[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise	uses-with	patch	2026.11.1 → 2026.11.2	v2026.11.6 (+3)

---

Release Notes

jdx/mise

v2026.11.2: : Task tags, summary output, JSON run reports, and mise run --at

Compare Source

This release adds four mise run features that help CI scripts and coding agents: tags for selecting tasks, a summary output style that only shows failures, a JSON run report, and --at for running tasks at another git revision. It also fixes problems with safe-mode lockfiles, symlink-each dotfiles, shims and shell completion.

Added

• Task tags. You can label tasks with tags, then run every task that has a tag with mise run --tag. A tag can be a string or a list. File tasks set them with #MISE tags=[...], and templates add their tags to the tasks that extend them. You can repeat --tag, and a task matches if it has any of the given tags. Dependencies run whatever their tags are. If you also give a pattern, such as mise run --tag slow 'test:*', mise runs only the matching tasks that have the tag. mise tasks ls --tag filters the task list, and tasks ls --json, tasks info and the MCP task list now include tags. #​15406 (@​jdx)

  [tasks."lint:docs"]
  run = "markdownlint docs"
  tags = ["lint", "docs"]
  
  [tasks."test:e2e"]
  run = "./e2e/run"
  tags = ["test", "slow"]

  mise run --tag lint
  mise tasks ls --tag slow

• summary task output style. mise holds each task's output until the task ends. A task that passed prints one line, such as [unit] passed in 4.2s. A task that failed prints everything it wrote. Tasks that mise stopped print [name] cancelled. This style is opt-in: use --output summary, MISE_TASK_OUTPUT=summary, task.output, or a task's output. mise keeps up to 64 KiB of output per task and drops the oldest output past that. A long-running task such as a dev server prints nothing until it exits, so give those tasks output = "interleave". #​15403 (@​jdx)

  $ mise run --output summary test
  [lint] $ cargo clippy -- -D warnings
  [lint] error: unused variable: `x`
  [unit] passed in 4.2s
  [lint] ERROR task failed

• JSON run reports. mise run --report-file <PATH>, or MISE_TASK_REPORT_FILE, writes a JSON report when the run ends. This happens whether the run passes, fails, is interrupted or hits --timeout.

  • The report has the run's status (passed, failed, cancelled or timed_out) and every scheduled task, dependencies included.
  • Each task has its status (passed, failed, cancelled, skipped, cached or not_run), exit code, duration and timestamps.
  • Task arguments are redacted the same way as in terminal output.
  • The flag can't be combined with --dry-run. Tasks don't inherit the variable, so a nested mise run can't overwrite the outer report.

  #​15405 (@​jdx)

• mise run --at REV. Runs tasks at another git revision without touching your checkout. mise checks the revision out into a temporary detached worktree, runs the task with that revision's own config and tasks, then removes the worktree. It also removes it after a failure, a timeout or Ctrl-C. --at-setup CMD prepares the worktree first, for example by installing dependencies.

  • Submodules are initialized.
  • Tasks and the setup command get MISE_RUN_AT_SOURCE (your checkout) and MISE_RUN_AT_REV (the commit).
  • Config at that revision gets your main checkout's trust, and you can't bypass this with a prompt or --yes.
  • Paranoid mode always refuses a config at that revision.

  #​15410 (@​jdx)

