Skip to content

chore(deps): update support-deps - #1610

Merged
eoghanriley merged 3 commits into
mainfrom
renovate/support-deps
Oct 21, 2026
Merged

chore(deps): update support-deps#1610
eoghanriley merged 3 commits into
mainfrom
renovate/support-deps

Conversation

@renovate

@renovate renovate Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
actions/create-github-app-token action minor v3.2.0 → v3.3.0
defenseunicorns/uds-common minor v1.31.0 → v1.32.1
docker.io/library/nginx (source) patch 1.31.6 → 1.31.7
github/codeql-action action minor v4.38.3 → v4.39.0
golangci-lint tools minor 2.14.0 → 2.15.0
goreleaser/goreleaser-action action minor v7.2.3 → v7.3.0
hk tools minor 2.5.0 → 2.7.0 2.7.1
jdx/mise uses-with patch 2026.10.10 → 2026.10.15
jdx/mise-action action minor v5.1.1 → v5.2.0 v5.2.1
nginx (source) patch 1.31.6 → 1.31.7
node (source) tools minor 24.21.0 → 24.22.0
ossf/scorecard-action action minor v2.4.4 → v2.5.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
defenseunicorns/uds-common

v1.32.1

Compare Source

Bug Fixes
  • pull images with compose prior to transformation (#​804) (f56bc5e)

v1.32.0

Compare Source

Features
Bug Fixes
Miscellaneous
nginx/docker-nginx (docker.io/library/nginx)

v1.31.7

Compare Source

github/codeql-action

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198
golangci/golangci-lint (golangci-lint)

v2.15.0

Compare Source

Released on 2026-10-16

  1. Linters new features or changes
    • errcheck: from 1.20.0 to 1.30.0
    • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
    • gocognit: from 1.2.1 to 1.3.0
    • golines: from 0.15.0 to 0.16.0
    • govet-modernize: from 0.50.0 to 0.52.0
    • loggercheck: from 0.12.0 to 0.13.0
    • predeclared: from 0.2.2 to 0.3.0
    • wrapcheck: from 2.12.0 to 2.13.0
  2. Linters bug fixes
    • bidichk: from 0.3.3 to 0.3.4
    • canonicalheader: from a25c71c to e18e5c5
    • gofumpt: improve deprecation logs
    • gosec: improve concurrency default value
    • iface: from 1.5.1 to 1.5.3
    • paralleltest: from 1.0.15 to 1.0.16
    • revive: from 1.17.0 to 1.17.1
    • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
    • rowserrcheck: from c5f79b8 to e0740d5
    • staticcheck: from 0.8.1 to 0.8.2
  3. Bug fixes
    • fix: compute custom version hash with module versions
    • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

  • The replaced options still exists, and partially works, but they are deprecated.
  • The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
  • The check the value map has been replaced by mapliteral.
  • The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
  • The option ignore-enum-types (string) has been replaced by ignore-types (slice).
  • New report messages.
  • The linter is a now a "slow" linter.
goreleaser/goreleaser-action

v7.3.0

Compare Source

What's Changed

Full Changelog: goreleaser/goreleaser-action@v7.2.3...v7.3.0

jdx/hk (hk)

v2.7.0

Compare Source

🚀 Features
🐛 Bug Fixes
  • (builtins) stop passing file arguments to brakeman by @​beauraF in #​1704
  • (config) keep output.log, hk.log and patches in the repository's git dir by @​jdx in #​1705
  • (step) show rendered findings instead of raw SARIF in failed check output by @​jdx in #​1695
📚 Documentation
🛡️ Security
🔍 Other Changes
  • (release) shorten minimum release age to 2 days by @​jdx in bd30b5d
📦️ Dependency Updates
New Contributors

v2.6.0

Compare Source

🚀 Features
🐛 Bug Fixes
  • (builtins) stop passing file arguments to brakeman by @​beauraF in #​1704
  • (config) keep output.log, hk.log and patches in the repository's git dir by @​jdx in #​1705
  • (step) show rendered findings instead of raw SARIF in failed check output by @​jdx in #​1695
📚 Documentation
🛡️ Security
🔍 Other Changes
  • (release) shorten minimum release age to 2 days by @​jdx in bd30b5d
📦️ Dependency Updates
New Contributors
jdx/mise

v2026.10.15: : Default minimum_release_age covers every backend, plus a PowerShell installer

Compare Source

The default 24-hour minimum_release_age now applies to every backend. Many more backends report release dates, so the cooldown can actually hold new versions back, and mise warns when it installs a version it couldn't date. This release also adds a PowerShell installer for Windows, read_json/read_yaml/read_toml template functions, dotnet@lts/dotnet@sts, and new dotfiles options.

