Skip to content

chore(mise): update mise tools - #2373

Merged
onedr0p merged 1 commit into
mainfrom
renovate/mise-tools
Sep 5, 2026
Merged

chore(mise): update mise tools#2373
onedr0p merged 1 commit into
mainfrom
renovate/mise-tools

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
age tools patch 1.3.1 → 1.3.2
cloudflared (changelog) tools patch 2026.8.2 → 2026.8.3
flux2 tools patch 2.9.4 → 2.9.5
gh tools minor 2.98.0 → 2.99.0 2.100.0
lefthook tools patch 2.1.11 → 2.1.12
uv tools patch 0.12.6 → 0.12.9 0.12.10
zizmor tools minor 1.29.0 → 1.30.0

Release Notes

FiloSottile/age (age)

v1.3.2: age v1.3.2

Compare Source

age v1.3.2 is a minor release with a wide range of fixes and hardening improvements.

Some previously-accepted inputs are now rejected: headers over 2 MiB or 1024 recipients, malformed SSH keys in recipients files, and non-UTF-8 plaintext written to a terminal (force with -o -).

Pre-built binaries now cover windows/arm64 and darwin/amd64, and release archives include the compatibility plugins (age-plugin-pq, age-plugin-tag, and age-plugin-tagpq).

cloudflare/cloudflared (cloudflared)

v2026.8.3

Compare Source

SHA256 Checksums:
cloudflared-amd64.pkg: 95f499fba19643893212bbe912733e5e80394af111fea6c67f066b46a70c3194
cloudflared-arm64.pkg: 8dc66777e1ace4c24a347857eef63a3cbb23ccdfbf3ba72f3d621bdd5e6af203
cloudflared-darwin-amd64.tgz: 936aa4ed783b0e191fac48e7140c34605b25d8d5c0495c3599c90e350ae6e4c4
cloudflared-darwin-arm64.tgz: 50a04624531e7a98ddb65f1223905e32f84e7488ed3ee8dadcd3260aa8932603
cloudflared-fips-linux-amd64: 99e8ad6e87228afd213890cc39176b7dd02b76fcf81030af4040645b89f8a205
cloudflared-fips-linux-amd64.deb: 9510f46a1fad3bd8f31551fad978bde9e0e92796be01a25288efbac413db3980
cloudflared-fips-linux-x86_64.rpm: 0697fbebcd25a61db5cbcffc7ba47a561ec94291327b365752f469f6cecafe46
cloudflared-linux-386: 691e3a2b8926f90ec4fcec4f4bc8e38b1de14f6232d93a24f6cb7b2c23ab5e92
cloudflared-linux-386.deb: 68e7e2cec6934a6bc5f06ca6703d55e898369fef297e33e3b23d02b1f7282a4e
cloudflared-linux-386.rpm: b2fc222ef9410ee81a04e0058b00a4e4944274c253c2eb1ebda0ea63583c18b5
cloudflared-linux-aarch64.rpm: 85bda0d5385757549c04f036571a453a933b6e9f32f3cd84cf8692ccf25f5bb6
cloudflared-linux-amd64: f29324fe934d1e100617484c78deef803c4dc2cd351d645bbde42e96b4fccc5e
cloudflared-linux-amd64.deb: 660b348d473bba81997445b534e7eaefaf4c4e16331866922326c338a7013dd9
cloudflared-linux-arm: 7a7cac4ad4561ff55797eaf27aae1a0be37498c85502715bc87e3bad919d928c
cloudflared-linux-arm.deb: f1ee5c2e42771d1f63313910e792a1d1e355fc1b55cd69bececac7a8ff6acb12
cloudflared-linux-arm.rpm: ce958ce42ad88b5a436e5b6d72bb988e23167f4f670cea69c05f2702c3ad62e7
cloudflared-linux-arm64: 4bcfd35521a7cbc545ebfd5d57334a71ee180e2a64874981f374c81472118391
cloudflared-linux-arm64.deb: 2c0d991ed6061e55d2e0148b794d86f594ddb473c1db43cf0647278b62e326ab
cloudflared-linux-armhf: d8bd9d00c15398ef4c6e6bc1a0486b6f1eb8c0dfd93e7479e07a121aa4e3dd57
cloudflared-linux-armhf.deb: dc1265f86d79c425cacc4e8a2a036a6276d189f118d95c319e833e74ae4b0f2e
cloudflared-linux-armhf.rpm: 4ac13cfb739c30330739655ae4aad6cf24a53d860b11de0d33f1e48885915045
cloudflared-linux-x86_64.rpm: f442d9c2bd9afc595c6fbe9d1a19a9ff0d3a44911c0ccc00666fa28c08d1a31f
cloudflared-windows-386.exe: bdfab00122a3c2a0772d3f176445f6baf0271fed71656d0902cbc23a0eea7048
cloudflared-windows-386.msi: a21d6c4a60e076e2e34a2df800fd94e70aabd6427f07d55c987ae11cabc025bf
cloudflared-windows-amd64.exe: 83e726ed18ea78c5ad5213c4c3a3a27051393950d2bc8ed4de69bec12d14eaae
cloudflared-windows-amd64.msi: 4236c68898bcd9d1e9aeea70268e6482d13a7bb9ea111e532299f35fde82f721
fluxcd/flux2 (flux2)

