Update dependency mise to 2026.4.25 by renovate[bot] · Pull Request #117 · SonarSource/cloud-native-gradle-modules

renovate · 2026-03-29T22:07:37Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change	Pending
mise	major	`2025.7.12` → `2026.4.25`	`2026.4.28` (+1)

Release Notes

jdx/mise (mise)

`v2026.4.28`

Compare Source

🐛 Bug Fixes

(copr) remove stale pinned image digest and rebuild copr image on Dockerfile changes by @bestagi in #9451
(task) avoid gix panic when cloning a remote task by commit SHA by @jdx in #9473

`v2026.4.27`

Compare Source

🚀 Features

(backend) add npm package-manager install options by @risu729 in #9109
(release) list aqua package additions/updates in changelog by @jdx in #9471
Make config_root available to environment plugins for relative path resolution by @hisaac in #9465
watch sources of dependencies by @43081j in #9437

🐛 Bug Fixes

(backend) Don't cache empty version lists by @c22 in #9444
(shims) compare PATH entries case-insensitively on macOS by @jdx in #9468
(task) preserve essential env vars under deny_env on Linux by @jdx in #9467

Chore

(ci) make vendored-file-warning a failing check by @jdx in #9469

New Contributors

@43081j made their first contribution in #9437
@hisaac made their first contribution in #9465

📦 Aqua Registry Updates

New Packages (7)

Updated Packages (5)

`v2026.4.25`

Compare Source

🚀 Features

(task) add --name-only flag to mise tasks ls by @jdx in #9435

🐛 Bug Fixes

(Dockerfile) install copr-cli via dnf for better dependency management by @bestagi in #9421
(aqua) drop empty-releases fallback to tags by @jdx in #9443
(docs) fix theme flicker on docs by @vhespanha in #9427
(lockfile) update global lockfile on upgrade by @jdx in #9442
(ls-remote) omit rolling/prerelease from JSON when false by @jdx in #9439
(task) support usage refs in dependency template tags by @jdx in #9424
(task) populate usage.cmd for subcommand-only tasks; share make_usage_ctx by @jdx in #9431
(task) resolve sandbox allow_read/allow_write against task dir by @jdx in #9428

📚 Documentation

(site) add self-hosted page tracker via Cloudflare Worker, drop GoatCounter by @jdx in #9430

New Contributors

@vhespanha made their first contribution in #9427

`v2026.4.24`

Compare Source

🚀 Features

(ls-remote) add prereleases setting and --prerelease flag by @jdx in #9415

🐛 Bug Fixes

(http) retry transient HTTP failures with backoff and warn on rescue by @jdx in #9414
(release) purge mise.en.dev CDN zone after each S3 publish by @jdx in #9416

📚 Documentation

prefix GitHub star count with ★ glyph by @jdx in #9417
update intro messaging by @jdx in #9418

`v2026.4.23`

Compare Source

🚀 Features

(backend) add global libc preference by @jdx in #9404
opt-in to pre-release versions for github and aqua backends by @jakedgy in #9329

🐛 Bug Fixes

(backend) allow unresolved latest opt-in by @jdx in #9401
(install) stop rewriting healthy runtime symlinks by @jdx in #9410
(node) route musl tarball URLs to unofficial-builds by @jdx in #9409
(prune) skip remote version resolution for tracked configs by @jdx in #9406
(schema) allow array values in tool additionalProperties by @JP-Ellis in #9400

📦️ Dependency Updates

bump communique to 1.1.2 by @jdx in #9402

📦 Registry

use aqua for rumdl by @scop in #9397

Chore

(ci) improve pr-closer workflow by @jdx in #9403
(docs) switch canonical domain to mise.en.dev by @jdx in #9411
(release) stop appending sponsor blurb when communique succeeds by @jdx in #9395

New Contributors

@JP-Ellis made their first contribution in #9400

`v2026.4.21`

Compare Source

🚀 Features

(registry) add --security flag to include security info in JSON output by @jdx in #9364

