[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise	uses-with	patch	2026.10.23 → 2026.10.25	v2026.11.2 (+2)

---

Release Notes

jdx/mise

v2026.10.25: : Edit and remove tasks from the CLI, and mise watch --once

Compare Source

mise tasks can now add, change and remove tasks in a chosen config file without an editor, and mise watch --once waits for one change, runs the tasks and exits. Both suit scripts and coding agents. The release also adds opt-in env caching for configs with redacted values, and fixes concurrent installs, lockfiles in symlinked config dirs, slow reshims and signed macOS app bundles.

Added

• mise tasks set and mise tasks rm, plus more options for mise tasks add. #​15213 (@​jdx)

  • add, set and rm take the same --env, --global and --path flags as mise use, so you can pick the file they write to.
  • add and set take new task fields: --env-var, --tools, --usage and --confirm.
  • set changes only the fields you pass and keeps the rest of the file, comments included. --unset FIELD removes a field. It fails if the task doesn't exist.
  • rm (alias remove) deletes a TOML task's table or a file task's script. It asks for confirmation unless you pass --yes, and it refuses tasks inferred from package.json or defined in included files.
  • All three commands accept --json and --dry-run. If more than one loaded file defines a task, set and rm stop and list the files so you can choose one.
  • When add or set trusts the config root it writes to, it now says so on stderr.

  mise tasks add --env local deploy --env-var STAGE=prod --tools node@24 \
    --confirm "Deploy now?" -- ./deploy.sh
  mise tasks set build --description "Build for release" -- cargo build --release
  mise tasks rm --env local --yes scratch

• mise watch --once. mise waits for a change in the watched sources, runs the tasks once with mise run, and exits with their status. It uses the same filters as a normal watch and runs nothing at start, so --postpone is implied. Flags that only control how watchexec reruns the command, such as --restart and --clear, are refused with --once. Ctrl-C exits with 130. SIGTERM while waiting exits without running anything. A signal during the run stops the whole task process tree. mise watch also now passes --exit-on-error to watchexec, which stops at the first failed run and exits with its status. --exit-on-error requires watchexec 2.5.0 or later. #​15212 (@​jdx)

  mise watch test --once && echo "tests pass after the change"

• env_cache_redacted setting. With env_cache = true, mise never caches an environment that contains a redact = true directive, so a slow _.source script ran again on every prompt. The new opt-in env_cache_redacted setting (MISE_ENV_CACHE_REDACTED=1, default false) lets these environments be cached. Values stay masked in output when they are read from the cache. The tradeoff: the secret values are stored on disk, encrypted with a key that every process started from the activated shell inherits. age and sops values, plugin results with cacheable = false, redacted [vars], and redacted default/required directives are still never cached. With MISE_DEBUG=1, mise now logs when an environment wasn't cached and which directive prevented it. #​15200 (@​jdx, @​Achder)

  [settings]
  env_cache = true
  env_cache_redacted = true

• managed_by in bootstrap package status JSON. Installed brew-cask packages now report managed_by ("mise", "homebrew" or "unknown") in mise bootstrap packages status --json and mise bootstrap status --json. Scripts can use it to tell which casks mise will upgrade and which it leaves to Homebrew. #​15198 (@​jdx, @​drewbitt)

• Registry: added jouet, which installs from its signed packslip #​15201 (@​jdx)

Changed

• mise tasks add now accepts --force. Re-adding an identical task does nothing. Replacing a task that has a different definition without --force still works for now. mise will warn about it starting in 2027.5.0 and refuse it starting in 2028.5.0. Scripts that only run on current mise versions can add --force now. #​15213 (@​jdx)

