Pin dependencies - #290
Conversation
|
93273ff to
72c65a5
Compare
renovate
Bot
changed the title
|
SummaryThis Renovate-generated PR pins GitHub Actions workflow dependencies to specific commit SHAs, replacing floating version references like Note: The actual versions pinned in the workflows differ from those listed in the PR description:
Reviewers should verify these versions are intentional, not accidental updates. What reviewers should knowFiles modified: All
Security context: Pinning to commit SHAs prevents unexpected action behavior from future version releases while still maintaining version comments for reference. Verification needed: Cross-check the actual pinned versions (in the
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
72c65a5 to
18c861e
Compare
|
There was a problem hiding this comment.
LGTM! ✅
Clean dependency-pinning PR with no bugs or logic issues. The versions actually pinned in the workflows differ from the PR description: ci-github-actions is pinned to 1.4.0 (description says 1.3.35) and gh-action_release to 7.0.1 (description says 7.0.0). This is a known Renovate behaviour — the description can fall out of sync if the upstream tag moves between when Renovate opens the PR and when it commits. The SHAs in the workflows are what matters; confirm they resolve to the intended tags before merging.
18c861e to
5ea85e2
Compare
|
5ea85e2 to
08740c6
Compare
08740c6 to
9af7da3
Compare
9af7da3 to
4b7c790
Compare
4b7c790 to
012d4be
Compare
012d4be to
2f46314
Compare
2f46314 to
8fd3dc6
Compare
8fd3dc6 to
f23e8f1
Compare
d7d3110 to
6637a66
Compare
afbb77b to
150d756
Compare
e85144d to
5ba3989
Compare
7c409c6 to
5aed8d1
Compare
746b546 to
eae0289
Compare
eae0289 to
242700c
Compare
|
|
|
This pull request is being closed because it has been identified as stale. |
This PR contains the following updates:
v1→1.8.91.1.0→1.2.1v3→3.3.0v7→v7.0.12026.6.1→2026.8.14v2026.8.152025.7.12→2025.12.13v4.1.0→v4.3.0v4.2.0→v4.3.0Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Release Notes
SonarSource/gh-action_pre-commit (SonarSource/gh-action_pre-commit)
v1.2.1Compare Source
What's Changed
Dependency Updates
v6.1.0→v6.3.0(#45)v4→v4.0.1(#45)v5.0.1→v6.1.0(#46)v6.0.1→v7.0.0(#46)v2.0.0→v4.0.1(#46)v2→v4(#46)Internal & Chores
PullRequestClosed,PullRequestCreated,RequestReview,SubmitReview) to automate Jira status updates on PR review events, usingSonarSource/vault-action-wrapperfor credential retrieval (#49, BUILD-11517)Full Changelog: SonarSource/gh-action_pre-commit@1.2.0...1.2.1
v1.2.0Compare Source
What's Changed
New Contributors
Full Changelog: SonarSource/gh-action_pre-commit@1.1.0...1.2.0
jdx/mise (jdx/mise)
v2026.8.14: : npm/aube install fixes and cleaner temp/prune handlingCompare Source
This is a small release focused on bug fixes for npm (aube-backed) installs, HTTP cache cleanup, and Windows config pruning.
Fixed
.npmrcinto the per-tool install directory. Install-scoped settings such asminimumReleaseAge,trustPolicyExclude,allowedUnpopularPackages, and (for CLI installs)globalDir/globalBinDirnow go into.config/aube/config.tomlas typed TOML, whileallowBuildsstays inpackage.json. Inline-tabletrust_policy_excludes/allow_low_downloadsinmise.tomlstill round-trip correctly. (#12425 by @jdx)__node-gyp-bootstraptrampoline that embedded aube's lazynode-gypshim re-execs. Previously naked-run rewriting turned it intomise run __node-gyp-bootstrap …and failed with "no tasks defined", breakingallow_buildsinstalls whose lifecycle scripts callnode-gyp(for example gemini-cli via node-pty). (#12429 by @jdx)http-tarballs. All failure paths now clean up the temp directory. (#12420 by @Marukome0743)mise prune --configson Windows now removes trusted config links whose target no longer exists. Because Windows stores these links as plain files holding the target path, the previous existence check never fired; the link's target is now resolved before deciding whether to prune. (#12418 by @JamBalaya56562)Full Changelog: jdx/mise@v2026.8.13...v2026.8.14
💚 Sponsor mise
mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.8.13: : Task exclusions, visible conf.d fragments, and a broad round of fixesCompare Source
This release adds a few configuration and task features and delivers a large batch of fixes across completions, tools, lockfiles, tasks, config parsing, and shell integration. It also restores dynamic shell completions that regressed after the recent CLI parser change.
