Skip to content

fix(deps): update dependency jdx/mise to v2026.4.28#65

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/jdx-mise-2026.x
Open

fix(deps): update dependency jdx/mise to v2026.4.28#65
renovate[bot] wants to merge 1 commit intomainfrom
renovate/jdx-mise-2026.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 8, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change Pending
jdx/mise patch 2026.4.11 → 2026.4.28 2026.5.5 (+5)

Release Notes

jdx/mise (jdx/mise)

v2026.4.28

Compare Source

🐛 Bug Fixes
  • (copr) remove stale pinned image digest and rebuild copr image on Dockerfile changes by @​bestagi in #​9451
  • (task) avoid gix panic when cloning a remote task by commit SHA by @​jdx in #​9473

v2026.4.27

Compare Source

🚀 Features
🐛 Bug Fixes
  • (backend) Don't cache empty version lists by @​c22 in #​9444
  • (shims) compare PATH entries case-insensitively on macOS by @​jdx in #​9468
  • (task) preserve essential env vars under deny_env on Linux by @​jdx in #​9467
Chore
New Contributors
📦 Aqua Registry Updates
New Packages (7)
Updated Packages (5)

v2026.4.25

Compare Source

🚀 Features
🐛 Bug Fixes
📚 Documentation
  • (site) add self-hosted page tracker via Cloudflare Worker, drop GoatCounter by @​jdx in #​9430
New Contributors

v2026.4.24

Compare Source

🚀 Features
  • (ls-remote) add prereleases setting and --prerelease flag by @​jdx in #​9415
🐛 Bug Fixes
  • (http) retry transient HTTP failures with backoff and warn on rescue by @​jdx in #​9414
  • (release) purge mise.en.dev CDN zone after each S3 publish by @​jdx in #​9416
📚 Documentation

v2026.4.23

Compare Source

🚀 Features
🐛 Bug Fixes
📦️ Dependency Updates
📦 Registry
Chore
New Contributors

v2026.4.22

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
🧪 Testing
📦 Aqua Registry

Updated aqua-registry: v4.498.0 -> v4.499.0.

Included aqua-registry releases:

v2026.4.21

Compare Source

🚀 Features
  • (registry) add --security flag to include security info in JSON output by @​jdx in #​9364
🐛 Bug Fixes
📚 Documentation
📦️ Dependency Updates
📦 Registry
Chore
  • (npm-publish) use aube publish instead of npm publish by @​jdx in #​9328
New Contributors

v2026.4.20

Compare Source

🐛 Bug Fixes
🚜 Refactor
📚 Documentation
📦️ Dependency Updates
Chore
📦 Aqua Registry

Updated aqua-registry: v4.492.0 -> v4.498.0.

Included aqua-registry releases:

v2026.4.19

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
📦️ Dependency Updates
📦 Registry
Chore
New Contributors
📦 Aqua Registry Updates
New Packages (3)
Updated Packages (3)

v2026.4.18

Compare Source

🚀 Features
🐛 Bug Fixes
  • (backend) skip versions host for direct-source backends by @​jdx in #​9245
  • (github) route artifact attestation verification to custom api_url by @​jdx in #​9254
  • (lockfile) use unique temp file for atomic save to avoid concurrent rename race by @​jdx in #​9250
  • (log) drop noisy third-party debug/trace logs by @​jdx in #​9248
  • (progress) disable animated clx output in ci by @​jdx in #​9249
  • (use) honor --quiet and --silent flags by @​jdx in #​9251
  • (vfox) opt backend plugins out of --locked URL check by @​jdx in #​9252
📦 Registry
New Contributors

v2026.4.17

Compare Source

🐛 Bug Fixes
🚜 Refactor
📚 Documentation
📦️ Dependency Updates
📦 Registry
New Contributors
📦 Aqua Registry Updates
New Packages (3)
Updated Packages (1)

v2026.4.16

Compare Source

🚀 Features
🐛 Bug Fixes
📚 Documentation
📦️ Dependency Updates
📦 Registry
New Contributors
📦 Aqua Registry Updates
New Packages (3)
Updated Packages (2)

v2026.4.15

Compare Source

🐛 Bug Fixes
📚 Documentation
📦 Registry
New Contributors
📦 Aqua Registry Updates
Updated Packages (2)

v2026.4.14

Compare Source

Chore

v2026.4.13

Compare Source

🐛 Bug Fixes
📦️ Dependency Updates
New Contributors

v2026.4.12

Compare Source

🚀 Features
🐛 Bug Fixes
📚 Documentation
📦 Registry
Chore
New Contributors
📦 Aqua Registry Updates
New Packages (7)
Updated Packages (3)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 8, 2026 •
edited
Loading