Fixed

• Running several mise install processes at once could fail with errors like "Python graph installs require an installed interpreter", because one process saw a tool another process was still installing and treated it as complete. Installs and forced reinstalls now mark a version as incomplete before touching its directory. #​15196 (@​jdx, @​theredspoon)
• When ~/.config/mise is a symlink into a dotfiles checkout that has a config.override.toml, running mise install inside the checkout no longer makes mise.lock alternate between full and empty. #​15197 (@​jdx, @​ponko2)
• mise reshim, including the reshim at the end of mise install, no longer slows down quadratically with the number of tracked configs. On machines with thousands of tracked projects it could take minutes. #​15203 (@​jdx, @​Birzool)
• On macOS, signed .app bundles extracted from tarballs made with bsdtar are no longer killed on launch. mise now applies the ._* AppleDouble files to the files they belong to and then deletes them, as macOS tar does. #​15211 (@​jdx, @​jpeeler)
• A [bootstrap.repos] entry whose ref is an annotated tag now reports current once that tag is checked out. Before, it always reported differs, and every apply checked the tag out again. #​15199 (@​jdx)
• Dotfiles: replacing several tracked paths with the directory that contains them no longer leaves the directory stuck as "not applied here" with autosave stopped. #​15187 (@​jdx, @​drewbitt)
• Dotfiles: mise dot untrack with several paths now checks all of them before changing anything. Before, if a later path wasn't tracked, the command failed but had already stopped tracking the earlier paths. #​15208 (@​jdx, @​drewbitt)

Full Changelog: jdx/mise@v2026.10.24...v2026.10.25

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.24: : Container daemons, append-position PATH entries, and extra CA certificates

Compare Source

Experimental daemons can now run container images with Docker or Podman, and named preset ports can get their own port per worktree. This release also adds position = "append" for env._.path, an extra_ca_certs setting for TLS-inspecting proxies, and a registry_index option for locking pypi: tools. It fixes several lockfile, PyPI, Homebrew and task issues.

Added

• Container images as daemons (experimental). A custom daemon with an image key runs through docker run or podman run. It supports ports, readiness checks, depends, the proxy and mise daemons logs, just like other daemons. Every port is published on 127.0.0.1 only. Containers are named per project and worktree, so two checkouts never clash, and a stale container left behind by a killed run is removed before the next start. runtime = "auto" (the default) uses docker if it is on PATH, otherwise podman. You can set MISE_CONTAINER_RUNTIME to use any Docker-compatible CLI. data_mount bind-mounts a per-checkout data directory, and ready_cmd can use {{ runtime }}, {{ container }} and port placeholders. Limitations: mise does not pull or build images or start the Docker/Podman service, only TCP ports are supported, and starting a container daemon on Windows fails. #​15182 (@​jdx)

  [daemons.cockroach]
  image = "cockroachdb/cockroach:v25.1.0"
  command = ["start-single-node", "--insecure"]
  port = { auto = true, base = 26257 }
  ports.http = { container = 8080, auto = true, base = 27000 }
  data_mount = "/cockroach/cockroach-data"
  ready_cmd = "{{ runtime }} exec {{ container }} cockroach sql --insecure -e 'select 1'"

• Per-worktree named ports for daemon presets. Named preset ports such as http_port on cockroachdb or monitor_port on nats now accept { auto = true, base, stride }, just like the primary port. Each linked worktree adds its slot to the port's own base. Before, these ports were either fixed or offset from the preset default. When base is omitted, it defaults to the preset's port. Integer overrides still work as before. mise now reports a load error if an auto named port collides with another daemon's port in the same project. #​15181 (@​jdx)

  [daemons.cockroach]
  preset = "cockroachdb"
  version = "26"
  port = { auto = true, base = 26258 }
  ports.http_port = { auto = true, base = 27000 }

• position = "append" for env._.path. Appended entries go after tool paths and before the inherited PATH. This lets directories like ~/bin or ~/.cargo/bin stop shadowing tools that mise installs. The default is still "prepend". #​15158 (@​jdx, @​Mossop)

  [env]
  _.path = [
    "bin",
    { path = ["~/bin", "~/.cargo/bin"], position = "append" },
  ]

• extra_ca_certs setting. extra_ca_certs (MISE_EXTRA_CA_CERTS) points to a PEM bundle that mise trusts in addition to its usual roots, on every platform. Use it when you're behind a traffic-inspecting proxy such as Socket Firewall. It covers mise's own HTTP requests: downloads, version lookups, GitHub API calls, attestation checks and vfox plugins. Programs that mise runs, such as git and uv, keep using their own certificate settings. You can set it only in the environment or in global config. The path must be absolute or start with ~/. If the bundle is unusable, mise warns and keeps its usual roots. #​15171 (@​jdx, @​abjectnotfound)

