[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.37.9 → v4.38.0
jdx/mise	uses-with	patch	2026.9.5 → 2026.9.7
prometheus-node-exporter (source)		minor	4.56.3 → 4.57.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

jdx/mise (jdx/mise)

v2026.9.7: : Lockfile revision 2 with npm and Python dependency graphs, dotfile conflict inspection

Compare Source

This release introduces mise.lock revision 2, which records complete transitive dependency graphs for npm tools (via embedded aube) and Python tools (via uv) in native sidecar files, and adds mise bootstrap dotfiles conflicts for inspecting dotfile sync conflicts before resolving them. It also lets dotfile templates consume bootstrap secrets, stops minimum_release_age from rejecting versions already committed to a lockfile, and closes a security gap in history.describe_command.

Added

• lock: Lockfile revision 2 records the full dependency graph of npm tools installed by embedded aube and of pypi: tools installed by uv, then replays it with a strict frozen install so two projects on the same top-level version can still receive their own reviewed transitive graph. Graphs live in native sidecar files (uv.lock / aube-lock.yaml plus a manifest) under .mise/locks/<backend-tool>/<version>/, referenced from mise.lock by relative path and SHA-256 digest, so the lockfile itself stays small. Commit the sidecar directory with mise.lock. New lockfiles use revision 2; existing revision 0 and 1 files keep their format until you run mise lock --upgrade. mise lock --bump <tool> refreshes a tool's transitive graph even when its top-level version is unchanged, ordinary mise install validates and accepts hand-edited sidecars, and mise install --locked rejects digest mismatches until you run mise lock. Python graph locking requires uv 0.12.10 or newer and published wheels for the target platform; Git sources, standalone pipx installs, and free-form uvx_args/pipx_args stay version-only. (#​13131, #​13146 by @​jdx)

  mise lock --upgrade        # move an existing lockfile to revision 2 and resolve graphs
  mise install --locked      # replay the recorded graphs
  mise lock --bump pypi:black  # refresh Black's dependencies without changing its version

• pypi: pypi: is now the preferred name for the Python CLI backend; pipx: remains fully supported as an alias with no warnings, and settings accept both pypi.* and pipx.* names. The two spellings are distinct tool identities (pypi-black vs pipx-black install directories and lock entries), so switching spelling creates a new installation. (#​13146 by @​jdx)

• bootstrap: mise bootstrap dotfiles conflicts [PATH...] shows a read-only comparison of the saved local and fetched remote versions of a conflicted dotfile so you can decide between --take-remote and --keep-local with full context. The default output is a unified diff including file-mode changes; --difftool opens the configured Git diff.tool (falling back to merge.tool) and --tool <name> picks one explicitly. Encrypted contents are decrypted only into private temporary files, and inspection never modifies either side or marks the conflict resolved. Bootstrap secrets are also now resolved from the same composed config maps as dotfile discovery, so root-scoped dotfile templates can use secrets declared by their bootstrap root. (#​13144 by @​jdx)

  mise bootstrap dotfiles conflicts ~/.config/mise/config.toml
  mise bootstrap dotfiles conflicts --difftool ~/.config/mise/config.toml

• dotfiles: Dotfile templates (mode = "template") can reference [bootstrap.secrets] values with {{ secret(name="...") }}, matching managed bootstrap file templates. Dotfiles commands that render templates (add, apply, diff, edit, status, unapply) accept --prompt-secrets; without an available value, rendering fails closed. A full mise bootstrap run preflights dotfile templates before making changes, mise bootstrap status reports secrets used only by dotfiles, and textual diffs redact resolved secret values. (#​13140 by @​jdx)

  [bootstrap.secrets]
  api_token = "EXAMPLE_API_TOKEN"
  
  [dotfiles."~/.config/example/credentials"]
  source = "dotfiles/credentials.tmpl"
  mode = "template"

Fixed

• lock: Installing from a committed mise.lock no longer fails when the locked release is younger than minimum_release_age. The cutoff still applies when resolving unlocked fuzzy requests and when generating or bumping a lockfile, and npm:/pypi: still forward it to unpinned transitive dependencies, but a reviewed lock entry now reproduces immediately in CI instead of waiting for the release to cool. (#​13128 by @​jdx)
• config: A .python-version (or other idiomatic version file) containing system selects the system interpreter without printing the mise-specific @system deprecation warning, matching the existing .tool-versions exception. Explicit python@system requests from mise configuration or command arguments still warn. (#​13132 by @​jdx)
• npm: Embedded aube is updated to 2.2.16, fixing the Bun checksum install regression and ensuring local npm tarballs keep their manifest package name. (#​13145 by @​jdx)
• registry: The mc shorthand uses aqua:minio/mc again now that the upstream Aqua registry entry is restored, with asdf:mise-plugins/mise-mc kept as the fallback. (#​13124 by @​jdx)