Changed

  • The default minimum_release_age applies to every backend. The built-in 24h cooldown used to cover only backends that reported release dates (aqua, cargo, core, github, npm, pypi and others). asdf, vfox, conda, dotnet, http: and s3: tools had no cutoff at all. Now every backend gets the cooldown. A tool whose only version is less than 24h old now resolves to "no versions found", as aqua and github tools already did. To opt a tool out, add it to minimum_release_age_excludes. To turn the cooldown off, set minimum_release_age = "0s". #​14701 (@​jdx)

  • mise warns when it can't check a version's release date. A version with no known date still passes the cutoff, but mise install, mise upgrade and mise use now print a one-time warning naming the version. Exact pins you wrote yourself don't trigger it. mise env, mise ls, mise outdated and mise ls-remote never print it. #​14694 (@​jdx)

    WARN  asdf:tiny@3.1.0 has no release date, so the ... cutoff cannot be checked and it is allowed (exclude it with minimum_release_age_excludes to silence this)

  • More backends report release dates, so the cooldown applies to them:

    • conda versions use the channel's earliest index timestamp. #​14693
    • aqua packages that take versions from git tags (version_source: github_tag, such as aws/aws-cli, docker/cli and cockroachdb/cockroach) are now dated. #​14691
    • dotnet dates come from Microsoft's releases index. deno and erlang dates come from their GitHub releases. #​14692
    • Every python version now has a date, and so do many more ruby versions (from ruby-lang.org, Maven Central for JRuby, and GitHub for TruffleRuby). Rust's stable, beta and nightly channels are dated too. With an explicit past cutoff, rust@stable resolves to the newest stable release that is old enough, and beta/nightly resolve to a dated build from before the cutoff. #​14697
    • The dart, flutter, nim, julia, nomad-pack, sentinel, tfc-agent, android-cli, cursor-agent and twg registry tools now report dates. #​14698

    All by @​jdx.

  • Version lists for more backends come from the mise-versions host. npm:, pipx:, cargo:, gem:, go:, dotnet: and spm: tools now list versions from mise-versions, like other registry tools, instead of going to their own source. So do http/s3 tools with a version_list_url. If you redirect a source, mise still lists from that source directly. That covers a custom npm registry or npm.shell_out, pypi.registry_url, a non-default GOPROXY, cargo.registry_name, a custom gem source, dotnet.registry_url, S3 endpoint overrides, and local listing options. conda always lists from its channel. The host cache TTL now follows the tool's minimum_release_age. To list everything from the source, set MISE_USE_VERSIONS_HOST=0. #​14700 (@​jdx)

Added

  • PowerShell installer for Windows. It's published with each release as install.ps1 and served from mise.run at /powershell and /pwsh, so you pipe it into iex with irm. It works on PowerShell 5.1+ and doesn't need admin rights. It installs the newest release that is at least 24h old, or MISE_VERSION if set. The download is verified against SHASUMS256.txt from GitHub Releases. mise.exe and mise-shim.exe go into ~\.local\bin, and that directory is added to your user Path. Re-running it upgrades an existing install. Options include MISE_INSTALL_PATH, MISE_INSTALL_MODIFY_PATH=0, MISE_INSTALL_SHIMS_PATH=1 and MISE_INSTALL_FROM_GITHUB=1. See the "Installing mise" docs for the full command. #​14660 (@​jdx, @​lhs-12)

  • read_json(), read_yaml() and read_toml() template functions parse a file so a template can use a value from it. This saves copying a version from package.json or Pulumi.yaml into mise.toml by hand. Relative paths resolve from the config file's directory. A missing key is an error unless you add | default(value="..."). Like read_file(), these functions need a trusted config, and they don't work in safe mode, .miserc.toml or OCI dotfile templates. #​14705 (@​jdx, @​edahlseng)

