[dependabot]

Bumps jdx/mise-action from 4.3.0 to 5.2.2.

Release notes

Sourced from jdx/mise-action's releases.

v5.2.2: Include conf.d config fragments in the cache key

The cache key now includes mise conf.d/*.toml config fragments, so changing one of them invalidates the cache.

Fixed

• Editing a conf.d fragment now invalidates the cache. mise can load config from single-file fragments in conf.d/ directories, but the action didn't hash those files when it built the cache key. As a result, adding or changing tools in a fragment could restore an outdated cache. The cache key now also hashes conf.d/*.toml files under .config/mise/, .mise/ and mise/. If your repo already uses these fragments, the cache will miss once after you upgrade. (#698 by @​rileymichael)

New Contributors

• @​rileymichael made their first contribution in #698

Full Changelog: jdx/mise-action@v5.2.1...v5.2.2

v5.2.1: Require the signed packslip for mise 2026.9.3 and later

The action now refuses to install mise 2026.9.3 or later if the release's signed packslip is missing. This closes a gap where verification could be downgraded to the weaker checksum check.

Fixed

• A missing packslip no longer weakens the check on recent mise releases. v5.2.0 started checking the mise binary against the release's signed packslip.sigstore.json. If that file wasn't found, though, the action quietly fell back to the minisign-signed SHASUMS256 checksums. Anyone who could hide the file could force the weaker check. Every mise release from 2026.9.3 on includes a packslip, so for those versions a missing bundle now stops the install with an error like this:

  mise v2026.10.11 must ship a signed packslip, but https://github.com/jdx/mise/releases/download/v2026.10.11/packslip.sigstore.json was not found
  

  Releases before 2026.9.3 don't include a packslip, so they're still checked against the signed checksums. A version string that isn't three dot-separated numbers also requires a packslip. If you set the sha256 input, it still takes precedence over both checks. A packslip that fails verification still never falls back to the checksums. (#695 by @​jdx)

Full Changelog: jdx/mise-action@v5.2.0...v5.2.1

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.4 - 2026-10-26

🐛 Bug Fixes

• (cache) reuse signed checksums saved with a cached mise (#708) by @​jdx in #708

---

5.2.3 - 2026-10-24

🐛 Bug Fixes

• (cache) hash mise config files without walking the workspace (#703) by @​jdx in #703

---

5.2.2 - 2026-10-21

🐛 Bug Fixes

• hash conf.d config fragments in cache key (#698) by @​rileymichael in #698

New Contributors

• @​rileymichael made their first contribution in #698

---

5.2.1 - 2026-10-19

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679

... (truncated)

Commits

• 8418fed chore: release v5.2.2 (#699)
• bb33e9b chore(deps): update communique, hk in mise.lock (#700)
• 0cc9f84 fix: hash conf.d config fragments in cache key (#698)
• 7ce9a02 chore(deps): lock file maintenance (#697)
• fc42bcc chore: release v5.2.1 (#696)
• 720e96a fix: require the signed packslip for mise 2026.9.3 and later (#695)
• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9eee8a7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

PR

Finding: #7836 — this review is of the current head c0ed3ae1b97f1d3d6d5fa483b3ae376987963225.

Dependency change

Finding: Bumps jdx/mise-action from 5.0.0 (9149ea85…) to 5.1.2 (08ae2a09…) across the workflow uses pins.

Lock and manifest

Finding: Every changed uses pin is the verified v5.1.2 commit SHA; one pr.yaml pin still comments # v5.0.0 while the SHA is already 5.1.2.

Compatibility confidence

9/10 for c0ed3ae1
Finding: Tag SHA matches, existing inputs stay valid, and the v5.1.1 token-export break does not apply here because no workflow uses MISE_GITHUB_TOKEN or persist_github_token.

Risk and gaps

Finding: Residual risk is only live CI exercising Setup Mise on this head; no local GitHub Actions reproduction was run, by design for this ecosystem.

Local validation

Finding: Static checks only — changelog/action.yml vs our with: blocks, tag-to-SHA verification, and a repo scan for token/mise_dir usage; no product suite for github_actions.

SHA and CI

Finding: Current head is c0ed3ae1; CI on that head is pending (server-, client-, hooks, functions, plog, infra, pystreams, docker builds, wake-stack-e2e, and related path-filter jobs). format-check and impeccable already passed.

Merge readiness

Finding: CI pending — wait for the remaining required checks on c0ed3ae1 before merge; no dependency fix required for the pin itself.

  

_{Sent by Cursor Automation: Review Dependabot PRs (gram)}

[cursor]

SHA is the intended v5.1.2 pin (08ae2a09…), but the trailing comment still says # v5.0.0. Update the comment to # v5.1.2 for consistency with the other pins (keep the zizmor ignore).