Skip to content

chore(deps): update mise tools#64

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/mise-tools
Open

chore(deps): update mise tools#64
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/mise-tools

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 8, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change Pending
act patch 0.2.87 → 0.2.88
gh minor 2.89.0 → 2.92.0
github:minamijoyo/hcledit patch 0.2.17 → v0.2.18
trivy minor 0.69.3 → 0.70.0
uv patch 0.11.7 → 0.11.14 0.11.16 (+1)

Release Notes

nektos/act (act)

v0.2.88

Compare Source

Changelog

Other
  • 48822e4 chore: bump VERSION to 0.2.88
  • bd86152 build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#​6070)
cli/cli (gh)

v2.92.0: GitHub CLI 2.92.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed.

Users are advised to update gh to version v2.92.0 as soon as possible.

For more information see: GHSA-crc3-h8v6-qh57

Support GitHub Enterprise Cloud (GHEC) in skill commandset

Now gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts with data residency.

Add --allow-hidden-dirs flag to skill preview

Following the addition of --allow-hidden-dirs to skill install in the previous release, now the flag is also supported in skill preview, allowing users to preview skills located in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.91.0...v2.92.0

v2.91.0: GitHub CLI 2.91.0

Compare Source

GitHub CLI now collects pseudonymous telemetry

To better understand how features are used in practice, especially as agentic adoption grows, GitHub CLI now sends pseudonymous telemetry.

See Telemetry for more details on what's collected, why, and how to opt out.

Support more agents in gh skill

Thanks to community feedback, gh now supports a large number of agent hosts. Run gh skill install --help for the list of available agents.

Improve skill discovery

gh skill install now adds the --allow-hidden-dirs flag to support discovering skills in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

Detect skills re-published from other sources

GitHub CLI now detects if the skill to be installed is re-published from an upstream source and offers the option to install it from there. The --upstream flag is also added for non-interactive use cases.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores

Full Changelog: cli/cli@v2.90.0...v2.91.0

v2.90.0: GitHub CLI 2.90.0

Compare Source

Manage agent skills with gh skill (Public Preview)

Agent skills are portable sets of instructions, scripts, and resources that teach AI coding agents how to perform specific tasks. The new gh skill command makes it easy to discover, install, manage, and publish agent skills from GitHub repositories - right from the CLI.


# Discover skills
gh skill search copilot

# Preview a skill without installing
gh skill preview github/awesome-copilot documentation-writer

# Install a skill
gh skill install github/awesome-copilot documentation-writer

# Pin to a specific version
gh skill install github/awesome-copilot documentation-writer --pin v1.2.0

# Check installed skills for updates
gh skill update --all

# Validate and publish your own skills
gh skill publish --dry-run

Skills are automatically installed to the correct directory for your agent host. gh skill supports GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity. Target a specific agent and scope with --agent and --scope flags.

gh skill publish validates skills against the Agent Skills specification and checks remote settings like tag protection and immutable releases to improve supply chain security.

Read the full announcement on the GitHub Blog.

gh skill is launching in public preview and is subject to change without notice.

Official extension suggestions

When you run a command that matches a known official extension that isn't installed (e.g. gh stack), the CLI now offers to install it instead of showing a generic "unknown command" error.

This feature is available for github/gh-aw and github/gh-stack.

When possible, you'll be prompted to install immediately. When prompting isn't possible, the CLI prints the gh extension install command to run.

gh extension install no longer requires authentication

gh extension install previously required a valid auth token even though it only needs to download a public release asset. The auth check has been removed, so you can install extensions without being logged in.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.89.0...v2.90.0

minamijoyo/hcledit (github:minamijoyo/hcledit)

v0.2.18

Compare Source

Changelog

aquasecurity/trivy (trivy)

v0.70.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10546

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0700-2026-04-16

astral-sh/uv (uv)

v0.11.14

Compare Source

Released on 2026-05-12.

Enhancements
  • Add Astral mirror URL override (#​19206)
  • Ignore top_level.txt entries in uninstall that are not valid Python identifiers (#​19340)
Bug fixes
  • Avoid applying .env files in parent process (#​19343)
  • Filter ANSI codes in logging output (#​19311)
  • Fix uv tree showing extra-conditional deps for packages required without extras (#​19332)
  • Respect build options (e.g., --no-build) during lock validation (#​19366)

v0.11.13

Compare Source

Released on 2026-05-10.

Bug fixes
  • Include data files in editable builds (#​19312)
  • Respect --require-hashes when installing from pylock.toml files (#​19334)
Python
  • Add CPython 3.14.5

v0.11.12

Compare Source

Released on 2026-05-08.

Python
  • Add CPython 3.15.0b1
Enhancements
  • Add --no-editable support to uv pip install (#​19306)
  • Require git refs in URLs to be percent-encoded (#​19320)
Bug fixes
Documentation
  • Fix bug from inconsistent workflow name in GHA-PyPI guide example (#​19309)

v0.11.11

Compare Source

Released on 2026-05-06.

Bug fixes
  • Accept legacy ID format from pre-0.11.9 cache entries (#​19301)

v0.11.10

Compare Source

Released on 2026-05-05.

