Skip to content

Update GitHub actions - #340

Merged
hedinasr merged 1 commit into
masterfrom
renovate/github-actions
Oct 15, 2026
Merged

Update GitHub actions#340
hedinasr merged 1 commit into
masterfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
SonarSource/gh-action_cache action patch v1.7.2 → v1.7.3
SonarSource/vault-action-wrapper action minor 3.6.1 → 3.7.0
actions/attest-build-provenance action minor v4.1.1 → v4.2.2
actions/checkout action patch v7.0.0 → v7.0.1
actions/upload-artifact action patch v7.0.1 → v7.0.2
gradle/actions action minor v6.2.0 → v6.4.0
jdx/mise uses-with minor 2026.6.14 → 2026.10.6 v2026.10.10 (+3)
jdx/mise uses-with minor 2026.5.9 → 2026.10.6 v2026.10.10 (+3)
jdx/mise uses-with minor 2026.3.7 → 2026.10.6 v2026.10.10 (+3)
jdx/mise-action action minor v4.2.0 → v4.3.0
re-actors/alls-green action minor v1.2.2 → v1.3.0

Release Notes

SonarSource/gh-action_cache

v1.7.3

Compare Source

What's Changed

Bug Fixes

  • PREQ-8655: Lengthen Cognito credential-setup retries by @​tomverin in #​98

    Org-wide CI bursts (for example sonar-enterprise FULLQA) could exhaust the previous 3-attempt / 5s Cognito window with GetCredentialsForIdentity Rate exceeded. Defaults are now 5 attempts / 8s base (exponential backoff with 50–100% jitter, about 60–120s). Each Cognito attempt fetches a fresh GitHub OIDC token so the longer window cannot outlive the 5-minute token. Permanent Cognito errors (for example ValidationException) fail fast.

    Workflows already on SonarSource/gh-action_cache@v1 pick this up automatically with this v1 branch update.

Improvements

  • BUILD-12217: bump vitest and SCA dependency overrides by @​hedinasr in #​90

    Fixes CVE-2026-47429 via vitest ^3.2.7 and tightens npm overrides (undici ≥6.28.0, vite ≥7.3.6, postcss ≥8.5.23, nanoid ≥3.3.17).

CI (this repository)

New Contributors

Full Changelog: SonarSource/gh-action_cache@v1.7.2...v1.7.3

SonarSource/vault-action-wrapper

v3.7.0

Compare Source

What's new

Full Changelog: SonarSource/vault-action-wrapper@3.6.1...3.7.0

actions/attest-build-provenance

v4.2.2

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

actions/checkout

v7.0.1

Compare Source

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

gradle/actions

v6.4.0

Compare Source

Highlights
Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job
annotations and in the Job Summary (#​1057). Thanks to @​ov7a for the contribution.

version kind job annotation version table below the table
End-of-life — two or more major versions behind the latest release warning ⚠️ expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major notice ℹ️ one-line legend pointing at the Gradle release lifecycle docs
Current none — —

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and
pre-releases (release candidates, milestones and snapshots never produce annotations). The latest
Gradle release is determined from the wrapper checksum data already bundled with the action, so no
network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting
add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations
remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the
GitHub Dependency Graph Gradle Plugin
(up from v1.4.2) (#​1069).

The headline change is that the Gradle Build Tool running the build is now reported as an
org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version
of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle
Build Tool are published against.

Details worth knowing:

  • The entry is always reported as a direct dependency with development scope.
  • It is not affected by the project, configuration or scope filters, so it appears even in graphs
    that filter aggressively.
  • Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.
A new Gradle signing key, if you use dependency verification

[!IMPORTANT]
If your build has dependency verification
enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will
fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the
key previously documented in our setup guide has been revoked upstream:

Artifact Signing key
org.gradle:github-dependency-graph-gradle-plugin 1.5.0 and later E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA (new)
org.gradle plugin versions before the rotation 7B79ADD11F8A779FE90FD3D0893A028475557671 (old, revoked)
com.gradle Develocity Gradle plugin, including 4.5.0 7B79ADD11F8A779FE90FD3D0893A028475557671 (old, revoked)

Because the Develocity Gradle plugin is still signed with the old key, you should trust both keys
rather than swapping one for the other — replacing the old key outright will break Develocity
injection. The documented snippet in
docs/setup-gradle.md
has been updated accordingly (#​1071):

