Repository navigation
chore(deps): update support-deps - #1593
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/support-deps
branch
from
October 7, 2026 17:45
51bf69e to
4718eed
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/support-deps
branch
3 times, most recently
from
October 9, 2026 11:36
6bf3f3c to
f3004ce
Compare
| datasource | package | from | to | | -------------------------- | ----------------------------------------- | ---------- | ---------- | | github-tags | defenseunicorns/uds-common | v1.30.1 | v1.31.0 | | github-tags | defenseunicorns/uds-core | 1.14.0 | 1.14.1 | | docker | ghcr.io/defenseunicorns/packages/uds/core | 1.14.0 | 1.14.1 | | github-releases | jdx/hk | 2.4.0 | 2.5.0 | | github-release-attachments | jdx/mise | v2026.10.3 | v2026.10.6 | | github-tags | jdx/mise-action | v5.1.0 | v5.1.1 |
renovate
Bot
force-pushed
the
renovate/support-deps
branch
from
October 9, 2026 19:12
f3004ce to
4c3eb9d
Compare
eoghanriley
approved these changes
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.30.1→v1.31.01.14.0→1.14.11.14.0-upstream→1.14.1-upstream2.4.0→2.5.02026.10.3→2026.10.6v5.1.0→v5.1.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
defenseunicorns/uds-common (defenseunicorns/uds-common)
v1.31.0Compare Source
Features
Miscellaneous
defenseunicorns/uds-core (defenseunicorns/uds-core)
v1.14.1Compare Source
Bug Fixes
jdx/hk (hk)
v2.5.0Compare Source
🚀 Features
🐛 Bug Fixes
📚 Documentation
⚡ Performance
🧪 Testing
🛡️ Security
🔍 Other Changes
📦️ Dependency Updates
jdx/mise (jdx/mise)
v2026.10.6: : Per-machine [vars] prompts, local config includes, and working-tree changes in --affectedCompare Source
[vars]entries can now ask once per machine and remember the answer,includeaccepts local files, andmise run --affectednow counts uncommitted work and no longer needsexperimental = true. On a fresh machine,mise bootstrapcan install git and ssh before it clones. The release also fixes several dotfiles history issues and stops lazy tools from triggering remote version lookups when something else launches.Added
Per-machine
[vars]prompts. Give a var aprompt, plus either adefaultorrequired. mise asks for it once and saves the answer in$MISE_STATE_DIR/vars.toml, outside your config and dotfiles history. Templates, tasks and tools then read it as usual. One shared dotfiles setup can use this to set a different Git identity on each machine. #14190Only
mise vars promptandmise bootstrap --prompt-varsever ask. Everything else uses the saved answer, then thedefault. Precedence, highest first: the process environment, a value from a higher-precedence config file, the saved answer, thedefault. Answers are keyed by var name, so projects that use the same name share one answer on a machine.promptis not allowed in[env].Local paths in
include.includeinmise.tomlnow accepts local TOML files, not justgit::andoci::references. A path can be relative to the including file or absolute. Local files merge the same way as remote ones, ranking just below the including file. They are read on every load, so edits apply immediately and invalidate the cached env. Paranoid mode rejects local includes, and safe mode still skips all includes in project config. #14178mise bootstrapinstalls git and ssh before cloning.mise bootstrap --fromand--adoptused to fail with a spawn error when git was missing. Now mise checks for git, and for ssh when the URL isssh://oruser@host:path, and offers to install whatever is missing with the host package manager. Supported managers are apt, dnf, pacman, apk, zypper, Homebrew, scoop and winget.--yesaccepts the offer without asking, and--dry-runonly reports what is missing. #14188mise dot save --re-encrypt. After you change[history.encryption] recipients, a normal save leaves some encrypted files under their old keys: manual-save entries the save doesn't name, and other-platform variants. Add--re-encryptto re-encrypt every saved file in the new checkpoint to the current recipients. It never captures unsaved edits. If this machine can't unlock some of the files, nothing is saved and the error lists all of them. #14210mise dot statusshows unsaved changes. It now lists tracked paths that changed since the latest checkpoint. Unsaved edits were previously invisible there when the watcher was stopped or an entry used--no-autosave.--jsonreports these paths ashistory.unsaved. The value isnullwhen they can't be determined, for example with no checkpoint yet or with encrypted files this machine can't compare without prompting. #14209Changed
