Skip to content

chore(deps): update mise tools - #144

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/mise-tools
Nov 7, 2026
Merged

chore(deps): update mise tools#144
renovate[bot] merged 1 commit into
mainfrom
renovate/mise-tools

Conversation

@renovate

@renovate renovate Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
act tools patch 0.2.89 → 0.2.94 0.2.97 (+2)
gh tools minor 2.102.0 → 2.103.3
github:minamijoyo/hcledit tools patch v0.2.18 → v0.2.19
uv tools patch 0.13.4 → 0.13.6 0.13.7

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

nektos/act (act)

v0.2.94

Compare Source

Changelog

Bug fixes
  • 3fde8e6 fix(runner): check docker context against the executor workspace
Other
  • ec4776c chore(runner): fix lint in action path containment

v0.2.93

Compare Source

Changelog

Bug fixes
  • 66cee43 fix(runner): keep local action paths and docker build contexts inside the workspace
  • cf5130c fix(git): keep brackets on IPv6 enterprise SSH hosts
  • cb08f14 fix(git): keep userinfo out of query/fragment and drop HTTPS port for GHE SSH
  • 3311ed9 fix(git): match GitHub remotes with ports and git:// URLs again
Other
  • 2b8b3d6 chore(testdata): drop vulnerable npm deps from fixture actions
  • c365046 test(git): silence secretlint on fake credential fixture

v0.2.92

Compare Source

Changelog

Bug fixes
  • 0dca768 fix(artifacts): quote rejected request fields in the debug log
  • 6646c2e fix(cmd): do not follow project file symlinks out of the workdir
  • a97c016 fix(git): anchor and escape hostnames in remote URL patterns
  • 703e9d4 fix(cmd): treat ./.actrc as untrusted project config
  • 0c0446b fix(runner): strip terminal control sequences from step output
  • 63b3922 fix(runner): refuse NODE_OPTIONS from GITHUB_ENV and set-env
  • 8fc492b fix(artifactcache): serve cache blobs through os.Root
  • 3d37545 fix(artifacts): contain storage, bound signed URLs, drop empty-key parsing
  • 53ab38f fix(container): restrict workflow container options and host volumes
  • 4105885 fix(runner): keep remote action paths inside the action repository
  • 8ec74ee fix(container): keep host-mode file writes inside the destination
  • 1dc092d fix: report module pseudo and dirty versions instead of the VERSION fallback
Documentation updates
  • b962e1e docs: add security audit findings and triage
  • 770ad71 docs: host the act logo and repair broken README images
  • 020ca09 docs: pin attestation verification to the release workflow and tag
  • d68ab16 docs: add security policy
Other
  • cba121f refactor(runner): split action reading and volume checks out of long functions
  • ec60045 ci: publish the release only after provenance is attested
  • fe5c98b ci: run the host-test skip message under bash on every OS
  • c5f5a42 ci: release by pushing only the tag
  • 37c5aa9 chore(deps): bump golang.org/x/net to v0.62.0
  • e1f4d7a ci: add Dependabot cooldown and Docker updates
  • 54bdd4e ci: pin Dockerfile base images by digest
  • 27f467a ci: verify Chocolatey build inputs
  • 2e7e440 ci: attest release provenance and pin GoReleaser
  • 8859a7e ci: drop unused write scopes from checks
  • d9255cf ci: scope workflow token permissions to jobs

v0.2.91

Compare Source

Changelog

Other
  • 7d8044a chore: bump VERSION to 0.2.91
  • d2f81f0 ci: point default-branch references at main
  • 8b2f210 ci: publish Winget and Chocolatey apart from GoReleaser

v0.2.90

Compare Source

Changelog

Bug fixes
  • 1f4b48f fix: close cache upload and container attach leaks
  • 2bfe1c1 fix(artifacts): make v4 URL signatures unambiguous and parse the workflow
  • b9d3535 fix(artifacts): harden the artifact server
  • eae8221 fix: overwrite read-only files when copying an action
  • 1ef687e fix: dispatch the gh-act tag run by id
  • b961a56 fix: exempt backlog issues from the stale workflow
  • 5d34ab3 fix: address triage review comments
  • a34fa0c fix: bump golang.org/x/crypto to v0.56.0 to fix SSH deadlock DoS advisories (supersedes v0.52.0) (#​6133)
Other
  • 58317c0 chore: bump VERSION to 0.2.90
  • 62994da ci: keep sharded test-linux and correct the golangci pin comment
  • b3534b0 ci: address review notes and scan with Go 1.26.10
  • c2bf3f4 ci: acknowledge intentional zizmor trigger exceptions
  • 9916e4f chore: remove local action cache captured during tests
  • eb59aa8 ci: harden workflows and move fixtures off EOL Debian
  • fcf3ffa test: clear ACT_TEST_LINUX_SHARD when asserting sharding is off
  • c060d21 ci: let Dockerfile suffixes use spaces
  • 79cd048 ci: keep the Actions artifact URL out of test-linux
  • 0dafad1 ci: expose Actions cache credentials and skip fixture builds off Linux
  • 617c662 ci: shard test-linux and cache fixture images
  • e1cd3ee build(deps): clear open Go Dependabot alerts
  • 0301b13 ci: tighten approval auto-merge permissions and concurrency
  • 3a74ece ci: resolve fork pull requests for approval auto-merge
  • 8536521 ci: tag gh-act from master so promote environment secrets are reachable
  • 9a46b94 ci: authenticate promote and gh-act tags with the release app
  • fe22388 ci: auto-merge after an approval from a writer
  • 2506039 ci: rerun Dependabot auto-merge when drafts are ready
  • b59d01a ci: replace Mergify with native GitHub automation
  • 64f3e1d chore: add CodeRabbit review configuration
  • f9563e8 chore: tighten issue and pull request triage
  • 29d3714 build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 (#​6210)
  • fb52a49 chore: fast tests, no-op promote, and cheaper CI (#​6214)
cli/cli (gh)