v2.9.5

Compare Source

Highlights

Flux v2.9.5 is a patch release that moves helm-controller and source-controller back to upstream Helm, now at v4.2.4, dropping the temporary Flux fork. It hardens the handling of kubeconfig Secrets in helm-controller and kustomize-controller, which now reject kubeconfigs referencing files on the local filesystem and require credentials and certificates to be embedded inline. It also stops kustomize-controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution where a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. Across all controllers and the CLI, the fluxcd/pkg dependencies have been updated, bringing Kubernetes to 1.36.4. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

  • Validate kubeconfigs from .spec.kubeConfig Secrets, rejecting local file references in certificate-authority, tokenFile, client-certificate and client-key; credentials and certificates must be embedded inline (helm-controller, kustomize-controller)
  • Purge temporary directories at startup (kustomize-controller)
  • Fix panic on negative-length substring expressions in post-build substitution (kustomize-controller, flux CLI)

Improvements:

  • Move back to upstream Helm v4.2.4, dropping the Flux fork (helm-controller, source-controller)
  • Update fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4 (all controllers, flux CLI)

Components changelog

CLI changelog

Full Changelog: fluxcd/flux2@v2.9.4...v2.9.5

cli/cli (gh)

v2.99.0: GitHub CLI 2.99.0

Compare Source

What's Changed

New Contributors

Full Changelog: cli/cli@v2.98.0...v2.99.0

evilmartians/lefthook (lefthook)

v2.1.12

Compare Source

astral-sh/uv (uv)

v0.12.9

Compare Source

Released on 2026-09-01.

Python
Enhancements
  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#​21402)
Performance
  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)
Bug fixes
  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

v0.12.8

Compare Source

Released on 2026-08-31.

Enhancements
  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#​21368)
Preview features
  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#​21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#​21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#​21344)
Performance
  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#​21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#​21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#​21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#​21300)
Bug fixes
  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#​21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#​21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#​21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#​21341)
Other changes
  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#​21346)

v0.12.7

Compare Source

Released on 2026-08-27.

Python
  • Replace managed Python installations when upgrading to a newer build of the same version (#​21323)
Enhancements
  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#​21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#​21318)
Preview features
  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#​19693)
Bug fixes
  • Reject source archives with hash mismatches before persisting their extracted contents to the cache (#​21248)
Other changes
zizmorcore/zizmor (zizmor)

v1.30.0

Compare Source

Sponsorship is appreciated!

New Features 🌈🔗

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#​2259)

  • Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#​2289)

  • Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#​2300)

  • Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#​2308)

  • Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#​2295)

    Many thanks to @​dmbuil for proposing and implementing this improvement!

  • Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#​2330)

  • Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#​2337)

  • Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#​2339)

  • Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#​2247)

    Many thanks to @​potiuk for proposing and implementing this improvement!

  • Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#​2349)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@onedr0p
onedr0p merged commit 6f130b5 into main Sep 5, 2026
34 checks passed
@onedr0p
onedr0p deleted the renovate/mise-tools branch September 5, 2026 11:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/github-release type/minor type/patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@onedr0p