    [tools]
node = "{{ read_json(path='package.json')['volta']['node'] }}"
pulumi = "{{ read_yaml(path='Pulumi.yaml')['requiredPulumiVersion'] }}"

  • dotnet@lts and dotnet@sts resolve to the newest SDK in the current LTS or STS channel, using Microsoft's release index. Preview, go-live and end-of-life channels are skipped. A lts alias you define in [tool_alias.dotnet.versions] still takes precedence. Runtime-only installs still need an exact version. #​14683 (@​jdx)

  • mise bootstrap --prune-dotfiles removes dotfiles that are no longer deployed, the same way mise dot apply --prune does, so mise bootstrap --upgrade --prune-dotfiles handles everything in one run. The prune runs at the end of the dotfiles phase. It respects --dry-run, --yes and --skip dotfiles. Copies you edited are left in place. #​14681 (@​jdx, @​thernstig)

  • dotfiles.windows_symlinks (default false) makes symlink and symlink-each create real file symlinks on Windows. With it on, apply fails if Windows refuses to create a link, instead of silently copying. To create symlinks, Windows needs Developer Mode or an elevated shell. If you turn the setting back off, mise dot unapply needs --force on entries that still hold links. #​14682 (@​jdx)

    [settings.dotfiles]
windows_symlinks = true

  • http: tools can report release dates with the new version_date_expr option. It maps versions to dates from the version_list_url response. Use version_date_url to read the dates from a different URL, and version_date_next_expr to follow paged listings (same host only). Dates can be RFC 3339, YYYY-MM-DD or HTTP dates. #​14696 (@​jdx)

  • vfox plugins can report release dates. An Available or BackendListVersions hook can return created_at (RFC 3339) for each version. Plain version strings still work. #​14695 (@​jdx)

  • mise tasks -a is a short alias for mise tasks --all. #​14674 (@​williamsjokvist)

Fixed
  • mise fmt no longer breaks multiline inline tables (TOML 1.1). It used to pull comments out of the table and drop indentation. Now it leaves these tables exactly as written. #​14670 (@​jdx, @​ponko2)
  • If one task's dir template fails to render, other task commands keep working. Before, every command failed, including mise tasks validate. Now mise tasks validate reports the broken task as invalid-directory-template, and only running that task fails. #​14680 (@​jdx)
  • aqua tools now find their binaries in macOS universal archives, such as fastfetch 2.70.0. #​14665 (@​jdx)
  • npm: lifecycle scripts approved by allow_builds now run even when ~/.npmrc sets ignore-scripts=true. #​14661 (@​jdx)
  • npm: mise lock no longer fails when your aube config sets a different default lockfile, such as pnpm-lock.yaml. #​14659 (@​jdx)
  • .7z tool archives now extract when mise's data directory path contains .., for example in a localized mise setup. #​14657 (@​jdx, @​sevenc-nanashi)
  • The mise-shim.exe in the Windows release now keeps its version tag, so mise doctor and mise reshim --force stop reporting it as outdated. The warning goes away after you update and run mise reshim --force. #​14656 (@​jdx)
  • On Windows, symlink-each dotfiles messages and dry-run previews now say the files were copied rather than symlinked. #​14654 (@​jdx, @​lhs-12)
  • Rust: with a RUSTUP_DIST_SERVER mirror configured and GitHub unreachable, mise now lists the stable, beta and nightly channels instead of failing, so rust@stable installs through the mirror. #​14662 (@​jdx)
  • On Windows, http: installs of large archives no longer fail with "Access is denied" while antivirus is scanning the extracted files. mise now retries the final move for up to about a minute. #​14703 (@​jdx)
Documentation
  • New mise.toml playground: a schema-aware editor with hover help, completion and error checking. You can share a config as a link. Every mise.toml example in the docs now shows hover help on its keys. #​14673, #​14686 (@​jdx)
  • The mise.toml reference is now a searchable key explorer grouped by topic. Each key shows its type, default and a real example. Nearly every key now has a description, and these also appear in mise config explain. #​14687, #​14690, #​14688 (@​jdx)
  • The fnox secrets page now covers setup, CI and migration. The dotnet page explains how private feeds authenticate. #​14675, #​14679 (@​jdx)

Full Changelog: jdx/mise@v2026.10.14...v2026.10.15

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.14: : Global override config, mise config explain, and stricter tool option checks

Compare Source

A global config.override.toml can now take precedence over project config, and mise config explain describes each key in a config file. Paranoid mode can be turned on per category, and in that mode dotenv files need their own content-bound trust. Installs now fail when a tool has an option its backend doesn't read, which affects existing configs (see Changed).