<trusted-keys>
   <trusted-key id="7B79ADD11F8A779FE90FD3D0893A028475557671">
      <trusting group="com.gradle"/>
      <trusting group="org.gradle"/>
   </trusted-key>
   <trusted-key id="E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA">
      <trusting group="org.gradle"/>
   </trusted-key>
</trusted-keys>
cache-provider: external for externally managed Gradle User Home

Builds that save and restore Gradle User Home by some other mechanism (Develocity Artifact Cache, for
example) previously had to set cache-disabled: true, which was misleading: caching wasn't disabled,
it just wasn't managed by this action, and the Job Summary reported it as "Disabled".

cache-provider: external skips Gradle User Home restore/save exactly as cache-disabled does, but
reports a distinct External status in the Job Summary explaining that caching is handled by
another provider (#​1059).

- uses: gradle/actions/setup-gradle@v6
  with:
    cache-provider: 'external'
Develocity access keys containing OIDC tokens now work

Short-lived-token handling validated the server=key[;server=key]* access key format with a regex
whose key portion was too strict, so an access key holding an OIDC token value was rejected
outright. Worse, had it passed the regex, parsing split each entry on = and kept only the second
field — silently truncating any key containing = (as JWT padding does) and sending the mangled
key to the server. Both problems are fixed (#​1061).

Job Summary attribution

Job summaries produced by setup-gradle and dependency-submission now carry a top-level heading
naming the action, so the block stays attributable when another action's summary content lands in the
same job (#​1058).

Updated defaults
  • GitHub Dependency Graph Gradle Plugin: 1.4.2 → 1.5.0
  • 5 new known-good wrapper checksums for wrapper-validation (368 → 373 entries)
What's Changed
New Contributors

Full Changelog: gradle/actions@v6.3.0...v6.4.0

v6.3.0

Compare Source

Highlights
Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

  • Cache entries failed to store at all on Windows.. Every entry failed
    with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so
    every downstream job ran against an empty Gradle User Home. The cause was a nested,
    unpatched copy of @actions/glob combined with a silently swallowed require() in
    the bundle, which left Windows path separators unnormalized.

  • Cache cleanup deleted instrumented jars that were in use. A bug in key
    hashing for paths shorter than 64 characters made cleanup judge freshly created
    caches/jars-9 entries as unused and remove them, so the instrumented-jars entry
    was never saved and every job re-instrumented its classpaths.

    Also included: cache entry names are now consistent between the save and restore
    reports — restore previously fell back to showing the raw glob pattern (e.g.
    /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT]
Existing cache entries are invalidated by this release. The cache protocol
version was bumped to v2, so the first run after upgrading will be a cache miss
and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports
(Entry not saved: save failed) in the Job Summary when a cache save fails, rather
than reporting success (#​1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so
dependency graph generation works on builds that enable it (#​1025). Thanks to @​reinsch82 for the contribution.

Updated defaults
  • Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
  • 36 new known-good wrapper checksums added for wrapper-validation
What's Changed
New Contributors

Full Changelog: gradle/actions@v6.2.0...v6.3.0

jdx/mise

v2026.10.6: : Per-machine [vars] prompts, local config includes, and working-tree changes in --affected

Compare Source

[vars] entries can now ask once per machine and remember the answer, include accepts local files, and mise run --affected now counts uncommitted work and no longer needs experimental = true. On a fresh machine, mise bootstrap can install git and ssh before it clones. The release also fixes several dotfiles history issues and stops lazy tools from triggering remote version lookups when something else launches.

Added

  • Per-machine [vars] prompts. Give a var a prompt, plus either a default or required. mise asks for it once and saves the answer in $MISE_STATE_DIR/vars.toml, outside your config and dotfiles history. Templates, tasks and tools then read it as usual. One shared dotfiles setup can use this to set a different Git identity on each machine. #​14190

    [vars.git_name]
default = "Ada Lovelace"
prompt = "Git author name"

[vars.git_email]
required = "Run mise vars prompt to set git_email"
prompt = "Git email"
    mise vars                       # list every var and where its value comes from
mise vars prompt                # ask for every unanswered prompt var (or name some)
mise vars git_name=Ada          # save a value without a prompt
mise vars unset git_name        # forget a saved value
mise bootstrap --prompt-vars    # prompt during a bootstrap run, e.g. with --adopt

    Only mise vars prompt and mise bootstrap --prompt-vars ever ask. Everything else uses the saved answer, then the default. Precedence, highest first: the process environment, a value from a higher-precedence config file, the saved answer, the default. Answers are keyed by var name, so projects that use the same name share one answer on a machine. prompt is not allowed in [env].