  mise run --at main test
  mise run --at HEAD~1 --at-setup "npm ci" test

Fixed

• Lockfiles and safe mode
  • MISE_SAFE=1 MISE_LOCKED=1 mise install works again for node, python and go when mise.lock has their checksums. It used to fail with "No lockfile URL found". These tools now work out their own download URL and check it against the locked checksum. If safe mode is the reason a URL is missing, the error now says so. #​15392 (@​jdx)
  • npm: tools locked through aube now install in safe mode and in untrusted projects. mise keeps the lockfile's dependency graph if it only fetches from the registry using integrity hashes. Graphs that name tarball URLs, git sources or local paths are still dropped. #​15401 (@​jdx)
  • mise lock java@temurin-27 no longer rewrites java = "temurin-26" to the broken temurin-temurin. It now writes temurin-27, with the same precision as the original request. Switching vendor at the same version, as in java@zulu-26, is saved too. #​15386 (@​jdx)
  • When mise lock tool@3.0.1 changes tool = "2" to tool = "3" in the config, the lockfile entry now records "3", the request the config holds, instead of "3.0.1". Before, later lookups for that request couldn't find the entry. #​15404 (@​jdx)
• Dotfiles and bootstrap
  • mise bootstrap now writes mise's own config files first and plans the rest of the dotfiles from the result, as mise dot apply already did. If a dotfile entry deploys a conf.d file, the entries in that file now apply in the same run, not the next one. --dry-run previews them as well. #​15387 (@​jdx, @​webkaz)
  • A symlink-each entry no longer writes through a directory symlink you made inside its target. That symlink is now reported as a conflict that needs --force. unapply also no longer deletes a directory symlink as if it were an empty folder. #​15399 (@​jdx)
  • On the first apply, a symlink-each source that contains a dangling symlink no longer loses its link right after creating it. #​15395 (@​jdx)
  • mise dot unapply --group and mise dot apply --prune now delete a group's leftover symlink-each state records once none of its links remain. #​15390 (@​jdx)
  • On a second machine whose local history holds no files, mise dot origin set now adopts the origin's history. It used to fail with "local and origin histories are unrelated". If origin set refuses to connect, it no longer writes [history.origin]. #​15394 (@​jdx)
  • History snapshots no longer start a git process for each encrypted tracked file. This speeds up mise bootstrap and the dotfile history commands when you have many encrypted files. #​15393 (@​jdx)
• Shims
  • On macOS, when a due tool_update.global_auto check ran from a shim, the tool was launched with mise's internal arguments (jq: Unknown option --id). mise now runs the update itself. #​15389 (@​jdx)
  • When the installed version ships other executables but not the one you called, as after mprocs was renamed to dekit, the shim and mise which errors no longer suggest a reinstall that can't help. They now show the error mprocs@0.10.3 does not provide mprocs (it provides: dekit), or name another installed version that does provide it. #​15388 (@​jdx)
• Completion
  • In mise x -- <cmd> <Tab>, every word after the command now completes file names, as it would in a plain shell. The same applies to mise dot capture --, mise bootstrap repos exec -- and mise ssh. #​15396 (@​jdx, @​Yasushi)
  • When a task has the same name as a built-in command, such as upgrade, completing mise up now shows the built-in command's description. mise run <TAB> still shows the task. #​15385 (@​jdx)
• Installs and config
  • Go tool installs now retry go install after temporary network errors from the module proxy or checksum database, using the http_retries setting. When the retries run out, mise shows the network error, not a misleading unknown revision. #​15384 (@​jdx)
  • On Windows, aqua raw downloads whose URL ends in .exe now keep the extension when the recipe sets complete_windows_ext: false. Before, aqua:SonarSource/sonarqube-cli installed sonar instead of sonar.exe. #​15412 (@​jdx)
  • mise no longer crashes with PermissionDenied if it can't resolve a config path. This happened on Windows inside workspace sandboxes. A config trusted outside the sandbox may show as untrusted inside it; MISE_TRUSTED_CONFIG_PATHS works around that. #​15383 (@​jdx)
  • With skills.auto_sync, a tool that only your global config declares no longer has its agent skills linked into every project as well. Global tools are linked only under your home directory. mise skills sync without --dir or --global follows the same rule. Links that are already in project directories stay until you run mise skills sync --prune. #​15391 (@​jdx)

Changed

• Registry: temporal now installs the Temporal CLI from aqua:temporalio/cli, which includes temporal server start-dev. Before, it installed the server bundle. If you need the server bundle, use mise use aqua:temporalio/temporal. #​15373 (@​jdx)
• Registry: odin on Windows now gets an odin shim. Before, only the bundled linker tools were shimmed. #​15400 (@​jdx)

Documentation

• The site search can now find individual keys on the mise.toml reference page, such as doctor.checks. #​15375 (@​jdx)

Full Changelog: jdx/mise@v2026.11.1...v2026.11.2

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SCANCLI-286

[gitar-bot]

Code Review ✅ Approved 🟡 Medium risk

Updating mise in three build workflows changes CI tool installation behavior, which could alter build setup or job outcomes.

Bumps the mise tool dependency from 2026.11.1 to 2026.11.2 in the CI configuration. The release adds task tags, summary output, JSON run reports, and mise run --at, along with safe-mode and dotfile fixes. No issues found.

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 348: Update dependency mise to 2026.11.2 Inspected
PR 288: SCANCLI-232 Migrate the build from Maven to Gradle Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[zglicz]

Auto-approved: Renovate dependency update.