v2.103.3: GitHub CLI 2.103.3

Compare Source

What's Changed

🐛 Fixes
  • fix(gh auth status): explain expired expiring tokens with --no-refresh by @​babakks in #​14815

Full Changelog: cli/cli@v2.103.2...v2.103.3

v2.103.2: GitHub CLI 2.103.2

Compare Source

🐛 Fixes

New Contributors

Full Changelog: cli/cli@v2.103.1...v2.103.2

v2.103.1: GitHub CLI 2.103.1

Compare Source

What's Changed

🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.103.0...v2.103.1

v2.103.0: GitHub CLI 2.103.0

Compare Source

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

[!IMPORTANT]
Expiring access tokens should not be cached. Scripts and extensions that store the output of gh auth token will eventually hold an expired token, so run gh auth token again each time a token is needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

[!IMPORTANT]
Issue artifacts are in private preview. These commands only work for repositories enrolled in the preview. See the Issue Artifacts private preview announcement and feedback discussion for access instructions and to share feedback.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.102.1...v2.103.0

v2.102.1: GitHub CLI 2.102.1

Compare Source

What's Changed

:dependabot: Dependencies

chore(deps): bump Go toolchain from 1.27.1 to 1.27.3 and golang.org/x/net from 0.58.0 to 0.60.0

Full Changelog: cli/cli@v2.102.0...v2.102.1

minamijoyo/hcledit (github:minamijoyo/hcledit)

v0.2.19

Compare Source

Changelog

astral-sh/uv (uv)

v0.13.6

Compare Source

Released on 2026-10-26.

Enhancements
  • Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#​22814)
  • Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#​22916)
Python
  • Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#​22938)
Preview features
  • Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#​22690)
  • Nest each module's owners in an object in uv workspace metadata output (#​22638)
  • Report the unsupported properties required by an incompatible wheel variant (#​22719)
Performance
Bug fixes
  • Prevent uv run --active --script and uv sync --active --script from deleting non-virtual-environment directories (#​21464)
  • Use AMD64 for platform_machine when resolving for x86-64 Windows (#​22935)
  • Preserve free-threaded and other non-default variants in uv python upgrade (#​22836)
  • Allow uv init --no-package and uv init --script when UV_INIT_BUILD_BACKEND is set (#​22907)
  • Prevent panics when rendering containment markers with local versions (#​22815)
Documentation
  • Update the Docker guide and reproduction examples to use uv 0.13.5 (#​22867)

v0.13.5

Compare Source

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements
  • Report incompatible self-dependencies directly in resolution errors (#​21845)
Python
  • Add CPython 3.15.1, 3.14.9, and 3.13.17 (#​22802)
Preview features
  • Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#​22535, #​22536, #​22687, #​22688)
Performance
  • Reduce peak memory use when resolving dependencies across multiple environments (#​22769, #​22770, #​22784)
  • Speed up exports with complex transitive extras by resolving activation across the dependency graph (#​22751)
  • Reduce uv's binary size by keeping additional error formatters out of line (#​22775)
  • Reduce overhead when parsing custom build cache keys (#​22749)
Bug fixes
  • Lock packages distributed only as Android wheels without a source distribution (#​22806)
  • Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#​22751)
  • Reject invalid custom build cache keys instead of silently falling back to the defaults (#​22749)
Security
  • Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#​22777)
  • Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#​22773)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner November 6, 2026 13:26
@renovate
renovate Bot enabled auto-merge (squash) November 6, 2026 13:26
@codecov

codecov Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@renovate
renovate Bot force-pushed the renovate/mise-tools branch 2 times, most recently from 9ad8441 to 910871e Compare November 7, 2026 18:30
@renovate
renovate Bot force-pushed the renovate/mise-tools branch from 910871e to f1020df Compare November 7, 2026 18:31
@sonarqubecloud

sonarqubecloud Bot commented Nov 7, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate
renovate Bot merged commit 2b9a72a into main Nov 7, 2026
14 checks passed
@renovate
renovate Bot deleted the renovate/mise-tools branch November 7, 2026 21:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants