feat(bootstrap): add skip controls#10497
Merged
Merged
Conversation
Contributor
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a ChangesBootstrap --skip option
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Greptile SummaryThis PR adds
Confidence Score: 5/5Safe to merge — the change is purely additive (a new optional flag), all existing bootstrap paths are preserved when --skip is not used, and the new paths are well-covered by e2e tests. All changed logic is guarded behind the new --skip flag with no modifications to the default (no-flag) execution path. The config/hooks reload when skipping dotfiles is intentional and tested. The skip_tools propagation to run_task is correct. Documentation and completion specs are consistent across all files. No files require special attention. Important Files Changed
Reviews (5): Last reviewed commit: "fix(bootstrap): render skip usage artifa..." | Re-trigger Greptile |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/cli/bootstrap.md`:
- Line 4: The Usage synopsis in the bootstrap command documentation incorrectly
marks the subcommand as required using angle brackets <SUBCOMMAND> when it is
actually optional. Since Bootstrap.command is defined as Option<Commands> in the
Rust code, the subcommand should be marked as optional. Change <SUBCOMMAND> to
[SUBCOMMAND] in the Usage line to accurately reflect that mise bootstrap can be
run without a subcommand.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 04c4774f-0a70-4dc2-a107-4fc008e7ee2c
📒 Files selected for processing (4)
docs/bootstrap.mddocs/cli/bootstrap.mde2e/cli/test_bootstrapsrc/cli/bootstrap.rs
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 04d5c93. Configure here.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/cli/bootstrap.md (1)
51-55: 💤 Low valueMinor grammar: structure sentence for clarity.
Lines 53–55 read as disconnected fragments. Combining them into a proper sentence would improve readability.
📝 Suggested revision
### `--skip… <SKIP>` -Skip one or more bootstrap parts +Skip one or more bootstrap parts. -Can be passed multiple times or as a comma-separated list. +Can be passed multiple times or as a comma-separated list.Or alternatively:
### `--skip… <SKIP>` -Skip one or more bootstrap parts - -Can be passed multiple times or as a comma-separated list. +Skip one or more bootstrap parts (can be passed multiple times or as a comma-separated list).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/bootstrap.md` around lines 51 - 55, In the documentation for the `--skip… <SKIP>` section, combine the two separate sentences "Skip one or more bootstrap parts" and "Can be passed multiple times or as a comma-separated list." into a single grammatically correct sentence that flows naturally and conveys both pieces of information cohesively.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/cli/bootstrap.md`:
- Line 4: The bootstrap command documentation incorrectly shows a required
subcommand syntax, but the code confirms the subcommand is optional (using
Option<Commands> in the Rust struct) and the examples demonstrate running
without a subcommand. Locate the cmd bootstrap block in the mise.usage.kdl file
and add the subcommand_required=`#false` attribute to it (similar to how it's used
in nested subcommand blocks). This will update the auto-generated documentation
to show [SUBCOMMAND] with square brackets instead of <SUBCOMMAND> with angle
brackets, correctly reflecting that the subcommand is optional.
---
Nitpick comments:
In `@docs/cli/bootstrap.md`:
- Around line 51-55: In the documentation for the `--skip… <SKIP>` section,
combine the two separate sentences "Skip one or more bootstrap parts" and "Can
be passed multiple times or as a comma-separated list." into a single
grammatically correct sentence that flows naturally and conveys both pieces of
information cohesively.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 46fe3a52-b760-4fb1-b851-03493c8d8a87
📒 Files selected for processing (6)
docs/cli/bootstrap.mde2e/cli/test_bootstrapman/man1/mise.1mise.usage.kdlsrc/cli/bootstrap.rsxtasks/fig/src/mise.ts
✅ Files skipped from review due to trivial changes (1)
- man/man1/mise.1
🚧 Files skipped from review as they are similar to previous changes (1)
- src/cli/bootstrap.rs
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/cli/bootstrap.md (1)
51-55: 💤 Low valueMinor grammar: structure sentence for clarity.
Lines 53–55 read as disconnected fragments. Combining them into a proper sentence would improve readability.
📝 Suggested revision
### `--skip… <SKIP>` -Skip one or more bootstrap parts +Skip one or more bootstrap parts. -Can be passed multiple times or as a comma-separated list. +Can be passed multiple times or as a comma-separated list.Or alternatively:
### `--skip… <SKIP>` -Skip one or more bootstrap parts - -Can be passed multiple times or as a comma-separated list. +Skip one or more bootstrap parts (can be passed multiple times or as a comma-separated list).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/bootstrap.md` around lines 51 - 55, In the documentation for the `--skip… <SKIP>` section, combine the two separate sentences "Skip one or more bootstrap parts" and "Can be passed multiple times or as a comma-separated list." into a single grammatically correct sentence that flows naturally and conveys both pieces of information cohesively.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/cli/bootstrap.md`:
- Line 4: The bootstrap command documentation incorrectly shows a required
subcommand syntax, but the code confirms the subcommand is optional (using
Option<Commands> in the Rust struct) and the examples demonstrate running
without a subcommand. Locate the cmd bootstrap block in the mise.usage.kdl file
and add the subcommand_required=`#false` attribute to it (similar to how it's used
in nested subcommand blocks). This will update the auto-generated documentation
to show [SUBCOMMAND] with square brackets instead of <SUBCOMMAND> with angle
brackets, correctly reflecting that the subcommand is optional.
---
Nitpick comments:
In `@docs/cli/bootstrap.md`:
- Around line 51-55: In the documentation for the `--skip… <SKIP>` section,
combine the two separate sentences "Skip one or more bootstrap parts" and "Can
be passed multiple times or as a comma-separated list." into a single
grammatically correct sentence that flows naturally and conveys both pieces of
information cohesively.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 46fe3a52-b760-4fb1-b851-03493c8d8a87
📒 Files selected for processing (6)
docs/cli/bootstrap.mde2e/cli/test_bootstrapman/man1/mise.1mise.usage.kdlsrc/cli/bootstrap.rsxtasks/fig/src/mise.ts
✅ Files skipped from review due to trivial changes (1)
- man/man1/mise.1
🚧 Files skipped from review as they are similar to previous changes (1)
- src/cli/bootstrap.rs
🛑 Comments failed to post (1)
docs/cli/bootstrap.md (1)
4-4:
⚠️ Potential issue | 🔴 Critical🧩 Analysis chain
🏁 Script executed:
#!/bin/bash # Find and verify the usage spec source for the bootstrap command fd -t f 'usage\|spec' --type f -e kdl -e toml | head -20Repository: jdx/mise
Length of output: 34
🏁 Script executed:
#!/bin/bash # 1. Find and examine bootstrap.rs to check if command is Option fd -type f -name "bootstrap.rs" | head -5Repository: jdx/mise
Length of output: 223
🏁 Script executed:
#!/bin/bash # 2. Search for usage spec files more broadly (KDL, YAML, TOML, etc.) find . -type f \( -name "*.kdl" -o -name "*.yaml" -o -name "*.yml" \) 2>/dev/null | grep -i usage | head -20Repository: jdx/mise
Length of output: 125
🏁 Script executed:
#!/bin/bash # 3. Look at directory structure to understand where usage specs are stored ls -la */cli/ 2>/dev/null | head -30Repository: jdx/mise
Length of output: 1754
🏁 Script executed:
#!/bin/bash # 4. Search for "bootstrap" in spec/usage files rg -l "bootstrap" --type yaml --type toml --type kdl 2>/dev/null | head -20Repository: jdx/mise
Length of output: 34
🏁 Script executed:
#!/bin/bash # Search for bootstrap command in the main usage spec rg "bootstrap" ./mise.usage.kdl -A 20 -B 2Repository: jdx/mise
Length of output: 18906
🏁 Script executed:
#!/bin/bash # Find bootstrap.rs to verify the command structure fd -name "bootstrap.rs" | xargs cat | head -100Repository: jdx/mise
Length of output: 283
🏁 Script executed:
#!/bin/bash # Search for the Bootstrap struct in bootstrap.rs to see if command is Option fd -name "bootstrap.rs" | xargs grep -A 10 "struct Bootstrap"Repository: jdx/mise
Length of output: 285
🏁 Script executed:
#!/bin/bash # Find and examine bootstrap.rs find . -name "bootstrap.rs" -type fRepository: jdx/mise
Length of output: 107
🏁 Script executed:
#!/bin/bash # Read the bootstrap.rs file find . -name "bootstrap.rs" -type f | xargs catRepository: jdx/mise
Length of output: 39174
🏁 Script executed:
#!/bin/bash # Verify the bootstrap command in the usage spec to see if subcommand_required is set rg "cmd bootstrap" ./mise.usage.kdl -A 3 | head -20Repository: jdx/mise
Length of output: 375
🏁 Script executed:
#!/bin/bash # Check the exact line showing bootstrap command with potentially subcommand_required attribute rg "cmd bootstrap" ./mise.usage.kdl -B 2 -A 15 | head -50Repository: jdx/mise
Length of output: 1495
🏁 Script executed:
#!/bin/bash # Get the complete bootstrap cmd definition from the usage spec to see all attributes rg "cmd bootstrap help=.*Set up a machine" ./mise.usage.kdl -A 50 | head -60Repository: jdx/mise
Length of output: 2458
🏁 Script executed:
#!/bin/bash # Search for the complete bootstrap cmd block including the opening line and check for subcommand_required rg "cmd bootstrap help=.*Set up a machine" ./mise.usage.kdl -A 100 | grep -E "(cmd bootstrap|subcommand_required|cmd launchd|cmd macos-defaults)" | head -20Repository: jdx/mise
Length of output: 589
🏁 Script executed:
#!/bin/bash # Check the exact structure around the bootstrap cmd to see if subcommand_required is defined sed -n '/cmd bootstrap help="\[experimental\]/,/^cmd /p' ./mise.usage.kdl | head -80Repository: jdx/mise
Length of output: 3896
🏁 Script executed:
#!/bin/bash # Look at the generated bootstrap.md to see the current Usage line head -10 docs/cli/bootstrap.mdRepository: jdx/mise
Length of output: 415
🏁 Script executed:
#!/bin/bash # Verify: check if subcommand_required is the issue by looking at how other optional commands are defined in the usage spec rg "subcommand_required=`#false`" ./mise.usage.kdl | head -10Repository: jdx/mise
Length of output: 34
🏁 Script executed:
#!/bin/bash # Look at examples in the usage spec to confirm bootstrap can run without subcommand rg "mise bootstrap" ./mise.usage.kdl | grep -v "packages\|macos\|launchd\|systemd\|user"Repository: jdx/mise
Length of output: 261
Add
subcommand_required=#false`` to the bootstrap command in mise.usage.kdl.Line 4 shows
<SUBCOMMAND>(required syntax), but the code confirms the subcommand is optional: the Rust struct usesOption<Commands>and the usage examples demonstrate runningmise bootstrapwithout a subcommand (e.g.,mise bootstrap --force-dotfiles,mise bootstrap --skip tools,task). The generated documentation is auto-generated frommise.usage.kdl, where thecmd bootstrapblock lacks thesubcommand_required=#false`` attribute present on nested subcommands. Update the usage spec to mark the bootstrap command as having an optional subcommand so the generated syntax uses square brackets[SUBCOMMAND]instead of angle brackets.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/cli/bootstrap.md` at line 4, The bootstrap command documentation incorrectly shows a required subcommand syntax, but the code confirms the subcommand is optional (using Option<Commands> in the Rust struct) and the examples demonstrate running without a subcommand. Locate the cmd bootstrap block in the mise.usage.kdl file and add the subcommand_required=`#false` attribute to it (similar to how it's used in nested subcommand blocks). This will update the auto-generated documentation to show [SUBCOMMAND] with square brackets instead of <SUBCOMMAND> with angle brackets, correctly reflecting that the subcommand is optional.