Added
task: New
task_config.excludeslets file-task discovery skip config-root-relative paths, directories, and glob patterns, so accidental TOML files (like apyproject.tomlinside a task directory) or entire subtrees are no longer treated as tasks. The closest config that setsexcludesreplaces inherited values, and an empty list clears the cascade. Relativetask.disable_pathsnow resolve from the declaring config file. (#12366 by @jdx)config: Project configuration can now be split into visible
mise/conf.d/*.tomlfragments, mirroring the existing.mise/conf.dand.config/mise/conf.dsupport but without a hidden dot-directory. Fragments merge alphabetically,mise/config.tomlstill wins over fragments, and environment-specific and.localvariants (for examplemise/conf.d/tools.development.toml) follow the usual env config rules. (#12395 by @jdx)bootstrap: Added
--skip-dirtytomise bootstrap,mise bootstrap repos apply, andmise bootstrap repos updateto warn and skip repos with local changes so the remaining repos still update. Origin mismatches and non-git targets still fail closed as before. (#12364 by @jdx)Fixed
run=completers work again in fish and zsh, while native file/path completion still falls back correctly. (#12376, #12379 by @jdx)VAR=override mise run ...) are no longer wiped when reconstructing the pre-mise environment in an activated shell; mise-managed values are only rolled back when the live value still matches what mise recorded. (#12390 by @jdx)latestrequest failed for a tool installed only withmise install --system; the effective install directory is now recovered so system/shared-only installs satisfylatest. (#12406 by @jdx)extract_nestedly, for example a zip containing only a DMG), and bare cask.pkgdownloads are staged correctly. (#12373, #12371 by @jdx)latestrequests now resolve to the remote default branch HEAD and are treated as a rolling channel, sooutdatedandupgradedetect branch movement. An unavailable configured executable is now rejected instead of failing later. (#12407, #12416 by @jdx)#MISEheader keys that need quoting are no longer dropped, and negative template argument bounds are rejected. Sandbox errors now name which paths do not exist yet. (#12370, #12397, #12415, #12421, #12309)__MISE_SESSIONis now unset on deactivate. (#12361 by @NgoQuocViet2001)Documentation
Registry
mr-boxington,ori,hey-cli,playwright, andghui, and switchedclaude-codeto aqua on Windows. (#12384, #12388, #12387, #12385, #12386, #12399)Full Changelog: jdx/mise@v2026.8.12...v2026.8.13
💚 Sponsor mise
mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.8.12: : Cleaner diagnostics and a raft of task, config, and tool fixesCompare Source
This release adds package uninstall support to the plugin bootstrap flow and fixes a broad set of task, config, tool, and diagnostic edge cases. Many changes turn silent failures and cryptic errors into actionable messages, so it is largely a robustness and quality-of-life release.
