chore(deps): update github-actions by renovate[bot] · Pull Request #1996 · immich-app/devtools

renovate · 2026-10-13T00:23:35Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/download-artifact	action	patch	`v8.0.1` → `v8.0.2`
actions/upload-artifact	action	patch	`v7.0.1` → `v7.0.2`
jdx/mise	uses-with	patch	`2026.10.0` → `2026.10.4`	`v2026.10.8` (+3)
jdx/mise-action	action	minor	`v5.0.1` → `v5.1.1`	`v5.1.2`

Release Notes

actions/download-artifact (actions/download-artifact)

`v8.0.2`

Compare Source

What's Changed

Update the readme by @danwkennedy in #473
Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Update @actions/artifact to 6.3.1 by @tunc-d in #492
Prepare download-artifact v8.0.2 by @tunc-d in #493

New Contributors

@tunc-d made their first contribution in #492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact (actions/upload-artifact)

`v7.0.2`

Compare Source

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in #821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

jdx/mise (jdx/mise)

`v2026.10.4`: : Task-scoped fnox secrets, automatic global tool updates, and an opt-in identity install layout

Compare Source

This release adds experimental task-scoped secrets backed by fnox, automatic updates for global tools, and an experimental opt-in install layout that names installations by what they contain. It also adds dotfile merge entries, headers auth for the http: backend, npm installs from git, and a set of prune, install and lockfile fixes.

Added

Secrets (experimental)

These need mise settings experimental=true and fnox 1.39.0 or newer. They are refused in safe mode.

[secrets.fnox] and mise secrets ls. A project can name fnox as its secrets source in its own mise.toml. mise secrets ls lists key names and metadata but never values. -J prints JSON. Global, system and home-level [secrets] config is ignored, and mise doctor reports it. #13967
Tasks get only the secrets they list. Add secrets = [...] to a task, or #MISE secrets=[...] in a file task header. Only that task gets the values, only while it runs, and they are redacted from its output. Dependencies, hooks, mise env, hook-env and shims get nothing. A task without grants never calls fnox. Tasks that list secrets need a trusted config, aren't artifact-cached, and ignore --raw unless the task sets raw or interactive. Hooks, watch_files, daemons and mise bootstrap can't run them, and remote or global-config tasks can't list secrets. #13974
```
min_version = "2026.10.4"   # older mise rejects `secrets` on a task

[secrets.fnox]
profile = "prod"

[tasks.deploy]
depends = ["build"]                       # build receives nothing
secrets = ["DEPLOY_KEY", "DATABASE_URL"]
run = "./deploy.sh"
```
One-off grants from the command line. --secrets KEY[,KEY] and --secrets-all work on mise run, mise tasks run and mise x. For mise run, only the tasks named on the command line get them, not their dependencies. mise x gets nothing unless you pass a flag, and it can't receive file secrets. Flags placed after the task name go to the task, and mise warns when that happens. #13975
```
mise run --secrets STRIPE_KEY deploy
mise x --secrets GH_TOKEN -- gh release list
```
{{ secrets.X }} in task env values. A task can build an env var from a secret, for example env.PGURL = "postgres://app:{{ secrets.DB_PASSWORD }}@db/app". The reference counts as the grant. References are rejected in run, [env], [vars] and other fields. #13978
fnox daemon cache. If the project's fnox config enables the daemon and it's running, an interactive run reads cached values over its socket without starting an fnox process. mise never starts the daemon itself. CI, non-TTY runs and Windows always use the fnox CLI. #13979

Automatic global tool updates

auto_update for global tools. Set auto_update on a tool in your global config. When a shim or mise x is about to run that tool and its check interval is due, mise upgrades it within the configured range and then runs the new version. true uses the new tool_update.check_duration setting (default 24h), and a duration string sets that tool's own interval (minimum 1h). #14026
- Exact pins never update.
- It never runs offline, in CI, with locked = true, from tasks or hook-env, or from project configs.
- If an update fails, mise warns and runs the installed version. The failure shows in mise doctor.
```
# ~/.config/mise/config.toml
[tools]
claude = { version = "latest", auto_update = true }
node = { version = "22", auto_update = "6h" }   # newest 22.x, never 23
```
Background tool-update service. A built-in bootstrap service checks auto_update tools hourly, so launches don't wait for downloads and tools run directly from PATH under activation also stay current. It installs a systemd user unit, LaunchAgent or scheduled task. #14040
```
[bootstrap.services.mise-tool-update]
builtin = "tool-update"
```