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates mise from v2026.4.11 to v2026.4.28, spanning 17 patch releases. Analysis of the release notes reveals the following key changes:

Major Bug Fixes:

  • HTTP Resilience (v2026.4.24): Added retry logic with jittered backoff for transient HTTP failures during tool downloads, improving reliability in flaky network conditions
  • Empty Version Cache Fix (v2026.4.27): Fixed cache poisoning issue where empty version lists prevented future version resolution
  • Remote Task SHA Handling (v2026.4.28): Fixed panic when cloning remote tasks by commit SHA
  • COPR Docker Build (v2026.4.28): Fixed stale Docker image digest issues in Fedora COPR pipeline

Security & Stability Improvements:

  • PATH Recursion Fix (v2026.4.27): Fixed macOS shim recursion with case-insensitive PATH comparison to prevent infinite loops
  • Sandbox Environment (v2026.4.27): Fixed critical regression where deny_env=true stripped essential environment variables (PATH, HOME) on Linux
  • Lockfile Safety (v2026.4.25): Fixed concurrent lockfile writes using atomic temp files to prevent race conditions
  • Symlink Handling (v2026.4.23): Stopped rewriting healthy runtime symlinks during installs

New Features (Non-Breaking):

  • npm Package Manager Options (v2026.4.27): Added install options for npm package managers
  • Pre-release Support (v2026.4.23-24): Added opt-in pre-release version support for GitHub and Aqua backends
  • Task Enhancements (v2026.4.25-27): Various task system improvements including dependency watching
  • Registry Updates: Multiple aqua registry package additions and updates

Breaking Changes:
None identified. All changes maintain backward compatibility.

Security Fixes:
No critical security vulnerabilities were patched, but several stability and robustness improvements were made to prevent panics, cache poisoning, and environment isolation issues.

🎯 Impact Scope Investigation

Current Usage in Codebase:

  1. Dockerfile (Line 6): MISE_VERSION=2026.4.28 - Version is updated here
  2. Docker Build Stage: mise binary downloaded from GitHub releases and installed in Alpine-based image
  3. Tool Installation: mise used to install Node.js, Ruby, Go, Python, and Rust runtimes with specific versions
  4. CI/CD (.github/workflows/ci.yml): Uses jdx/mise-action@v4.0.1 for GitHub Actions integration
  5. Development (mise.toml): Defines tool versions for local development

Usage Patterns:

  • mise use -g <tool>@<version> - Global tool installation (5 instances in Dockerfile)
  • mise settings ruby.compile=false - Runtime-specific settings (1 instance)
  • Download from GitHub releases API (Dockerfile line 9)

Impact Assessment:

  • ✅ Docker Build: No impact. The update only changes the mise binary version; all tool installation commands remain compatible
  • ✅ CI/CD: No impact. The GitHub Action version (v4.0.1) is separate from the mise binary version
  • ✅ Local Development: No impact. The mise.toml configuration format is unchanged
  • ✅ Runtime Installation: No breaking changes to mise use or mise settings commands
  • ✅ Binary Download: The GitHub release distribution method remains unchanged

Dependency Analysis:

  • No changes to Go module dependencies
  • No changes to nsjail configuration
  • No changes to language runtime versions (Node, Ruby, Go, Python, Rust)
  • mise acts as a standalone binary installer with no code-level integration

Configuration Impact:

  • No changes required to mise.toml
  • No changes required to Dockerfile installation logic
  • No changes required to CI/CD workflows

💡 Recommended Actions

Pre-Merge:

  1. ✅ Automated Testing: Rely on existing CI/CD pipeline:

    • Unit tests will verify Go code compatibility
    • E2E tests will verify Docker build and runtime installations
    • Build job will confirm Docker image builds successfully with new mise version

  2. ✅ No Manual Changes Required: The diff shows only the version number change, which is correct

Post-Merge:

  1. Monitor CI/CD pipeline for any unexpected issues during Docker build
  2. Verify that all language runtimes install successfully in the Docker image
  3. No rollback plan needed - reverting the version number is trivial if issues arise

Benefits of This Update:

  • Improved HTTP download reliability with retry logic (helps with flaky networks during CI builds)
  • Fixed cache poisoning issues that could affect version resolution
  • Better stability with lockfile handling and symlink management
  • Enhanced robustness against panics in edge cases

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants