Repository navigation
chore: update github-actions (non-major) - #160
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/github-actions-(non-major)
branch
from
October 22, 2026 14:33
2a9cd15 to
4472bad
Compare
renovate
Bot
force-pushed
the
renovate/github-actions-(non-major)
branch
from
October 23, 2026 14:35
4472bad to
975b81d
Compare
renovate
Bot
force-pushed
the
renovate/github-actions-(non-major)
branch
from
October 23, 2026 18:57
975b81d to
6809a03
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2026.10.9→2026.10.12v2026.10.18(+4)v5.1.2→v5.2.0v5.2.2(+1)Release Notes
jdx/mise
v2026.10.12: : Per-tool Python runtimes for PyPI tools, Gradle workspace discovery, and env file find_upCompare Source
PyPI and pipx tools can now choose their own Python runtime, the workspace graph can read Gradle multi-module builds, and
env._.filecan search parent directories. When mise-versions is having an outage, GitHub lookups now retry onapi.github.com, and_.sourcescripts no longer pick up~/.bashrcwhen mise is launched from an editor.Added
Per-tool Python for
pypi:tools. Setpythonto a minor series or an exact version, and mise installs that runtime and passes it to uv or pipx for that tool only. The runtime stays private to the tool and does not become your shell's default Python.mise lockrecords the selected Python with the tool, andmise prunekeeps any runtime that a retained tool environment still uses. You can't combinepythonwith--python/-pinuvx_argsorpipx_args. Tools that don't setpythonbehave as before. #14479 (@jdx)If you change a tool's
python, mise installs a new environment instead of reusing the old one. If that install fails, the previous working environment is left untouched. #14504 (@jdx)Gradle workspace discovery.
mise tasks graphandmise run --affectednow find projects listed byincludeinsettings.gradleorsettings.gradle.kts, using Groovy or Kotlin syntax. Project IDs follow Gradle paths::appbecomesgradle::app, and the root project isgradle::. Literalproject(":lib")references in a project's top-leveldependencies {}block become graph edges. mise reads the scripts as text and never runs Gradle. If anincludeis computed or conditional, aprojectDirisn't a plainfile("...")literal, or both settings files exist, mise reports an error that points to[monorepo.projects."gradle:..."]overrides. Editing the settings script marks every Gradle project as affected. Based on a prototype by @Jarvvski. #14512 (@jdx)find_upforenv._.file. Withfind_up = true, mise looks for a relative path in the current directory and in every parent, so a global config can load each project's.envfiles. Files load from the root down, so values in closer files win. The default isfalse, and the option has no effect on absolute paths. #14497 (@jdx)Detect git-rewritten files in
watch_fileshooks. mise setsMISE_WATCH_FILES_GIT_REWRITTEN=1when every changed file was last written before git's most recent HEAD move (checkout, pull, rebase). Commits don't count as HEAD moves. Hooks such as format-on-edit can use this to skip files the user didn't edit.git stash pop/applydon't move HEAD, so mise doesn't detect them. #14511 (@jdx).terasources inferred for dotfile group templates. Amode = "template"entry in[dotfile_groups]no longer needs asourcejust to point at a.terafile. If the exact path doesn't exist, mise falls back to the same path with.teraadded. An explicitsourcestill takes precedence, and the.terafile is not also deployed under its suffixed name. #14502 (@jdx)mise lockwarns about unsupported platforms. If you name platforms withlockfile_platformsormise lock --platform, mise prints a warning for each tool version that has no build for one of them, for exampleapko@0.30.0 is not available for windows-x64; it will not install there. The default platform set still only logs this at debug level, and the exit status is unchanged. #14500 (@jdx)Registry: added
martin(github:maplibre/martin). #14488 (@ivan-ivkovic, @jdx)Fixed
429or5xx, mise now retries the lookup onapi.github.com, using your GitHub token if one is set. This covers releases, tags, repository contents, attestations andself-update. A404,403or empty answer from mise-versions is still trusted and not retried, so normal use doesn't spend GitHub's anonymous rate limit. If both sources fail, the error shows both failures, and a previously cached version list is still used. #14501 (@jdx)_.sourceno longer loads~/.bashrc. When mise's stdin was a socket andSHLVLwas unset, which happens when an editor extension such as the VS Code mise extension starts it, bash sourced~/.bashrcbefore the script. That leaked variables into the environment and could drop the script'sPATHentries. The script now runs with--norc. #14487 (@pikeas)prerelease = trueon alatestentry made a separate"1"entry resolve to a prerelease. #14476 (@JamBalaya56562, @risu729)go.work),mise tasks graphandmise run --affectedfailed for the whole repo. Declaring a project in that provider's namespace under[monorepo.projects]now replaces the provider's output and clears its error. Providers with no declared projects still fail loudly. #14508 (@jdx)Documentation
mise activatekeeps shims onPATH#14493 (@jdx), and clarified the platform-specific mise cache paths for CI #14506 (@zeitlinger).Full Changelog: jdx/mise@v2026.10.11...v2026.10.12
💚 Sponsor mise
mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.