  MISE_EXTRA_CA_CERTS=/etc/ssl/proxy-ca.pem mise install

• registry_index for pypi: tools. Set registry_index = "priority" to search a per-tool registry_url before PyPI when locking. This works for registries that host only your own packages, such as Gitea/Forgejo, pypiserver or a static index. The tool always comes from the registry, and only packages the registry doesn't have fall back to PyPI. The default, "default", keeps the current behavior: the registry replaces PyPI. #​15157 (@​jdx)

  [tools]
  "pypi:black" = { version = "25.9.0", registry_url = "<your-registry>/api/packages/org/pypi/simple/{}/", registry_index = "priority" }

• secret() in merge = "missing" dotfile entries. Tera templates in these entries can now call secret(). mise asks only for the secrets of keys missing from the target, so you can add a key to a private config later without entering the existing ones again. mise dot status and mise dot diff never read or prompt for a secret. Enforced merge = true entries still can't use secret(). #​15168 (@​jdx, @​thernstig)

• Danger Swift libraries. The danger-swift registry entry now uses Danger's official installer, so libDanger and the Swift modules are installed with the executable. You still need to install Node and Danger JS separately. #​15120 (@​Mostafa-Ashraf97)

Fixed

• Lockfiles
  • mise upgrade now updates every lock entry of a tool that is declared in more than one config file, such as config.toml and a conf.d fragment. Before, the old entry stayed in the lockfile and mise outdated kept offering the same upgrade. #​15164 (@​jdx, @​eliebleton-manomano)
  • http: tools with a file:// URL and no checksum install and lock again under the default lockfile_mode = "generate". mise now hashes the local file directly. #​15180 (@​jdx, @​hcrosse)
  • mise install no longer exits 1 when a git task include can't be loaded, for example a private repository in CI. It warns and leaves the lockfile unchanged. An explicit mise lock still fails. #​15166 (@​jdx)
• PyPI / pipx
  • mise lock now locks a pypi: tool's dependency graph with the selected Python, even when that Python isn't on PATH. If a per-tool python isn't installed yet, uv may download it for resolution only, unless offline is set. #​15153 (@​jdx)
  • Tools from registries that publish no upload times can now have their dependency graph locked when minimum_release_age is set. Dependencies still respect the cutoff. #​15159 (@​jdx)
  • Repos that lock the same tool and dependencies on different days now share one install instead of each creating its own copy. Each affected tool gets one new install the first time you install it after upgrading. #​15179 (@​jdx, @​tecnobrat)
• Homebrew
  • Source builds of tap formulae whose post_install uses Homebrew's MachO no longer fail. These steps are skipped with a warning. #​15152 (@​jdx)
  • install_symlink with a relative source, such as bin.install_symlink "foo" => "bar", now resolves against the target directory, as Homebrew does, instead of failing with different prefix. #​15173 (@​waynehoover)
  • Cask postflight hooks that use staged_path can now access the binary payload. This fixes installs such as brew-cask:dynatrace-oss/tap/dtctl. #​14837 (@​azohra)
• Tasks
  • A remote file task (one whose file is an HTTP URL) with its own env no longer fails with exit 127 when it runs as a sub-task or dependency. #​15178 (@​jdx)
  • mise now accepts comments in turbo.json, which is parsed as JSONC, and in global.json, which still rejects trailing commas. Before, a commented turbo.json printed a warning on every run and its task suggestions were dropped, and a commented global.json broke dotnet version detection. #​15141 (@​jdx)
• mise prune no longer removes tool versions that tasks still need when those tasks come from task_config.includes files, default task directories, or executable scripts with #MISE tools=.... #​15156 (@​jdx)
• latest for gem: tools no longer resolves to a RubyGems prerelease such as 4.1.0.beta3. To get prereleases, request one explicitly or set MISE_PRERELEASES=1. #​15143 (@​dennmart)
• When the active version doesn't provide a shim's executable, the error now names that version and the config that set it, and lists the installed versions that do provide it. Before, mise said "No version is set" and suggested switching versions with mise use -g. #​15165 (@​jdx, @​mzagaja)
• mise upgrade and mise outdated no longer say "All tools are up to date" when a version lookup fails. They now list the tools they could not check. #​15171 (@​jdx, @​abjectnotfound)