Added

  • Global override files. ~/.config/mise/config.override.toml, and config.<env>.override.toml for each MISE_ENV, rank above every project file, including mise.local.toml and mise.<env>.toml. This covers [env], [tools], [settings], [tasks], hooks and the other sections. Anything the override file doesn't set still comes from the project. mise never writes to these files by default. To write to one, pass --override to use, unuse, set, unset, settings set|add|unset or config get|set. A tool declared in an override file resolves from the global mise.lock and is exempt from the project's --locked check. If MISE_GLOBAL_CONFIG_FILE is set, override files are not loaded. mise config ls shows a Tier column and mise doctor labels the files. #​14610 (@​jdx)

    # ~/.config/mise/config.override.toml
[env]
AWS_PROFILE = "personal"

[tools]
node = "24"

  • mise config explain [KEY] lists each key a config file sets, with its line number and its description from the schema. It flags unknown keys with a "did you mean" suggestion and marks deprecated keys. It reads the file as plain TOML, so it also works on a config mise refuses to load. Pass a key such as tasks to show only that section, --json for machine-readable output, and --file, --global, --system or --override to pick a file. #​14642 (@​jdx)

  • Paranoid mode can be turned on per category. paranoid now accepts a list of config, env_files, plugins and provenance in addition to true/false. MISE_PARANOID=config,env_files also works. true still turns on all four categories. An unknown category name is an error. #​14609 (@​jdx, @​thernstig)

    [settings]
paranoid = ["env_files"]

  • env_file takes several filenames, for example env_file = [".env", ".env.local"] or MISE_ENV_FILE=.env:.env.local. The file nearest the current directory wins. Within one directory, a name later in the list wins. A single string still works. #​14606 (@​jdx, @​thernstig)

  • A find_up entry in env._.file can search several names together. Give one entry a path list, and mise searches directory by directory. The closest directory wins, then the later name within a directory. With two separate entries, a .env.local in a parent directory still overrides the project's .env. The docs now explain this difference and how env_file differs from _.file. #​14620, #​14602 (@​jdx)

    [env]
_.file = { path = [".env", ".env.local"], find_up = true }

  • #MISE headers in file tasks accept the same keys as [tasks.<name>], including timeout, vars and the deny_*/allow_* sandbox keys. Before, these keys were ignored with a warning. If one header value is invalid, mise warns and skips that key, and every other task still loads. An invalid confirm or deny_* value is still an error, so a typo can't remove a confirmation prompt or a sandbox restriction. Before, a template named with extends overrode a header's silent. Now the header's value wins. #​14637 (@​jdx)

  • Interactive mise.toml reference in the docs at configuration/reference. It lists every key with its type, choices and default, and you can filter keys and link to them directly. Plain Markdown copies are also published for agents. #​14641 (@​jdx)