Added
PackageUninstallhook, somise bootstrap packages prune --manager <plugin>is no longer Homebrew-only. mise records ownership only for packages that go from missing to installed during an install, and prune removes only owned packages that are absent from the current config and trusted tracked configs. Pre-existing and manually installed packages are never claimed, dry-run never invokes the hook, and the keep-set is reloaded after confirmation so newly declared packages cannot be removed without another prompt. (#12332 by @jdx)Fixed
Out-File -Encoding utf8) could make.tool-versions,.node-version,package.jsonpackageManager, registry-scraped files likeEarthfile, and.sdkmanrcentries silently vanish or resolve to a corrupt version. Cached idiomatic parses written by an older mise are re-parsed so the fix takes effect on upgrade. (#12325 by @JamBalaya56562)mise edit(and the interactive TUI) now preserves comments — leading, trailing, and section comments are captured on parse and written back on save, instead of being stripped. (#12319 by @Marukome0743)package.jsonthat was tracked while enabled and later disabled no longer triggers a spurious "cannot update idiomatic version file" warning on read-only operations likemise ls --all-sources. The tracking entry is retained so re-enabling the tool reactivates it. (#12194 by @xqm32)cdtarget that cannot be entered (for example viaMISE_CDpointing at a missing directory, or a directory the process cannot chdir into) is now reported with the path and OS reason instead of panicking. (#12314 by @JamBalaya56562)killed by SIGINT/killed by SIGTERMrather than "no exit status". (#12323 by @Marukome0743)--file <file>) now stay string-typed during template rendering, so path filters likedirnamework on them. Switch flags still default to booleans and count flags to integers. (#12355 by @jdx)chmod +xadvice is gone from Windows messages. (#12324 by @JamBalaya56562)env_with_pathrather than rebuilding PATH from a pristine environment, restoring project_.pathdirectories and fixing discovery of sibling stubs. The stub-selected tool version is no longer shadowed by an outer task's install directories. (#12322 by @tmkx)mise watch --clear=reset --restartno longer leaves the terminal without echo after Ctrl-C. The controlling terminal (preferring/dev/tty) is now saved and restored from a drop guard, so it recovers on normal return, errors, and cancellation, including when stdin is redirected or a second terminal is in use. (#12328 by @Marukome0743)go installno longer inherits aGOROOTthat mise exported for a different Go, which causedcompile: version ... does not match go tool version ...failures when anothergowas first on PATH. An explicitly configuredinstall_envGOROOT is still honored. (#12342 by @Marukome0743)mise doctornow flags a tool whose install directory exists but is empty (for example after an interrupted download), marking it(empty)and suggestingmise install --force, instead of silently treating it as installed. (#12321 by @Marukome0743)$VARnow names the key or directive that referenced the missing variable and the config file it lives in, making it possible to find the offending line in a large[env]block. (#12316 by @Marukome0743)oc(OpenShift client) now installs from channel aliases such asoc = "stable"by resolving the unversioned artifact name within the channel directory, fixing a 404. (#12326 by @Marukome0743)Documentation
MISE_TASK_DIRfor locating sibling files, which works consistently across Linux, macOS, and Windows without renaming the task. (#12313 by @JamBalaya56562)New Contributors
Full Changelog: jdx/mise@v2026.8.11...v2026.8.12
💚 Sponsor mise
mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.8.11: : Automatic updates, remote mise installs, and versioned lockfilesCompare Source
This release adds opt-in automatic self-updates, lets remote bootstrap leave a working mise behind on each target, and introduces versioned lockfiles that bind each request to the version it resolved. It also replaces the CLI parser with usage-rs, hardens remote Git task handling, and fixes a wide range of tool-installation, task, and config edge cases.
Highlights
mise lock --upgradefor safe migration and no surprise drift for existing files.Added
self-update: New opt-in automatic updates. Enable
auto_update(withauto_update_check_duration, default7d) and mise will update itself before eligible interactive commands, then re-exec your original invocation with the new binary. Updates are throttled and lock-serialized, skipped in CI, offline, non-interactive, and shell-integration contexts, and failures never block the requested command. Package-managed builds are steered toward the official optimized binaries. (#12288 by @jdx)bootstrap: Remote bootstrap can now install a persistent mise on each target instead of tearing it down with the staging directory. Set
install_misein[bootstrap.remote](or per host) or pass--install-mise[=/path]; the same checksum-verified executable that ran the bootstrap is installed, so the host converges on the orchestrating mise version. (#12284 by @jdx)lock: Lockfiles now carry
lockfile_version = 1and bind each original request to the entry it resolved, so overlapping requests like"1"and"1.0.0"can lock different versions. Existing unversioned lockfiles stay on format 0 during ordinarymise lock/install/upgradeto avoid drift; runmise lock --upgradeto migrate (transactional, rolls back on failure). (#12299 by @jdx)node: mise can now act as a Corepack replacement, honoring the