🐛 Bug Fixes

(config) limit resolved backend opts to aliases by @risu729 in #9315
(docs) stack banner message and link on mobile by @jdx in #9362
(github) prefer shortest asset name as tiebreaker in auto-detection by @jdx in #9361
(java) newer zulu versions use a different directory structure by @roele in #9365
(prune) respect tracked lockfiles by @jdx in #9373
(task) skip tool install for missing naked tasks by @jdx in #9374
(trust) add untrust command by @jdx in #9370
fix - flux-operator-mcp aqua path by @monotek in #9357

📚 Documentation

update ruby compile msg by @fladson in #9338

📦️ Dependency Updates

update ubuntu docker tag to v26 by @renovate[bot] in #9347
update ghcr.io/jdx/mise:deb docker digest to 1af5a69 by @renovate[bot] in #9352
update taiki-e/install-action digest to 787505c by @renovate[bot] in #9354
update ghcr.io/jdx/mise:rpm docker digest to 7015ff3 by @renovate[bot] in #9353
update ghcr.io/jdx/mise:copr docker digest to da63a0f by @renovate[bot] in #9351
update ghcr.io/jdx/mise:alpine docker digest to 461700f by @renovate[bot] in #9350
bump communique 1.0.3 → 1.0.4 by @jdx in #9378

📦 Registry

remove openshift-install by @jdx in #9372
remove go-sdk by @jdx in #9371

Chore

(npm-publish) use aube publish instead of npm publish by @jdx in #9328

New Contributors

@fladson made their first contribution in #9338

`v2026.4.22`

Compare Source

🚀 Features

(copr) add Fedora 44 & Rawhide support by @bestagi in #9391

🐛 Bug Fixes

(backend) repair latest runtime labels and go resolution by @jdx in #9383
(task) label deps output by provider by @jdx in #9385

🚜 Refactor

(config) rename install_before setting by @jdx in #9384

📚 Documentation

(site) show release version in nav by @jdx in #9388
(site) address release nav feedback by @jdx in #9389

🧪 Testing

(config) pin tombi schema test version by @jdx in #9386

📦 Aqua Registry

Updated aqua-registry: v4.498.0 -> v4.499.0.

Included aqua-registry releases:

v4.499.0

`v2026.4.20`

Compare Source

🐛 Bug Fixes

(config) resolve relative path: tool versions against config root by @jdx in #9320
(lock) resolve @latest and prune poisoned lockfile entries by @jdx in #9321
fix - be able to work with regex in attestation check by @monotek in #9327

🚜 Refactor

(aqua) bake aqua registry from merged yaml by @risu729 in #9043

📚 Documentation

add cross-site announcement banner by @jdx in #9326
keep banner height in sync via ResizeObserver by @jdx in #9330
respect banner expires field by @jdx in #9334

📦️ Dependency Updates

bump communique to 1.0.2 by @jdx in #9313
bump communique to 1.0.3 by @jdx in #9332
update actions/setup-node digest to 48b55a0 by @renovate[bot] in #9339
update ghcr.io/jdx/mise:alpine docker digest to a92efa5 by @renovate[bot] in #9340
update ghcr.io/jdx/mise:rpm docker digest to 5c24f69 by @renovate[bot] in #9343
update rust docker digest to e4f09e8 by @renovate[bot] in #9345
update rui314/setup-mold digest to 9c9c13b by @renovate[bot] in #9344
update ghcr.io/jdx/mise:deb docker digest to a3afe3e by @renovate[bot] in #9342
update ghcr.io/jdx/mise:copr docker digest to 4098d5a by @renovate[bot] in #9341
update taiki-e/install-action digest to 74e87cb by @renovate[bot] in #9346

Chore

(ci) remove cargo-vendor install from ppa publish by @jdx in #9312
(release) publish snap to stable channel by @jdx in #9318
remove FUNDING.yml in favor of jdx/.github default by @jdx in #9331

📦 Aqua Registry

Updated aqua-registry: v4.492.0 -> v4.498.0.