v2026.10.11: : Much faster installs and far fewer GitHub API callsCompare Source
mise is much faster in this release and calls the GitHub API far less. Version lists, release tags, attestations and other public GitHub metadata now come from mise-versions, so everyday commands like
mise install,exec, shims,outdated,lockandself-updateare quicker and users without a GitHub token no longer run into the 60-requests-an-hour limit. Cached version lists are reused for longer, so repeat installs skip most lookups. It also addsmise bootstrap --upgradeandmise env --paths, and closes a trust gap in remote task files.Speed and GitHub API usage
Cold-cache timings for v2026.10.10 versus v2026.10.11, measured with hyperfine on one Linux x64 machine with no GitHub token set:
mise ls-remote pythonmise install(jq, ripgrep, fd, bat, gh, shellcheck)mise outdated(same six tools installed)The install and
outdatedruns are noisy (±0.1–0.4s over 4 runs) and the install time includes downloads, so treat them as rough. Requests toapi.github.comin a coldmise installofgithub:tools dropped from 2 to 0. Coldmise outdatedmade 8 network requests before and none now.use_versions_hoston (the default), release lists,latest, git tags (aquagithub_tagpackages, ubi and go), artifact attestations (including aqua'spredicate_typefilters) and the digest in the checksum-mismatch hint are read from mise-versions instead ofapi.github.com. GitHub is still asked directly for repositories mise-versions doesn't list when you have a token (the private-repository case), and in paranoid mode for attestations. The direct API is also used withuse_versions_host = false, GitHuburl_replacementsand customapi_urls. #14460, #14461, #14469, #14481, #14477, #14443mise x,mise exec, shims andhook-envuse mise-versions when they auto-install a tool. #14458mise self-updatereads mise's releases from mise-versions and downloads the archive from github.com release downloads. Packslip and zipsign verification are unchanged. #14464mise lockdownloads artifacts for provenance checks from github.com instead of the API asset endpoint. #14465mise install,useandrunnow reuse a cached version list for the tool'sminimum_release_agewindow minus one hour, clamped to 1–24h. With the default 24h cutoff, that is 23h.outdated,upgrade,ls-remote,lockandlateststill refresh after 1h. If you setfetch_remote_versions_cacheyourself, your value applies to every command. #14484, #14485, #14457mise outdatedcan resolve many registry tools with one request to the mise-versions index. #14473latestis resolved without refetching the list. #14456aqua:jqlang/jqreuse the registry tool's version list. #14459mise ls-remote python,outdated,upgradeand fuzzymise use python@3.12read the python-build definitions from mise-versions. A cold listing took about 960ms before and about 90ms now. pyenv is still cloned when mise compiles Python, whenpython.pyenv_repopoints at a fork, when you're offline, or whenuse_versions_host = false. Some definitions that had no date before now have one, so they are held back byminimum_release_ageuntil they are old enough. #14455mise oci buildnow requires root forapt:packages, as it already did for apk, and fails up front with a clear message. If apt-get still fails, the error now includes the last lines of dpkg's output. #14447native-sdknow installs from npm (@native-sdk/cli), so thenativecommand works. It requires Node 24+. #14431Security