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.11 x -- echo |
18.3 ± 0.8 | 16.8 | 24.6 | 1.00 |
mise x -- echo |
19.4 ± 3.5 | 17.4 | 75.1 | 1.06 ± 0.20 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.11 env |
18.3 ± 0.9 | 16.6 | 21.8 | 1.00 |
mise env |
18.7 ± 0.8 | 17.2 | 22.6 | 1.02 ± 0.06 |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.11 hook-env |
18.8 ± 0.8 | 17.3 | 23.3 | 1.00 |
mise hook-env |
19.3 ± 0.8 | 17.8 | 24.9 | 1.03 ± 0.06 |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.11 ls |
15.7 ± 0.7 | 14.3 | 18.5 | 1.00 |
mise ls |
16.2 ± 0.7 | 15.0 | 20.0 | 1.04 ± 0.06 |
xtasks/test/perf
| Command | mise-2026.6.11 | mise | Variance |
|---|---|---|---|
| install (cached) | 131ms | 133ms | -1% |
| ls (cached) | 57ms | 58ms | -1% |
| bin-paths (cached) | 62ms | 63ms | -1% |
| task-ls (cached) | 123ms | 124ms | +0% |
renovate Bot
added a commit
to boardgamers/clash
that referenced
this pull request
Jun 17, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/boardgamers/clash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
pull Bot
pushed a commit
to Spencerx/rover
that referenced
this pull request
Jun 17, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apollographql/rover). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
donbeave
added a commit
to ChainArgos/blockchain-nodes
that referenced
this pull request
Jun 17, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. ##### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. ##### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). ##### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIxMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
smorimoto
pushed a commit
to hashicorp-contrib/setup-packer
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/hashicorp-contrib/setup-packer). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to scottames/copr
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Change | Type | Update | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | [`v4.1.0` -> `v4.2.0`](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) | action | minor | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - Every minute (`* * * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/scottames/copr). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
smorimoto
pushed a commit
to fossa-contrib/fossa-action
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/fossa-contrib/fossa-action). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to prometheus/client_java
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/prometheus/client_java). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
donbeave
added a commit
to jackin-project/jackin
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. ##### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. ##### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). ##### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjIyOS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com> Signed-off-by: Renovate Bot <renovate@whitesourcesoftware.com> Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com> Co-authored-by: Claude <noreply@anthropic.com>
donbeave
added a commit
to jackin-project/jackin-the-architect
that referenced
this pull request
Jun 18, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/125) for more information. --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjIyOS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Signed-off-by: Renovate Bot <renovate@whitesourcesoftware.com> Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com>
Automaat
pushed a commit
to Automaat/zsh-clean-history
that referenced
this pull request
Jun 19, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Automaat/zsh-clean-history). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to lambchop4prez/network
that referenced
this pull request
Jun 20, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/1064) for more information. --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Detroit) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/lambchop4prez/network). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItYWN0aW9ucyIsInJlbm92YXRlL2dpdGh1Yi1yZWxlYXNlcyIsInR5cGUvbWlub3IiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to bojanrajkovic/atc
that referenced
this pull request
Jun 20, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/bojanrajkovic/atc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
DavidJFelix
pushed a commit
to DavidJFelix/DavidJFelix
that referenced
this pull request
Jun 21, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | action | patch | `v1.0.148` → `v1.0.153` | | [jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.1.0` → `v4.2.0` | --- ### Release Notes <details> <summary>anthropics/claude-code-action (anthropics/claude-code-action)</summary> ### [`v1.0.153`](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.153) [Compare Source](https://github.com/anthropics/claude-code-action/compare/v1.0.152...v1.0.153) **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.153> ### [`v1.0.152`](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.152) [Compare Source](https://github.com/anthropics/claude-code-action/compare/v1.0.151...v1.0.152) **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.152> ### [`v1.0.151`](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.151) [Compare Source](https://github.com/anthropics/claude-code-action/compare/v1.0.150...v1.0.151) ##### What's Changed - fix: skip workflow validation token exchange failures by [@​Ryanoonan](https://github.com/Ryanoonan) in [#​1417](https://github.com/anthropics/claude-code-action/pull/1417) ##### New Contributors - [@​Ryanoonan](https://github.com/Ryanoonan) made their first contribution in [#​1417](https://github.com/anthropics/claude-code-action/pull/1417) **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.151> ### [`v1.0.150`](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.150) [Compare Source](https://github.com/anthropics/claude-code-action/compare/v1.0.149...v1.0.150) **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.150> ### [`v1.0.149`](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.149) [Compare Source](https://github.com/anthropics/claude-code-action/compare/v1.0.148...v1.0.149) ##### What's Changed - fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*) rules to bare Bash by [@​alexglynn](https://github.com/alexglynn) in [#​1350](https://github.com/anthropics/claude-code-action/pull/1350) - fix(mcp): align allowed-tools parser with SDK option parser by [@​bymle](https://github.com/bymle) in [#​1373](https://github.com/anthropics/claude-code-action/pull/1373) ##### New Contributors - [@​alexglynn](https://github.com/alexglynn) made their first contribution in [#​1350](https://github.com/anthropics/claude-code-action/pull/1350) **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.149> </details> <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - "before 5am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](undefined) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: djf-renovate[bot] <289662816+djf-renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to scottames/containers
that referenced
this pull request
Jun 21, 2026
