Skip to content

chore(deps): update support-deps - #1543

Merged
bradclawsie merged 1 commit into
mainfrom
renovate/support-deps
Sep 8, 2026
Merged

chore(deps): update support-deps#1543
bradclawsie merged 1 commit into
mainfrom
renovate/support-deps

Conversation

@renovate

@renovate renovate Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
aqua:defenseunicorns/uds-cli tools minor 0.36.0 → 0.37.0
goreleaser/goreleaser minor v2.17.1 → v2.18.0 v2.18.1
hk tools minor 1.57.0 → 1.58.1
jdx/mise uses-with patch 2026.9.1 → 2026.9.3

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

defenseunicorns/uds-cli (aqua:defenseunicorns/uds-cli)

v0.37.0

Compare Source

⚠ BREAKING CHANGES
  • next: operator monitor command (#​1528)
  • keep CLI features out of Zarf tools (#​1525)
  • next: artifact support for remove (#​1477)
Features
Bug Fixes
Miscellaneous
goreleaser/goreleaser (goreleaser/goreleaser)

v2.18.0

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.18.

Changelog

New Features
Security updates
Bug fixes
Documentation updates
Other work

Full Changelog: goreleaser/goreleaser@v2.17.1...v2.18.0

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

jdx/hk (hk)

v1.58.1

Compare Source

📚 Documentation
jdx/mise (jdx/mise)

v2026.9.3

Compare Source

v2026.9.2: : Packslip Backend, SSH Relay, and Reimagined Install Progress

Compare Source

This is a large release headlined by the new stable packslip: backend for installing tools from a vendor's own signed release manifest, a read-only GitHub SSH relay for remote onboarding, redesigned install progress for both terminals and CI logs, and a rebuilt dotfiles-tracking model for bootstrap. It also carries dozens of fixes across shims, tasks, brew, Go, npm, and the schema, plus two security fixes.

Highlights
  • The packslip: backend is now generally available: install tools directly from a project's cryptographically signed release manifest, with signer pinning, trusted stampers, host-requirement checks, shell completions, and agent skills all driven from the same signed source.
  • Install output was reimagined end to end. Interactive terminals get a live region with a fractional install-wide bar and permanent completion lines, while CI logs, pipes, and AI-agent terminals get a compact append-only reporter instead of thousands of scrolling rows.
  • Bootstrap grows a read-only GitHub SSH relay and --from-git onboarding, an AUR package manager, and a rebuilt dotfiles-history model that tracks files through ordinary Git commits synchronized with an origin.
Added

  • packslip: New packslip: backend installs tools from a vendor-published, signed release manifest (a sigstore bundle) that names every artifact with its digest, platform, format, and executables. The tool name is a pin, like a known_hosts entry: packslip:github.com/owner/repo accepts only a packslip signed by that repository's release workflow, and signature, log entry, statement, digest, and size are all verified before anything is unpacked. Custom hosts and monorepo tools are supported. The backend is no longer experimental. (#​12778, #​12811 by @​jdx)

    [tools]
"packslip:github.com/oxc-project/oxc/oxlint" = "latest"

  • packslip: Signer pinning remembers, per project, the signer that signed the first accepted release in a pins.toml file (like SSH's known_hosts) and records the signer in mise.lock, so a later release signed by anyone else, or one that weakens provenance, is refused. mise packslip pins lists what is pinned and mise packslip forget <project> accepts an announced key rotation. (#​12783 by @​jdx)

  • packslip: New packslip.stampers setting lets you require that a trusted host has stamped a version before mise offers or installs it (a scanning service, a mirror, or eventually the registry), with a per-tool trust = "vendor" override. (#​12782 by @​jdx)

  • packslip: Declared host requirements (OS/glibc minimums, shared libraries, required commands) are checked before download; confirmed failures refuse the install, gaps mise cannot verify warn only, and ignore_requirements = true overrides hard failures. latest also resolves from verified vendor recommendations. (#​12804, #​12805 by @​jdx)

  • packslip: A tool's packslip can ship shell completions and agent skills. mise completion <shell> --tool <name> prints (or --install writes a version-aware stub for) completions for whichever version is active in the current directory, and mise skills ls / mise skills sync link a tool's Agent Skills into .claude/skills at the pinned version. Completions are also loaded automatically in activated shells. (#​12779, #​12780, #​12848 by @​jdx)

  • install: Redesigned install progress. Interactive terminals now show a live region with an install-wide fractional bar, per-tool phase/elapsed/artifact rows, dependency-wait rows ("waiting for node@​24.20.0"), and permanent completion lines written into scrollback. prune, uninstall, and upgrade removals reuse the same session, so pruning hundreds of versions no longer floods the screen. (#​12906 by @​jdx)