Included aqua-registry releases:

`v2026.4.19`

Compare Source

🚀 Features

(backend) support aqua vars templates by @risu729 in #9110
(oci) build OCI images from mise.toml with per-tool layers by @jdx in #9273
add gsudo (Sudo for Windows) to registry by @matracey in #9281

🐛 Bug Fixes

(backend) stop fuzzy requests installing literal dirs by @AsgardMuninn in #9276
(backend) use full token chain for all sigstore attestation calls by @cameronbrill in #9307
(backend) use remote version cache offline by @risu729 in #9304
(cli) retrieve token from github helper for self-update command by @sushichan044 in #9259
(cli) suppress error output after interactive cancel by @jdx in #9294
(conda) avoid temp file collisions during parallel package downloads by @salim-b in #9293
(github) scope auth headers to API URLs by @risu729 in #9271
(go) treat empty GOPROXY as default by @jdx in #9310
(vfox) use github token for lua http requests by @jdx in #9257
(vfox) avoid auth on release asset downloads by @jdx in #9299
(vfox) scope github auth to API URLs only by @jdx in #9309

🚜 Refactor

(core) centralize install_before resolution by @risu729 in #9286
(deps) store deps state under $MISE_STATE_DIR by @jdx in #9301

📚 Documentation

add aube hero banner by @jdx in #9265
add en.dev footer by @jdx in #9267
implement landing page design by @jdx in #9266

📦️ Dependency Updates

lock file maintenance by @renovate[bot] in #9268
bump msrv for aws smithy updates by @jdx in #9295
bump sigstore-verification to 0.2.7 by @jdx in #9302

📦 Registry

add llama.cpp (github:ggml-org/llama.cpp) by @igor-makarov in #9282
add kiro-cli by @shalk in #9274
add flux-operator & flux-operator-mcp by @monotek in #8852

Chore

(ci) increase autofix timeout by @jdx in #9296
(ci) stop release-plz from saving build cache by @jdx in #9297
(ci) stop lint from saving build cache by @jdx in #9298
(ci) restore lint as Linux build cache writer by @jdx in #9305
(release) add en.dev sponsor blurb to release notes by @jdx in #9272
bump communique to 1.0.1 by @jdx in #9264

New Contributors

@AsgardMuninn made their first contribution in #9276
@monotek made their first contribution in #8852
@igor-makarov made their first contribution in #9282

📦 Aqua Registry Updates

New Packages (3)

Updated Packages (3)

`v2026.4.18`

Compare Source

🚀 Features

(latest) add --before flag to mise latest by @risu729 in #9168
(npm) add aube package manager support by @jdx in #9256
(spm) add filter_bins option to restrict built executables by @jdx in #9253
(vfox) support plugin-declared dependencies via metadata.lua by @ahemon in #9051
rename mise prepare to mise deps and add package management by @jdx in #9056

🐛 Bug Fixes

(backend) skip versions host for direct-source backends by @jdx in #9245
(github) route artifact attestation verification to custom api_url by @jdx in #9254
(lockfile) use unique temp file for atomic save to avoid concurrent rename race by @jdx in #9250
(log) drop noisy third-party debug/trace logs by @jdx in #9248
(progress) disable animated clx output in ci by @jdx in #9249
(use) honor --quiet and --silent flags by @jdx in #9251
(vfox) opt backend plugins out of --locked URL check by @jdx in #9252

📦 Registry

add aqua backend for bitwarden-secrets-manager by @msuzoagu in #9255

New Contributors

@ahemon made their first contribution in #9051
@msuzoagu made their first contribution in #9255