mise run --affectednow counts working-tree changes, and the workspace graph is no longer experimental. Besides the committedbase...headrange,--affectednow also counts staged and unstaged edits and untracked files that aren't ignored. You can narrow it with--affected-committed,--affected-uncommittedand--affected-untracked, which can be combined (environment variables:MISE_AFFECTED_*). Working-tree changes only count when the head is your current checkout. To get the old committed-only selection, for example in a CI job that writes untracked files before it runs, use--affected-committed.--affected,mise tasks graph,[monorepo.task_defaults],[monorepo.projects]andtask.auto_inferno longer requireexperimental = true. #14214Credential checks for dotfiles. Files with names ending in
.example,.sampleor.templateno longer match the credential name rules. The content scan before publishing still checks them. Once you approve a file for plaintext tracking, mise no longer warns about it on every save. #14204mise dot trackonly asks about plaintext at a terminal. Before saving a credential-named file in plaintext, it now asks only when both stdin and stderr are terminals. Previously, a piped line, such as the next entry in awhile readloop, could be taken as the answer. Scripts need--allow-plaintextor--encrypt. #14205Fixed
Lazy tools no longer trigger remote lookups for other lazy tools. Previously, mise looked up versions for configured lazy tools that weren't installed, even though they weren't being launched. With a cold cache and no network, launching one tool waited on each lookup and could print "Failed to resolve tool version list" warnings. In one offline test a launch took 41 seconds. This no longer happens in these cases:
auto_updatetool launches (#14195)mise xor a shim installs a new version (#14197)mise install,mise upgradeandmise usestill resolve everything.Too many open fileswith parallelnpm:installs. Parallel installs could fail under macOS's default launchd soft limit of 256, for example when mise was started from a LaunchAgent. On Unix, mise now raises its soft open-file limit at startup toward the hard limit, up to 10240, and never lowers it. #14174, #14216go:tools with an untidygo.mod. Tools whose publishedgo.modis missing a requirement now install, for examplego:tailscale.com/cmd/tailscale. mise now passes-mod=modtogo installinstead of-mod=readonly. A project'sGOFLAGS=-mod=vendorstill doesn't affect these installs. #14180 (@JamBalaya56562)Config at the filesystem root. A config file at
/, such as/mise.tomlin a Docker image, mademise installandmise execpanic. It now works. #14182.NET installs. Installing a .NET SDK no longer fails with "was not found in
dotnet --list-sdksoutput" when another mise-managed SDK comes before the shims onPATH. The post-install check now runs the new SDK'sdotnetdirectly. #14189Shims and directories. Shims and
mise whichno longer resolve a bin name to a directory in another tool's bin path. Previously,hunk'sskills/directory blockednpm:skillswith "Permission denied". #14193mise oci buildand multiple versions. A tool pinned to several versions is now written to the embedded/etc/mise/config.tomlas a single array, in resolution order. Previously each version got its own duplicate key, which made the config unreadable inside the container. #14200 (@JamBalaya56562)Encrypted files a sync can't unlock.
mise bootstrap --adopt,mise dot pullandmise dot syncnow list every encrypted file they can't unlock in one error, instead of stopping at the first one. Damaged files still stop the sync immediately. #14208Rollback and undo messages.
mise dot rollback <path>now names the checkpoint that saved the restored version, which matchesmise dot history --path. Rollback and undo also name both checkpoints they record: the result, and the one holding the state before the operation. Previously, rollback could name a checkpoint thathistory --pathdidn't list. What gets restored is unchanged. #14207, #14211mise dot statuson adopted machines. On a machine that adopted a shared setup, it no longer prints "nothing configured in [dotfiles]" while history tracks entries. #14206New Contributors
Full Changelog: jdx/mise@v2026.10.5...v2026.10.6
💚 Sponsor mise
mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.