mise.tomlwith only[tasks]loads without trust. Before this fix, if one of those tasks setfileto a remote URL,mise tasks ls,mise tasks infoandmise tasks validaterendered the file's#MISEheaders, so a template like{{ exec(...) }}ran without a trust prompt. Remote files now follow the same rule as local task includes: if the headers contain template syntax, the config that references them must be trusted first. Remote files with plain headers still list without trust, and braces in the script body need no trust. #14416 (@JamBalaya56562, @risu729)Added
mise bootstrap --upgradeinstalls what is missing and then upgrades what is already installed, in a single run. In the packages phase it runs the same upgrade asmise bootstrap packages upgrade, and pins are respected. In the tools phase it runsmise upgradewithout--bump, so configured version ranges hold. Both run before the matching post hooks and dependent services.--dry-runpreviews both steps and--skipworks as before. It does not update mise itself, repositories or images, and it does not restart services. #14433mise self-update --yes && mise bootstrap --upgrademise env --pathsprints the PATH entries mise manages, one per line and in PATH order: tool bin directories,_.pathentries, and inherited directories that mise moves forward, such as~/.cargo/bin. This lets CI integrations export only mise's additions without diffingPATH. #14429The install script downloads pinned versions from mise.jdx.dev.
curl https://mise.run | MISE_VERSION=<version> shnow tries mise.jdx.dev first and falls back to GitHub Releases if that download fails. Checksums for pinned versions still come only from GitHub'sSHASUMS256.txt. If no checksum is found, the script refuses to install.MISE_INSTALL_FROM_GITHUB=1still uses GitHub only. #14446Registry:
gdalinstalls the GDAL/OGR command-line tools from conda-forge (conda:libgdal-core). #14440 (@ivan-ivkovic)Fixed
mise upgradeno longer installs lazy tools that have never been installed. Naming the tool still installs it. A lazy tool that already has a version installed upgrades as before. A missing lazy tool is still installed if an upgraded tool depends on it.mise outdatednow marks these tools as[MISSING] (lazy), and the bare upgrade no longer looks up their versions. #14422 (@ryanrhughes), #14444stack limit reachederrors on the static musl builds, for example on Ubuntu 26.04. These errors broke aquaversion_filterparsing and made shims such as kubectl's report "not a valid shim". #14450mise lock --platform ...run on Alpine or NixOS no longer records Node source builds for other platforms. Only an explicitnode.compileorall_compile = trueforces source builds for those targets. #14432mise upgrade --bumpand hand-edited version pins no longer drop a pipx tool's locked uv dependency graph. Before,mise install --lockedthen failed on a fresh checkout. #14426 (@wislertt)fnox@1now skip releases this host can't install, the same waylatestdoes. Each skipped release gets a warning, and if no match can be installed, mise reports a clear error. #14467bashshim ahead of/binno longer causes a false "shim fallback recursion detected" error for commands likebash -c 'bash --version'. The docs now recommend installing shells with the system package manager instead of[tools]. #14475interfacenow render the incoming direction (ufw allow in on tailscale0 ...), which fixesInvalid token 'on'errors. #14480files: applyprompt, mise now lists each file it will create, overwrite or remove and warns that local edits will be replaced. The prompt now defaults to No. #14430mise dot add --changednow also captures edited files that a copy-modedotfile_groupsroot discovers automatically, not just files listed explicitly inentries. #14436Documentation
mise.lock, so CI and Docker builds skip version lookups. #14453New Contributors
Full Changelog: jdx/mise@v2026.10.10...v2026.10.11
💚 Sponsor mise
mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.