  • Local paths in include. include in mise.toml now accepts local TOML files, not just git:: and oci:: references. A path can be relative to the including file or absolute. Local files merge the same way as remote ones, ranking just below the including file. They are read on every load, so edits apply immediately and invalidate the cached env. Paranoid mode rejects local includes, and safe mode still skips all includes in project config. #​14178

    include = ["./config/tools.toml", "/etc/mise/team.toml"]

  • mise bootstrap installs git and ssh before cloning. mise bootstrap --from and --adopt used to fail with a spawn error when git was missing. Now mise checks for git, and for ssh when the URL is ssh:// or user@host:path, and offers to install whatever is missing with the host package manager. Supported managers are apt, dnf, pacman, apk, zypper, Homebrew, scoop and winget. --yes accepts the offer without asking, and --dry-run only reports what is missing. #​14188

  • mise dot save --re-encrypt. After you change [history.encryption] recipients, a normal save leaves some encrypted files under their old keys: manual-save entries the save doesn't name, and other-platform variants. Add --re-encrypt to re-encrypt every saved file in the new checkpoint to the current recipients. It never captures unsaved edits. If this machine can't unlock some of the files, nothing is saved and the error lists all of them. #​14210

  • mise dot status shows unsaved changes. It now lists tracked paths that changed since the latest checkpoint. Unsaved edits were previously invisible there when the watcher was stopped or an entry used --no-autosave. --json reports these paths as history.unsaved. The value is null when they can't be determined, for example with no checkpoint yet or with encrypted files this machine can't compare without prompting. #​14209

Changed

  • mise run --affected now counts working-tree changes, and the workspace graph is no longer experimental. Besides the committed base...head range, --affected now also counts staged and unstaged edits and untracked files that aren't ignored. You can narrow it with --affected-committed, --affected-uncommitted and --affected-untracked, which can be combined (environment variables: MISE_AFFECTED_*). Working-tree changes only count when the head is your current checkout. To get the old committed-only selection, for example in a CI job that writes untracked files before it runs, use --affected-committed. --affected, mise tasks graph, [monorepo.task_defaults], [monorepo.projects] and task.auto_infer no longer require experimental = true. #​14214

    mise run --affected build                                         # committed + uncommitted + untracked
mise run --affected --affected-uncommitted --affected-untracked build  # only what you haven't committed yet
mise run --affected --affected-committed build                    # committed range only, as before

  • Credential checks for dotfiles. Files with names ending in .example, .sample or .template no longer match the credential name rules. The content scan before publishing still checks them. Once you approve a file for plaintext tracking, mise no longer warns about it on every save. #​14204

  • mise dot track only asks about plaintext at a terminal. Before saving a credential-named file in plaintext, it now asks only when both stdin and stderr are terminals. Previously, a piped line, such as the next entry in a while read loop, could be taken as the answer. Scripts need --allow-plaintext or --encrypt. #​14205

Fixed

  • Lazy tools no longer trigger remote lookups for other lazy tools. Previously, mise looked up versions for configured lazy tools that weren't installed, even though they weren't being launched. With a cold cache and no network, launching one tool waited on each lookup and could print "Failed to resolve tool version list" warnings. In one offline test a launch took 41 seconds. This no longer happens in these cases:

    • the update that runs before an auto_update tool launches (#​14195)
    • after mise x or a shim installs a new version (#​14197)
    • the first launch of a lazy tool through its shim (#​14201)

    mise install, mise upgrade and mise use still resolve everything.