  • install: CI logs, pipes, and AI-agent terminals (CLAUDECODE/AI_AGENT) get a compact append-only reporter: one permanent line per finished tool plus a periodic snapshot of the bar, active phases, transfer rates, and queue count, instead of hundreds of scrolling status rows. Resolver hosts and retry progress are surfaced too. (#​12902, #​12907 by @​jdx)

  • ssh: New mise ssh runs ordinary OpenSSH sessions with optional session-scoped, read-only GitHub access, and mise bootstrap remote --from-git onboards a remote host from a Git repo. The initiating machine keeps the credential and brokers authorized clone/fetch and REST reads over an SSH Unix-socket forward; no token is installed on the target. (#​12830 by @​jdx)

    mise ssh devbox --github-relay-read-only --github-relay-repo jdx/dotfiles

  • bootstrap: mise bootstrap --from-git <GIT_URL> clones a repository-backed global config into $MISE_CONFIG_DIR so its config.toml, conf.d/, and tasks apply on the first bootstrap and stay active afterward. (#​12715 by @​jdx)

  • bootstrap: New aur: package manager installs from the Arch User Repository via yay (preferred) or paru, with foreign-package status detection so repo packages with colliding names cannot satisfy an AUR request. Bootstrap can also declare packages as absent to remove them, and now reports which root declarations were selected. (#​12718, #​12716, #​12770 by @​jdx)

  • bootstrap: Rebuilt dotfiles tracking. Files enrolled with mode = "track" stay in place while mise commits changes to a separate bare Git store with checkpoints, rollback/undo, and optional origin synchronization, including encryption of shared files before storage. (#​12918 by @​jdx)

  • activate: New activate_shims = false (MISE_ACTIVATE_SHIMS=false) keeps tool shim directories off PATH during activation and hooks without changing your auto-install or lazy-tool settings. Command wrappers such as mr-boxington's cargo keep working. (#​12926 by @​jdx)

  • core: Rust tools accept mr_boxington = true and mise use gains a repeatable --tool-option KEY=VALUE flag, so setting up the Cargo wrapper is a single command. (#​12908 by @​jdx)

    mise use --tool-option mr_boxington=true rust mr-boxington

  • ruby: mise now reads Bundler's ruby file: ".ruby-version" form from a Gemfile (resolving the path next to the Gemfile), so projects that pin Ruby through a sibling file resolve correctly. (#​12914 by @​jdx)

  • self-update: New global-only self_update.repository and self_update.api_url settings let organizations point manual updates, out-of-date hints, and automatic updates at a curated GitHub or GitHub Enterprise release mirror. Project config cannot redirect updates, and artifacts still pass the embedded-signature check. (#​12735 by @​jdx)

  • backend: install_env is now applied when resolving and downloading tools, not just at build time. (#​12777 by @​rabadin)

  • brew: mise can now evaluate ordinary third-party taps. (#​12774 by @​jdx)

Fixed
Security
  • http: URL replacements no longer forward authorization headers or URL credentials when an HTTPS origin is rewritten to HTTP; such credential-carrying downgrades are refused, and errors omit URLs so embedded credentials cannot leak through diagnostics. (#​12879 by @​jdx)
  • self-update: Self-update now requires secure release sources. (#​12737 by @​jdx)
New Contributors

Full Changelog: jdx/mise@v2026.9.1...v2026.9.2

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 8, 2026 02:50
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 53799e2 to 5f724a6 Compare September 8, 2026 14:06
@renovate renovate Bot changed the title chore(deps): update support dependencies to v2026.9.2 chore(deps): update support dependencies to v2026.9.3 Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 5f724a6 to b073a4f Compare September 8, 2026 14:55
@renovate renovate Bot changed the title chore(deps): update support dependencies to v2026.9.3 chore(deps): update support-deps Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/support-deps branch from b073a4f to 297e7db Compare September 8, 2026 15:24
@renovate
chore(deps): update support-deps
9ff89f6 
| datasource                 | package                 | from      | to        |
| -------------------------- | ----------------------- | --------- | --------- |
| github-tags                | defenseunicorns/uds-cli | 0.36.0    | 0.37.0    |
| github-releases            | goreleaser/goreleaser   | v2.17.1   | v2.18.0   |
| github-releases            | jdx/hk                  | 1.57.0    | 1.58.1    |
| github-release-attachments | jdx/mise                | v2026.9.1 | v2026.9.3 |
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 297e7db to 9ff89f6 Compare September 8, 2026 20:38
@bradclawsie
bradclawsie merged commit a021015 into main Sep 8, 2026
26 checks passed
@bradclawsie
bradclawsie deleted the renovate/support-deps branch September 8, 2026 21:00
@github-actions github-actions Bot mentioned this pull request Sep 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@bradclawsie bradclawsie bradclawsie approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bradclawsie