v2026.10.10: : Task skip_if, snap and COPR in bootstrap, and dotfiles pull fixesCompare Source
Tasks can now skip themselves with a
skip_ifcheck, and bootstrap gains Snap packages, Fedora COPR repositories, and branch selection for--adopt. This release also fixes severalmise dot pullproblems that could loop, stall, or leave sharing paused on long histories. On the Windows side, it fixes.mise-binsexecutables and npm installs restored from a cache.Added
skip_iffor tasks. Before a task runs, mise runs itsskip_ifshell command. If the command exits 0, mise skips the task and counts it as successful. Any other exit status runs the task as usual. #14399The check runs after
dependsand beforeconfirm. It uses the task's directory, shell, environment, sandbox andtimeout, and it supports Tera templates and task arguments. Its output is discarded and it gets no stdin. It does not receive the task'ssecrets. File tasks can set it with#MISE skip_if="...".mise run --forceskips the check,--dry-runprints it without running it, andmise tasks infoshows it. If the check can't start, times out, or is killed, the task fails.Snap packages in bootstrap. On Linux, you can declare snaps in
[bootstrap.packages]alongside apt and flatpak, with optionalchannelandclassic, andstate = "absent"to remove a snap. If a snap tracks a different channel than you declared,statusshows it andapplymoves it withsnap refresh --channel. snapd can't install or hold a specific version, soapplyandupgradeskip entries with a version pin and print a warning. #14402COPR repositories with
[bootstrap.dnf.repos]. You can declare a COPR next to thednf:packages that come from it, instead of using apre-packageshook. mise writes the same/etc/yum.repos.dfile thatdnf copr enabledoes. It does not need the copr plugin, so this also works on Fedora Atomic hosts that layer packages. The chroot is chosen from/etc/os-release(Fedora, EL, Amazon Linux). Without--yes, mise asks before enabling any COPR. mise never disables or removes repositories, butmise bootstrap unapplynames any leftover files. #14401mise bootstrap --adopt <url>?ref=<branch>adopts a branch other than the default, either for global config or for a setup history. This also works withmise bootstrap remote. The ref must be a branch: tags, commits and missing branches are refused before anything is cloned. mise never switches an existing~/.config/misecheckout to another branch, even with--update, so usegit switchfirst. The docs now also explain howmise dot origin setrelates to an adopted global config. #14400GitHub OAuth refresh token in the Secure Enclave. On a Mac with Touch ID, set
github.oauth_cache_secure_enclave = trueto keep the native GitHub OAuth refresh token behind Touch ID instead of in plaintext ingithub-oauth-tokens.toml. Touch ID asks for a fingerprint only when the token needs refreshing. If you cancel the prompt, mise skips the refresh and keeps the cached access token. This needs the Developer ID-signed release build. Homebrew and source builds print a warning and keep the token in the cache file. #14413Changed
experimental = truenow turns on the identity install layout by itself, which keeps deep npm, pipx and Java trees under the 260-character path limit. Only new installs use it. Existing installs stay where they are, andmise installs migratecan move them. To keep the old layout, setinstall_layout = "legacy"(orMISE_INSTALL_LAYOUT=legacy). Linux and macOS still needinstall_layout = "identity"set explicitly. #14392Fixed
Dotfiles
mise dot watchcould publish commits endlessly without any real edits. Now mise keeps the ciphertext that history already has whenever it decrypts to the same content, mode and recipients. Machines that are already looping settle after one more sync. #14405mise dot pullon long histories is much faster. The number of git processes no longer grows with the length of the history: in one test with 2,000 commits, a pull went from 137 s to under 6 s. #14407, #14415mise dot pullby hand. Now, if nothing has been written yet, mise retries on the next attempt and the watcher keeps applying changes. #14414mise dot pull --yesno longer fails with "local saved history changed since planning". The pull now recovers the interrupted operation before it plans. #14410mise dot pull --take-remote <path>again for a path an earlier pull already resolved no longer fails with "is not a conflict". #14411Windows