Changed

  • Installs fail on tool options the backend doesn't read. Before, such options were silently ignored. A typo or a key meant for another backend now stops the install, and the error names the option: cargo:eza: option 'asset_pattern' is not used by the cargo backend. Keys under platforms are checked too. So far this applies to the cargo, conda, gem, github, gitlab, forgejo, go, http, npm, packslip, pipx, s3, spinel, spm and ubi backends. aqua, plugin and core-language tools are not checked. The npm backend accepts the checksum option that comes from a packageManager field in package.json. #​14629, #​14655 (@​jdx)
  • Paranoid mode needs content-bound trust for env files. In paranoid mode, files loaded through _.file, found by the env_file setting, or run by _.source each need their own trust. Editing one of these files revokes its trust. Before, trusting mise.toml also approved these files, and later edits went unchecked. Running mise trust with no path trusts the project's config and every env file it loads. The error names the file but prints none of its values. To exempt a file by path, add it to trusted_config_paths in your global config. With a category list, this check belongs to env_files. #​14604 (@​jdx, @​thernstig)
  • More specific config error messages.
    • A warning about an unknown mise.toml key now gives the line and column, and suggests a close match, for example mise.toml:5:1: settings.experimantal (did you mean experimental?). #​14639 (@​jdx)
    • A wrong value for a hook, a task run/depends entry or an [env] variable now says which forms are accepted, or names the unknown key. Before, the error was data did not match any variant of untagged enum. An unknown key in a run or depends table now gets a warning. Before, it was silently ignored. #​14640 (@​jdx)
  • [bootstrap.linux.firewall] is validated on every OS. macOS and Windows still skip the section at bootstrap time, but an invalid value such as backend = "iptables" is now an error there too. #​14615 (@​jdx)
  • Editor schema updates. Editors now flag unknown keys in most [bootstrap] tables and in [dotfiles] entries. The schema now documents launchd keep_alive_on_failure and nice, and dotfile autosave and enabled. It also accepts valid configs it used to reject: templated login_shell, queue_directories and umask, nested macOS defaults values, and tools on [vars] entries. On Windows, [bootstrap.brew].adopt no longer causes an unknown-field warning. #​14616, #​14644, #​14613 (@​jdx)
  • mise dot status and mise dot sync are faster with many tracked files. They start one git process per tracked file instead of three, which took about 10s down to 4s for 860 files. #​14607 (@​waynehoover)

Fixed

  • With an external rustup that keeps its proxies in a shared directory, such as pacman's /usr/bin, mise no longer puts that directory ahead of its own tools. Before, mise exec -- node could run the system Node. Only the Rust proxies are now exposed, through a directory that mise owns. #​14597 (@​jdx)
  • The cargo backend now honors rename_exe. Before, it ignored the option and installed the executable under its original name. #​14626 (@​jdx)
  • Locked pypi: installs through uv now pass the configured mise Python to uv sync. Before, mise passed an empty path, so uv could pick another interpreter and fail on --no-build tools such as yamllint. #​14593 (@​jdx, @​hollow)
  • When the TLS root store or a CA file can't be loaded, the npm backend now reports an error instead of crashing mise with a core dump. #​14595 (@​jdx)
  • On fish, mise no longer recurses until fish hits its call stack limit after mise implode. #​14594 (@​jdx, @​thernstig)
  • mise bootstrap now finds Nix in /nix/var/nix/profiles/default/bin when a pre-packages hook installed it earlier in the same run, so nix: packages install. #​14596 (@​jdx)
  • MISE_WATCH_FILES_GIT_REWRITTEN is no longer set when HEAD stayed on the same commit, for example after git checkout -b, git reset or git branch -m. Before, format-on-edit hooks skipped files you had just edited. #​14585 (@​JamBalaya56562)
  • Command wrapper templates can now use config_root and config_source. Relative paths in template functions resolve from the wrapper's config file instead of the current directory. #​14628 (@​JamBalaya56562)

Upgrading

  • Unsupported tool options: if an install now fails with option '...' is not used by the ... backend, remove the option or fix its spelling. mise config explain tools shows which keys mise doesn't recognize.
  • Paranoid mode: after upgrading, run mise trust in each project to approve its env files. Run it again after editing them. If you only want the env-file check, set paranoid = ["env_files"].
  • Firewall config on macOS and Windows: if a shared config has an invalid [bootstrap.linux.firewall] value, it now fails to load on macOS and Windows too. Correct the value.

Full Changelog: jdx/mise@v2026.10.13...v2026.10.14

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.13: : Untrusted project configs can no longer change settings

Compare Source

mise now ignores [settings] in a project config until you trust it. This release also adds per-version-range backend options to the registry and template support for command wrappers and [bootstrap.repos]. It fixes several bugs in lockfiles, tasks and multi-version tool options.