  • Too many open files with parallel npm: installs. Parallel installs could fail under macOS's default launchd soft limit of 256, for example when mise was started from a LaunchAgent. On Unix, mise now raises its soft open-file limit at startup toward the hard limit, up to 10240, and never lowers it. #​14174, #​14216

  • go: tools with an untidy go.mod. Tools whose published go.mod is missing a requirement now install, for example go:tailscale.com/cmd/tailscale. mise now passes -mod=mod to go install instead of -mod=readonly. A project's GOFLAGS=-mod=vendor still doesn't affect these installs. #​14180 (@​JamBalaya56562)

  • Config at the filesystem root. A config file at /, such as /mise.toml in a Docker image, made mise install and mise exec panic. It now works. #​14182

  • .NET installs. Installing a .NET SDK no longer fails with "was not found in dotnet --list-sdks output" when another mise-managed SDK comes before the shims on PATH. The post-install check now runs the new SDK's dotnet directly. #​14189

  • Shims and directories. Shims and mise which no longer resolve a bin name to a directory in another tool's bin path. Previously, hunk's skills/ directory blocked npm:skills with "Permission denied". #​14193

  • mise oci build and multiple versions. A tool pinned to several versions is now written to the embedded /etc/mise/config.toml as a single array, in resolution order. Previously each version got its own duplicate key, which made the config unreadable inside the container. #​14200 (@​JamBalaya56562)

  • Encrypted files a sync can't unlock. mise bootstrap --adopt, mise dot pull and mise dot sync now list every encrypted file they can't unlock in one error, instead of stopping at the first one. Damaged files still stop the sync immediately. #​14208

  • Rollback and undo messages. mise dot rollback <path> now names the checkpoint that saved the restored version, which matches mise dot history --path. Rollback and undo also name both checkpoints they record: the result, and the one holding the state before the operation. Previously, rollback could name a checkpoint that history --path didn't list. What gets restored is unchanged. #​14207, #​14211

  • mise dot status on adopted machines. On a machine that adopted a shared setup, it no longer prints "nothing configured in [dotfiles]" while history tracks entries. #​14206

New Contributors

Full Changelog: jdx/mise@v2026.10.5...v2026.10.6

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.5: : Java defaults to Temurin, per-machine and local-only dotfile history, packslip workflow pinning

Compare Source

Java versions without a vendor prefix now install Eclipse Temurin builds. Dotfiles gain per-machine and local-only history, a merge = "missing" mode, and a secret check before mise dot sync publishes anything. Packslip tools can be pinned to the workflow that signs their releases. Several features documented as experimental now actually require experimental = true. The rest of the release is fixes across tasks, shims, config loading, bootstrap and backends.

