[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
mise	patch	2026.10.18 → 2026.10.19	2026.10.23 (+3)

---

Release Notes

jdx/mise (mise)

v2026.10.19

Compare Source

🚀 Features

• (config) expose mise_config_dir to templates by @​jdx in #​14886
• (lsp) send semantic tokens for tasks, tools, env vars and templates by @​jdx in #​14918

🐛 Bug Fixes

• (lock) rebuild lockfiles completely by default by @​jdx in #​14893
• (pipx) list git+ssh github.com sources over ssh when GitHub can't see them by @​jdx in #​14905
• (python) stop uv_venv_auto from fork-bombing through python shims by @​jdx in #​14927
• (task) apply extended template usage to file tasks by @​jdx in #​14888
• (task) quote and escape header values written by tasks add --file by @​xucian in #​14925
• (uninstall) remove installs whose directories deny their owner writes by @​HengYangDS in #​14883
• (upgrade) don't downgrade date-versioned tools with leading zeros by @​jdx in #​14923

📚 Documentation

• tell agents not to edit the vendored aqua registry by @​jdx in #​14910

🧪 Testing

• update e2e expectations after version validation moved earlier by @​jdx in #​14920
• pin java relock e2e to a fully published Temurin line by @​jdx in #​14940

📦️ Dependency Updates

• bump ctutils to 0.4.5 by @​jdx in #​14887
• update aube to v2.8.2 by @​renovate[bot] in #​14889
• update rust crate clx to v3.0.5 by @​renovate[bot] in #​14890
• ignore RUSTSEC-2026-0387 in cargo-deny by @​jdx in #​14939

Ci

• retry snapcraft upload on transient store errors by @​jdx in #​14909

Security

• (backend) keep untrusted values out of subprocess arguments and the project directory by @​jdx in #​14896
• (backend) keep archive contents and release asset names inside the install directory by @​jdx in #​14895
• (backend) validate versions and names that become paths or URL segments by @​jdx in #​14901
• (backend) tighten SLSA signer and GitHub attestation checks by @​jdx in #​14904
• (backend) make SLSA, attestation and signed-checksum checks fail closed by @​jdx in #​14908
• (backend) reject SLSA provenance built from another tag by @​jdx in #​14924
• (completion) stop shell completion from running untrusted task code by @​jdx in #​14898
• (config) tie trust to the right files for worktrees, symlinks and config dirs by @​jdx in #​14902
• (config) close safe-mode gaps for lazy tools, deps, S3, bin_path and templates by @​jdx in #​14900
• (config) stop treating help, shims, hooks and config writes as consent to trust by @​jdx in #​14903
• (config) keep untrusted repo content from hanging or crashing hook-env by @​jdx in #​14916
• (github) send forge tokens only to their API host and harden release caches by @​jdx in #​14913
• (hooks) render hook commands once and keep templates out of written versions by @​jdx in #​14897
• (http) bound response, download and archive sizes and slow response bodies by @​jdx in #​14915
• (install) enforce pinned checksums and node signatures instead of falling back by @​jdx in #​14899
• (lockfile) stop lockfiles, tool stubs and the task cache from reaching outside the repo by @​jdx in #​14906
• (packslip) pin signers by repository ID and stop release-age backdating by @​jdx in #​14912
• (task) close sandbox escapes in --allow-write, --deny-net and --deny-write, and OCI whiteouts by @​jdx in #​14911
• keep credentials out of install paths, lockfiles, logs and redirects by @​jdx in #​14917

New Contributors

• @​xucian made their first contribution in #​14925
• @​HengYangDS made their first contribution in #​14883

📦 Aqua Registry Updates

New Packages (5)

• Future-Element/pinset
• bronto-community/bronto-cli
• faberlang/releases/faber
• muvon/octomind
• pratyay360/ensor

Updated Packages (5)

• anomalyco/opencode
• duckdb/duckdb
• grafana/gcx
• grafana/mcp-grafana
• magefile/mage

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SCANDOCKER-99

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating the mise version in both build workflow jobs changes CI tool provisioning and could alter installed tool behavior or build outcomes.

Bumps the mise tool dependency from 2026.10.18 to 2026.10.19 in the scanner CLI Docker image. No issues found.

Verification Rules 3/3 met PRs 1 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 329: SCANDOCKER-91 Validate the Docker image using trivy Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[zglicz]

Auto-approved: Renovate dependency update.