Identity install layout (experimental, opt-in)

install_layout = "identity". With experimental = true, each installation lives in installs/<label>-<hash>/. The hash covers the canonical backend, version, platform and install-affecting options. installs/<tool>/<version> becomes a link to that directory, a real junction on Windows. As a result: #13951
- age and aqua:FiloSottile/age share one installation.
- Variants of one version with different options can exist side by side.
- Windows IDEs can follow the version links.
Existing installs keep working and aren't moved. Nothing changes unless you set this. MISE_INSTALL_LAYOUT=identity also turns it on. See the new install layout docs.
On Windows, identity-layout installations go into the shorter %LOCALAPPDATA%\mise\i\, while version links stay in installs\. MISE_INSTALL_STORE_DIR sets the location on any platform. #13952
mise installs ls lists installations as selected, pinned or shared. mise installs select <dir> chooses which installation requests without a lockfile use. When several installations match and none is selected, mise lists them instead of guessing. #13953
mise installs migrate [--dry-run] [TOOL[@VERSION]] reinstalls legacy installations into the new layout and leaves a link at the old path. If a run is interrupted, the next run recovers it. #13955
In the layout, mise backends switch installs the new backend's version and points the link at it. mise where and the other commands now resolve versions named on the command line the same way, and mise where lists variants instead of picking one. #13957
mise prune handles templated tool versions such as node = "{{ vars.node }}". It uses snapshots of what each project last rendered and keeps installs when it isn't sure they are unused. #14025

Other additions

Dotfile merge entries. A merge = true entry sets only the keys from its source in a JSON, TOML or YAML file, and leaves keys added by the application (Codex, Claude Code, etc.) alone. TOML and YAML keep comments and formatting. mise dot status and mise dot diff only report drift in those keys. A target that doesn't parse is never overwritten. #14012
```
[dotfiles]
"~/.codex/config.toml/shared" = { source = "codex/shared.toml", merge = true }
```
headers for the http: backend. You can now authenticate with bearer tokens or API keys, for example to download OCI blobs from ghcr.io. Values are templates. Headers are sent with downloads, version_list_url and checksum_url requests, and dropped on cross-host redirects unless the host is listed in headers_forward. Changing a token doesn't trigger a reinstall. #14022
```
[tools."http:polaris"]
version = "0.9.2"
headers = { Authorization = "Bearer {{ env.GITHUB_TOKEN | b64_encode }}" }
```
npm packages from git. git+ URLs and github:, gitlab: and bitbucket: specs now install. The version is a git ref, and latest is the default branch. #14044
```
mise use 'npm:github:owner/repo@v1.2.0'
```
settings.write_targets. Sends new global [tools], [bootstrap.packages] and [dotfiles] entries to separate conf.d files. Existing entries are updated where they're already declared. #14018
```
[settings.write_targets]
tools = "~/.config/mise/conf.d/10-tools.toml"
dotfiles = "~/.config/mise/conf.d/30-dotfiles.toml"
```
prune.exclude (or MISE_PRUNE_EXCLUDE) lists tools that mise prune, mise ls --prunable and upgrade pruning never remove. Short and full names both work, e.g. node or aqua:BurntSushi/ripgrep. #14030
lockfile_auto_prune = false keeps lockfile entries for tools missing from the active config. This is useful when profiles share one lockfile. The default (true) keeps the current pruning behavior. #13980
mise dot notify sends a test desktop notification, which also triggers the macOS permission prompt. mise doctor and mise dot status now show whether notifications can be delivered. #14009

Changed

mise's own auto-update settings moved under self_update.*. auto_update is now self_update.auto (MISE_SELF_UPDATE_AUTO), and auto_update_check_duration is now self_update.check_duration (MISE_SELF_UPDATE_CHECK_DURATION). The old names keep working. The new key wins when both are set. Deprecation warnings start in 2027.4.0. Older mise versions ignore a settings file that has unknown self_update keys, so keep the old spelling if a config has to work with both. #14038
mise prune, mise unuse --prune, mise ls --prunable and deferred pruning after an upgrade now keep any version a running process was started from, on Linux, macOS and Windows. They say which process kept it. #14020
pypi:/pipx: tools installed with uv are now built on mise's Python when mise manages one. Previously uv could use its own downloaded interpreter, which broke CI caches that only restore the mise data dir. A package whose requires-python excludes mise's Python now fails; to override, pass --python in uvx_args. #14024
With python.uv_venv_auto, mise install now creates the project venv with mise's Python instead of whatever uv found. #13981 by @halms
Inherited secrets: when a parent mise marks variables as secrets in __MISE_SECRET_KEYS, a nested mise now does the following #13966:
- redacts them from logs
- hides them from templates, get_env() and exec()
- disables the env cache
- keeps them out of __MISE_DIFF, other tasks and pitchfork
mise x and shims still pass them through.