Breaking Changes
  • java@21, java@lts and java@latest now install Temurin. The default of java.shorthand_vendor changes from openjdk to temurin. The jdk.java.net OpenJDK builds stop at the next feature release, so java@21 was stuck on 21.0.2 from January 2024. Vendor-prefixed requests (openjdk-21, corretto-21, ...) are not affected. Installed OpenJDK versions keep working, and mise upgrade offers the Temurin build. Shorthand versions now include Temurin's build suffix (for example 21.0.12+101.0.LTS). Temurin has no builds of Java 9, 10 or 12–15, so use openjdk-12 and similar for those. #​14146
    • Lockfiles: existing shorthand lock entries record shorthand_vendor = "openjdk". Without that setting, mise install --locked fails with java@21 is not in the lockfile. Either keep OpenJDK: 
      [settings]
java.shorthand_vendor = "openjdk"
# or per project: java = "openjdk-21"
      or switch to Temurin with mise lock --bump java and commit the result.
  • Some experimental features now require experimental = true (or MISE_EXPERIMENTAL=1) when you use them. Config that only mentions them still loads. #​14114
    • Running a task with a git:: remote file, including through mise run --dry-run, mise watch, or as a dependency. Commands that only inspect tasks (tasks ls, tasks info, tasks deps, generate task-docs) show the task from its TOML and warn once that the file wasn't fetched. These were documented as experimental but were missing the check in the codebase.
    • git:: and oci:: entries in task_config.includes. These are skipped with a warning.
    • OpenTelemetry export of mise run when an OTLP endpoint is set.
    • Installing spinel: tools.
  • mise.local.toml now overrides mise.<env>.toml in the same directory, as the docs already said. Before, the committed environment file won in project directories, and also in ~/.config/mise when the walk up from the cwd reached it. Within each directory the order is now, highest first: mise.<env>.local.toml, mise.local.toml, mise.<env>.toml, mise.toml. If you relied on the environment file winning, move those keys into mise.<env>.local.toml. #​14148
  • MCP: in the mise://tasks resource, env is now an array of env directive strings, the same format as mise tasks ls --json. It was always an empty object before. #​14111
  • mise settings set and add refuse writes that would have no effect. This covers early-init settings (env, ceiling_paths, env_conf_d, ...) written to a config file, and global-only settings (yes, paranoid, trusted_config_paths, ...) written with --local. The error says where the setting has to go: miserc.toml, the global config, or the MISE_* variable. #​14126
Added
Dotfiles
  • Per-machine tracked files. Some files describe the machine, such as a monitor layout. Use variants = [{ machine = true }] or mise dot track --machine to keep a separate history for each machine. Sync pushes every machine's version to the origin but never applies one machine's version on another. Each machine gets a generated name, which you can set with [history] machine = "desk". A machine variant must be the entry's only variant and can't be combined with encrypt. Upgrade every machine that shares a setup before using it. #​14062 
    [dotfiles]
"~/.config/hypr/monitors.lua" = { mode = "track", variants = [{ machine = true }] }
  • mode = "track-local" (or mise dot track --local) keeps a file's history in a separate store on this machine, with no origin. The file never reaches the shared manifest, a commit or a push. Commands that name a path use the history that holds it. Use mise dot --local history or mise dot --local undo to work with the local history directly. save, capture and watch cover both histories. #​14082
  • merge = "missing" sets only the keys the target file doesn't have yet. Values an app writes itself, such as the model picked with /model in Codex or Claude Code, are left alone. Works with TOML, YAML and JSON. #​14081 
    [dotfiles]
"~/.codex/config.toml/shared" = { merge = true }
"~/.codex/config.toml/defaults" = { source = "codex/defaults.toml", merge = "missing" }
  • Merge entries can leave out source. mise then reads the target's path under dotfiles.root. Switching an entry from symlink to merge now replaces a link that points at the merge source with a writable copy, so the app's own keys survive. #​14076
  • mise dot sync refuses to publish saved versions that look like secrets. It checks for provider tokens, private key blocks, and *_KEY/*_TOKEN/*_SECRET/*_PASSWORD assignments. Only versions the origin doesn't have yet are checked. The error names the file, line and version, never the value. --allow-plaintext-history skips the check. #​14171
  • mise bootstrap --adopt <url> --take-remote-all takes the repository's version of every file that differs, in one step. Combined with --replace-history, it also adopts the repository on a machine that already has history of its own. #​14065
  • mise doctor shows the dotfiles history repo path and the connected origin (URL, branch, sync mode), in both text and --json output. #​14173
Bootstrap
  • [bootstrap.files] and [bootstrap.directories] accept the same os selector as packages. Entries that don't match the host are skipped completely. #​14058 
    [bootstrap.files."/etc/docker/daemon.json"]
os = "linux"
source = "./files/docker-daemon.json"
  • fish = "auto" in [bootstrap.mise_shell_activate] writes a block that runs mise activate fish in interactive shells and --shims everywhere else. #​14172
  • [bootstrap] is now allowed in config includes. It merges below the including file, so a shared baseline can declare packages, hooks and services, and the project still wins on any key it sets itself. #​14176
  • Systemd units accept state = "absent", which stops, disables and deletes the matching mise-managed service and timer. mise bootstrap unapply now also removes the units an environment added. #​14139
Tools and backends
  • Packslip workflow option. It accepts only releases signed by the named GitHub Actions workflow on tags. It takes one workflow or a list, and an entry can name a ref (release.yml@refs/heads/main). It can't be combined with pubkey, identity, identity_prefix or issuer. #​14075, #​14093 
    [tools]
"packslip:github.com/aubepkg/aube" = { version = "latest", workflow = ["release-plz.yml", "release.yml"] }
    • Registry entries for dagu, timoni, helmfile, fnox, hk, usage, communique, mr-boxington, pitchfork, aube and worktrunk are now pinned to the workflow that signs their releases. A workflow or pubkey you set yourself replaces the registry pin. #​14092, #​14091, #​14073 (@​max-sixty)
  • MCP install_tool is implemented. It installs the requested version, or the configured version, or latest, and returns the resolved version and install path. install_tool and run_task now refuse to act on untrusted config instead of trusting it on the client's behalf. #​14111
  • mise installs migrate no longer fails on installs it can't reinstall, such as withdrawn releases, signer changes or no network. It moves them into the identity layout as they are and leaves a link at the old path. It also handles lockfile-suffixed ~aube~/~uv~ directories correctly. #​14079
