Skip to content

fix(deps): update minor and patch updates - #174

Merged
lervag merged 1 commit into
masterfrom
renovate/minor-and-patch-updates
Oct 23, 2026
Merged

fix(deps): update minor and patch updates#174
lervag merged 1 commit into
masterfrom
renovate/minor-and-patch-updates

Conversation

@renovate

@renovate renovate Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
jdx/mise-action action minor v5.0.1 → v5.1.1 v5.2.2 (+3) age confidence
typer (changelog) project.dependencies patch ==0.27.2 → ==0.27.3 age confidence
types-markdown (changelog) dependency-groups patch ==3.10.2.20260712 → ==3.10.2.20261007 age confidence
uv tools patch 0.12.22 → 0.12.24 0.13.5 (+5) age confidence

Release Notes

jdx/mise-action

v5.1.1: : GitHub token is no longer exported to later steps by default

Compare Source

mise-action no longer exports its GitHub token as MISE_GITHUB_TOKEN to every later step in the job. A new persist_github_token input lets you turn that back on, or pass a different token to later steps. This changes the default behavior. If later steps need the token, see Breaking Changes below.

Fixed
  • The GitHub token now stays inside the action by default. Before this release, the github_token input (which defaults to ${{ github.token }}) was written to GITHUB_ENV as MISE_GITHUB_TOKEN. That let any later step read the token and call the GitHub API with the job's permissions, even if the step never asked for a credential. Now the token is set only for the mise-action step and the processes it starts. The action masks the token in logs. (#​658 by @​jdx, reported in #​657)
Added

  • persist_github_token input (default false). It takes one of three values:

    • false: the token stays inside the action.
    • true: the token the action used is exported to later steps. If env.MISE_GITHUB_TOKEN is already set, it takes precedence over github_token.
    • A token value: that token is exported to later steps instead, for example a read-only token. The action still installs tools with github_token, or with MISE_GITHUB_TOKEN if it's already set.

    Setting false doesn't clear a MISE_GITHUB_TOKEN that was already set at the job level or exported by an earlier step. (#​658 by @​jdx)

Breaking Changes

Check your workflow if a later step needs MISE_GITHUB_TOKEN, such as mise shims, mise exec, mise run or lazy tool installs that call the GitHub API. Those steps no longer get the token automatically and may hit GitHub API rate limits. To get the old behavior back, opt in:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: true

Or give later steps a separate token:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: ${{ secrets.READ_ONLY_TOKEN }}

Full Changelog: jdx/mise-action@v5.1.0...v5.1.1

v5.1.0: : Tool version outputs, plugins input, and cached mise reuse

Compare Source

mise-action now reports the tool versions it installed as step outputs, can install mise plugins before tools, and can save the cache at the end of the job. Several caching fixes stop the action from downloading mise again on every run.

Added
  • Tool versions as step outputs. After install, the action runs mise ls --json --current and sets a versions output. This is a JSON object of the active, installed tools. Each tool maps to a list of {version, requested_version, install_path, source} entries. Each tool also gets its own output with its resolved version, such as steps.mise.outputs.node. A tool only gets its own output if its name is a valid output name and isn't cache-hit or versions. Names like npm:@scope/pkg appear only in versions. If the action can't read the versions, it prints a warning and the step still succeeds. (#​655 by @​jdx) 
    - uses: jdx/mise-action@v5
  id: mise
- run: echo "node ${{ steps.mise.outputs.node }}"
  • plugins input. List plugins one per line as name or name url. Blank lines and # comments are ignored. The action runs mise plugins install -y for each one before mise install. Plugins that are already installed, for example restored from the cache, are left as they are. An unknown plugin fails the step. When plugins is set, its hash is added to the default cache key. Custom cache_key templates can use it as {{plugins_hash}}. If plugins is unset, existing cache keys don't change. (#​656 by @​jdx) 
    - uses: jdx/mise-action@v5
  env:
    # needed for idiomatic files such as .yvmrc
    MISE_IDIOMATIC_VERSION_FILE_ENABLE_TOOLS: yarn
  with:
    plugins: |
      yarn
      php https://github.com/verzly/mise-php#latest
  • cache_save_post input (opt-in, default false). When enabled, the mise cache is saved in the action's post step instead of right after install. This way, tools installed by later steps are included in the cache, for example from monorepo sub-project configs or task-level tools. The setting only applies on a cache miss, because an existing cache entry can't be overwritten. The post step runs even if a later step fails. If the post-step save fails, the action prints a warning and the job doesn't fail. (#​649 by @​jdx)
  • auto_update input (default false). See Changed below. (#​642 by @​jdx)
  • The action now warns when you use the mise_toml input and a .mise.toml already exists in the working directory. mise loads .mise.toml before the mise.toml the action writes, so the input may have no effect. (#​654 by @​jdx)
Changed
  • A cached mise is kept when version is unset. Before, each new mise release made the action reject the cached binary in integrity verification and download mise again on every run until the cache key changed. Now the cached binary is kept until the cache key changes. The action verifies it against the signed checksums of the version recorded at install, without running it first. Caches saved before this release have no version record, so they are still verified against the latest release, and a tampered binary is still replaced. The integrity warning now includes the underlying error. To keep updating to newer releases as before, set auto_update: true. Each updated binary is cached under its own mise version, so each release is downloaded only once. An explicit version input works the same as before. (#​642 by @​jdx)
Fixed
  • The cache is saved after a partial-match restore. When the cache was restored from a key that only matched the prefix, the action never saved under the primary key, so it rebuilt the same tools on every run. Exact cache hits still skip the save. (#​646 by @​jdx)
  • Caches saved before this release no longer cause a download on every run. These caches have no version record, so a cached binary is verified against the latest release. Once a newer mise shipped, the action downloaded mise again on every run. It now also saves the reinstalled binary in a cache keyed by mise version, so later runs restore that binary instead of downloading it. (#​648 by @​jdx)
  • Windows: mise installs without unzip. The mise zip is now extracted with PowerShell's Expand-Archive. Self-hosted Windows runners that don't have unzip, such as fresh Windows 11 arm64 machines, can now install mise. (#​650 by @​jdx)
Documentation
  • New README guides cover matrix builds, using another cache action, and Rust caching:
    • Matrix builds: use MISE_<TOOL>_VERSION overrides and give each matrix entry its own cache_key.
    • Other cache actions: set cache: false and cache mise's data directory yourself.
    • Rust: explains why a restored cache can be missing Rust components such as rustfmt, with two workarounds. (#​654, #​651 by @​jdx)