Fixed

Install state
- A failed tool-level postinstall hook no longer leaves its version listed as installed or selectable. The next install retries it. #14037
- Incomplete-install markers moved from the cache to $MISE_STATE_DIR, so mise cache clear no longer makes a half-installed version look installed. Existing markers are migrated. #14051
Lockfiles and backends
- mise install --locked now works for dotnet: tools. #13971 by @james-newell-forge
- mise lock for pypi: tools on registries with a <root>/pypi/{}/json template, such as Artifactory, now uses <root>/simple/. #14007 by @deiga
- Parallel cargo: installs that fall back to cargo install no longer corrupt the shared rustup toolchain. #14042
- mise upgrade --bump and mise outdated --bump no longer rewrite vendor-only requests like java = "temurin" to a bare version from another vendor. #14031
- A registry move within the same backend kind, such as vfox:mise-plugins/* to vfox:jdx/*, no longer triggers the backend-switch warning or appears in mise backends switch or mise doctor. #14032
- mise doctor only warns about a backend mismatch when the registry's backend actually serves the installed version. It now suggests mise backends switch. #14005
- mise uninstall --dry-run lists each version once. #13992
Network
- Downloads are retried when an HTTP/2 stream reset breaks reading the response body. #14049
- mise no longer retries a 429 whose Retry-After is longer than the backoff. #14027
- Fewer duplicate requests: concurrent callers share one fetch of a cached GitHub release, and packslip release lists are read once per command. #13990, #13991
- mise oci push uploads layers larger than 64 MiB in a single streamed PATCH. GHCR previously rejected these with 416. #14017
GitHub attestations
- mise warns when some attestations were skipped because the Sigstore or GitHub TUF trust root couldn't be reached, even if verification passed on the others. #14036
- Attestations that failed partway are now logged at debug level. #14035
Config and bootstrap
- A project's ignored_config_paths no longer hides your global config when ~/.config/mise is a symlink into that project. A global config can no longer be ignored only through its symlink target. #14006
- mise bootstrap no longer fails with another history operation is running when it has no file history to record. Parallel CI jobs that share a state dir no longer block each other. #14029
Dotfiles
- Conflicting declaration errors now explain when a source file is missing. #13973 by @himkt
- Group entries no longer go through legacy link discovery. #14023
Secrets, MCP and tasks
- Secrets are fully redacted when redaction values overlap. #13962
- The MCP run_task tool rejects task names that start with a dash. #13961
- The mise://tasks MCP resource now lists tasks from monorepo subprojects. #14053
Changing a Ruby version file that a Gemfile references no longer prints a watch_file hook has neither run nor task set warning. #13985 by @DahanItamar

Documentation

url_replacements docs now include a package proxy example. #14050

Breaking Changes

mise secrets is now a built-in command. If you have a task named secrets, run it with mise run secrets. #13967

New Contributors

@james-newell-forge made their first contribution in #13971
@deiga made their first contribution in #14007
@DahanItamar made their first contribution in #14034

Full Changelog: jdx/mise@vfox-v2026.10.3...v2026.10.4

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

`v2026.10.3`: : Dotfile groups, templated Compose projects, and secret hygiene for shell state

Compare Source

This release adds dotfile groups for Stow-style dotfiles repositories, templated [bootstrap.compose] values, and custom labels for task confirm prompts. Secret values no longer get copied into __MISE_DIFF/__MISE_SESSION or written to the env cache. It also fixes dotenv ${VAR} expansion, mise x tool@latest reporting other tools as missing, and Ruby source builds ignoring depends tools.

Added

Dotfile groups. You can now declare a directory tree as a group with [dotfile_groups.<name>], using one directory per app or machine role like GNU Stow. mise walks the group's root and deploys each file to the same path under target (default ~), so you don't have to list files one by one. A machine picks which groups to apply with [bootstrap] dotfile_groups. If that list isn't set, every group applies. #13945
```
[dotfile_groups.home]
root = "home"            # relative to dotfiles.root
dot_prefix = true        # dot-config/ deploys as .config/
exclude = ["README.md"]

[dotfile_groups.home.entries]
"~/.config/kitty" = { mode = "symlink" }                            # link this directory whole
"~/.gitconfig" = { source = "git/config.tmpl", mode = "template" }

[bootstrap]
dotfile_groups = ["home", "zsh"]
```
- Groups support mode (symlink-each by default, or copy or symlink), exclude, dot_prefix, manifest and relative. A [dotfile_groups.<name>.entries] table uses the same syntax as [dotfiles] and removes those paths from the walk, so you can link a directory whole, render a template, or mark a file absent.
- If two selected groups write the same file, apply and status fail before anything is written, and the error names both groups.
- mise records what each group deployed under $MISE_STATE_DIR/dotfiles/groups/. mise dot status shows files that no active entry deploys any more as orphaned. mise dot apply --prune removes them after asking you, and mise dot unapply --group <name> removes one group's files even after the group is gone from config. mise only removes links that still point at their source and copies that still match what it wrote, unless you pass --force.
- mise dot add and mise dot edit put files under a group's target into that group's root, and both accept --group when more than one group could match.
- mise oci build does not include group trees.
Templates in [bootstrap.compose]. Every string field in a Compose project, including project_dir, files, env_files, command and depends_on, is now rendered as a Tera template in the context of the config that declares it. Shared configs can use {{ config_root }}, {{ vars.* }} or {{ env.* }} instead of hardcoded absolute paths. exec() isn't allowed in these templates. #13938
```
[bootstrap.compose.mempalace]
project_dir = "{{ config_root }}/mempalace"
files = ["compose.yaml"]
env_files = [".env"]
```
Custom labels for task confirm prompts. The object form of confirm now accepts yes and no labels, which support the same templates as message. default is now optional and still defaults to yes. Piped answers still take y/n, and --yes still skips the prompt. #13944
```
[tasks.deploy]
confirm = { message = "Deploy to production?", yes = "Deploy", no = "Cancel", default = "no" }
run = "deploy.sh"
```