Security

  • [settings] from untrusted project configs is ignored. Before, a cloned repo's mise.toml could change settings as soon as mise found it, with no trust prompt. That included settings that redirect downloads or feed build commands, such as node.mirror_url, python.pyenv_repo and ruby.precompiled_url. These settings now apply only after mise trust, like [env], [hooks] and [tools] options already did. Trusted projects, global and system config, environment variables and CLI flags work as before. Commands that trust the active config implicitly (mise run, mise exec, mise install) reload settings after trusting it, so the project's settings still apply to that same command. Settings files are now parsed once per load. #​14538, #​14553 (@​jdx)

    For example, if an untrusted repo sets [settings.python] pyenv_repo to its own URL, mise settings get python.pyenv_repo returns the default pyenv repository until you run mise trust.

  • mise's own zip dependency moved to 9.x, which fixes GHSA-4684-h2q9-2vcp. Older versions applied Unix permissions through extracted symlinks without checking that the target stayed inside the destination. mise uses this code to extract downloaded .zip tool archives. #​14577 (@​jdx)

Added

  • One registry backend can carry different options for each version range. A registry entry can list the same backend more than once, each time with its own min_version/max_version and options. Tools whose release assets changed at some version can then stay on one backend. Two entries can't give the same version different options unless their platforms don't overlap. Table syntax such as tool = { version = "1.4.0" } now takes its registry defaults from the entry that version selects. Older mise releases apply only the first entry's options to every version. #​14543 (@​jdx)

    backends = [
  { full = "github:example/tool", min_version = "2.0.0", options = { asset_pattern = "tool-v2-*" } },
  { full = "github:example/tool", max_version = "2.0.0", options = { asset_pattern = "tool-*" } },
]

  • mise ls-remote lists every version range of a registry tool. When a tool's backends serve different version ranges, mise now lists each range from the backend that serves it. Before, it listed only the first backend's range. For example, mise ls-remote hk now starts at 0.1.4 instead of 1.58.1. Explicit backends, overrides, --all and --strict-metadata behave as before. #​14544 (@​jdx)

  • Command wrapper values render as templates. command, args and env in [wrappers] can use vars, env and the usual template functions. tools and config_root are not available. A command that renders blank is an error. Use {% raw %} to keep literal braces, such as Docker's {{.Names}}. #​14565 (@​jdx)

    [wrappers.foo]
command = "foo-real"
args = ["--mode={{ vars.mode }}"]
env = { FOO_HOME = "{{ [xdg_data_home, 'foo'] | join_path }}" }

  • [bootstrap.repos] supports templated url/ref and clone options. url and ref render from [vars] or the process environment. Values from a config's [env] table are not available. filter, depth and submodules = true are passed to the first git clone as --filter, --depth and --recurse-submodules. Existing checkouts are left as they are. depth can't be combined with a commit SHA or a refs/… ref. #​14548 (@​jdx, @​ovidiubuligan)

    [bootstrap.repos]
"~/src/large" = { url = "git@github.com:example/large.git", ref = "{{ vars.branch }}", filter = "blob:none", depth = 1 }

  • {{ system_brew_prefix }} template variable. It resolves to the Homebrew prefix that mise bootstrap installs into: /opt/homebrew on macOS and /home/linuxbrew/.linuxbrew on Linux, or the value of MISE_SYSTEM_BREW_PREFIX. It does not detect a Homebrew install somewhere else. [bootstrap.user].login_shell now renders templates too, so login_shell = "{{ system_brew_prefix }}/bin/zsh" works. #​14572, #​14570 (@​jdx)

  • vfox PreInstall hooks can return a headers table next to url and sha256. Plugins can now download private or token-gated artifacts through the normal install path, which handles checksums, retries and lockfile URLs. Headers are sent only to the origin of url, are dropped on cross-origin redirects, are redacted in debug output and are never written to mise.lock. An explicit Authorization header overrides netrc and the automatic GitHub token. #​14531 (@​jdx)

  • mise doctor reports a stale mise-shim.exe on Windows. In windows_shim_mode = "exe", shims are copies of the mise-shim.exe that sits beside mise.exe. If that template is older than mise, or has no version tag (every template built before this release), mise doctor reports it and mise reshim warns. To fix it, update mise with the package manager that installed it, or run mise self-update, and then run mise reshim --force. #​14586 (@​jdx)