This PR contains the following updates: | Package | Change | Type | Update | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | [`de0fac2` -> `df4cb1c`](https://github.com/actions/checkout/compare/de0fac2...df4cb1c) | action | digest | | [actions/checkout](https://github.com/actions/checkout) | [`v6.0.2` -> `v6.0.3`](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3) | action | patch | | [docker/metadata-action](https://github.com/docker/metadata-action) | [`030e881` -> `80c7e94`](https://github.com/docker/metadata-action/compare/030e881...80c7e94) | action | digest | | [jdx/mise-action](https://github.com/jdx/mise-action) | [`v4.0.1` -> `v4.2.0`](https://github.com/jdx/mise-action/compare/v4.0.1...v4.2.0) | action | minor | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@​yaananth](https://github.com/yaananth) in [#​2439](https://github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@​yaananth](https://github.com/yaananth) in [#​2414](https://github.com/actions/checkout/pull/2414) </details> <details> <summary>jdx/mise-action (jdx/mise-action)</summary> ### [`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0): : Bootstrap mode & wget fallback [Compare Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0) This release adds an opt-in **bootstrap mode** for projects that use `mise bootstrap`, and makes the action work on runner images that ship `wget` but not `curl`. #### Added ##### Bootstrap mode ([#​522](https://github.com/jdx/mise-action/pull/522)) by [@​jdx](https://github.com/jdx) Three new inputs let the action drive `mise bootstrap` instead of `mise install`: ```yaml - uses: jdx/mise-action@v4 with: bootstrap: true bootstrap_skip: "tools,task" # comma-separated parts to skip bootstrap_args: "--yes" # extra args forwarded to mise bootstrap ``` - When `bootstrap: true`, the action runs `mise bootstrap` under the existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically. - If a repo mise lock file is present, it runs `mise --locked bootstrap`, matching the auto-lock behavior introduced for `mise install` in v4.1.0. - `install_args` cannot be combined with `bootstrap: true` — the action fails fast and tells you to use `bootstrap_skip` / `bootstrap_args` instead, because full bootstrap doesn't support partial tool install args. - A new `{{bootstrap_hash}}` template variable is included in the default cache key (and available in custom `cache_key` templates) so bootstrap and non-bootstrap configurations don't share caches. `bootstrap_skip` relies on `mise bootstrap --skip` from [jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so make sure you're on a recent mise version if you use it. #### Fixed - **Fall back to `wget` when `curl` is unavailable** ([#​521](https://github.com/jdx/mise-action/pull/521)) by [@​risu729](https://github.com/risu729) — The action used to hard-code `curl` for fetching the mise binary, tar/zip archives, and the latest `VERSION` lookup, which broke on minimal runner images that only ship `wget`. It now prefers `curl` and transparently falls back to `wget`, preserving the streaming `download | tar` fast path for `.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses [jdx/mise#10488](https://github.com/jdx/mise/issues/10488). #### Documentation - Link the known Rust cache interaction note from the README ([#​496](https://github.com/jdx/mise-action/pull/496)) by [@​risu729](https://github.com/risu729). **Full Changelog**: <jdx/mise-action@v4.1.0...v4.2.0> ### [`v4.1.0`](https://github.com/jdx/mise-action/releases/tag/v4.1.0): : automatic --locked installs [Compare Source](https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0) This release adds automatic locked installs when a `mise.lock` is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers. ##### Added ##### Automatic `--locked` install when `mise.lock` exists ([#​495](https://github.com/jdx/mise-action/pull/495)) by [@​zeitlinger](https://github.com/zeitlinger) When a repo contains `mise.lock`, the action now automatically passes `--locked` to `mise install` (on mise versions that support it). This removes the need to manually set `install_args: --locked` and prevents `mise install` from silently mutating the lockfile in CI. Explicit `install_args` and older mise versions are still respected. Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating `mise.lock` mid-run — this surfaces lockfile drift rather than hiding it. ##### Fixed - **Cache key collisions across runner providers** ([#​456](https://github.com/jdx/mise-action/pull/456)) — the default cache key now includes the runner image (e.g. `macos15`, `ubuntu24` for GitHub-hosted runners; `self-hosted` otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's `~/.local/share/mise/installs/*`, causing failures like `does not have an executable named '…'` or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image. - **`mise-shim.exe` missing on Windows** ([#​476](https://github.com/jdx/mise-action/pull/476)) by [@​risu729](https://github.com/risu729) — the action now installs `mise-shim.exe` alongside `mise.exe` and repairs restored caches that lack the shim. Fixes [#​475](https://github.com/jdx/mise-action/issues/475). ##### Changed - Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) ([#​436](https://github.com/jdx/mise-action/pull/436)). No user-facing behavior change. **Full Changelog**: <jdx/mise-action@v4.0.1...v4.1.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - "after 4pm on thursday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/scottames/containers). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTguMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tak848
pushed a commit
to tak848/dotfiles
that referenced
this pull request
Jun 21, 2026
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|---|
| [aqua:astral-sh/uv](https://github.com/astral-sh/uv) | |
patch | `0.11.21` → `0.11.23` | |
|
|
| [aqua:bufbuild/buf](https://github.com/bufbuild/buf) | |
minor | `1.70.0` → `1.71.0` | |
|
|
| [aqua:cli/cli](https://github.com/cli/cli) | | minor |
`2.94.0` → `2.95.0` | |
|
|
|
[aqua:cloudflare/cloudflared](https://github.com/cloudflare/cloudflared)
| | patch | `2026.6.0` → `2026.6.1` | |
|
|
| [aqua:jdx/usage](https://github.com/jdx/usage) | | patch |
`3.5.0` → `3.5.2` | |
|
|
| [aquaproj/aqua](https://github.com/aquaproj/aqua) | | patch |
`v2.60.0` → `v2.60.1` | |
|
|
|
[aquaproj/aqua-registry](https://github.com/aquaproj/aqua-registry)
| | minor | `v4.524.1` → `v4.526.0` | |
|
|
| [aws/aws-cli](https://github.com/aws/aws-cli) | | patch |
`2.35.4` → `2.35.9` | |
|
|
| [github:aquaproj/aqua](https://github.com/aquaproj/aqua) | |
patch | `v2.60.0` → `v2.60.1` | |
|
|
| [github:endevco/aube](https://github.com/endevco/aube) | |
minor | `v1.21.0` → `v1.22.0` | `v1.23.0` |
|
|
|
[github:google-antigravity/antigravity-cli](https://github.com/google-antigravity/antigravity-cli)
| | patch | `1.0.8` → `1.0.10` | |
|
|
|
[github:sorafujitani/ccsession](https://github.com/sorafujitani/ccsession)
| | minor | `v0.6.0` → `v0.7.0` | |
|
|
| [jdx/mise](https://github.com/jdx/mise) | | patch |
`v2026.6.9` → `v2026.6.11` | |
|
|
| [jdx/mise-action](https://github.com/jdx/mise-action) |
action | minor | `v4.1.0` → `v4.2.0` | |
|
|
| [node](https://nodejs.org)
([source](https://github.com/nodejs/node)) | | minor |
`24.16.0` → `24.17.0` | |
|
|
| [npm:@typescript/native-preview](https://www.typescriptlang.org/)
([source](https://github.com/microsoft/typescript-go)) | |
patch | `7.0.0-dev.20260614.1` → `7.0.0-dev.20260620.1` |
`7.0.0-dev.20260621.1` |
|
|
| [npm:ccusage](https://github.com/ccusage/ccusage)
([source](https://github.com/ccusage/ccusage/tree/HEAD/apps/ccusage))
| | patch | `20.0.11` → `20.0.14` | |
|
|
| [npm:freee-mcp](https://github.com/freee/freee-mcp) | | patch
| `0.30.0` → `0.30.1` | |
|
|
| [pnpm](https://pnpm.io)
([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | |
minor | `11.6.0` → `11.8.0` | |
|
|
---
### Release Notes
<details>
<summary>astral-sh/uv (aqua:astral-sh/uv)</summary>
###
[`v0.11.23`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01123)
[Compare
Source](https://github.com/astral-sh/uv/compare/0.11.22...0.11.23)
Released on 2026-06-19.
##### Bug fixes
- Revert "Fix transparent Python upgrades in project environments" to
mitigate unintended breakage in `pre-commit-uv`
([#​19925](https://github.com/astral-sh/uv/pull/19925))
- Restore old behavior where workspace members "hidden" by an
intermediate `pyproject.toml` would be treated as standalone projects
([#​19926](https://github.com/astral-sh/uv/pull/19926))
###
[`v0.11.22`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01122)
[Compare
Source](https://github.com/astral-sh/uv/compare/0.11.21...0.11.22)
Released on 2026-06-18.
