[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise-action	action	patch	v5.2.0 → v5.2.1	v5.2.3 (+1)

---

Release Notes

jdx/mise-action

v5.2.1: : Require the signed packslip for mise 2026.9.3 and later

Compare Source

The action now refuses to install mise 2026.9.3 or later if the release's signed packslip is missing. This closes a gap where verification could be downgraded to the weaker checksum check.

Fixed

• A missing packslip no longer weakens the check on recent mise releases. v5.2.0 started checking the mise binary against the release's signed packslip.sigstore.json. If that file wasn't found, though, the action quietly fell back to the minisign-signed SHASUMS256 checksums. Anyone who could hide the file could force the weaker check. Every mise release from 2026.9.3 on includes a packslip, so for those versions a missing bundle now stops the install with an error like this:

  mise v2026.10.11 must ship a signed packslip, but https://github.com/jdx/mise/releases/download/v2026.10.11/packslip.sigstore.json was not found
  

  Releases before 2026.9.3 don't include a packslip, so they're still checked against the signed checksums. A version string that isn't three dot-separated numbers also requires a packslip. If you set the sha256 input, it still takes precedence over both checks. A packslip that fails verification still never falls back to the checksums. (#​695 by @​jdx)

Full Changelog: jdx/mise-action@v5.2.0...v5.2.1

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7233

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating the pinned mise action makes CI require signed packslips for recent releases, so missing bundles could prevent configured tool installations and fail jobs.

Updates the jdx/mise-action GitHub Action from v5.2.0 to v5.2.1 in the workflow configuration. The new version requires a signed packslip for mise 2026.9.3 and later, closing a path where verification could fall back to the weaker checksum check. No issues found.

Verification Rules 1/3 met

Rules 2 failed 1 passed

❌ Approved GitHub Actions runners - Retired label sonar-xs-public is used in build.yml (line 484) and PrepareNextIteration.yml (line 13); replace with sonar-xs (policy: https://xtranet-sonarsource.atlassian.net/wiki/spaces/Platform/pages/3694231566/GitHub+Actions+Runners+-+GitHub).
❌ Repository license compliance - LICENSE.txt contains SONAR Source-Available License v1.0, but the central exception for sonar-java requires LGPL-3.0 in LICENSE.txt; this is unrelated to the PR's changes and needs maintainer confirmation.
✅ Internal artifact registries

Functional validation No results

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.