Fixed

  • Lockfiles
    • Running mise lock on Windows now records ruby entries for Windows, Linux and macOS platforms. Before, it skipped them, and mise install --locked then failed. #​14520, #​14529 (@​jdx)
    • Commands that rewrite mise.lock without locking again, such as mise link, no longer delete other platforms' option variants (for example, per-platform asset_pattern entries). #​14519 (@​jdx)
    • A mise link for one version of a tool no longer makes mise install --locked fail for that tool's other versions. A link now bypasses the lockfile only when the requested version could select it. #​14539 (@​jdx)
    • mise install --locked for Java no longer fetches the mise-java catalog when mise.lock already has the download URL, so locked installs work in air-gapped or proxied environments. #​14534 (@​jdx)
  • Tasks and shims
    • mise run no longer hangs when parallel tasks need to install the same tool. #​14536 (@​jdx)
    • Running mise install inside a task no longer removes the shims for that task's lazy tools. #​14533 (@​jdx)
    • Task hooks (such as postinstall = { task = "setup" }) and watch_files task hooks now run with mise even when a tool shim triggered them. Before, they could fail with errors like jq: Unknown option --cd. #​14550 (@​jdx, @​alitas)
    • mise watch exits quietly with status 130 when you interrupt watchexec with Ctrl+C, instead of printing an error. #​14541 (@​jdx)
  • Per-version tool options
    • When a github:, gitlab: or forgejo: tool lists several versions in config, each version now installs with its own options. Before, an option such as rename_exe set only on the first entry applied to every version. #​14537 (@​JamBalaya56562)
    • vfox: plugin hooks now receive only the options configured for the version they handle. #​14562 (@​JamBalaya56562)
  • mise install now restores cargo, rustc and the host's rust-std when they are missing from a Rust toolchain with the minimal or default profile. Before, mise reported such a toolchain as installed. #​14525 (@​JamBalaya56562, @​risu729)
  • The uv, pip and poetry deps providers now run again after mise recreates a deleted venv in a later process. Before, the new venv stayed empty. #​14532 (@​halms)
  • vfox plugins now report an error, instead of crashing mise, when the HTTP client can't be built (for example, when no CA certificates are installed). #​14576 (@​JamBalaya56562)
  • MCP resource

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 14, 2026 16:26
@renovate
renovate Bot force-pushed the renovate/support-deps branch 9 times, most recently from dd56007 to 2daf895 Compare October 19, 2026 11:58
@renovate
chore(deps): update support-deps
b1b4f1e 
| datasource                 | package                         | from        | to          |
| -------------------------- | ------------------------------- | ----------- | ----------- |
| github-tags                | actions/create-github-app-token | v3.2.0      | v3.3.0      |
| github-tags                | defenseunicorns/uds-common      | v1.31.0     | v1.32.1     |
| docker                     | docker.io/library/nginx         | 1.31.6      | 1.31.7      |
| github-tags                | github/codeql-action            | v4.38.3     | v4.39.0     |
| github-tags                | golangci/golangci-lint          | 2.14.0      | 2.15.0      |
| github-tags                | goreleaser/goreleaser-action    | v7.2.3      | v7.3.0      |
| github-releases            | jdx/hk                          | 2.5.0       | 2.7.0       |
| github-release-attachments | jdx/mise                        | v2026.10.10 | v2026.10.15 |
| github-tags                | jdx/mise-action                 | v5.1.1      | v5.2.0      |
| docker                     | nginx                           | 1.31.6      | 1.31.7      |
| node-version               | node                            | v24.21.0    | v24.22.0    |
| github-tags                | ossf/scorecard-action           | v2.4.4      | v2.5.0      |
@renovate
renovate Bot force-pushed the renovate/support-deps branch from 2daf895 to b1b4f1e Compare October 20, 2026 15:44
@renovate

renovate Bot commented Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

eoghanriley
eoghanriley previously approved these changes Oct 21, 2026
View reviewed changes
@eoghanriley
eoghanriley requested a review from a team October 21, 2026 00:16
@eoghanriley
eoghanriley merged commit e9f80a2 into main Oct 21, 2026
30 checks passed
@eoghanriley
eoghanriley deleted the renovate/support-deps branch October 21, 2026 13:22
@github-actions github-actions Bot mentioned this pull request Oct 21, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@slaskawi slaskawi slaskawi approved these changes
@eoghanriley eoghanriley eoghanriley approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@slaskawi @eoghanriley