v2026.10.5: : Java defaults to Temurin, per-machine and local-only dotfile history, packslip workflow pinningCompare Source
Java versions without a vendor prefix now install Eclipse Temurin builds. Dotfiles gain per-machine and local-only history, a
merge = "missing"mode, and a secret check beforemise dot syncpublishes anything. Packslip tools can be pinned to the workflow that signs their releases. Several features documented as experimental now actually requireexperimental = true. The rest of the release is fixes across tasks, shims, config loading, bootstrap and backends.Breaking Changes
java@21,java@ltsandjava@latestnow install Temurin. The default ofjava.shorthand_vendorchanges fromopenjdktotemurin. The jdk.java.net OpenJDK builds stop at the next feature release, sojava@21was stuck on 21.0.2 from January 2024. Vendor-prefixed requests (openjdk-21,corretto-21, ...) are not affected. Installed OpenJDK versions keep working, andmise upgradeoffers the Temurin build. Shorthand versions now include Temurin's build suffix (for example21.0.12+101.0.LTS). Temurin has no builds of Java 9, 10 or 12–15, so useopenjdk-12and similar for those. #14146shorthand_vendor = "openjdk". Without that setting,mise install --lockedfails withjava@21 is not in the lockfile. Either keep OpenJDK:mise lock --bump javaand commit the result.experimental = true(orMISE_EXPERIMENTAL=1) when you use them. Config that only mentions them still loads. #14114git::remotefile, including throughmise run --dry-run,mise watch, or as a dependency. Commands that only inspect tasks (tasks ls,tasks info,tasks deps,generate task-docs) show the task from its TOML and warn once that the file wasn't fetched. These were documented as experimental but were missing the check in the codebase.git::andoci::entries intask_config.includes. These are skipped with a warning.mise runwhen an OTLP endpoint is set.spinel:tools.mise.local.tomlnow overridesmise.<env>.tomlin the same directory, as the docs already said. Before, the committed environment file won in project directories, and also in~/.config/misewhen the walk up from the cwd reached it. Within each directory the order is now, highest first:mise.<env>.local.toml,mise.local.toml,mise.<env>.toml,mise.toml. If you relied on the environment file winning, move those keys intomise.<env>.local.toml. #14148mise://tasksresource,envis now an array of env directive strings, the same format asmise tasks ls --json. It was always an empty object before. #14111mise settings setandaddrefuse writes that would have no effect. This covers early-init settings (env,ceiling_paths,env_conf_d, ...) written to a config file, and global-only settings (yes,paranoid,trusted_config_paths, ...) written with--local. The error says where the setting has to go:miserc.toml, the global config, or theMISE_*variable. #14126Added
Dotfiles
variants = [{ machine = true }]ormise dot track --machineto keep a separate history for each machine. Sync pushes every machine's version to the origin but never applies one machine's version on another. Each machine gets a generated name, which you can set with[history] machine = "desk". A machine variant must be the entry's only variant and can't be combined withencrypt. Upgrade every machine that shares a setup before using it. #14062mode = "track-local"(ormise dot track --local) keeps a file's history in a separate store on this machine, with no origin. The file never reaches the shared manifest, a commit or a push. Commands that name a path use the history that holds it. Usemise dot --local historyormise dot --local undoto work with the local history directly.save,captureandwatchcover both histories. #14082merge = "missing"sets only the keys the target file doesn't have yet. Values an app writes itself, such as the model picked with/modelin Codex or Claude Code, are left alone. Works with TOML, YAML and JSON. #14081source. mise then reads the target's path underdotfiles.root. Switching an entry fromsymlinktomergenow replaces a link that points at the merge source with a writable copy, so the app's own keys survive. #14076mise dot syncrefuses to publish saved versions that look like secrets. It checks for provider tokens, private key blocks, and*_KEY/*_TOKEN/*_SECRET/*_PASSWORDassignments. Only versions the origin doesn't have yet are checked. The error names the file, line and version, never the value.--allow-plaintext-historyskips the check. #14171mise bootstrap --adopt <url> --take-remote-alltakes the repository's version of every file that differs, in one step. Combined with--replace-history, it also adopts the repository on a machine that already has history of its own. #14065mise doctorshows the dotfiles history repo path and the connected origin (URL, branch, sync mode), in both text and--jsonoutput. #14173Bootstrap
[bootstrap.files]and[bootstrap.directories]accept the sameosselector as packages. Entries that don't match the host are skipped completely. #14058fish = "auto"in[bootstrap.mise_shell_activate]writes a block that runsmise activate fishin interactive shells and--shimseverywhere else. #14172[bootstrap]is now allowed in config includes. It merges below the including file, so a shared baseline can declare packages, hooks and services, and the project still wins on any key it sets itself. #14176state = "absent", which stops, disables and deletes the matching mise-managed service and timer.mise bootstrap unapplynow also removes the units an environment added. #14139Tools and backends