`v2026.4.17`

Compare Source

🐛 Bug Fixes

(backend) respect install_before in latest lookup by @risu729 in #9193
(backend) route explicit latest through stable lookup by @risu729 in #9228
(backends) deprecate b shorthand by @risu729 in #9234
(config) warn for deprecated env keys by @risu729 in #9205
(config) treat enable_tools empty as disable-all by @risu729 in #9108
(github) avoid auth on release asset downloads by @risu729 in #9060
(gitlab) warn when glab OAuth2 token is expired by @stanhu in #9195
(npm) honor install_before without day drift by @risu729 in #9157
(npm) warn on old bun and pnpm for install_before by @risu729 in #9232
(pipx) honor install_before for uv and pipx installs by @risu729 in #9190
(registry) allow shfmt on Windows by @zeitlinger in #9191

🚜 Refactor

(backend) remove unused rolling release helper by @risu729 in #9175
(backend) use file util for removals by @risu729 in #9206

📚 Documentation

(config) clarify always_keep_download behavior by @risu729 in #9235
(configuration) add rust to idiomatic version files by @jjt in #9233
(contributing) expand contribution guide introduction by @marianwolf in #9208
(github) document multiple release assets workaround by @risu729 in #9236

📦️ Dependency Updates

update actions/setup-node action to v6 by @renovate[bot] in #9183
update dependency @types/node to v25 by @renovate[bot] in #9187
update crazy-max/ghaction-import-gpg action to v7 by @renovate[bot] in #9186
update actions/cache action to v5 by @renovate[bot] in #9181
update amannn/action-semantic-pull-request action to v6 by @renovate[bot] in #9184
update apple-actions/import-codesign-certs action to v6 by @renovate[bot] in #9185
update dependency eslint to v10 by @renovate[bot] in #9200
update dependency toml to v4 by @renovate[bot] in #9201
update rust crate reqwest to 0.13 by @renovate[bot] in #9171
update ghcr.io/jdx/mise:deb docker digest to 523d826 by @renovate[bot] in #9198
update ghcr.io/jdx/mise:alpine docker digest to 05617e0 by @renovate[bot] in #9196
update ghcr.io/jdx/mise:rpm docker digest to c1992f9 by @renovate[bot] in #9199
update ghcr.io/jdx/mise:copr docker digest to 90db6cd by @renovate[bot] in #9197
update taiki-e/install-action digest to 58e8625 by @renovate[bot] in #9209
update fedora docker tag to v45 by @renovate[bot] in #9213
update docker/setup-buildx-action action to v4 by @renovate[bot] in #9212
update docker/metadata-action action to v6 by @renovate[bot] in #9211
update docker/login-action action to v4 by @renovate[bot] in #9210
update dependency typescript to v6 by @renovate[bot] in #9202
update docker/build-push-action action to v7 by @renovate[bot] in #9203
update github artifact actions (major) by @renovate[bot] in #9215
update rust crate duct to v1 by @renovate[bot] in #9220
update rust crate demand to v2 by @renovate[bot] in #9219
update rust crate clx to v2 by @renovate[bot] in #9218
update nick-fields/retry action to v4 by @renovate[bot] in #9217
update jdx/mise-action action to v4 by @renovate[bot] in #9216
update rust crate self_update to 0.44 by @renovate[bot] in #9174
migrate eslint config to flat format for v10 compat by @jdx in #9222
update actions/checkout action to v6 by @renovate[bot] in #9182
update rust crate toml to v1 by @renovate[bot] in #9225
update rust crate versions to v7 by @renovate[bot] in #9226
update rust crate which to v8 by @renovate[bot] in #9227
update rust crate rmcp to v1 by @renovate[bot] in #9221

📦 Registry

add sheldon by @3w36zj6 in #9104
add pocketbase by @ranfdev in #9123
add worktrunk ([aqua:max-sixty/worktrunk, cargo:worktrunk](https://github.com/max-sixty/worktrunk, cargo:worktrunk))#1 by @edouardr in #8796
add dependency-check (aqua:dependency-check/DependencyCheck) by @kapitoshka438 in #9204
add janet by @ranfdev in #9241

New Contributors

@ranfdev made their first contribution in #9241
@jjt made their first contribution in #9233
@marianwolf made their first contribution in #9208
@edouardr made their first contribution in #8796

