[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
mise	patch	2026.10.7 → 2026.10.9	2026.10.14 (+4)

---

Release Notes

jdx/mise (mise)

v2026.10.9

Compare Source

🚀 Features

• (bootstrap) add apt repositories and PPAs with [bootstrap.apt.sources] by @​jdx in #​14306
• (bootstrap) embed apt source signing keys inline in .sources files by @​jdx in #​14348
• (bootstrap) render templates in [bootstrap.repos] checkout paths by @​jdx in #​14359
• (bootstrap) declare macOS login items by @​jdx in #​14354
• (bootstrap) layer dnf packages with rpm-ostree on Fedora Atomic hosts by @​jdx in #​14357
• (bootstrap) support run0 and doas for privilege elevation by @​jdx in #​14351
• (dotfiles) show tracked entries that no variant selects in status by @​jdx in #​14266
• (dotfiles) group mise dot status into sections by @​jdx in #​14361
• (github) add oauth_copy_code to copy the device code to the clipboard by @​jdx in #​14269
• (github) keep the native OAuth refresh token in a password manager or keychain by @​jdx in #​14360
• (http) add libc() and avx2() template functions by @​jdx in #​14298
• (pypi) read upload times from PEP 691 simple indexes by @​jdx in #​14352
• (rust) download rustup-init from RUSTUP_UPDATE_ROOT by @​jdx in #​14356

🐛 Bug Fixes

• (aqua) warn once for packages with no repo to list versions from by @​jdx in #​14336
• (backend) keep decoded download file names inside the download directory by @​JamBalaya56562 in #​14274
• (bootstrap) support dnf package groups by @​jdx in #​14347
• (bootstrap) don't print a stdin-only helper as a manual command by @​jdx in #​14350
• (bootstrap) explain why dnf packages cannot install on ostree hosts by @​jdx in #​14353
• (brew) install bottle etc files and run post_install_steps when pouring by @​jdx in #​14272
• (brew) refuse to chown a prefix owned by another user by @​jdx in #​14345
• (brew) preserve protected post-install copy destinations by @​jdx in #​14311
• (brew-cask) support generate completions in evaluated casks by @​pmmmwh in #​14255
• (docker) install libatomic1 in the Debian image so Node.js 26 runs by @​jdx in #​14303
• (dotfiles) keep existing ciphertext when an encrypted file is unchanged by @​jdx in #​14300
• (dotfiles) stop a newly selected profile from deleting its shared file by @​jdx in #​14275
• (dotfiles) restore config entries when adopting under a symlinked home by @​jdx in #​14315
• (dotfiles) show per-file diffs for directory copy entries in dot diff by @​jdx in #​14333
• (dotfiles) apply mise's own config before planning the other entries by @​jdx in #​14339
• (go) read an exact go line in go.mod as the toolchain version by @​jdx in #​14308
• (http) retry artifact downloads started by mise exec and shims by @​jdx in #​14342
• (npm) resolve unlocked latest to the npm version of a graph-locked install by @​jdx in #​14307
• (npm) give unlocked requests their own install under the identity layout by @​jdx in #​14309
• (oci) ignore host apt hooks when installing apt bootstrap packages by @​jdx in #​14296
• (packslip) let a workflow list carry the signer pin across a workflow move by @​jdx in #​14338
• (packslip) keep a renamed project's lockfile signer under packslip 1.7 by @​jdx in #​14362
• (prune) keep a uv-locked pipx tool's installs for every Python by @​jdx in #​14335
• (prune) keep versions of task-scoped tools by @​jdx in #​14334
• (schema) accept [bootstrap.secrets] by @​JamBalaya56562 in #​14322
• (schema) accept [bootstrap.groups] and [bootstrap.users] by @​JamBalaya56562 in #​14340
• (schema) accept table forms for vars..file and vars..source by @​JamBalaya56562 in #​14383
• (shim) keep other projects' command wrappers on reshim by @​jdx in #​14355
• (task) bump gix so remote tasks work in git hooks by @​any-victor in #​14316
• hide the Windows console for the tool-update service by @​jdx in #​14344

🚜 Refactor

• replace serde_yaml with serde-saphyr by @​jdx in #​14328

📚 Documentation

• (bootstrap) explain when to use --from versus --adopt by @​jdx in #​14301
• (bootstrap) recommend fish = "auto" for fish shell activation by @​jdx in #​14304
• (dotfiles) explain when to use sync, pull, and apply by @​jdx in #​14343
• (shims) explain how to check whether a tool is installed by @​jdx in #​14337
• switch body text to DM Sans and tighten the releases page by @​jdx in #​14302
• self-host DM Sans and JetBrains Mono so they load on mise.jdx.dev by @​jdx in #​14310

🧪 Testing

• (bootstrap) don't depend on bc being absent in the apt sources test by @​jdx in #​14371

📦️ Dependency Updates

• install Homebrew uses_from_macos dependencies on Linux by @​itskyf in #​14288
• bump packslip to 1.7.0 by @​jdx in #​14363
• lock file maintenance by @​renovate[bot] in #​14320
• update github actions by @​renovate[bot] in #​14380
• update dependency python to v3.14.8 by @​renovate[bot] in #​14381
• update rust crates by @​renovate[bot] in #​14382
• update docker images by @​renovate[bot] in #​14379

📦 Registry

• install opencode 2 from npm by @​jdx in #​14295

Chore

• (ci) switch to jactionlint v2 and drop zizmor by @​jdx in #​14256
• fix CI for the aqua registry update and the unsafe-libyaml advisory by @​jdx in #​14326

Ci

• double the unit-macos job timeout by @​jdx in #​14346

Security

• (config) require trust for path: tool versions by @​jdx in #​14358

New Contributors

• @​pmmmwh made their first contribution in #​14255
• @​itskyf made their first contribution in #​14288

📦 Aqua Registry Updates

New Packages (3)

• Alice39s/xmtr
• bufbuild/protoschema-plugins/protoc-gen-jsonschema
• takumin/qemu-bin

Updated Packages (3)

• bootandy/dust
• connectrpc/connect-go/protoc-gen-connect-go
• sharkdp/hyperfine

v2026.10.8

Compare Source

🚀 Features

• (runtime-symlinks) add a global link to the version global config selects by @​jdx in #​14271

🐛 Bug Fixes

• (history) skip rewriting unchanged checkpoint metadata on index rebuild by @​jdx in #​14249
• (http) retry when a response body drops mid-stream by @​JamBalaya56562 in #​14253
• (lock) decode percent-encoded release tags when checking a locked URL by @​jdx in #​14252
• (schema) accept outputs = { auto = false } on tasks by @​JamBalaya56562 in #​14265

📚 Documentation

• (dotfiles) add a recommended setup and a readable modes-and-keys table by @​jdx in #​14267

🧪 Testing

• (http) stop the allow_html test waiting out the https retry by @​jdx in #​14285

📦 Registry

• test ansible, azure and dvc against python 3.14 by @​jdx in #​14268

📦 Aqua Registry Updates

New Packages (2)

• runxhq/runx
• takumin/passt-bin

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: PLUGINAPI-247

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating mise in build and promotion workflows changes CI tool resolution, which could alter builds or release artifacts if tool behavior differs.

Bumps the mise dependency from 2026.10.7 to 2026.10.8, a patch release with bug fixes for history, HTTP retries, lock handling, and schema validation. No issues found.

Verification

Functional validation No results

Rules 3 not applicable

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube