versions for that metadata.
    • If mise-versions fails for any reason other than a 404, mise falls back to api.github.com and logs a warning.

  • Registry-required GitHub attestations. Registry github: backends can declare attestations_since = "<semver>". For versions at or after that boundary:

    • mise lock records github-attestations provenance.
    • Installs require a verified attestation for every downloaded asset. This requirement overrides weaker provenance recorded in a lockfile.
    • A missing attestation is a hard error.

    42 registry tools now set this boundary, including aube, aqua, pixi, ty, pandoc, fnox, doppler, and syncthing. Users who have turned off github_attestations are not affected. #​13586

Fixed

  • Install lock waits: when one process is waiting for another to finish installing the same tool version, the message now names the process holding the lock (waiting for install lock held by pid 61907). This is usually a shim auto-installing the tool. #​13588
  • Slow downloads: mise now warns once per download if throughput stays below 16 KiB/s for a full minute, naming the host and suggesting a mirror. The download is not aborted; http_download_timeout is still the hard limit. #​13589
  • Interrupted installs: a half-installed version no longer appears in version listings, can't be picked as the latest installed version, and doesn't keep latest/1/1.2 runtime symlinks pointing into it. #​13596
  • mise prune: no longer deletes versions pinned by another project when you run it from a directory whose .miserc.toml lists that project in ignored_config_paths. The same fix applies to mise ls --prunable and the stale-version check in mise upgrade. These commands now honor ignored_config_paths only from MISE_IGNORED_CONFIG_PATHS and global or system miserc.toml. #​13602
  • mise oci build: directory [dotfiles] entries (symlink-each and directory copy) now honor exclude and manifest = "git", so the image contains the same files mise dot apply deploys. #​13591
  • pipx/pypi: latest no longer resolves to PEP 440 developmental releases such as 2026.9.16.232951.dev0, matching what pip and uv do. Local labels like 1.1+gpu.dev0 are still treated as stable. #​13601
  • pipx/pypi: mise use 'pypi:git+ssh://git@github.com/psf/black.git' now works. Previously, the @ in git@ was read as the version separator. #​13610
  • MISE_USE_VERSIONS_HOST=0: now fetches the version list from the source instead of reusing a cached, possibly older list from the versions host. #​13605
  • brew source builds: checksum-pinned formula source downloads now follow HTTPS-to-HTTP mirror redirects (such as those from ftpmirror.gnu.org) and still reject tarballs whose checksum doesn't match. This affects Unix only. Every other download still refuses HTTPS-to-HTTP redirects. #​13611
  • npm backend on Windows: updating the bundled aube to v2.4.0 fixes lifecycle scripts failing with EISDIR: illegal operation on a directory, lstat 'C:' during npm: installs. #​13608

Changed

  • The [bootstrap].config_roots deprecation warning now explains how to move each root into a conf.d folder, either by moving it or by symlinking it. The removal date (mise 2027.3.3) is unchanged. #​13598
  • Registry: spin-framework now installs through aqua by default. The previous backend is still available. #​13594 by @​scop

Full Changelog: jdx/mise@vfox-v2026.9.15...v2026.9.14

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

prometheus-community/helm-charts (prometheus-node-exporter)

v4.59.0

Compare Source

A Helm chart for prometheus node-exporter

What's Changed

New Contributors

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-91.7.1...prometheus-node-exporter-4.59.0

v4.58.0

Compare Source

A Helm chart for prometheus node-exporter

What's Changed

  • [prometheus-node-exporter] Update quay.io/brancz/kube-rbac-proxy Docker tag to v0.23.0 by @​renovate[bot] in #​7328

Full Changelog: prometheus-community/helm-charts@prometheus-redis-exporter-6.32.0...prometheus-node-exporter-4.58.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 26, 2026 00:12
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 8c3157a to 73a3082 Compare September 26, 2026 08:49
@renovate renovate Bot changed the title chore(deps): update support dependencies to v2026.9.14 chore(deps): update support-deps Sep 26, 2026
@renovate
renovate Bot force-pushed the renovate/support-deps branch 4 times, most recently from f885710 to 2ec3ae7 Compare September 28, 2026 04:08
@renovate
chore(deps): update support-deps
c3cb0f7 
| datasource                 | package                  | from       | to         |
| -------------------------- | ------------------------ | ---------- | ---------- |
| github-tags                | github/codeql-action     | v4.38.1    | v4.38.2    |
| github-tags                | golangci/golangci-lint   | 2.13.2     | 2.14.0     |
| github-releases            | jdx/hk                   | 2.0.1      | 2.2.0      |
| github-release-attachments | jdx/mise                 | v2026.9.13 | v2026.9.16 |
| helm                       | prometheus-node-exporter | 4.57.0     | 4.59.0     |
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 2ec3ae7 to c3cb0f7 Compare September 28, 2026 12:45
@bradclawsie
bradclawsie merged commit a982a99 into main Sep 28, 2026
55 of 56 checks passed
@bradclawsie
bradclawsie deleted the renovate/support-deps branch September 28, 2026 13:29
@github-actions github-actions Bot mentioned this pull request Sep 28, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Oct 6, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@bradclawsie bradclawsie bradclawsie approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bradclawsie