Fixed

Dotenv ${VAR} expansion checks the file's own values first. Before, ${VAR} in a dotenv file read the process environment first. With mise activate exporting another .env, a reference could expand against the shell instead of an earlier line in the same file. Now the file's own earlier assignments come first, then values already loaded (with expand = true) or the process environment. The ${VAR:-default}, ${VAR:+alt} and ${VAR:?message} forms now work too. When the env_file setting hits a syntax error, mise keeps the assignments it read before the error and shows one warning for the file. #13946
mise x tool@latest no longer reports other tools as missing. Passing any @latest argument used to resolve every configured tool against its newest release and ignore the lockfile, so tools that were installed and locked showed up as missing. Now only the tools named on the command line resolve to latest. #13943
Ruby source builds can see depends tools. ruby-build now gets the declared dependencies on PATH. For example, JRuby builds use a mise-managed java instead of the system JDK. PATH stays the same when no dependencies are declared. #13942 by @seuros

Security

No extra plaintext copies of secrets. #13950
- Shell state: __MISE_DIFF and __MISE_SESSION are passed to every child process. They now store a blake3: digest of each value mise sets instead of the value itself. The previous (old) values are still stored in plain text because mise needs them to restore the environment. These are plain hashes, not keyed ones, so a low-entropy value could be brute-forced from its digest.
- Env cache: mise no longer writes environments that contain secrets to the env cache. This covers age values (also when used through [vars]), sops-encrypted _.file entries, any directive with redact = true, and env modules that return cacheable = false. Before, a non-tool module's cacheable = false was ignored.
- Env module redact: a redact setting on an env module, such as _.my-plugin = { redact = false }, now overrides the plugin's own preference. Before, it was ignored. A non-boolean value is now a config error.
- mise x -- fish: env values no longer go in fish's command-line arguments, where ps could read them. --deny-env now applies there too.
- Upgrading: shells started with an older mise still restore their environment correctly. mise rewrites their state in the new format at the next prompt.

Registry

Added jactionlint (github:jdx/jactionlint), a maintained fork of actionlint with upstream fixes and new checks. actionlint is now deprecated, with a message pointing to jactionlint. Existing actionlint installs keep working. #13960

Documentation

The installation guide shows how to pin the packslip bootstrapper while letting mise install the latest release. The Docker cookbook has a new multi-stage Debian example with a digest-pinned packslip image. #13935

Full Changelog: jdx/mise@vfox-v2026.10.2...v2026.10.3

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

`v2026.10.2`: : Experimental spinel backend, typed tool options in the schema, and daemon presets on Windows

Compare Source

This release adds an experimental spinel: backend for compiling Ruby CLIs to native binaries. The mise.toml schema now checks each backend's own tool options, and daemon presets work on Windows. It also includes fixes for shell activation with untrusted configs, task timeouts and Windows quoting.

Added

Experimental spinel: backend. It builds a Ruby command-line tool from a GitHub repository into a native executable using Spinel, Matz's Ruby AOT compiler. Versions come from git tags through git ls-remote, so listing them doesn't call the GitHub API. Available options: entrypoint, bin, tag_prefix, source_ref and spinel. You need the spinel compiler on PATH (mise doesn't install it yet) and mise settings experimental=true. It works on macOS and Linux only, and it may be removed later if it becomes a maintenance burden. Based on nateberkopec/mise-backend-spinel. #13922
```
[tools."spinel:tobi/try"]
version = "1.10.1"
entrypoint = "try.rb"
bin = "try"
tag_prefix = "v"
```
Typed tool options in the JSON schema. Editors that use schema/mise.json now validate and autocomplete options for each backend, based on the tool's prefix. This covers github, gitlab, forgejo, ubi, http, s3, aqua, cargo, npm, pypi/pipx, gem, go, conda, spm, packslip and spinel. It also covers core-tool options for python, java, rust and dotnet, per-platform overrides (platforms.<os>-<arch>) and [tasks.*.tools] tables. For example, a numeric asset_pattern or java release_type = "stable" is now flagged. Boolean options accept true/false, "true"/"false" and 1/0, the same values mise accepts. lazy_bins accepts a single string. The deprecated experimental_monorepo_root key is allowed again. Runtime behavior is unchanged, but your editor may now flag mistakes in existing configs. #13924
Daemon presets on Windows. mise daemons start no longer refuses preset daemons on Windows. Every preset except redis, which has no Windows build, now runs under pitchfork's default cmd /C shell. For PostgreSQL to stop cleanly, you need pitchfork 2.29.0 or later. PostgreSQL also won't start from an elevated prompt. Windows reserves some port ranges for Hyper-V and WSL, so a preset's default port can be blocked. If it is, set a different one with ports. #13929 by @JamBalaya56562
```
[daemons.db]
preset = "postgres"
version = "18"
options = { database = "app" }
```
Install mise with packslip. The installation guide now covers installing mise's signed release without running an install script. packslip verifies the Sigstore signature and the archive digest. mise self-update works with this install method. #13710
```
packslip install github.com/jdx/mise --pin ps1_nlhmwtfeufglxv5myvwvronk7a
```