##### Enhancements
- Publish wheels before sdists in `uv publish`
([#​19831](https://github.com/astral-sh/uv/pull/19831))
- Add `TY` and `RUFF` env vars for providing paths for binaries used by
`uv format` and `uv check`
([#​19821](https://github.com/astral-sh/uv/pull/19821))
##### Preview features
- Allow configuring preview features in `uv.toml` and `pyproject.toml`
([#​18437](https://github.com/astral-sh/uv/pull/18437))
- Update the lockfile during `uv check --no-sync`
([#​19909](https://github.com/astral-sh/uv/pull/19909))
- Add `--script` to `uv check` and `uv metadata`
([#​19860](https://github.com/astral-sh/uv/pull/19860))
- Report workspace-exclusive dependency groups in `workspace metadata`
([#​19862](https://github.com/astral-sh/uv/pull/19862))
- Support SARIF as a `uv audit` output
([#​19872](https://github.com/astral-sh/uv/pull/19872))
##### Performance
- Use a more deadlock-resistant concurrent hashmap in the resolver
([#​19532](https://github.com/astral-sh/uv/pull/19532))
##### Bug fixes
- Update string marker ordering semantics to match [upstream clarified
rules](https://github.com/pypa/packaging.python.org/pull/1988)
([#​19808](https://github.com/astral-sh/uv/pull/19808))
- Reject extras that have the same normalized name
([#​19871](https://github.com/astral-sh/uv/pull/19871))
- Reject dependency group `include-group` entries that have additional
fields
([#​19866](https://github.com/astral-sh/uv/pull/19866))
- Reject invalid UTF-8 URL credentials
([#​19814](https://github.com/astral-sh/uv/pull/19814))
- Validate that PEP 517 `backend-path`s exist when building sdists
([#​19834](https://github.com/astral-sh/uv/pull/19834))
- Validate that `pylock.toml` files do not have an unsupported a
`lock-version`
([#​19869](https://github.com/astral-sh/uv/pull/19869))
- Validate that the environment satisfies the `packages.requires-python`
of a `pylock.toml`
([#​19868](https://github.com/astral-sh/uv/pull/19868))
- Allow `uv` to be recursively invoked by PEP 517 build hooks
([#​19879](https://github.com/astral-sh/uv/pull/19879))
- Allow empty `credentials.toml` files
([#​19815](https://github.com/astral-sh/uv/pull/19815))
- Fix transparent Python upgrades in project environments
([#​19890](https://github.com/astral-sh/uv/pull/19890))
- Handle non-file editable URLs in `uv pip list`
([#​19867](https://github.com/astral-sh/uv/pull/19867))
- Fix incorrect output from `uv tree --invert`
([#​19910](https://github.com/astral-sh/uv/pull/19910))
- Fix environment locking of `uv venv` in a project
([#​19837](https://github.com/astral-sh/uv/pull/19837))
- Fix handling of workspace-exclusive dependency groups in `uv tree`
([#​19905](https://github.com/astral-sh/uv/pull/19905))
##### Documentation
- Archive the 0.10.x changelog
([#​19813](https://github.com/astral-sh/uv/pull/19813))
##### Other changes
- Mark more tests as requiring network for vendors that need to run
tests offline
([#​19819](https://github.com/astral-sh/uv/pull/19819))
</details>
<details>
<summary>bufbuild/buf (aqua:bufbuild/buf)</summary>
###
[`v1.71.0`](https://github.com/bufbuild/buf/blob/HEAD/CHANGELOG.md#v1710---2026-06-16)
[Compare
Source](https://github.com/bufbuild/buf/compare/v1.70.0...v1.71.0)
- Port new formatter and fix bugs for in-line block comment spacing.
- Fix handling for an empty rpc input/output.
</details>
<details>
<summary>cli/cli (aqua:cli/cli)</summary>
###
[`v2.95.0`](https://github.com/cli/cli/releases/tag/v2.95.0):
GitHub CLI 2.95.0
[Compare
Source](https://github.com/cli/cli/compare/v2.94.0...v2.95.0)
#### Read repository files and directories with `gh repo read-file` and
`gh repo read-dir`
Two new preview commands read repository contents without cloning:
```shell
# Read a single file to stdout
gh repo read-file README.md --repo cli/cli
# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli
# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli
# List the entries in a directory
gh repo read-dir script --repo cli/cli
```
Both commands default to the repository's default branch, accept `--ref`
to target any branch, tag, or commit, and support `--json`, `--jq`, and
`--template` for scripting. This makes it easy for agents and automation
to inspect a repo without a full checkout.
> \[!NOTE]
> `gh repo read-file` and `gh repo read-dir` are in preview and subject
to change without notice.
#### What's Changed
##### ✨ Features
- feat: add `repo read-file` and `repo read-dir` by
[@​babakks](https://github.com/babakks) in
[#​13580](https://github.com/cli/cli/pull/13580)
- feat(skills): list available skills when install runs
non-interactively by
[@​SamMorrowDrums](https://github.com/SamMorrowDrums) in
[#​13548](https://github.com/cli/cli/pull/13548)
- Support custom CLAUDE\_CONFIG\_DIR in install by
[@​tommaso-moro](https://github.com/tommaso-moro) in
[#​13523](https://github.com/cli/cli/pull/13523)
##### 🐛 Fixes
- fix(skills): stage updates in a temp dir and swap in-place by
[@​SamMorrowDrums](https://github.com/SamMorrowDrums) in
[#​13449](https://github.com/cli/cli/pull/13449)
##### 📚 Docs & Chores
- Make filtering by bot authors more discoverable by
[@​BagToad](https://github.com/BagToad) in
[#​13642](https://github.com/cli/cli/pull/13642)
- docs(discussion): polish help docs by
[@​babakks](https://github.com/babakks) in
[#​13632](https://github.com/cli/cli/pull/13632)
- Bump Go in devcontainer by
[@​spenserblack](https://github.com/spenserblack) in
[#​13674](https://github.com/cli/cli/pull/13674)
##### :dependabot: Dependencies
- chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by
[@​dependabot](https://github.com/dependabot)\[bot] in
[#​13640](https://github.com/cli/cli/pull/13640)
- chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by
[@​dependabot](https://github.com/dependabot)\[bot] in
[#​13663](https://github.com/cli/cli/pull/13663)
- chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by
[@​dependabot](https://github.com/dependabot)\[bot] in
[#​13661](https://github.com/cli/cli/pull/13661)
- chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by
[@​dependabot](https://github.com/dependabot)\[bot] in
[#​13619](https://github.com/cli/cli/pull/13619)
- chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1
by [@​dependabot](https://github.com/dependabot)\[bot] in
[#​13662](https://github.com/cli/cli/pull/13662)
- chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by
[@​dependabot](https://github.com/dependabot)\[bot] in
[#​13641](https://github.com/cli/cli/pull/13641)
**Full Changelog**:
<https://github.com/cli/cli/compare/v2.94.0...v2.95.0>
</details>
<details>
<summary>cloudflare/cloudflared (aqua:cloudflare/cloudflared)</summary>
###
[`v2026.6.1`](https://github.com/cloudflare/cloudflared/releases/tag/2026.6.1)
[Compare
Source](https://github.com/cloudflare/cloudflared/compare/2026.6.0...2026.6.1)
##### SHA256 Checksums:
```
cloudflared-amd64.pkg: 1c939cee0a953b30c91854fba114dc3a46f79570110fc5168703cd62afb65d82
cloudflared-arm64.pkg: acfcd577408f504254b4a207fbe6883d4c45fc1f9ae3b883bb3a493f412a1f8d
cloudflared-darwin-amd64.tgz: 3f74d697045ecf56dd2fbeb42f59767ecdf4067c409d55f080563923e8a1bb32
cloudflared-darwin-arm64.tgz: ae6ee90188ae5833c687ce937c3693e28403677607c06c65a2ff2b6a022f50e4
cloudflared-fips-linux-amd64: a22276b23500f75763604fd9bff7ece607f705ad62469344606bd662dbd3793d
cloudflared-fips-linux-amd64.deb: 4d8eb632229cec4df97d9cb03c23517f4bdada7189be3fd76a604233526b9b86
cloudflared-fips-linux-x86_64.rpm: dedcba9c1fed53fded13114c0ed968fbfa93eccc8d14b1ed147e5fdbebdee21e
cloudflared-linux-386: a9ded87fef4bbe2da6d44c8159f6e97df5811c24e4cf082d5426cefc1eb9a5aa
cloudflared-linux-386.deb: 7ef10a9544a5cba8025ac0f8ddf3c368e9c98f0160354017f62b4ad21237449c
cloudflared-linux-386.rpm: 27d5c887bee8071bf70c33955427adf40c6aed16074950f36988a269a392c1fe
cloudflared-linux-aarch64.rpm: 3291e4f9a7b65f97f318b0ac5d542148a3eb2a0b59a98a74d88e7777ef75f3ff
cloudflared-linux-amd64: 5861a10a438fe8ddcfebb3b830f83966cbf193edafce0fe2eeb198fbae1f7a22
cloudflared-linux-amd64.deb: ccd02ec216c62bfa573395d8f72cb2e91e95cbdf8726a8acc06b3e2d9aa31526
cloudflared-linux-arm: c07674eb6e13172d031e3ddc55c8817ed2a36ce00b0d42693e178c4317f9c1b8
cloudflared-linux-arm.deb: b10df091a66704198932a1563e2403cd71edf2bb0278d517bf5a8263b0732912
cloudflared-linux-arm.rpm: 934a2c6819056047dcd7475ffc3e8fcd64917f2977c418d39bc00532a7be61e6
cloudflared-linux-arm64: 59816ce9b16db71f5bc2a86d59b3632a96c8c3ee934bde2bc8641ee83a6070eb
cloudflared-linux-arm64.deb: bd03edd14de32ff38230ec9356e7fad0f32455558b2052d693bf51b7814f3ad4
cloudflared-linux-armhf: c742494eb1f90f6d43bbb07ef660e565e0baae15e49e4041626ac4d413d39072
cloudflared-linux-armhf.deb: a5242ccd0ee70d247eb70a161f6dd6fe5ddff0c6a5e4ea537202b7e9432755c8
cloudflared-linux-armhf.rpm: ff25adfd0aedb32ad5aa5a2efc343caf21b5137d6a5a8761d5f379df4238f853
cloudflared-linux-x86_64.rpm: 9690d870856b4396c8071ee7082acfc340b701013bc498635522e50889e49aa4
cloudflared-windows-386.exe: 52f63fb7055e5797e79585b0e1dbfb397046b1ed5edee29901d433dc16b94042
cloudflared-windows-386.msi: 4d3ff388a19c85bfe6de2f04b037963f7aee9dca6223ebb37b885d4d50762ecd