📦 Aqua Registry Updates

New Packages (3)

Updated Packages (1)

skim-rs/skim

`v2026.4.10`

Compare Source

🐛 Bug Fixes

ignore MISE_TOOL_VERSION in nested postinstall runs by @risu729 in #9050

`v2026.4.11`

Compare Source

🐛 Bug Fixes

(docs) typo in Go Backend by @dolmen in #9065
(task) render dependency templates even when no args are passed by @MatthiasGrandl in #9062
support npm semver ranges in devEngines by @risu729 in #9061

New Contributors

@dolmen made their first contribution in #9065
@MatthiasGrandl made their first contribution in #9062

`v2026.4.12`

Compare Source

🚀 Features

(npm) use --min-release-age for npm 11.10.0+ supply chain protection by @webkaz in #9072
(registry) add openfga by @mnm364 in #9084
(task) allow to set confirmation default by @roele in #9089
support os/arch compound syntax in tool os filtering by @RobertDeRose in #9088

🐛 Bug Fixes

(activate) export __MISE_EXE and resolve bare ARGV0 to absolute path by @fru1tworld in #9081
(install) support aliased installs sharing a backend by @jdx in #9093
(shim) use which_no_shims when resolving mise binary in reshim and doctor by @kevinswiber in #9071
filter empty segments in colon-separated env var parsing by @baby-joel in #9076

📚 Documentation

fix wrong file reference to forgejo backend implemenation by @roele in #9090
fix cli token command for token resolution by @roele in #9077

📦 Registry

add trzsz-go (aqua:trzsz/trzsz-go) by @ZeroAurora in #9083
add copilot (aqua:github/copilot-cli) by @risu729 in #9082

Chore

add AGENTS.md symlink by @jdx in #9094

New Contributors

@kevinswiber made their first contribution in #9071
@webkaz made their first contribution in #9072
@RobertDeRose made their first contribution in #9088

📦 Aqua Registry Updates

New Packages (7)

Updated Packages (3)

`v2026.4.13`

Compare Source

🐛 Bug Fixes

(go) honor install_before for module versions by @mariusvniekerk in #9097
(vfox-plugin) support Git URL with commit hash for mise.toml by @Oyami-Srk in #9099
MISE_FETCH_REMOTE_VERSIONS_CACHE not respected by @mcncl in #9096

📦️ Dependency Updates

unblock cargo-deny advisories check by @jdx in #9112

New Contributors

@mariusvniekerk made their first contribution in #9097
@mcncl made their first contribution in #9096
@Oyami-Srk made their first contribution in #9099

`v2026.4.14`

Compare Source

Chore

bump sigstore-verification by @jdx in #9128

`v2026.4.15`

Compare Source

🐛 Bug Fixes

(env) use OS path separator for path-list env vars on Windows by @richardthe3rd in #9058
check all github token sources in 403 rate limit warning by @jdx in #9121

📚 Documentation

add settings section for java by @roele in #9126

📦 Registry

added podlet by @tony-sol in #9134
add maturin by @Bing-su in #9113

New Contributors

@Bing-su made their first contribution in #9113

📦 Aqua Registry Updates

Updated Packages (2)

`v2026.4.16`

Compare Source

🚀 Features

(registry) add .perl-version support for perl by @ergofriend in #9102
(task) add Tera template support for inline table run tasks by @iamkroot in #9079

🐛 Bug Fixes

(env) use runtime symlink paths for fuzzy versions by @jdx in #9143
(github) use full token resolution chain for attestation verification by @jdx in #9154
(go) Remove install-time version override for subpath packages by @c22 in #9135
(npm) respect install_before when resolving dist-tag versions by @webkaz in #9145
(self-update) ensure subcommand exists by @salim-b in #9144
(task) show available tasks when run target missing by @jdx in #9141
(task) forward task help args and add raw_args by @jdx in #9118
(task) remove red/yellow from task prefix colors by @lechuckcaptain in #8782
(task) merge TOML task block into same-named file task and surface resolved dir by @jdx in #9147
(toolset) round-trip serialized tool options by @atharvasingh7007 in #9124
(vfox) fallback to absolute bin path if env_keys not set by @80avin in #9151