Fixed

Config and activation

An untrusted project config no longer breaks shell activation. Before, mise hook-env failed completely, so tools and env from your trusted global config were not applied either. Now it skips the untrusted file, prints the usual one-time warning and loads everything else. Explicit commands such as mise run and mise x still error on untrusted configs. #13919
A failed settings reload is reported as an error instead of crashing. Commands such as mise install, mise use, mise upgrade and mise ls-remote --prerelease reload settings partway through. Before, a failed reload aborted mise with SIGABRT and a core dump. Now mise prints failed to reload settings with the cause and keeps using the previous settings. #13925
--no-config and MISE_NO_CONFIG=1 now skip .miserc.toml discovery. Before, a malformed project, global or system miserc broke commands like mise --no-config version. #13926 by @donbeave

Tasks

A timed-out task fails even if it exits cleanly. On Unix, a task that caught SIGTERM and exited 0 after its timeout was reported as successful. Now mise run reports timed out and exits non-zero. #13930 by @Marukome0743
Timed-out tasks on Windows can clean up. When a task hits its timeout, mise now sends it Ctrl+C and gives it 5 seconds before ending its process tree, the way Unix uses SIGTERM followed by SIGKILL. For example, PowerShell finally blocks now run. Only the timed-out task gets the Ctrl+C. The whole-run mise run --timeout still stops tasks immediately on Windows. #13889 by @JamBalaya56562

Windows

mise exec -- cmd /c keeps double quotes. Before, mise exec -- cmd /c 'echo "a b"' printed \"a b\". Pitchfork daemons with mise = true whose run contained a quote, such as a quoted program path with a space, also failed to start. mise now passes a single quoted command after /c or /k to cmd unchanged. #13887 by @JamBalaya56562
Task daemons with init steps start under cmd.exe. Before, they failed with 'exec' is not recognized. On Windows, mise now builds the command with cmd quoting and escaping. Write init steps as cmd commands. #13928 by @JamBalaya56562

Other

packslip follows repositories that moved to a new owner. mise now treats a transfer like a rename, matching on repository ID with a one-time warning. It still refuses a different repository that reuses a deleted repository's name. Refusal messages now tell you which records to clear: mise packslip forget, the tool's mise.lock entries, or both. Existing pins and lockfile entries still load. #13710
mise dot save and history sync work after a tracked directory is replaced by a symlink. Before, they failed while reading older checkpoints. #13931

Registry

helmfile (1.8.1 and later) and dagu (2.18.0 and later) now install from signed packslip manifests. Older versions still install through aqua:. To list them, run mise ls-remote aqua:helmfile/helmfile or mise ls-remote aqua:dagucloud/dagu. #13933
New aqua packages: goccy/tobari, ymmt2005/pbschema-lens.

Full Changelog: jdx/mise@v2026.10.1...v2026.10.2

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

`v2026.10.1`: : Task timeout and Ctrl-C fixes, Windows daemon and shim fixes

Compare Source

This release is mostly bug fixes. mise run now stops tasks properly when --timeout expires or you press Ctrl-C. Task daemons and native shims work better on Windows. core:rust now follows mise.lock and picks up new stable and beta toolchains. Lockfile, GitHub asset selection, Homebrew cask and plugin update problems are also fixed.