+sha...checksum suffixes inpackageManager/devEngines.packageManagerand verifying the exact npm, pnpm, Yarn, or bun artifact before installing. Adds SHA-224/SHA-384 hashing and a Windows script launcher for Yarn's JS CLI. (#12214 by @jdx)prune:
mise prune --dry-runnow explains why each version is prunable, naming either the kept versions and the configs requiring them or the fact that nothing tracked references the tool. (#12304 by @Marukome0743)java: Oracle GraalVM "innovation" feature releases are now recognized. (#12189 by @roele)
Fixed
python/latest) onto the image's Python, so tools no longer dangle at runtime. (#12211 by @jdx)--no-hook-env. (#12218 by @JamBalaya56562)PATHnow folds onto a single key on Windows. (#12312 by @JamBalaya56562)go installwarning paths render correctly, and mise suggests compatible package backends. (#12252, #12251, #12225 by @risu729)conf.dfragments load unconditionally again, and mise no longer prompts for trust when stdin is not a tty. (#12242 by @jdx, #12268 by @Marukome0743)mise lock" hint now points at--globalwhen only global config has tools. (#12260 by @jdx)mise set --filenow refuses a file it cannot read back. (#12207 by @JamBalaya56562)-cshell (#12277 by @JamBalaya56562).Changed
usageCLI, andmise completion --installwrites self-contained scripts. This raises the minimum supported Rust version to 1.95. (#12221 by @jdx)mise generate bootstrapis renamed tomise generate install-scriptto avoid confusion withmise bootstrap. The old spelling still works as a hidden, deprecated alias (removal scheduled for 2027.9.0). (#12247 by @jdx)Security
..traversal, Windows absolute/backslash and drive-qualified forms, and intermediate symlink escapes, and refusing non-regular-file targets. This closes escapes that couldchmod +xand execute attacker-chosen files outside the checkout. (#12254 by @risu729)Deprecated
all_compile = truedefault on Alpine now warns and is scheduled for removal in 2027.8.0; precompiled musl binaries become the default path. Setall_compile = trueexplicitly to keep building from source. (#12287 by @risu729)go.mod(go X.Y) andCMakeLists.txt(cmake_minimum_required) now warn when they resolve a version and stop being read in 2026.11.0.toolchain goX.Y.Zis unaffected. Only affects users who opted these tools intoidiomatic_version_file_enable_tools. (#12259 by @jdx)Documentation
_.sourcebeing bash-only (#12286 by @risu729) and its cacheable source example (#12278 by @Marukome0743), cross-file hook execution order (#12295 by @jdx), that--systemis shared storage rather than a mise-free install (#12253 by @jdx), which backends lockfile strict mode skips (#12306 by @Marukome0743), that task deps ignores run-array refs (#12285 by @risu729), and thatrawserializes execution (#12307 by @Marukome0743).Registry
Performance
Breaking Changes
mise completion's--include-bash-completion-lib/--usageflags are now no-ops. Command behavior, flags, and aliases are otherwise preserved.New Contributors
Full Changelog: jdx/mise@v2026.8.10...v2026.8.11
💚 Sponsor mise
mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.8.10: : Remote bootstrap environments and asset-matching fixesCompare Source
This release lets remote bootstrap pick which config environments run on each target, fixes several tool-installation edge cases (archive naming, Windows ZIP preference, renamed aqua packages, Homebrew cask metadata), and hardens pacman package detection and Windows self-update cleanup.
Added
bootstrap: Remote bootstrap can now select which
mise.<env>.tomllayers load on each SSH target without inheriting the orchestrator's full environment. Set a default with[bootstrap.remote].mise_env, override per host in your inventory, or pass--remote-env(repeatable or comma-separated) on the command line. (#12182 by @jdx)bootstrap: Independent config roots can now contribute
symlink-eachtrees that share the same target directory, as long as their leaf paths are disjoint. Overlapping leaves and file/directory collisions still fail before any changes, reporting both declaring config origins. (#12190 by @jdx)doctor:
mise doctornow detects leftover Windows self-update helper files (__relocated__/__selfdelete__copies in TEMP) and reports their count and total size, noting that a subsequentmise self-updateremoves them. (#12205 by @JamBalaya56562)Fixed
Providesare no longer reported as missing. mise now usespacman -Tto distinguish genuinely missing packages, recovers the provider's version for status, and skips provider-satisfied aliases during targeted upgrades so pacman does not try to replace the provider. (#12183 by @jdx)aqua:backends (including d2, typstyle, gitui, gradle, ktlint, kubeseal, and velero) now point at their renamed, canonical package ids, so they install even in networks whereapi.github.comis unreachable. A regression test prevents this drift from returning. (#12186 by @kkom)azure-clinow installs from the official bundled-Python ZIP release instead of PyPI, fixingazfailing with'python' is not recognizedorNo module named 'azure'. Linux and macOS continue to use the existing pipx install. (#12161 by @JamBalaya56562)"auto_updates": null, treating it as the defaultfalse. This was breaking metadata fetches for the majority of current casks. (#12192 by @jdx)tar.zst>tar.xz> other), which a prior change had accidentally reduced to a tiebreak. (#12200 by @risu729).tbzand.tbz2are now normalized correctly when matching preferred asset names and stem-only checksums, including mixed-case suffixes. This prevents assets from losing the preferred-name bonus and selecting the wrong archive. (#12199 by @risu729)Performance
Documentation
New Contributors
Full Changelog: jdx/mise@v2026.8.9...v2026.8.10
💚 Sponsor mise
mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.