Security

• history: history.describe_command is now global-only. Previously an implicitly trusted project could set it and have a later dotfiles history checkpoint execute the project-controlled command with unencrypted tracked-file diffs. The setting is honored only from system/global configuration or MISE_HISTORY_DESCRIBE_COMMAND; project values are ignored with a warning. (#​13134 by @​jdx)
• oci: mise oci build now renders dotfile templates with a restricted engine: secret() is rejected and the env context, get_env(), exec(), and read_file() are unavailable, so ambient credentials cannot be baked into a publishable image layer. (#​13140 by @​jdx)

Breaking Changes

• Lockfile revision 2 is not readable by older mise versions. Newly created lockfiles use revision 2, and existing files switch only when you run mise lock --upgrade. Upgrade collaborators and CI to this release before committing a revision 2 mise.lock, and commit the .mise/locks/ (or .config/mise/locks/) sidecar directory alongside it. Revision 2 --locked installs fail if a recorded graph is missing or its digest does not match. If you gitignore mise.local.lock, also ignore its matching sidecar subdirectory (for example .mise/locks/mise.local/).
• history.describe_command in project configuration is ignored. Move it to ~/.config/mise/config.toml or set MISE_HISTORY_DESCRIBE_COMMAND.
• mise oci build dotfile templates can no longer call secret(), get_env(), exec(), or read_file() or read the env context.

Full Changelog: jdx/mise@v2026.9.6...v2026.9.7

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.9.6: : Project daemons, mise doctor project, and vfox backend tool discovery

Compare Source

This release adds experimental project daemons backed by pitchfork, a mise doctor project command for project-declared diagnostic checks, and tool discovery from vfox backend plugins in mise search. It also changes the HTTP backend's default install layout so uninstall and prune reclaim disk space, speeds up warm lockfile_mode = "generate" installs and repeated OCI builds, and fixes a batch of nushell, monorepo, lockfile, brew, and Windows bootstrap issues.

Highlights

• Services next to tools: [daemons] declares background processes and PostgreSQL/Redis presets in mise.toml, managed through mise daemons and optionally started when you enter the project. [doctor.checks.<name>] lets projects declare their own environment probes for mise doctor project.
• Discovery and output: mise search, shell completion, and interactive mise use now include tools published by installed vfox backend plugins, and settings.truncate / --no-truncate disable terminal-width truncation (automatically when a coding agent is detected).
• Storage and speed: HTTP tools now extract into their own install directory by default (opt back into deduplication with shared_extraction = true), warm generate-mode installs skip needless lockfile rewrites, and OCI builds share a local tool-layer cache.

Added

• daemons: New experimental [daemons] section and mise daemons command family (start, stop, restart, ls, status, logs, tui) manage project background processes with pitchfork. PostgreSQL and Redis presets install the database as a tool (participating in lockfiles), supply connection environment variables and readiness checks, and keep project data across stop/start. Daemons with auto = ["start", "stop"] start when entering the project from an activated Bash, Zsh, or Fish shell and are released when the last shell session leaves. Requires experimental = true and pitchfork 2.25.0 or later; database presets are Unix-only and PostgreSQL uses loopback trust authentication intended for local development. (#​13085 by @​jdx)

  [settings]
  experimental = true
  
  [daemons]
  postgres = "18"
  redis = "8"
  
  [daemons.web]
  run = "npm run dev"
  port = 3000
  auto = ["start", "stop"]

• doctor: mise doctor project runs checks declared in [doctor.checks.<name>] with the project's environment and installed tools, reporting PASS/FAIL/error/skipped per check in text or --json. Checks support description, hint, timeout (default 10s), dir, shell, and os selectors, run concurrently under the jobs limit, and exit nonzero when any check fails. Ordinary mise doctor does not run them, and hints are never executed. A follow-up aligned dir resolution with task conventions (config root for project configs including ~/mise.toml, ~/ expansion), fixed head-of-line blocking when one probe hangs, and kept nohup mise doctor project alive on SIGHUP. (#​13062, #​13089 by @​jdx)

  [doctor.checks.openssl]
  description = "OpenSSL development files are discoverable"
  run = "pkg-config --exists openssl"
  hint = "Run `mise bootstrap packages apply` to install the declared build dependencies."
  timeout = "5s"
  os = ["linux", "macos"]