Fixed

Tasks

mise run --timeout now stops the tasks it was running. Before, mise printed the timeout error and exited, but the task processes could keep running in the background. Now the whole-run timeout (--timeout or the task.timeout setting) stops tasks the same way a per-task timeout does. On Unix, mise sends SIGTERM and then SIGKILL after 5 seconds. On Windows, it runs taskkill /F /T. Tasks with raw = true are not stopped by the whole-run timeout. #13876 by @Marukome0743
A single Ctrl-C lets tasks shut down cleanly. Before, one Ctrl-C could make mise exit right away while tasks were still cleaning up. This happened in three cases: a task that runs mise run itself got SIGINT twice; a tool like docker compose up treated the duplicate SIGINT as a force-quit; and a task that exits non-zero on SIGINT caused mise to send SIGTERM to its sibling tasks. Now mise waits for tasks to finish and then exits with status 130. A second Ctrl-C still force-quits. #13904
Tab completion for the :task shorthand. In a monorepo, mise run :<TAB> now suggests tasks from the current config root, and task flags complete after the shorthand. #13882 by @pikeas

Daemons

Task daemons start on Windows. A daemon declared with task = failed under cmd /C with 'exec' is not recognized. mise now registers it as an argv command that pitchfork starts without a shell, so args reach the task exactly as written on every platform. This needs pitchfork 2.28.0 or later. With an older pitchfork, mise shows an error that tells you to upgrade, for example with mise use pitchfork@latest. Task daemons that use init still run through a shell, so they still don't work under cmd /C. #13714 by @JamBalaya56562
Daemon run commands can use [env] and [vars]. Before, a template such as {{ vars.test_var }} failed with Variable 'vars' is not defined. mise x now renders the command when the daemon starts, using the project's [env], [vars] and mise template filters. Pitchfork's own variables, such as {{ name }}, still work. This applies only to run and requires a pitchfork release newer than 2.29.0. #13894
```
[vars]
greeting = "it's"

[daemons.hello]
run = "exec echo {{ vars.greeting | quote }} from {{ name }}"
```

Windows shims

No more endless process chains from duplicate shim copies. If two copies of mise-shim.exe were on PATH (for example, one from winget's Links directory), they could keep calling each other through mise x. Running mise-shim by its own name now exits with an error. If mise x resolves a tool to another shim copy, mise stops after one step and names the PATH directory to remove. #13681 by @JamBalaya56562
Node IPC works through the node.exe shim. A Node parent that spawned the shim with an 'ipc' stdio entry used to wait forever. JSON IPC messages and disconnects now pass through the shim. Passing socket or server handles over the channel is still not supported. #13903

Rust

mise upgrade rust updates stable and beta. mise didn't recognize rustup 1.29's new update available: text. Even when it detected an update, the upgrade skipped the toolchain as already installed. mise now reads both spellings, counts only updates for the toolchain it manages, and updates the toolchain in place. If the update fails, the old toolchain stays usable. #13898
core:rust follows mise.lock. mise mistook rustup's symlinks for mise linked versions, so it ignored the lockfile and installed the newest version even with locked = true. #13915

Backends, lockfiles and bootstrap

GitHub auto-detection no longer installs metadata files. SBOMs, signatures, checksums and other sidecar files with platform names, such as *.tar.gz.sbom.json, could be chosen as the tool and saved to mise.lock. Automatic selection now skips them. Explicit url and asset_pattern options are unchanged. #13908
mise lock removes outdated duplicate entries. After you changed a tool option, for example by adding uvx = false to a pipx: tool, mise lock --upgrade could leave the old unbound entry next to the new bound one. Unfiltered mise lock runs now remove the old entry, unless it has platform data (checksum or URL) that the new entry doesn't have. #13909
Aqua registry cache errors after upgrading. Compiled registry caches from earlier versions could load but then fail when a package was resolved. mise now ignores those caches and rebuilds them. #13884
Packslip installs retry missing skills. If the binary installed but a declared skill couldn't be fetched, mise still marked the install as complete. Now the install fails with an error. The next mise install fetches only the missing skills and doesn't reinstall the tool. #13885
Pkg-based brew-cask packages are no longer reinstalled on every run. Casks such as google-drive list package IDs for several architectures, and mise expected every one of them to be installed. Receipts now store only the patterns that match on your machine. Casks recorded by earlier versions are reinstalled once to write a corrected receipt. #13893
mise plugins update works when the remote isn't named origin. This happens, for example, when git's clone.defaultRemoteName is set to something else. mise uses origin if it exists and otherwise uses the first remote. #13914

Changed

mise skills sync, the table output of mise skills ls, and other human-facing messages now show paths under your home directory with ~. This includes output from mise deps install, task source lines, mise completion --install and daemon messages. --json output and script-oriented commands still print full paths. #13910

Full Changelog: jdx/mise@vfox-v2026.10.0...v2026.10.1

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

jdx/mise-action (jdx/mise-action)

`v5.1.1`: : GitHub token is no longer exported to later steps by default

Compare Source

mise-action no longer exports its GitHub token as MISE_GITHUB_TOKEN to every later step in the job. A new persist_github_token input lets you turn that back on, or pass a different token to later steps. This changes the default behavior. If later steps need the token, see Breaking Changes below.