workflowoption. It accepts only releases signed by the named GitHub Actions workflow on tags. It takes one workflow or a list, and an entry can name a ref (release.yml@refs/heads/main). It can't be combined withpubkey,identity,identity_prefixorissuer. #14075, #14093workfloworpubkeyyou set yourself replaces the registry pin. #14092, #14091, #14073 (@max-sixty)install_toolis implemented. It installs the requested version, or the configured version, or latest, and returns the resolved version and install path.install_toolandrun_tasknow refuse to act on untrusted config instead of trusting it on the client's behalf. #14111mise installs migrateno longer fails on installs it can't reinstall, such as withdrawn releases, signer changes or no network. It moves them into the identity layout as they are and leaves a link at the old path. It also handles lockfile-suffixed~aube~/~uv~directories correctly. #14079mprocsis renamed todekitto match upstream, andmprocsstays as an alias. From v0.10.0 the binary isdekit. #14169Changed
dot pull,dot track,undo,rollback,connectandbootstrap --adopt. Destructive ones still ask, such as--replace-history,dot recover --keep-currentandimplode.--yesandMISE_YESare still accepted. #14077, #14071, #14067MISE_SAFE=1) now ignores a project's[bootstrap],[dotfiles]and[dotfile_groups]. Before, an untrusted repo could link files into$HOMEor clone repositories. Global and system config still apply. #141102were checked. Setnode.gpg_verify = falsefor mirrors without signatures. #14132mise generate github-actionnow usesactions/checkout@v7andjdx/mise-action@v5and no longer setsMISE_EXPERIMENTAL.mise generate devcontainernow adds"postCreateCommand": "mise install". #14145Deprecated
task.cache.stats_report,sops.age_recipientsandplugin_autoupdate_last_check_durationnever had any effect. Setting one now prints a warning, and they will be removed in 2027.10.5. #14112mise bootstrap launchd|systemd|macos-defaults, the old--only/--skippart names (launchd,systemd,defaults,shell) andmise direnvnow print a warning that names the replacement. They will be removed in 2027.10.4. #14113Fixed
Tasks
cacheenabled is now skipped when its sources are fresh and its cache key hasn't changed. Before, it ran every time. #14121sourcesthat matches no files now prints a warning.mise tasks deps <task>now showsdepends_posttasks. Scripts in$MISE_CONFIG_DIR/tasksload even without a global config file. #14122mise run ./scriptresolves relative to the current directory. #14120mise generate task-stubsskips hidden and global tasks. #14127Shims and exec
mise xandmise envno longer look up remote versions for lazy tools that aren't installed. With 20 lazy tools and no network, running an installed tool went from about 42s to 0.09s. #14063mise x tool@1.2.3installs the exact version when the version list times out, instead of failing with "couldn't exec process". #14164mise doctorrecognizes amiseentry in the dedicated shims dir. #14069Config, settings and CLI
config.tomlyet,mise use -gcreatesconfig.tomlinstead of writing intoconfig.<env>.toml. #14179mise config set --type booland boolean settings acceptyes/no/1/0. Forenv.*and other keys that aren't settings, onlytrueandfalsebecome booleans, and anything else is stored as written.mise latest tool@prefix:Xworks, and--log-level warnis accepted.mise doctorprints the full chain when config fails to load. #14125mise editno longer overwrites an existing config when there is no terminal. #14124.monorepomarkers are verified in paranoid mode. #14105mise config lsandmise prunewith an invalid tool version, the--monorepoflags, andmise plugins uninstall --purge. #14118, #14094 (@JamBalaya56562), #14103 (@JamBalaya56562), #14116, #14117mise env --redactedhonorsredact = falseexclusions.watch_fileshooks don't run in safe mode or with--no-hooks. #14109, #14108mise watchpasses watchexec flags through to watchexec. #14115bootstrap remoteand the watchexec install hint. #14142<temp>/mise-tmp, somise cache clearno longer deletes files that are still in use. #14134Bootstrap and dotfiles
mise bootstrapkeeps writing the shell activation block into a startup file that is only tracked. #14135exec(). #14136mise dot undorestores them.--replace-historyno longer fails on its first attempt. #14065mise dot pullsays so when incoming history changes no files on this machine. #14066Backends and plugins
mise install cargo:...no longer uses an inactivecargo-binstallshim. It falls back to native binstall orcargo install. #14070npm.shell_out, a mise shim from another data dir can no longer be run asnpmand fork until the machine runs out of memory. #14084 (originally found and fixed by @tfournet)java.shorthand_vendortakes effect without waiting for the cache to expire. Inlinejava[release_type=ea]is respected when listing and resolving versions. #14131{os}and{arch}correctly. #14133ls-remoterespectsdisable_backends. #14130api_urlfor cloning and skips lockfile URLs. #14129git::plugins install from a subdirectory, and[plugins]entries compare those sources correctly. Packslip entries in[plugins]install as vfox plugins. #14140, #14150 (@onokonem), #14141Daemons and sandbox
--deny-envclears inherited variables on Windows. On macOS,allow_netis rejected instead of writing invalid sandbox rules. #14107, #14106Security
[vars]and task arg values asblake3:digests instead of plaintext, so secret values are no longer uploaded. Existing cache entries miss once after upgrading. #14104Documentation
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.