cloudflared-windows-amd64.exe: 5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2
cloudflared-windows-amd64.msi: f20f932b6c0ddab4db18f7fa596d0a76cbd77bf3fa4572ade0b99d42c85f8a84
```
</details>
<details>
<summary>jdx/usage (aqua:jdx/usage)</summary>
###
[`v3.5.2`](https://github.com/jdx/usage/blob/HEAD/CHANGELOG.md#352---2026-06-17)
[Compare
Source](https://github.com/jdx/usage/compare/v3.5.1...v3.5.2)
##### 🔍 Other Changes
- **(ci)** install publish build targets by
[@​jdx](https://github.com/jdx) in
[#​687](https://github.com/jdx/usage/pull/687)
###
[`v3.5.1`](https://github.com/jdx/usage/blob/HEAD/CHANGELOG.md#351---2026-06-17)
[Compare
Source](https://github.com/jdx/usage/compare/v3.5.0...v3.5.1)
##### 🐛 Bug Fixes
- **(parse)** dedupe required flag validation errors by
[@​jdx](https://github.com/jdx) in
[#​685](https://github.com/jdx/usage/pull/685)
- **(zsh)** isolate generated completion options by
[@​jdx](https://github.com/jdx) in
[#​686](https://github.com/jdx/usage/pull/686)
- allow for variadic arguments to capture unknown flags as well by
[@​rtpg](https://github.com/rtpg) in
[#​676](https://github.com/jdx/usage/pull/676)
##### 📚 Documentation
- link to all sponsors by [@​jdx](https://github.com/jdx)
in [#​680](https://github.com/jdx/usage/pull/680)
- clarify contribution fit by
[@​jdx](https://github.com/jdx) in
[#​681](https://github.com/jdx/usage/pull/681)
##### 🛡️ Security
- **(deps)** update actions/checkout action to v6.0.3 by
[@​renovate\[bot\]](https://github.com/renovate\[bot]) in
[#​678](https://github.com/jdx/usage/pull/678)
##### 📦️ Dependency Updates
- update jdx/mise-action action to v4.1.0 by
[@​renovate\[bot\]](https://github.com/renovate\[bot]) in
[#​679](https://github.com/jdx/usage/pull/679)
- update mise dev tools in lockfile to latest by
[@​JamBalaya56562](https://github.com/JamBalaya56562) in
[#​682](https://github.com/jdx/usage/pull/682)
- lock file maintenance lockfile maintenance by
[@​renovate\[bot\]](https://github.com/renovate\[bot]) in
[#​683](https://github.com/jdx/usage/pull/683)
##### New Contributors
- [@​rtpg](https://github.com/rtpg) made their first
contribution in
[#​676](https://github.com/jdx/usage/pull/676)
</details>
<details>
<summary>aquaproj/aqua (aquaproj/aqua)</summary>
###
[`v2.60.1`](https://github.com/aquaproj/aqua/releases/tag/v2.60.1)
[Compare
Source](https://github.com/aquaproj/aqua/compare/v2.60.0...v2.60.1)
##### ⚠️ Security Fixes
[`d5b02b2`](https://github.com/aquaproj/aqua/commit/d5b02b220188de376a661b3aabfa912202a1a59a)
fix(unarchive): prevent archive extraction from writing outside the
destination
[For more details, please see the security
advisory.](https://github.com/aquaproj/aqua/security/advisories/GHSA-mf5c-hw34-4hpp)
##### :warning: Release Asset Naming Convention for Cosign Was Changed
- `*.sig` and `*.pem` files are no longer included in the release assets
- `*.bundle` files are renamed to `*.sigstore.json`
##### Fixes
[#​4938](https://github.com/aquaproj/aqua/issues/4938)
Remove GitHub Release Attestation verification
</details>
<details>
<summary>aquaproj/aqua-registry (aquaproj/aqua-registry)</summary>
###
[`v4.526.0`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.526.0)
[Compare
Source](https://github.com/aquaproj/aqua-registry/compare/v4.525.0...v4.526.0)
[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.526.0)
| [Pull
Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.526.0)
|
<https://github.com/aquaproj/aqua-registry/compare/v4.525.0...v4.526.0>
#### 🎉 New Packages
[#​55428](https://github.com/aquaproj/aqua-registry/issues/55428)
[Latias94/merman](https://github.com/Latias94/merman) -
Mermaid.js, but headless, in Rust
[@​yashikota](https://github.com/yashikota)
[#​55421](https://github.com/aquaproj/aqua-registry/issues/55421)
[coder/boo](https://github.com/coder/boo) - A GNU screen style
terminal multiplexer built on libghostty
[@​yashikota](https://github.com/yashikota)
#### Fixes
[#​55443](https://github.com/aquaproj/aqua-registry/issues/55443)
Rename bitnami-labs/sealed-secrets to bitnami/sealed-secrets
[#​55445](https://github.com/aquaproj/aqua-registry/issues/55445)
suzuki-shunsuke/ghtkn: support v0.2.6 or later
###
[`v4.525.0`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.525.0)
[Compare
Source](https://github.com/aquaproj/aqua-registry/compare/v4.524.1...v4.525.0)
[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.525.0)
| [Pull
Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.525.0)
|
<https://github.com/aquaproj/aqua-registry/compare/v4.524.1...v4.525.0>
#### 🎉 New Packages
[#​55397](https://github.com/aquaproj/aqua-registry/issues/55397)
[#​55401](https://github.com/aquaproj/aqua-registry/issues/55401)
[CycloneDX/cdxgen](https://github.com/CycloneDX/cdxgen) -
Creates CycloneDX Bill of Materials (BOM) from source code and container
images
[@​sebdanielsson](https://github.com/sebdanielsson)
[#​55389](https://github.com/aquaproj/aqua-registry/issues/55389)
[fallow-rs/fallow](https://github.com/fallow-rs/fallow):
Codebase intelligence for TypeScript and JavaScript. Free static layer:
unused code, duplication, circular deps, complexity hotspots,
architecture boundaries. Optional paid runtime layer: hot-path review
and cold-path deletion evidence from real production traffic.
Rust-native, sub-second, zero-config framework support
[@​wancup](https://github.com/wancup)
#### Fixes
[#​55395](https://github.com/aquaproj/aqua-registry/issues/55395)
haskell/ghcup-hs: Support Windows
[@​cprecioso](https://github.com/cprecioso)
[#​55393](https://github.com/aquaproj/aqua-registry/issues/55393)
Remove the verification of release attestations
</details>
<details>
<summary>aws/aws-cli (aws/aws-cli)</summary>
###
[`v2.35.9`](https://github.com/aws/aws-cli/compare/2.35.8...2.35.9)
[Compare
Source](https://github.com/aws/aws-cli/compare/2.35.8...2.35.9)
###
[`v2.35.8`](https://github.com/aws/aws-cli/compare/2.35.7...2.35.8)
[Compare
Source](https://github.com/aws/aws-cli/compare/2.35.7...2.35.8)
###
[`v2.35.7`](https://github.com/aws/aws-cli/compare/2.35.6...2.35.7)
[Compare
Source](https://github.com/aws/aws-cli/compare/2.35.6...2.35.7)
###
[`v2.35.6`](https://github.com/aws/aws-cli/compare/2.35.5...2.35.6)
[Compare
Source](https://github.com/aws/aws-cli/compare/2.35.5...2.35.6)
###
[`v2.35.5`](https://github.com/aws/aws-cli/compare/2.35.4...2.35.5)
[Compare
Source](https://github.com/aws/aws-cli/compare/2.35.4...2.35.5)
</details>
<details>
<summary>endevco/aube (github:endevco/aube)</summary>
###
[`v1.22.0`](https://github.com/jdx/aube/releases/tag/v1.22.0):
: Scoped registry tokens and a pnpm-lockfile parity sweep
[Compare
Source](https://github.com/endevco/aube/compare/v1.21.0...v1.22.0)
#### Added
- *(registry)* Scope-specific auth tokens
(`//host/:@​scope:_authToken`) for multi-org registries like
GitHub Packages, with `aube login --scope` writing scoped entries
([#​899](https://github.com/jdx/aube/pull/899))
#### Fixed
- *(install)* Verify lockfile tarball URLs against package packuments
instead of per-version endpoints, fixing frozen-lockfile installs
against registries with incomplete `/{name}/{version}` routes
([#​905](https://github.com/jdx/aube/pull/905))
- *(install)* Close a cluster of `pnpm-lock.yaml` parity and
re-resolution gaps: stop peer suffixes at the supplier, record
hosted-git deps as codeload tarballs, render git/tarball peer suffixes
as resolved specs, stamp pnpm config checksums on
update/remove/dedupe/audit, and re-resolve when `.pnpmfile.{cjs,mjs}`
changes ([#​896](https://github.com/jdx/aube/pull/896))
- *(install)* Repair member installs under
`sharedWorkspaceLockfile=false`: per-member warm-path freshness,
warm-path relink of deleted member `node_modules`, and
`packageExtensions` applied to git/tarball/directory deps
([#​891](https://github.com/jdx/aube/pull/891))
- *(install)* Restore nested `pnpm-workspace.yaml` as a hard workspace
boundary, matching pnpm — a member's settings-only yaml configures a
single-package workspace rather than being skipped
([#​889](https://github.com/jdx/aube/pull/889))
- *(lockfile)* Close `pnpm-lock.yaml` formatting and field parity gaps:
record every declared optional-dep arch, flow-form `cpu`/`os`/`libc`,
re-indent `transitivePeerDependencies`, reorder `catalogs:`, round-trip
`deprecated:`, drop `engines: {node: '*'}`, mark `optional: true`
snapshots, emit `transitivePeerDependencies`, and synthesize
`peerDependencies` for meta-only peers
([#​893](https://github.com/jdx/aube/pull/893))
- *(embedder)* Honor the embedder profile in the install banner, cache
directories, virtual-store leaf, Node-install root, install-shape
digest, and `doctor` messages
([#​888](https://github.com/jdx/aube/pull/888))
#### Changed
- *(commands)* Return exit codes from command entrypoints instead of
calling `process::exit`, so embedding aube as a library no longer tears
down the host process
([#​897](https://github.com/jdx/aube/pull/897))
#### 💚 Sponsor aube
aube is part of [**jdx.dev**](https://jdx.dev) — an independent
developer-tooling studio run by
[@​jdx](https://github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.