Full Changelog: jdx/mise-action@v5.0.1...v5.1.0

fastapi/typer (typer)

v0.27.3

Compare Source

Fixes
Internal
astral-sh/uv (uv)

v0.12.24

Compare Source

Release Notes

Released on 2026-10-08.

Enhancements
  • Remove orphaned temporary build environments with uv cache prune (#​22171)
  • Accept PEP 508 marker operators directly before grouped expressions (#​22309)
  • Reject malformed requirements-file options instead of partially parsing or ignoring them (#​22317)
  • Show underlying filesystem and registry errors when managed Python uninstallation fails (#​22362)
  • Identify the invalid source URL in Python mirror errors (#​22364)
Preview features
  • Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#​22292)
Configuration
  • Support custom installation mirrors for GraalPy (#​22269)
  • Support custom installation mirrors for Pyodide (#​22271)
  • Allow UV_NO_CACHE=false to override no-cache = true in configuration (#​22324)
  • Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#​22144)
Performance
  • Speed up later commands after creating an environment by warming its interpreter cache (#​21304)
  • Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#​22246)
  • Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#​22203)
  • Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#​22242)
  • Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#​22144)
  • Reduce Python download error formatting code size by sharing its formatter (#​22141)
Bug fixes
  • Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#​22369)
  • Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#​22360)
  • Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#​22237)
  • Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#​22234)
  • Give explicit uv publish --trusted-publishing values precedence over configuration (#​22279)
  • Allow UV_OFFLINE=false to override offline = true in configuration (#​22283)
  • Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#​22291)
  • Allow uv auth login over IPv6 loopback addresses (#​22306)
  • Resolve GitHub dependencies whose Git references contain # or % characters (#​22281)
  • Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#​22322)
  • Preserve JSON output from uv version and uv self version with a single --quiet flag (#​22280)
  • Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#​22284)
  • Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#​22235)
  • Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#​22302)
  • Prevent workspace-cache assertion failures after modifying a project at the workspace root (#​22236)
  • Hide the ignored --keyring-provider option from uv auth help (#​19520)
  • Report HTTP client setup failures directly when resolving unnamed uv tool requirements (#​22320)
Documentation
  • Update Docker and AWS Lambda examples to cache dependency layers using frozen lockfiles without project manifests (#​22172)
  • Fix stale links and descriptions in Rust crate documentation (#​22311, #​22361)
  • Fix a typo in the required-environments documentation (#​22238)

Install uv 0.12.24

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.ps1 | iex"

Download uv 0.12.24

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
uv-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
uv-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
uv-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
uv-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
uv-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
uv-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
uv-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
uv-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.12.23

Compare Source

Release Notes

Released on 2026-10-03.

Python
Preview features
  • Sync from uv.lock without a workspace manifest using uv sync --frozen with frozen-lockfile (#​22018)
  • Export from uv.lock without a workspace manifest using uv export --frozen with frozen-lockfile (#​22007)
  • Inspect dependency trees from uv.lock without a workspace manifest using uv tree --frozen with frozen-lockfile (#​22016)
  • Inspect workspace metadata and optionally sync its environment from uv.lock without a workspace manifest using uv workspace metadata --frozen with frozen-lockfile (#​22017, #​22018)
Bug fixes
  • Reject alternate sources for workspace members across conflicting dependency selections, avoiding lockfiles that cannot be installed (#​22153)
  • Allow x86-64 Python interpreters running under emulation on Windows ARM64 to install compatible win_amd64 wheels instead of building from source (#​22099)
Install uv 0.12.23
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.ps1 | iex"
Download uv 0.12.23
File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
uv-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
uv-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
uv-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
uv-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
uv-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
uv-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
uv-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
uv-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum
Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9pm on friday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026
@renovate
renovate Bot requested a review from lervag October 23, 2026 00:52
@lervag
lervag merged commit 7a32119 into master Oct 23, 2026
4 checks passed
@lervag
lervag deleted the renovate/minor-and-patch-updates branch October 23, 2026 12:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lervag lervag Awaiting requested review from lervag

Assignees

@lervag lervag

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lervag