Fixed

The GitHub token now stays inside the action by default. Before this release, the github_token input (which defaults to ${{ github.token }}) was written to GITHUB_ENV as MISE_GITHUB_TOKEN. That let any later step read the token and call the GitHub API with the job's permissions, even if the step never asked for a credential. Now the token is set only for the mise-action step and the processes it starts. The action masks the token in logs. (#658 by @jdx, reported in #657)

Added

persist_github_token input (default false). It takes one of three values:
- false: the token stays inside the action.
- true: the token the action used is exported to later steps. If env.MISE_GITHUB_TOKEN is already set, it takes precedence over github_token.
- A token value: that token is exported to later steps instead, for example a read-only token. The action still installs tools with github_token, or with MISE_GITHUB_TOKEN if it's already set.
Setting false doesn't clear a MISE_GITHUB_TOKEN that was already set at the job level or exported by an earlier step. (#658 by @jdx)

Breaking Changes

Check your workflow if a later step needs MISE_GITHUB_TOKEN, such as mise shims, mise exec, mise run or lazy tool installs that call the GitHub API. Those steps no longer get the token automatically and may hit GitHub API rate limits. To get the old behavior back, opt in:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: true

Or give later steps a separate token:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: ${{ secrets.READ_ONLY_TOKEN }}

Full Changelog: jdx/mise-action@v5.1.0...v5.1.1

`v5.1.0`: : Tool version outputs, plugins input, and cached mise reuse

Compare Source

mise-action now reports the tool versions it installed as step outputs, can install mise plugins before tools, and can save the cache at the end of the job. Several caching fixes stop the action from downloading mise again on every run.

Added

Tool versions as step outputs. After install, the action runs mise ls --json --current and sets a versions output. This is a JSON object of the active, installed tools. Each tool maps to a list of {version, requested_version, install_path, source} entries. Each tool also gets its own output with its resolved version, such as steps.mise.outputs.node. A tool only gets its own output if its name is a valid output name and isn't cache-hit or versions. Names like npm:@scope/pkg appear only in versions. If the action can't read the versions, it prints a warning and the step still succeeds. (#655 by @jdx)
```
- uses: jdx/mise-action@v5
  id: mise
- run: echo "node ${{ steps.mise.outputs.node }}"
```
plugins input. List plugins one per line as name or name url. Blank lines and # comments are ignored. The action runs mise plugins install -y for each one before mise install. Plugins that are already installed, for example restored from the cache, are left as they are. An unknown plugin fails the step. When plugins is set, its hash is added to the default cache key. Custom cache_key templates can use it as {{plugins_hash}}. If plugins is unset, existing cache keys don't change. (#656 by @jdx)
```
- uses: jdx/mise-action@v5
  env:
    # needed for idiomatic files such as .yvmrc
    MISE_IDIOMATIC_VERSION_FILE_ENABLE_TOOLS: yarn
  with:
    plugins: |
      yarn
      php https://github.com/verzly/mise-php#latest
```
cache_save_post input (opt-in, default false). When enabled, the mise cache is saved in the action's post step instead of right after install. This way, tools installed by later steps are included in the cache, for example from monorepo sub-project configs or task-level tools. The setting only applies on a cache miss, because an existing cache entry can't be overwritten. The post step runs even if a later step fails. If the post-step save fails, the action prints a warning and the job doesn't fail. (#649 by @jdx)
auto_update input (default false). See Changed below. (#642 by @jdx)
The action now warns when you use the mise_toml input and a .mise.toml already exists in the working directory. mise loads .mise.toml before the mise.toml the action writes, so the input may have no effect. (#654 by @jdx)

Changed

A cached mise is kept when version is unset. Before, each new mise release made the action reject the cached binary in integrity verification and download mise again on every run until the cache key changed. Now the cached binary is kept until the cache key changes. The action verifies it against the signed checksums of the version recorded at install, without running it first. Caches saved before this release have no version record, so they are still verified against the latest release, and a tampered binary is still replaced. The integrity warning now includes the underlying error. To keep updating to newer releases as before, set auto_update: true. Each updated binary is cached under its own mise version, so each release is downloaded only once. An explicit version input works the same as before. (#642 by @jdx)

Fixed

The cache is saved after a partial-match restore. When the cache was restored from a key that only matched the prefix, the action never saved under the primary key, so it rebuilt the same tools on every run. Exact cache hits still skip the save. (#646 by @jdx)
Caches saved before this release no longer cause a download on every run. These caches have no version record, so a cached binary is verified against the latest release. Once a newer mise shipped, the action downloaded mise again on every run. It now also saves the reinstalled binary in a cache keyed by mise version, so later runs restore that binary instead of downloading it. (#648 by @jdx)
Windows: mise installs without unzip. The mise zip is now extracted with PowerShell's Expand-Archive. Self-hosted Windows runners that don't have unzip, such as fresh Windows 11 arm64 machines, can now install mise. (#650 by @jdx)

Documentation

New README guides cover matrix builds, using another cache action, and Rust caching:
- Matrix builds: use MISE_<TOOL>_VERSION overrides and give each matrix entry its own cache_key.
- Other cache actions: set cache: false and cache mise's data directory yourself.
- Rust: explains why a restored cache can be missing Rust components such as rustfmt, with two workarounds. (#654, #651 by @jdx)

Full Changelog: jdx/mise-action@v5.0.1...v5.1.0

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 9am on tuesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

futo-kritika · 2026-10-13T00:24:49Z

Kritika Review

Updates GitHub Actions and mise while preserving token persistence.