Bug fixes
  • Allow pre-release Python requests with non-zero patch versions (#​19286)

v0.11.9

Compare Source

Released on 2026-05-04.

This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored.

We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team.

For more context, see the announcement, issue, and pull request.

Issues with the new release can be reported in the uv or CPython issue trackers.

Python
  • Upgrade PyPy to v7.3.22
  • Add CPython 3.14.5rc1
  • On macOS, CPython statically links libpython to match Linux
Enhancements
  • Omit compatible release desugaring for pre-release hints (#​19267)
  • Fix file locks on Android (#​18323)
Preview
  • uv audit add reporting for adverse project statuses (#​19128)
Bug fixes
  • Discover versioned Python executables when requires-python pins a version (#​18700)
  • Fix URL prefix matching to require path boundaries (#​19154)
  • Fix transitive Git path dependencies in lockfiles (#​19269)
  • Handle incorrect unlock error in LockedFile::drop on Wine (#​19229)
  • Prevent uninstalling site-packages for empty top_level.txt in .egg-info (#​19114)
  • Use symlinks instead of junctions on Wine (#​19213)
  • Fix floating-point environment handling on ARMv7 (#​19157)
  • Redact credentials from remote requirements URL in offline errors (#​19216)
  • Windows tramplolines no longer set PYTHONHOME and only set __PYVENV_LAUNCHER__ for virtual environments (#​19199)
Documentation
  • Mark --native-tls and UV_NATIVE_TLS as deprecated (#​18705)
  • Re-add pytorch-triton-rocm to PyTorch ROCm docs (#​19241)
  • Tweak changelog entries for 0.11.8 (#​19188)
  • Add 'Exporting lockfiles' to the Concepts->Projects index (#​19209)
  • Clarify that uv init creates git files / folders in the projects guide (#​19183)

v0.11.8

Compare Source

Released on 2026-04-27.

Enhancements
  • Add --python-downloads-json-url to python pin (#​19092)
  • Fetch uv from Astral mirror during self-update (#​18682)
  • Support pip uninstall -y (#​19082)
  • Add UV_PYTHON_NO_REGISTRY (#​19035)
  • Allow exclude-newer to be missing from the lockfile when exclude-newer-span is present (#​19024)
  • Only show the version number in uv self version --short (#​19019)
  • Silence warnings on empty SSL_CERT_DIR directory (#​19018)
  • Use a sentinel timestamp for relative exclude-newer and exclude-newer-package values in lockfiles (#​19022, #​19101)
Configuration
  • Add an environment variable for UV_NO_PROJECT (#​19052)
  • Expose UV_PYTHON_SEARCH_PATH for Python discovery PATH overrides (#​19034)
Bug fixes
  • Add rust-toolchain.toml to uv-build sdist (#​19131)
  • Ensure uv invocations of git do not inherit repository location environment variables (#​19088)
  • Redact pre-signed upload URLs in verbose output (#​19146)
  • Handle transitive URL dependencies in PEP 517 build requirements (#​19076, #​19086)
  • Support uv lock on a pyproject.toml that only contains dependency-groups (#​19087)
  • Disable transparent Python upgrades in projects when a patch version is requested via .python-version (#​19102)
  • Fix Python variant tagging in the Windows registry (#​19012)
  • Use a single codepath for extracting a .tar.zst wheel, disallowing external symlinks (#​19144)
Documentation
  • Bump astral-sh/setup-uv version in docs (#​19030)
  • Update PyTorch documentation for PyTorch 2.11 (#​19095)
  • Remove deprecated license classifiers from uv-build and add Python 3.14 classifier (#​19130)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from a team as a code owner May 8, 2026 11:03
@renovate renovate Bot added bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check labels May 8, 2026
@renovate renovate Bot force-pushed the renovate/mise-tools branch 4 times, most recently from 7345b7f to 39fce81 Compare May 15, 2026 05:34
@renovate renovate Bot force-pushed the renovate/mise-tools branch 5 times, most recently from df3556b to 9cb7abc Compare May 22, 2026 18:03
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented May 22, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mise.lock

mise ERROR error parsing config file: /tmp/renovate/repos/github/aignostics/foundry-python-core/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/aignostics/foundry-python-core/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

Command failed: mise lock act gh github:minamijoyo/hcledit trivy uv
mise ERROR error parsing config file: /tmp/renovate/repos/github/aignostics/foundry-python-core/mise.toml
mise ERROR Config files in /tmp/renovate/repos/github/aignostics/foundry-python-core/mise.toml are not trusted.
Trust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

@renovate renovate Bot force-pushed the renovate/mise-tools branch 2 times, most recently from bf1cf45 to 384c5e9 Compare May 25, 2026 01:43
@renovate renovate Bot force-pushed the renovate/mise-tools branch from e846101 to 40619bf Compare May 26, 2026 21:48
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 26, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bot Automated pull requests or issues dependencies Pull requests that update a dependency file renovate Pull requests from Renovate skip:codecov Skip Codecov reporting and check

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants