chore(deps): pin tool installs and add a uv wait period

.mise/tasks/python_min_version

@@ -1,4 +1,4 @@
-#!/usr/bin/env -S uvx --with packaging python
+#!/usr/bin/env -S uvx --with packaging==26.3 python
 # mise description="Print the minimum Python version from pyproject.toml requires-python"
 import tomllib
 from packaging.specifiers import SpecifierSet

mise.toml

@@ -4,7 +4,7 @@ adr-tools = "3.0.0"
 "github:minamijoyo/hcledit" = "v0.2.18"
 gh = "2.102.0"
 jq = "1.8.2"
-"pipx:keyring" = { version = "25.7.0", uvx_args = "--with keyrings.google-artifactregistry-auth" }
+"pipx:keyring" = { version = "25.7.0", uvx_args = "--with keyrings.google-artifactregistry-auth==1.1.2" }
 trivy = "0.76.0"
 uv = "0.13.4"
 

pyproject.toml

@@ -112,6 +112,7 @@ dev = [
 
 [tool.uv]
 required-version = ">=0.13.4" # CVE-2025-54368, GHSA-w476-p2h3-79g9, GHSA-pqhf-p39g-3x64
+exclude-newer = "5 days" # Same wait as minimumReleaseAge in renovate.json
 override-dependencies = [ # https://github.com/astral-sh/uv/issues/4422
     "nbconvert>=7.17.1",    # fix for CVE-2025-53000
     "pytest>=9.0.2",        # pytest-md-report depends on pytest<9 unnecessarily

renovate.json

@@ -23,6 +23,18 @@
     "enabled": true,
     "schedule": ["before 5am on monday"]
   },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": [
+        "Pinned PyPI packages in mise tasks, for example: uv tool install keyring==25.7.0 --with pkg==1.2.3.",
+        "This repo is public, so the org custom managers do not apply here."
+      ],
+      "managerFilePatterns": ["/^tasks\\.toml$/", "/^mise\\.toml$/", "/^\\.mise/tasks//"],
+      "matchStrings": ["(?<depName>[A-Za-z0-9][A-Za-z0-9._-]*)==(?<currentValue>\\d[^\\s\"]*)"],
+      "datasourceTemplate": "pypi"
+    }
+  ],
   "packageRules": [
     {
       "description": [
@@ -69,7 +81,7 @@
     },
     {
       "groupName": "mise tools",
-      "matchManagers": ["mise"],
+      "matchManagers": ["mise", "custom.regex"],
       "separateMajorMinor": false
     }
   ]

tasks.toml

@@ -26,7 +26,7 @@ uv run deptry src
 [install]
 description = "Install dev dependencies and pre-commit hooks"
 run = """
-uv tool install keyring --with keyrings.google-artifactregistry-auth
+uv tool install keyring==25.7.0 --with keyrings.google-artifactregistry-auth==1.1.2
 if [ -f uv.lock ]; then
   uv sync --all-extras --frozen
 else