Changed

• Homebrew formulae are now resolved from the bulk formula.json index, with caching for tap metadata and cask evaluations. In one large setup, warm mise bootstrap packages upgrade --dry-run dropped from about 7.7s to 3.7s, and status from about 4.0s to 1.5s. The first run on a machine downloads the index once. #​15183 (@​waynehoover)

Deprecated

• lockfile_mode = "merge" is deprecated in favor of the default generate mode. Nothing changes yet. mise will start warning in 2027.4.0, and the mode will be removed in 2027.10.0. To migrate, delete the lockfile_mode = "merge" line (or unset MISE_LOCKFILE_MODE=merge). #​15184 (@​jdx)

Documentation

• The dotfiles docs now show how to use profile variants to apply an entry only when several environments are active. #​15154 (@​jdx, @​miroslavkrysl)

New Contributors

• @​nurazon59 made their first contribution in #​15167
• @​Mostafa-Ashraf97 made their first contribution in #​15120
• @​dennmart made their first contribution in #​15143

Full Changelog: jdx/mise@v2026.10.23...v2026.10.24

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SCANCLI-274

[gitar-bot]

CI failed: Both CI failures are infrastructure issues: mise failed to install Java (Temurin) because the Adoptium download returned HTTP 504 on Linux and Windows jobs, unrelated to the mise version bump in this PR; a secondary workflow template JSON error at .github/workflows/build.yml is likely a cascade and not independently established.

Overview

Two unique error templates across 2 logs (Linux QA and Windows jobs), both showing the same transient upstream failure. Both are assessed as infrastructure-related with high confidence and no evidence linking them to the PR.

Failures

Adoptium Temurin JDK download returned HTTP 504 (confidence: high)

• Type: infrastructure
• Affected jobs: 127300160956 (Linux QA - SQ LATEST_RELEASE, Java 11), 127300161044 (Windows, Temurin JDK 21)
• Related to change: no
• Root cause: mise attempted to download java@temurin from the Adoptium GitHub release URL and received HTTP status server error (504 Gateway Timeout) after retries. mise then reported installed 0 tools · 1 failed (Linux) or installed 1 tool · 1 failed (Windows) and exited with code 1. Maven installed successfully on Windows, so the mise version bump itself (2026.10.23 → 2026.10.25) did not break tool resolution; the failure is a remote server timeout.
• Suggested fix: Rerun the affected jobs once the Adoptium release endpoint is healthy. If the 504 persists, check access to that release URL or configure a reliable mirror.

Workflow template JSON error at .github/workflows/build.yml (confidence: medium)

• Type: other
• Affected jobs: 127300160956 (line 146), 127300161044 (line 197)
• Related to change: unclear
• Root cause: The runner reports The template is not valid... Error reading JToken from JsonReader. Path '', line 0, position 0. in both jobs. The logs show it after the failed mise step, so it appears to be a cascade, but the logs do not prove it is independent or dependent on the failure.
• Suggested fix: If the template error persists after Java installs successfully, inspect the workflow expressions at .github/workflows/build.yml lines 146 and 197 separately.

Summary

• Change-related failures: None. Neither log establishes that the mise bump from 2026.10.23 to 2026.10.25 caused a failure.
• Infrastructure/flaky failures: 2 jobs failed on the Adoptium HTTP 504 after retries. The template JSON error is probably a secondary effect.
• Recommended action: Rerun the workflow. If it fails again with the same template error after JDK setup succeeds, investigate .github/workflows/build.yml separately from this PR.

Code Review ✅ Approved

🟡 Medium risk · Updating mise from 2026.10.23 to 2026.10.25 changes CI tool setup behavior and could alter dependency installation or cause builds to fail.

Renovate bump of the jdx/mise dependency from 2026.10.23 to 2026.10.24 in the CI tooling. No issues found.

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 336: Update dependency mise to 2026.10.24 Inspected
PR 288: SCANCLI-232 Migrate the build from Maven to Gradle Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[zglicz]

Auto-approved: Renovate update.