If aube is saving your team install time or CI minutes, please consider
[sponsoring at jdx.dev](https://jdx.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.
</details>
<details>
<summary>google-antigravity/antigravity-cli
(github:google-antigravity/antigravity-cli)</summary>
###
[`v1.0.10`](https://github.com/google-antigravity/antigravity-cli/blob/HEAD/CHANGELOG.md#1010)
[Compare
Source](https://github.com/google-antigravity/antigravity-cli/compare/1.0.9...1.0.10)
- Improved compatibility with a broader set of ARM64 devices (e.g.
raspberry pi 4b).
- Added `antigravity_guide` builtin skill to provide instant, in-context
reference guides for the Antigravity 2.0, CLI, IDE, and SDK.
- Improved commit history navigation: scrolling now immediately loads
and displays changed files and diffs.
- Improved Git integration by enabling ASCII node graphs (`git log
--graph`) for visual parity with hg/jj.
- Improved commit hash matching to seamlessly resolve short (6-char) to
long (64-char) hashes via prefix comparison.
- Added alert message type for system errors/warnings, separating them
from standard command output.
- Added the CLI log file path to the `/help` menu for easy
troubleshooting.
- Improved markdown rendering by upgrading `glamour` to v2.0.1 for
cleaner headings and block padding.
- Improved authentication to automatically launch browser sign-in via
`rundll32`.
- Fixed a bug where "ask" permissions were dropped during settings
updates, ensuring `settings.json` preservation.
- Fixed permission engine matching bugs by escaping regex metacharacters
(like `$` or `.`) in saved rules, preventing infinite prompt loops.
- Fixed environment flag parsing to prevent ignored disablement flags.
- Fixed bash mode argument escaping (preventing swallowed stdout) and
defaulted shell resolution to PowerShell.
###
[`v1.0.9`](https://github.com/google-antigravity/antigravity-cli/blob/HEAD/CHANGELOG.md#109)
[Compare
Source](https://github.com/google-antigravity/antigravity-cli/compare/1.0.8...1.0.9)
- Added submodule support for plugins installation. External plugin
installation now automatically resolves and initializes Git submodules.
- Optimized customizations permissions: Automatically grants read-only
access to the builtin customizations directory, eliminating redundant
permission prompts on startup.
- Improved glamour parser error handling (like nested checkboxes inside
list emphasis) and preventing it from crashing the TUI, falling back to
raw text with a warning banner.
- Updated bubbletea to v2.0.7: Resolves a potential TUI panic when
terminal input is unavailable, fixes a data race in mouse handling
within the Cursed Renderer, and corrects mouse release behavior under
the Kitty Keyboard protocol.
- Hardened command execution permission checks by enforcing strict
exact-match verification for PowerShell scripts, complex shell
redirections ( `>` , `2>&1` ), and unparseable strings to prevent
sandbox escapes.
- Hardened sandbox execution by adding `.git` to the core list of
dangerous paths, preventing unauthorized or destructive repository
modifications.
- Fixed a bug where allowlisted terminal commands with quoted arguments
(e.g., `python -c "print(1)"`) would silently fail to match at runtime
due to flawed whitespace tokenization.
- Fixed a bug in headless print mode resumption (`--conversation`/`-c`
`-p ...`) where the CLI would dump the entire historical conversation
transcript instead of only printing the newly generated response.
- Fixed a CPU compatibility issue on ARM64 devices without AES hardware
support.
</details>
<details>
<summary>sorafujitani/ccsession
(github:sorafujitani/ccsession)</summary>
###
[`v0.7.0`](https://github.com/sorafujitani/ccsession/releases/tag/v0.7.0):
ccsession 0.7.0
[Compare
Source](https://github.com/sorafujitani/ccsession/compare/v0.6.1...v0.7.0)
#### ccsession v0.7.0
An fzf-powered session picker for resuming local agent sessions.
##### Features
- **Agent-assisted session recovery workflow** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​85](https://github.com/sorafujitani/ccsession/issues/85)):
ccsession now ships a repo-local Agent Skill at
`.agents/skills/ccsession`, so agents can search, compare, preview, and
hand off prior local sessions without reimplementing the session-store
logic.
- **Structured handoff commands for agents** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​85](https://github.com/sorafujitani/ccsession/issues/85)):
`ccsession list --json --limit` emits machine-readable candidates, and
`ccsession resume-spec` prints the non-launching resume target before
any interactive process is started.
##### Contributors
Thanks to
[@​sorafujitani](https://github.com/sorafujitani) for the
work in this release!
***
See the README for installation instructions.
###
[`v0.6.1`](https://github.com/sorafujitani/ccsession/releases/tag/v0.6.1):
ccsession 0.6.1
[Compare
Source](https://github.com/sorafujitani/ccsession/compare/v0.6.0...v0.6.1)
#### ccsession v0.6.1
An fzf-powered session picker for resuming local agent sessions across
Claude Code, Codex, OpenCode, and Grok.
##### Fixes
- **Reuse Codex representative session metadata** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​78](https://github.com/sorafujitani/ccsession/issues/78)):
Codex scan, filtered scan, ID lookup, and label-based grep now reuse the
metadata already parsed during representative session selection,
avoiding redundant JSONL parsing while preserving duplicate session ID
behavior.
##### Performance
- **Cache grep transcript text** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​79](https://github.com/sorafujitani/ccsession/issues/79)):
grep mode now uses a metadata-validated on-disk cache for extracted
transcript text across Claude, Codex, and Grok, reducing repeated-query
work without changing match semantics.
- **Use hidden session locators for preview and resume** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​80](https://github.com/sorafujitani/ccsession/issues/80)):
fzf rows now carry source-aware locator metadata so preview and resume
can resolve file-backed sessions directly instead of rescanning by ID.
- **Parallelize Codex and Grok file-backed scans** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​81](https://github.com/sorafujitani/ccsession/issues/81)):
Codex representative parsing and Grok summary reads now run through an
order-preserving worker pool while keeping existing sort order and error
behavior.
- **Parallelize all-source operations** by
[@​sorafujitani](https://github.com/sorafujitani)
([#​82](https://github.com/sorafujitani/ccsession/issues/82)):
`--all` scan, filtered scan, and grep now fan out across backends
concurrently while preserving source-order aggregation, composite keys,
and backend-specific error context.
##### Contributors
Thanks to
[@​sorafujitani](https://github.com/sorafujitani) for the
work in this release!
***
See the README for installation instructions.
</details>
<details>
<summary>jdx/mise (jdx/mise)</summary>
###
[`v2026.6.11`](https://github.com/jdx/mise/releases/tag/v2026.6.11):
: apk bootstrap, cleaner Windows shims, and aqua polish
[Compare
Source](https://github.com/jdx/mise/compare/vfox-v2026.6.10...v2026.6.11)
A focused release that adds Alpine `apk` as a bootstrap package manager,
stops the default Windows `exe` shims from leaking into WSL, and fixes a
handful of aqua, HTTP cache, Rust, and Deno corners.
#### Added
- **bootstrap:** Alpine Linux `apk` joins apt, dnf, pacman, and brew as
a supported `[bootstrap.packages]` manager. Specify packages as
`apk:name` (with optional `@version`), or pass `--manager apk`
explicitly; status, install, and upgrade all wire through the same paths
as the other Linux managers
([#​10476](https://github.com/jdx/mise/pull/10476) by
[@​jdx](https://github.com/jdx)).
```toml
[bootstrap.packages]
"apk:curl" = "*"
"apk:git" = "@​2.45.2-r0"
```
- **registry:** Added
[`pinniped`](https://github.com/vmware/pinniped) to the
registry
([#​10456](https://github.com/jdx/mise/pull/10456) by
[@​tony-sol](https://github.com/tony-sol)).
#### Fixed
- **task:** `mise run //projects/backend` and `mise run //...` no longer
behave like `//projects/backend:*` — the monorepo pattern parser now
rejects path-only targets with a clear error pointing to `//path:<task>`
or `//path:*`
([#​10479](https://github.com/jdx/mise/pull/10479) by
[@​jdx](https://github.com/jdx)).