mise xand shims now run the original executable instead of its copy in.mise-bins, for tools installed with aquasymlink_bins, githubfilter_bins, or packslip. Programs that look for DLLs or data next to their own executable, such as exiftool, now start correctly. Tools installed by older versions needmise install --forceto get this. A shell frommise activatethat finds the copy onPATHstill runs the copy. #14397ERR_MODULE_NOT_FOUND. #14418Tools and installs
rust@nightly,mise ls-remote rust, andmise outdated/upgradenow read the nightly manifest fromRUSTUP_DIST_SERVER, so a mirror such as panamax no longer needs access tostatic.rust-lang.org. If[env]setsRUSTUP_DIST_SERVERorRUSTUP_UPDATE_ROOT, mise also passes them torustup-initandrustup toolchain install. #14384minimum_release_age,mise use --tool-option minimum_release_age=0s <tool>now installs the actual latest version instead of the version the global cutoff allows. #14398 (@halms)mise lock --globallocked with a dependency graph now regenerates the graph for the new version, including with--bump. Before, the upgrade dropped the graph and the nextmise install --lockedfailed. #14419 (@altendky)compiling with kerlwhile the build runs, instead of staying onverifying checksum. kerl's output now prints above the progress row instead of writing over it. #14391mise prunenow shows a progress line while it scans for unused versions, instead of printing nothing for what could be a long time. #14420env._.pythonand itsvenvoptions, matching what mise already refused at load time. Editors now flag these mistakes. #14387 (@JamBalaya56562, @risu729)Documentation
[bootstrap.apt.sources]. #14396Full Changelog: jdx/mise@v2026.10.9...v2026.10.10
💚 Sponsor mise
mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.
jdx/mise-action
v5.2.0: : Periodic cache rebuilds, signed packslip verification, and monorepo installsCompare Source
The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs
mise install --monorepoautomatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.Added
-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the newcache_max_age_daysinput to change the period, or set it to0to keep the old key that never expires. Customcache_keytemplates can use the new{{cache_period}}variable, which{{default}}already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also needauto_update: trueto pick up a newer mise. (#689 by @jdx, fixes #688)cache_restore_retry_budgetandcache_save_retry_budgetinputs set how long the action may wait. Each retry waits for theRetry-Aftervalue plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to0s(no retries).@actions/cachedoesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future@actions/cacherelease, throttling won't be detected and nothing will be retried. (#692 by @jdx, fixes #691)fetch_from_githubsetting decides which source it tries first. Pinned versions andminimum_release_ageinstalls are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @jdx)packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log showsVerified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign andSHASUMS256check. An explicitsha256input still takes precedence. (#693 by @jdx)[monorepo].config_roots, the action now adds--monorepotomise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, setmonorepo: false. (#679 by @zeitlinger)Fixed
PATHare now exported. The action used to find mise'sPATHchanges by comparing mise'sPATHwith the runner's. If a tool's bin directory was already on the runner'sPATH, such as~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example,rustupresolved to the shim instead of~/.cargo/bin/rustup. The action now asks mise for its entries withmise env --pathsand exports them in the order mise reports. This fix needs a mise version that supports--paths. With older versions, the action uses the old comparison. (#685 by @jdx)Documentation
cache: falseor GitHub'scache-mode: none. (#682 by @jdx)mise.lock, instead of installed tools. It includes a Windows example that setsMISE_CACHE_DIRfrom${{ runner.temp }}, becauseactions/cachedoesn't expand%TEMP%. (#686, #690 by @zeitlinger)Breaking Changes
cache_max_age_days: 0. Workflows that set a customcache_keywithout{{default}}or{{cache_period}}aren't affected.Full Changelog: jdx/mise-action@v5.1.2...v5.2.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.