  • Registry: mprocs is renamed to dekit to match upstream, and mprocs stays as an alias. From v0.10.0 the binary is dekit. #​14169
Changed
  • Dotfile operations you can undo no longer ask for confirmation after showing their plan. This covers dot pull, dot track, undo, rollback, connect and bootstrap --adopt. Destructive ones still ask, such as --replace-history, dot recover --keep-current and implode. --yes and MISE_YES are still accepted. #​14077, #​14071, #​14067
  • Safe mode (MISE_SAFE=1) now ignores a project's [bootstrap], [dotfiles] and [dotfile_groups]. Before, an untrusted repo could link files into $HOME or clone repositories. Global and system config still apply. #​14110
  • Node downloads are checked against the GPG signature for every version that publishes one. Before, only versions starting with 2 were checked. Set node.gpg_verify = false for mirrors without signatures. #​14132
  • mise generate github-action now uses actions/checkout@v7 and jdx/mise-action@v5 and no longer sets MISE_EXPERIMENTAL. mise generate devcontainer now adds "postCreateCommand": "mise install". #​14145
Deprecated
  • task.cache.stats_report, sops.age_recipients and plugin_autoupdate_last_check_duration never had any effect. Setting one now prints a warning, and they will be removed in 2027.10.5. #​14112
  • mise bootstrap launchd|systemd|macos-defaults, the old --only/--skip part names (launchd, systemd, defaults, shell) and mise direnv now print a warning that names the replacement. They will be removed in 2027.10.4. #​14113
Fixed
Tasks
  • A raw or interactive task with cache enabled is now skipped when its sources are fresh and its cache key hasn't changed. Before, it ran every time. #​14121
  • A typo in sources that matches no files now prints a warning. mise tasks deps <task> now shows depends_post tasks. Scripts in $MISE_CONFIG_DIR/tasks load even without a global config file. #​14122
  • mise run ./script resolves relative to the current directory. #​14120
  • Script extensions are stripped only from file task names. #​14159
  • Requests to the remote task cache include the mbx-cache headers. #​14147
  • mise generate task-stubs skips hidden and global tasks. #​14127
Shims and exec
  • Shims, mise x and mise env no longer look up remote versions for lazy tools that aren't installed. With 20 lazy tools and no network, running an installed tool went from about 42s to 0.09s. #​14063
  • On Unix, a system wrapper that execs the same command name can no longer send an unconfigured shim into an endless loop. #​14088
  • Windows lazy shim names now match regardless of letter case. #​14090
  • mise x tool@1.2.3 installs the exact version when the version list times out, instead of failing with "couldn't exec process". #​14164
  • mise doctor recognizes a mise entry in the dedicated shims dir. #​14069
Config, settings and CLI
  • With an environment active and no config.toml yet, mise use -g creates config.toml instead of writing into config.<env>.toml. #​14179
  • Booleans set through mise config set --type bool and boolean settings accept yes/no/1/0. For env.* and other keys that aren't settings, only true and false become booleans, and anything else is stored as written. mise latest tool@prefix:X works, and --log-level warn is accepted. mise doctor prints the full chain when config fails to load. #​14125
  • Help output uses the command name you typed. #​14123
  • mise edit no longer overwrites an existing config when there is no terminal. #​14124
  • .monorepo markers are verified in paranoid mode. #​14105
  • Bad input now gives an error instead of a panic, in places including mise config ls and mise prune with an invalid tool version, the --monorepo flags, and mise plugins uninstall --purge. #​14118, #​14094 (@​JamBalaya56562), #​14103 (@​JamBalaya56562), #​14116, #​14117
  • mise env --redacted honors redact = false exclusions. watch_files hooks don't run in safe mode or with --no-hooks. #​14109, #​14108
  • mise watch passes watchexec flags through to watchexec. #​14115
  • Error and warning hints point at current commands, for example the PATH advice from bootstrap remote and the watchexec install hint. #​14142
  • If stderr can't be written to during a migration, mise no longer aborts. #​14158 (@​JamBalaya56562)
  • When the default cache and temp directories overlap (the Windows default), temp files now go to <temp>/mise-tmp, so mise cache clear no longer deletes files that are still in use. #​14134
Bootstrap and dotfiles
  • mise bootstrap keeps writing the shell activation block into a startup file that is only tracked. #​14135
  • If one package manager fails, the others still run. #​14138
  • The firewall section is skipped on systems that don't support it. #​14137
  • Dry runs show hooks that use exec(). #​14136
  • Pulling onto a machine with no history now saves the files it replaces first, so mise dot undo restores them. --replace-history no longer fails on its first attempt. #​14065
  • mise dot pull says so when incoming history changes no files on this machine. #​14066
Backends and plugins
  • mise install cargo:... no longer uses an inactive cargo-binstall shim. It falls back to native binstall or cargo install. #​14070
  • With npm.shell_out, a mise shim from another data dir can no longer be run as npm and fork until the machine runs out of memory. #​14084 (originally found and fixed by @​tfournet)
  • Java: changing java.shorthand_vendor takes effect without waiting for the cache to expire. Inline java[release_type=ea] is respected when listing and resolving versions. #​14131
  • Ruby precompiled URLs expand {os} and {arch} correctly. #​14133
  • ls-remote respects disable_backends. #​14130
  • SPM uses a custom api_url for cloning and skips lockfile URLs. #​14129
  • GitHub assets are size-checked even when there is no checksum. GitLab release lookups percent-encode the tag. #​14128, #​14102 (@​thespags)
  • Brew infers the formula version from the GitHub release tag path, and detaches a DMG left attached by an interrupted install. #​14165 (@​JamBalaya56562), #​14177
  • git:: plugins install from a subdirectory, and [plugins] entries compare those sources correctly. Packslip entries in [plugins] install as vfox plugins. #​14140, #​14150 (@​onokonem), #​14141
  • vfox: an env plugin with no source no longer makes every command fail. Embedded plugin files are found relative to the manifest directory. #​14119, #​14167
Daemons and sandbox
  • On Windows, deferred daemon commands are quoted for cmd.exe. Argv and Windows readiness probes run in the tool environment. #​14055, #​14080 (@​JamBalaya56562)
  • --deny-env clears inherited variables on Windows. On macOS, allow_net is rejected instead of writing invalid sandbox rules. #​14107, #​14106
Security
  • Remote task cache keys store env, [vars] and task arg values as blake3: digests instead of plaintext, so secret values are no longer uploaded. Existing cache entries miss once after upgrading. #​14104
  • URL credentials are redacted from HTTP debug logs and from npm Git-source and SSH diagnostics. #​14155, #​14057, #​14064
Documentation
New Contributors