• vfox: Tools provided by installed vfox backend plugins now appear in mise search, shell completion, and interactive mise use, namespaced as <plugin>:<tool>. Plugins can implement BackendListTools for a finite catalog and/or BackendSearchTools for query-driven discovery in large ecosystems; a prefixed query like npm:eslint is routed only to that plugin. Results are cached, slow plugins fall back to stale cache, and existing plugins need no changes. mise registry remains registry-only. (#​13111 by @​jdx)

• cli: New settings.truncate (and MISE_TRUNCATE, default true) controls terminal-width shortening of table cells and task metadata. mise ls, mise config ls, and mise bootstrap dotfiles status gain --truncate / --no-truncate, and output is kept complete automatically when a known coding agent is detected. (#​13112 by @​jdx)

  mise bootstrap dotfiles status --no-truncate

• bootstrap: [bootstrap.macos.dock] gains apps, an ordered list of pinned application paths. Status compares identity and order (ignoring Dock-added metadata), apply adds, removes, and reorders application tiles while preserving other tiles and persistent-others, and an empty list removes all application tiles. Paths must be absolute or home-relative .app bundles. (#​13075 by @​azohra)

  [bootstrap.macos.dock]
  apps = [
    "/System/Applications/Utilities/Terminal.app",
    "/Applications/Firefox.app",
  ]

• bootstrap: mise bootstrap packages where brew:<formula> prints an installed formula's stable opt root (for example /opt/homebrew/opt/unzip), so scripts can put keg-only executables on PATH without hardcoding the Homebrew prefix or Cellar version. Missing installs exit nonzero with empty stdout. (#​13083 by @​himkt)

• dotfiles: Destination variants can omit source when every variant sets a target; the entry key is then resolved as a relative path under settings.dotfiles.root instead of next to mise.toml. Parent traversal is rejected. (#​13087 by @​jdx)

  [dotfiles."vscode/settings.json"]
  mode = "copy"
  variants = [
    { os = "macos", target = "~/Library/Application Support/Code/User/settings.json" },
    { os = "linux", target = "~/.config/Code/User/settings.json" },
  ]

• fmt: mise fmt now sorts lists whose order has no meaning: redactions lexically, and task sources/outputs, task_templates sources/outputs, task_config.global_inputs, and input_groups by reach (@group: references, then globs, then literal paths). Lists containing ! exclusions, entries starting with template syntax, or comments are left untouched, and precedence-sensitive lists such as env_file, tools.*, includes, and depends are never sorted. (#​13058 by @​jrandolf)

• oci: mise oci build gains --no-cache to bypass the new local tool-layer cache; entries live under each tool's cache directory and are removed by mise cache clear TOOL. (#​13056 by @​jdx)

Changed

• http: New http: installations extract directly into their own install directory, so mise uninstall and mise prune now remove their files instead of leaving payloads in $MISE_DATA_DIR/http-tarballs/. Set shared_extraction = true on a tool to keep the previous deduplicated symlink layout. Existing symlinked installs keep working; mise install --force <tool> migrates one to independent files without disturbing other installs that share the content. Legacy http-tarballs entries are not reclaimed automatically. Shared raw and compressed binary caches now also include the executable filename in their key, so differently named tools no longer reuse the wrong filename. (#​13059 by @​jdx)
• oci: mise oci push --no-cache now bypasses both the remote registry cache and the local tool-layer cache. (#​13056 by @​jdx)
• registry: postgres, redis, and mongodb now prefer conda: backends, installing prebuilt conda-forge binaries in seconds instead of compiling through vfox; vfox and asdf remain as fallbacks. conda:redis-server covers Linux and macOS only. (#​13061 by @​jdx)

Performance

• lockfile: Warm mise install runs in lockfile_mode = "generate" skip scheduling work for tools whose artifact metadata is already reusable, and skip rebuilding, serializing, and staging the lockfile entirely when nothing was installed and the on-disk lock already matches (preserving comments in the file). Explicit mise lock, forced provenance verification, upgrades, and new platforms still regenerate. (#​13101, #​13103 by @​jdx)
• oci: mise oci push --from BASE no longer downloads base layers when the base and target live in the same repository, and oci build, oci run, and oci push share a local cache of packaged tool layers keyed on file contents, so repeated builds with overlapping tools skip tar and gzip work. (#​13055, #​13056 by @​jdx)