v2026.8.9: : Composable Bootstrap, Environment-Aware conf.d, and Faster StartupCompare Source
This release expands declarative bootstrap into a composable, multi-root system; adds environment-specific
conf.dfragments and glob-based ignored config paths; smooths out shell activation so runtime overrides stick; and delivers major startup performance gains for vfox-backed setups. It also includes several security hardening fixes worth noting.Highlights
Added
bootstrap: Compose declarative resources from multiple independent config roots via
[bootstrap].config_roots. Selected roots contribute[dotfiles],[bootstrap.files],[bootstrap.directories],[bootstrap.services], and[bootstrap.compose]without gaining precedence from list or glob order; identical declarations are deduplicated and conflicting declarations fail with both origins reported. (#12105, #12132 by @jdx)bootstrap: Declaration provenance is now retained and exposed for dotfiles and managed files/directories.
mise bootstrap plan, bootstrap status, andmise dotfiles statusinclude origin details (declaring config, config root, environment, resolved source) in JSON, and human-readable tables gain a Config column. (#12100 by @jdx)bootstrap: Homebrew-compatible support for self-updating and adopted casks in
[bootstrap.packages]. Casks declaringauto_updates: trueare left to update themselves, and existing app bundles can be adopted globally with[bootstrap.brew].adopt = trueor per cask withadopt = true. (#12074 by @ascarter)bootstrap: Remote bootstrap gains symlink materialization controls. Use
--copy-link <PATH>(repeatable) to dereference selected source-relative symlinks or--copy-linksto recursively dereference all archived symlinks; both are also configurable in[bootstrap.remote]and per-host. Default behavior is unchanged (links stay links). (#12121 by @jdx)config: Environment-specific
conf.dfragments. Files like.mise/conf.d/*.{env}.toml(and.localvariants) load only when that config environment is active, applying to project, global, and systemconf.ddirectories. (#12151 by @jdx)config:
ignored_config_pathsnow supports relative entries and glob patterns (including recursive**). Entries in.miserc.tomlresolve against the declaring file, whileMISE_IGNORED_CONFIG_PATHSresolves against the invocation directory — making it easy to exclude vendored repos portably. (#12169 by @jdx)config:
mise run, nakedmise <task>,mise install,mise exec, andmise watchnow implicitly trust and persist the active config in normal mode, avoiding a redundant prompt. Automatichook-env/inspection commands still require explicit trust, and paranoid and safe modes are unchanged. (#12107 by @jdx)system: Plugins can declare an ordered list of candidate package names per package manager in
systemDependencies, so the same capability can be expressed across distro renames (for exampleapt = { "libaio1t64", "libaio1" }). mise resolves the first available candidate. (#12149 by @jdx)vfox: Traditional vfox plugins can now read configured
[tools]options fromctx.optionsinPreInstallandPostInstallhooks, with scalars as strings and arrays/tables as structured Lua values. Existing hook environment variables continue to work. (#12174 by @jdx)Fixed
export, shell aliases, sourced scripts, or direct PATH edits are no longer reverted on every prompt, reversing the continuous enforcement introduced in 2026.8.0. (#12094 by @jdx)libcselections stay strict. (#12093 by @jdx)uveven when invoked through a tool override (for examplemise x tiny@3), sopython.uv_venv_autono longer reportsuvas missing right after mise installs it. (#12177 by @jdx)mise which <bin> --tool=<tool>@<version>now reports that the requested version is not installed (with an install hint) instead of the misleading "not currently active" message. (#12106 by @TrevorBurnham)--no-hook-envomits the hook. (#12089, #12131, #12117 by @JamBalaya56562)+, and key the remote version cache by listing tool options. (#12118 by @Marukome0743, #12164 by @JamBalaya56562)Configuration
📅 Schedule: (in timezone Europe/Paris)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.