No findings

Confidence 4/5 · medium risk: No findings were reported, and the added persist_github_token: true keeps the previous token-export behavior that the failing assertion depended on. The account does not weigh that choice against the upstream change, which removed the token export on purpose, and it does not check that the new action SHA and mise version match the release notes.

Approved

Findings

Earlier findings (1 resolved)

[important · tests] actions/use-mise/action.yml:13 Update the token assertion for mise-action's new default · resolved

Summary

The dependency updates retain pinned action commits and a pinned mise version. The added persist_github_token setting preserves the existing token-persistence contract and aligns with the workflow’s later-step assertion.

Commands offered: curl, fd, gh, jq, rg, yq; none run.

_{Reviews (2) · Last reviewed commit: "fix: persist github token in use-mise" · openai/gpt-6.1-sol · $0.17}

renovate · 2026-10-13T07:47:05Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

futo-kritika

kritika: confidence 4/5 with medium risk at 14c4ec3.

chore(deps): update github-actions

1ae5ada

renovate Bot added changelog:skip dependencies renovate labels Oct 13, 2026

futo-kritika Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread actions/use-mise/action.yml

bo0tzz approved these changes Oct 13, 2026

View reviewed changes

fix: persist github token in use-mise

14c4ec3

futo-kritika Bot approved these changes Oct 13, 2026

View reviewed changes

bo0tzz merged commit 1b2100d into main Oct 13, 2026
19 checks passed

bo0tzz deleted the renovate/github-actions branch October 13, 2026 07:50

This was referenced Oct 13, 2026

chore(main): release multi-runner-build-workflow 4.1.0 #1912

Open

chore(main): release image-build-action 0.1.12 #2006

Open

chore(main): release use-mise-action 3.2.3 #2007

Merged

Navigation Menu

Repository navigation

chore(deps): update github-actions - #1996

chore(deps): update github-actions#1996
bo0tzz merged 2 commits into
mainfrom
renovate/github-actions

renovate Bot commented Oct 13, 2026

Uh oh!

futo-kritika Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

renovate Bot commented Oct 13, 2026

Uh oh!

futo-kritika Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 13, 2026

Release Notes

v8.0.2

What's Changed

New Contributors

v7.0.2

What's Changed

New Contributors

v2026.10.4: : Task-scoped fnox secrets, automatic global tool updates, and an opt-in identity install layout

Added

Secrets (experimental)

Automatic global tool updates

Identity install layout (experimental, opt-in)

Other additions

Changed

Fixed

Documentation

Breaking Changes

New Contributors

💚 Sponsor mise

v2026.10.3: : Dotfile groups, templated Compose projects, and secret hygiene for shell state

Added

Fixed

Security

Registry

Documentation

💚 Sponsor mise

v2026.10.2: : Experimental spinel backend, typed tool options in the schema, and daemon presets on Windows

Added

Fixed

Config and activation

Tasks

Windows

Other

Registry

💚 Sponsor mise

v2026.10.1: : Task timeout and Ctrl-C fixes, Windows daemon and shim fixes

Fixed

Tasks

Daemons

Windows shims

Rust

Backends, lockfiles and bootstrap

Changed

💚 Sponsor mise

v5.1.1: : GitHub token is no longer exported to later steps by default

Fixed

Added

Breaking Changes

v5.1.0: : Tool version outputs, plugins input, and cached mise reuse

Added

Changed

Fixed

Documentation

Configuration

Uh oh!

futo-kritika Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kritika Review

Findings

Summary

Uh oh!

Uh oh!

renovate Bot commented Oct 13, 2026

Edited/Blocked Notification

Uh oh!

futo-kritika Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v8.0.2`

`v7.0.2`

`v2026.10.4`: : Task-scoped fnox secrets, automatic global tool updates, and an opt-in identity install layout

`v2026.10.3`: : Dotfile groups, templated Compose projects, and secret hygiene for shell state

`v2026.10.2`: : Experimental spinel backend, typed tool options in the schema, and daemon presets on Windows

`v2026.10.1`: : Task timeout and Ctrl-C fixes, Windows daemon and shim fixes

`v5.1.1`: : GitHub token is no longer exported to later steps by default

`v5.1.0`: : Tool version outputs, plugins input, and cached mise reuse

futo-kritika Bot commented Oct 13, 2026 •

edited

Loading