Fixed

• nushell: mise activate nu no longer throws env_variable_not_found on every prompt or cd when a variable to hide is absent from the current scope; hide-env is now wrapped in try, matching the no-op behavior of other shells. (#​13071 by @​i-api)
• task: Task-level tools are now auto-installed for tasks referenced from run entries, including names rendered at runtime, right before they execute; --skip-tools is honored and install failures are reported as task failures without blocking siblings. (#​13086 by @​jdx)
• config: [monorepo] settings are now merged across same-directory config layers (base plus mise.<env>.toml overlays): omitted fields are inherited, an overlay's config_roots replaces the base list, and monorepo_root = false in an overlay disables the root and its descendant trust. (#​13084 by @​jdx)
• lockfile: Runtime tool requests such as mise which hk --tool hk@latest now use the lockfile belonging to the config that effectively defines the tool, instead of merging project and global pins and reporting a false "multiple resolutions" ambiguity or selecting an overridden pin. mise which --tool warns when a lower-precedence config has a matching pin the effective config lacks. (#​13042 by @​nettlesh)
• lockfile: Complete lockfile generation for Packslip tools skips platforms with no published artifact while still writing supported targets, and a verified Packslip signer may now replace legacy github-attestations metadata on upgrade instead of being rejected as a provenance downgrade. (#​13102, #​13105 by @​jdx)
• upgrade: mise upgrade now detects updates between letter-suffixed versions such as tmux 3.7b to 3.7c; sub-N aliases keep resolving numeric components as before. (#​13119 by @​jdx)
• brew: Formulae that are keg-only solely because macOS ships them (such as brew:zip and brew:unzip) are now linked into <prefix>/bin on Linux, matching Homebrew. Kegs installed by earlier mise versions stay unlinked until the next mise bootstrap packages upgrade or a reinstall. (#​13108 by @​lil-lon)
• brew-cask: Tap casks with preflight_steps or postflight_steps no longer fail during metadata extraction; declarative run steps are captured as structured steps and executed by mise, with support for must_succeed = false. (#​13060 by @​jdx)
• bootstrap: mise bootstrap remote on Windows now finds ssh.exe and tar.exe on PATH instead of failing with required command 'ssh' not found. (#​13117 by @​JamBalaya56562)
• bootstrap: macOS defaults status explains type mismatches, showing for example 2 (real; expected integer) instead of two identical-looking values marked differs. (#​13096 by @​jdx)
• dotfiles: mise bootstrap dotfiles track honors the global yes setting for confirmations, and warns when tracking a symlink whose resolved source is not itself tracked, suggesting the command to enroll it. (#​13072 by @​nettlesh, #​13095 by @​jdx)
• schema: The JSON schema now models Git directory manifest dotfile entries, restricting explicit modes to copy or symlink-each and rejecting combinations with inline content or file-edit fields. (#​12741 by @​risu729)
• asdf: mise asdf install and mise asdf reshim no longer re-enter the full CLI dispatch, avoiding stack overflows on small-stack Linux environments; asdf install now follows the same implicit config trust as mise install. Bash completions are regenerated for the updated usage-rs word-break handling. (#​13114 by @​jdx)

Registry

• Added mpv (conda:mpv, Linux and macOS) (#​13049 by @​i-api), agent-browser (aqua:vercel-labs/agent-browser) (#​13088 by @​3w36zj6), and himalaya (github:pimalaya/himalaya) (#​13091 by @​i-api).
• editorconfig-checker installs again after 4.0.1 renamed its assets and executable; the shorthand now uses the GitHub backend. (#​13098 by @​jdx)
• mc installs from MinIO's GitHub releases instead of the retired Aqua download URL that returned HTTP 410. (#​13113 by @​jdx)

Documentation

• The docs landing page gains interactive diagrams for project environment switching, bootstrap machine resources, tool configuration precedence, artifact cache execution, and tracked dotfile synchronization. (#​13065, #​13066, #​13067, #​13068, #​13069 by @​jdx)
• The task-running guide is reorganized around finding and running tasks, passing arguments, then controlling execution. (#​13077 by @​azohra)

New Contributors

• @​lil-lon made their first contribution in #​13108

Full Changelog: jdx/mise@v2026.9.5...v2026.9.6

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

prometheus-community/helm-charts (prometheus-node-exporter)

v4.57.0

Compare Source

A Helm chart for prometheus node-exporter

What's Changed

• [prometheus-node-exporter] keep the chart version out of the pod labels by @​DrFaust92 in #​7264

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-90.1.2...prometheus-node-exporter-4.57.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.