📚 Documentation

make agent guide wording generic by @jdx in #9142

📦️ Dependency Updates

update ghcr.io/jdx/mise:deb docker digest to e019cb9 by @renovate[bot] in #9160
update ghcr.io/jdx/mise:copr docker digest to 8d25608 by @renovate[bot] in #9159
update ghcr.io/jdx/mise:rpm docker digest to 22e52da by @renovate[bot] in #9161
update ghcr.io/jdx/mise:alpine docker digest to a3da97c by @renovate[bot] in #9158
update rust docker digest to 4a2ef38 by @renovate[bot] in #9162
update ubuntu:24.04 docker digest to c4a8d55 by @renovate[bot] in #9164
update rust crate aws-lc-rs to v1.16.3 by @renovate[bot] in #9165
update ubuntu docker tag to resolute-20260413 by @renovate[bot] in #9169
update rust crate clap to v4.6.1 by @renovate[bot] in #9166
update taiki-e/install-action digest to a2352fc by @renovate[bot] in #9163
update rust crate ctor to 0.10 by @renovate[bot] in #9170
update rust crate tokio to v1.52.1 by @renovate[bot] in #9167
update rust crate rmcp-macros to 0.17 by @renovate[bot] in #9173
update rust crate signal-hook to 0.4 by @renovate[bot] in #9177
update rust crate zipsign-api to 0.2 by @renovate[bot] in #9180
update rust crate toml_edit to 0.25 by @renovate[bot] in #9179
update rust crate strum to 0.28 by @renovate[bot] in #9178

📦 Registry

add ibmcloud by @dnwe in #9139
add rush by @jdx in [#9146](https://redirect.github.com/jdx/mi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone CET)

Branch creation
- "before 4am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonar-review-alpha · 2026-03-29T22:08:04Z

Summary

⚠️ The PR description exceeded the analysis limit and was truncated. The review may not reflect all context.

This PR updates the mise tool from 2025.7.12 to 2026.4.25 across two GitHub Actions workflows. The update is a major version bump that includes several new features (npm install options, config_root for plugins, dependency source watching) and bug fixes (backend version caching, PATH comparison on macOS, environment variable preservation).

Note: There's a newer version 2026.4.28 available with 2 additional bug fixes, but this PR targets 2026.4.23 per the title (the diff shows 2026.4.25, likely updated by Renovate).

What reviewers should know

Scope: Only changes .github/workflows/build.yml and .github/workflows/shadow-scan.yml — updates the mise version pinned in the jdx/mise-action step.

What to check:

Verify the version bump doesn't break any CI steps that depend on mise functionality
If your workflows use specific mise features or commands, confirm they're compatible with v2026.4.x
Note that the release includes fixes for task execution and environment variable handling that may affect reproducibility

No migration needed: This is a simple version pin update with no config changes or breaking changes to the workflow structure.

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

🐟 April Fools' persona mode!

sonarqube-next · 2026-04-05T14:21:24Z

Quality Gate passed for 'cloud-native-gradle-modules'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

sonar-review-alpha

LGTM! ✅

Clean, low-risk version pin update. Both workflow files are updated consistently, no other workflows reference mise, and mise.toml only pins java = "21.0" which is unaffected by the mise version bump.

The PR title says "2026.4.23" but the pinned version is 2026.4.25 — Renovate updated the version during rebasing without updating the title. This is expected Renovate behavior and not a concern.

🗣️ Give feedback

sonarqube-next · 2026-05-03T19:31:49Z

Quality Gate passed for 'cloud-native-gradle-modules'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

renovate Bot added the dependencies label Mar 29, 2026

renovate Bot requested a review from a team March 29, 2026 22:07