- **shim (Windows):** Default `exe` `windows_shim_mode` no longer writes
a second, extension-less bash shim next to `<tool>.exe`. Git Bash /
Cygwin / MSYS2 already resolve a bare `gh` to `gh.exe`, and dropping the
extras stops them from leaking into WSL via `/mnt/c/...` PATH interop
(the source of the `mise: not found` / infinite-recursion loops). `file`
mode still emits the bash shim where it is required. Old extras are
cleaned up on the next `reshim`
([#​10475](https://github.com/jdx/mise/pull/10475) by
[@​JamBalaya56562](https://github.com/JamBalaya56562)).
- **aqua:** `format_overrides` are now parsed from the aqua registry and
applied to the compiled package model. They run after version overrides
and before normal platform overrides — matching aqua's own ordering — so
per-OS archive formats finally resolve correctly. Aqua registry caches
will rebuild on first use due to a serialized-layout bump
([#​10461](https://github.com/jdx/mise/pull/10461) by
[@​risu729](https://github.com/risu729)).
- **aqua:** Minisign asset templates such as `{{.Asset}}.minisig` now
render against the selected package asset, fixing signature verification
for packages like `jedisct1/minisign` 0.12
([#​10462](https://github.com/jdx/mise/pull/10462) by
[@​risu729](https://github.com/risu729)).
- **deno:** Deno's Windows `.sha256sum` files use PowerShell
`Get-FileHash` multi-line output. mise now parses that format alongside
the standard whitespace-delimited one, validates the algorithm/length,
and stores hashes lowercased as `"<algo>:<hash>"`
([#​10464](https://github.com/jdx/mise/pull/10464) by
[@​risu729](https://github.com/risu729)).
- **http:** Auto-detected `strip_components` is now resolved before HTTP
archive cache lookup and folded into the `http-tarballs` cache key.
Stripped and unstripped extractions of the same URL no longer share a
cache entry, fixing tool-stub installs that re-used a previous
`bin_path`-based extract
([#​10468](https://github.com/jdx/mise/pull/10468) by
[@​risu729](https://github.com/risu729)).
- **install:** When resolving lockfiles, absolute symlink targets that
live under mise-managed data/cache/download/install/shared dirs are no
longer misclassified as `mise link` versions. External symlink targets
remain classified as linked. This fixes `mise install --locked`
idempotency for HTTP-backed tools
([#​10463](https://github.com/jdx/mise/pull/10463) by
[@​risu729](https://github.com/risu729)).
- **rust:** `rust-toolchain.toml` `profile`, `components`, and `targets`
are now stored on the generated `ToolRequest`, so install and
lockfile-option resolution both read the same `request.options()`
instead of re-parsing the file. As a side effect, lockfile keys are
canonicalized: TOML arrays now match comma-separated strings,
`components`/`targets` are sorted and deduplicated, and an empty
`profile` no longer emits a spurious key
([#​10178](https://github.com/jdx/mise/pull/10178) by
[@​risu729](https://github.com/risu729)).
- **exec:** `COLORTERM` is now passed through to child processes
(alongside `TERM`), preserving 24-bit truecolor signalling in sandboxed
environments
([#​10451](https://github.com/jdx/mise/pull/10451) by
[@​sschuberth](https://github.com/sschuberth)).
- **docs:** The Tera task-argument deprecation page now says removal is
in `2027.5.0`, matching the warning emitted by the CLI
([#​10453](https://github.com/jdx/mise/pull/10453) by
[@​reitzig](https://github.com/reitzig)).
- **docs:** The `minimum_release_age` example uses `6mo` (not `6m`) for
"6 months", matching jiff's friendly duration format
([#​10193](https://github.com/jdx/mise/pull/10193) by
[@​sisp](https://github.com/sisp)).
#### Changed
- **deps:** Replaced the unmaintained `fuzzy-matcher` crate (archived,
last published 2020) with `nucleo-matcher` for registry/task suggestion
scoring and picker highlight indices
([#​10467](https://github.com/jdx/mise/pull/10467) by
[@​risu729](https://github.com/risu729)).
- **deps:** Removed the `os-release` and `sys-info` crates in favor of
mise's internal `/etc/os-release` parser, which is now shared by libc
detection, env, Swift, and Erlang Linux fallbacks
([#​10465](https://github.com/jdx/mise/pull/10465) by
[@​risu729](https://github.com/risu729)).
#### Aqua Registry
New packages:
[`Latias94/merman`](https://github.com/Latias94/merman),
[`bitnami/sealed-secrets`](https://github.com/bitnami/sealed-secrets),
[`coder/boo`](https://github.com/coder/boo). Updated:
[`suzuki-shunsuke/ghtkn`](https://github.com/suzuki-shunsuke/ghtkn).
#### New Contributors
- [@​sschuberth](https://github.com/sschuberth) made
their first contribution in
[#​10451](https://github.com/jdx/mise/pull/10451)
- [@​sisp](https://github.com/sisp) made their first
contribution in
[#​10193](https://github.com/jdx/mise/pull/10193)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.6.10...v2026.6.11>
#### 💚 Sponsor mise
mise is built by [@​jdx](https://github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
###
[`v2026.6.10`](https://github.com/jdx/mise/releases/tag/v2026.6.10):
: Env defaults, Unix 7z, and stale-PATH fixes
[Compare
Source](https://github.com/jdx/mise/compare/vfox-v2026.6.9...vfox-v2026.6.10)
A focused release that adds a `default` shorthand for env vars, brings
`.7z` archive support to Unix, and cleans up several long-standing PATH
and shim edge cases on Linux, macOS, Windows, and WSL.
#### Added
- **env:** New `{ default = "fallback" }` shorthand for `[env]` (and
config/task `[vars]`). The default applies only when the variable is
unset or empty; existing non-empty values from the process env or
earlier config are preserved. Mixing `default` with `value`, `required`,
or `age` now fails with a clear message
([#​10441](https://github.com/jdx/mise/pull/10441) by
[@​jdx](https://github.com/jdx)).
```toml
[env]
EDITOR = { default = "vim" } # only used if $EDITOR is unset/empty
PORT = { default = "3000" }
```
- **backend:** `.7z` archives now extract on Unix as well as Windows,
and `strip_components` probing works cross-platform. Migrated from the
unmaintained `sevenz-rust` to `sevenz-rust2`, and tightened extraction
to reject directory traversal and absolute paths
([#​10434](https://github.com/jdx/mise/pull/10434) by
[@​risu729](https://github.com/risu729)).
#### Fixed
- **env:** When `env_shell_expand` is enabled, `${VAR:-default}` now
follows POSIX semantics: empty strings are treated as missing (fallback
applies), `${VAR-default}` only substitutes when the variable is unset,
and fallback text is recursively expanded (e.g.
`${NONEXISTENT:-$OTHER}`). Braced parsing is also stricter —
unterminated `${…` stays literal and `}` inside `$(…)` no longer closes
the brace
([#​10445](https://github.com/jdx/mise/pull/10445) by
[@​jdx](https://github.com/jdx), fixes
[#​10444](https://github.com/jdx/mise/discussions/10444)).
- **env:** `mise x` / `run` / `env` now strip mise-managed install
directories from the inherited PATH when composing the child
environment. Stale entries carried in from a frozen env snapshot (IDE
terminals, CI wrappers, AI-agent harnesses) no longer sit ahead of the
freshly injected bin dir, so subshells, `#!/usr/bin/env` shebangs, and
package-manager workers all resolve the requested tool version
([#​10422](https://github.com/jdx/mise/pull/10422) by
[@​JamBalaya56562](https://github.com/JamBalaya56562),
addresses
[#​10345](https://github.com/jdx/mise/discussions/10345)).
- **vfox:** Plugin install hooks that shell out via Lua `os.execute` now
run under the same sanitized `mise_env` as `cmd.exec`. Combined with new
resolution of `tools = true` env *values* during install, this fixes
setups like gcloud depending on python where a single `mise install`
previously left `CLOUDSDK_PYTHON` pointing at a nonexistent path
([#​10432](https://github.com/jdx/mise/pull/10432) by
[@​JamBalaya56562](https://github.com/JamBalaya56562),
fixes
[#​10282](https://github.com/jdx/mise/discussions/10282)).
- **shims:** Windows extensionless bash shims now detect WSL
(`WSL_DISTRO_NAME` / `WSL_INTEROP` / `WSLInterop`), drop their own dir
from PATH, and `exec` the tool directly. This breaks the infinite `mise
x` loop that happened when the Windows shims dir was exposed at
`/mnt/c/...` inside WSL, and gives a clean `<tool>: not found` when no
Linux tool is installed. `file`-mode shims are now also flagged
version-stale so a normal reshim regenerates them on upgrade
([#​10421](https://github.com/jdx/mise/pull/10421) by
[@​JamBalaya56562](https://github.com/JamBalaya56562),
addresses
[#​10299](https://github.com/jdx/mise/discussions/10299)).
- **file:** `make_symlink` on Unix now creates the link at a unique temp
name in the destination dir and atomically `rename(2)`s it into place.
This eliminates the noisy `failed to ln -sf … File exists (os error 17)`
warnings that surfaced when several mise processes (shell `hook-env`,
direnv, editor integrations) raced on the same tracked-config link, e.g.
when spawning a new git worktree
([#​10414](https://github.com/jdx/mise/pull/10414) by
[@​JamBalaya56562](https://github.com/JamBalaya56562),
fixes
[#​10292](https://github.com/jdx/mise/issues/10292)).