Full Changelog: jdx/mise@vfox-v2026.10.4...v2026.10.5

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.4: : Task-scoped fnox secrets, automatic global tool updates, and an opt-in identity install layout

Compare Source

This release adds experimental task-scoped secrets backed by fnox, automatic updates for global tools, and an experimental opt-in install layout that names installations by what they contain. It also adds dotfile merge entries, headers auth for the http: backend, npm installs from git, and a set of prune, install and lockfile fixes.

Added
Secrets (experimental)

These need mise settings experimental=true and fnox 1.39.0 or newer. They are refused in safe mode.

  • [secrets.fnox] and mise secrets ls. A project can name fnox as its secrets source in its own `mi

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Paris)

  • Branch creation
    • "after 7am every weekday,before 8pm every weekday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 31, 2026 15:44
@renovate
renovate Bot force-pushed the renovate/github-actions branch 6 times, most recently from 19ae1e3 to 85208bf Compare September 9, 2026 15:26
@renovate
renovate Bot force-pushed the renovate/github-actions branch 10 times, most recently from fa448c4 to 21cf58b Compare September 19, 2026 19:32
@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from 85b65b9 to 59b9ca1 Compare September 25, 2026 13:50
@renovate
renovate Bot force-pushed the renovate/github-actions branch 7 times, most recently from 9bb4a31 to 3d8d7d9 Compare October 4, 2026 11:26
@renovate
renovate Bot force-pushed the renovate/github-actions branch 8 times, most recently from defce8c to 2666195 Compare October 12, 2026 18:56
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 2666195 to f5276e2 Compare October 14, 2026 00:38
@renovate
renovate Bot force-pushed the renovate/github-actions branch from f5276e2 to a941978 Compare October 14, 2026 13:07
@sonarqubecloud

sonarqubecloud Bot commented Oct 14, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@hedinasr
hedinasr merged commit ceb4b65 into master Oct 15, 2026
21 checks passed
@hedinasr
hedinasr deleted the renovate/github-actions branch October 15, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hedinasr hedinasr hedinasr approved these changes

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hedinasr