- **task:** On Windows, script-task lookup now prefers Windows-native
variants (e.g. `.ps1`) over their extensionless siblings, and
extensionless takeover only applies when the match is unambiguous and
stays within the same config family
([#​10443](https://github.com/jdx/mise/pull/10443) by
[@​jdx](https://github.com/jdx)).
#### Changed
- **deps:** Replaced the unmaintained `number_prefix`
(RUSTSEC-2025-0119) and stale `humansize` crates with `bytesize`. Size
strings in generated `tool-stub` comments and `mise cache prune` output
now use native `bytesize` IEC formatting — e.g. `821.69 KiB` becomes
`821.7 KiB` and `2.15 MiB` becomes `2.2 MiB`
([#​10438](https://github.com/jdx/mise/pull/10438) by
[@​risu729](https://github.com/risu729)).
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.6.9...v2026.6.10>
#### 💚 Sponsor mise
mise is built by [@​jdx](https://github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
</details>
<details>
<summary>jdx/mise-action (jdx/mise-action)</summary>
###
[`v4.2.0`](https://github.com/jdx/mise-action/releases/tag/v4.2.0):
: Bootstrap mode & wget fallback
[Compare
Source](https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0)
This release adds an opt-in **bootstrap mode** for projects that use
`mise bootstrap`, and makes the action work on runner images that ship
`wget` but not `curl`.
#### Added
##### Bootstrap mode
([#​522](https://github.com/jdx/mise-action/pull/522)) by
[@​jdx](https://github.com/jdx)
Three new inputs let the action drive `mise bootstrap` instead of `mise
install`:
```yaml
- uses: jdx/mise-action@v4
with:
bootstrap: true
bootstrap_skip: "tools,task" # comma-separated parts to skip
bootstrap_args: "--yes" # extra args forwarded to mise bootstrap
```
- When `bootstrap: true`, the action runs `mise bootstrap` under the
existing `install` gate and sets `MISE_EXPERIMENTAL=1` automatically.
- If a repo mise lock file is present, it runs `mise --locked
bootstrap`, matching the auto-lock behavior introduced for `mise
install` in v4.1.0.
- `install_args` cannot be combined with `bootstrap: true` — the action
fails fast and tells you to use `bootstrap_skip` / `bootstrap_args`
instead, because full bootstrap doesn't support partial tool install
args.
- A new `{{bootstrap_hash}}` template variable is included in the
default cache key (and available in custom `cache_key` templates) so
bootstrap and non-bootstrap configurations don't share caches.
`bootstrap_skip` relies on `mise bootstrap --skip` from
[jdx/mise#10497](https://github.com/jdx/mise/pull/10497), so
make sure you're on a recent mise version if you use it.
#### Fixed
- **Fall back to `wget` when `curl` is unavailable**
([#​521](https://github.com/jdx/mise-action/pull/521)) by
[@​risu729](https://github.com/risu729) — The action used
to hard-code `curl` for fetching the mise binary, tar/zip archives, and
the latest `VERSION` lookup, which broke on minimal runner images that
only ship `wget`. It now prefers `curl` and transparently falls back to
`wget`, preserving the streaming `download | tar` fast path for
`.tar.gz` and `.tar.zst` installs on Linux/macOS. Proxy support is
unchanged — both tools honor `HTTP_PROXY`/`HTTPS_PROXY`. Addresses
[jdx/mise#10488](https://github.com/jdx/mise/issues/10488).
#### Documentation
- Link the known Rust cache interaction note from the README
([#​496](https://github.com/jdx/mise-action/pull/496)) by
[@​risu729](https://github.com/risu729).
**Full Changelog**:
<https://github.com/jdx/mise-action/compare/v4.1.0...v4.2.0>
</details>
<details>
<summary>nodejs/node (node)</summary>
###
[`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0):
2026-06-18, Version 24.17.0 'Krypton' (LTS), @​aduh95
[Compare
Source](https://github.com/nodejs/node/compare/v24.16.0...v24.17.0)
This is a security release.
##### Notable Changes
- (CVE-2026-48618) tls: normalize hostname for server identity checks
(Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip
Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors
(Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory
growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo
Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes
(Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host
(Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2
– Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport
(RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent
(Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission
model (RafaelGSS) – Low
##### Commits
-
\[[`9e4dfc7bba`](https://github.com/nodejs/node/commit/9e4dfc7bba)]
- **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length
(Filip Skokan)
[nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
-
\[[`cb2aed980c`](https://github.com/nodejs/node/commit/cb2aed980c)]
- **deps**: update llhttp to 9.4.2 (Antoine du Hamel)
[nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
-
\[[`a8a0d12875`](https://github.com/nodejs/node/commit/a8a0d12875)]
- **(CVE-2026-48937)** **deps**: fix integration issues with the latest
nghttp2 (Tim Perry)
[#​62891](https://github.com/nodejs/node/pull/62891)
-
\[[`66e6203c1c`](https://github.com/nodejs/node/commit/66e6203c1c)]
- **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub
Bot) [#​62891](https://github.com/nodejs/node/pull/62891)
-
\[[`dd627ced27`](https://github.com/nodejs/node/commit/dd627ced27)]
- **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot)
[#​63820](https://github.com/nodejs/node/pull/63820)
-
\[[`684bae568f`](https://github.com/nodejs/node/commit/684bae568f)]
- **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub
Bot) [#​63820](https://github.com/nodejs/node/pull/63820)
-
\[[`3a631e7f83`](https://github.com/nodejs/node/commit/3a631e7f83)]
- **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse)
[#​62656](https://github.com/nodejs/node/pull/62656)
-
\[[`cf44df3996`](https://github.com/nodejs/node/commit/cf44df3996)]
- **deps**: update undici to 7.28.0 (Node.js GitHub Bot)
[#​63703](https://github.com/nodejs/node/pull/63703)
-
\[[`138c70294b`](https://github.com/nodejs/node/commit/138c70294b)]
- **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL
bytes (Matteo Collina)
[nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
-
\[[`be7e719c3f`](https://github.com/nodejs/node/commit/be7e719c3f)]
- **(CVE-2026-48931)** **http**: fix response queue poisoning in
http.Agent (Matteo Collina)
[nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
-
\[[`cc7c11b4d1`](https://github.com/nodejs/node/commit/cc7c11b4d1)]
- **(CVE-2026-48619)** **http2**: cap originSet size to prevent
unbounded memory growth (Matteo Collina)
[nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
-
\[[`9224427b92`](https://github.com/nodejs/node/commit/9224427b92)]
- **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel
errors (Matteo Collina)
[nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
-
\[[`cf85d54839`](https://github.com/nodejs/node/commit/cf85d54839)]
- **(CVE-2026-48935)** **permission**: disable FileHandle utimes with
permission model (RafaelGSS)
[nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
-
\[[`a1bbc24f96`](https://github.com/nodejs/node/commit/a1bbc24f96)]
- **(CVE-2026-48617)** **permission**: handle process.chdir on
writereport (RafaelGSS)
[nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
-
\[[`e3723ff2d6`](https://github.com/nodejs/node/commit/e3723ff2d6)]
- **test**: add session reuse host verification regressions (Matteo
Collina)
[nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
-
\[[`a77af4867b`](https://github.com/nodejs/node/commit/a77af4867b)]
- **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated
host (Matteo Collina)
[nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
-
\[[`31beb4f707`](https://github.com/nodejs/node/commit/31beb4f707)]
- **(CVE-2026-48928)** **tls**: fix case-sen
> ✂ **Note**
>
> PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tak848/dotfiles).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: tak-automation[bot] <221638520+tak-automation[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mise bootstrap --skip <part[,part...]>for selective bootstrap executionDetails
Supported skip parts are
packages,dotfiles,defaults,launchd,systemd,user,tools,task, andfinal-hook. Skipping a phase also skips its directly associated phase hooks.Validation
mise run test:e2e e2e/cli/test_bootstrapNote
Low Risk
Experimental bootstrap CLI change with guarded phase gating and e2e tests; no auth or data-path changes, though skip/dotfiles config-reload behavior is worth a quick review.
Overview
Adds
mise bootstrap --skip <part>so you can run bootstrap without every built-in step. Parts includepackages,dotfiles,defaults,launchd,systemd,user,tools,task, andfinal-hook; values can be repeated or comma-separated (e.g.--skip tools,task).Skipping a part skips that phase and its directly tied hooks (e.g. skipping
packagesskipspre-packages/post-packages). Skippingdotfilesstill reloads config after earlier phases (e.g. hooks that writemise.local.toml) so later steps see updated config. Skippingtoolsalso passesskip_toolsinto the bootstrap task runner so it does not auto-install tools before the task.Docs (
docs/bootstrap.md, CLI usage, man page, Fig completions) and e2e tests ine2e/cli/test_bootstrapcover the new behavior.Reviewed by Cursor Bugbot for commit 469abe3. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
New Features
--skipoption tomise bootstrapto omit specific bootstrap phases (packages, dotfiles, defaults, launchd, systemd, user, tools, task, final-hook). Supports repeated flags and comma-separated values (for example,mise bootstrap --skip tools,task).Documentation
--skip, including supported values and examples.Tests
Chores
--skipoption.