Skip to content

chore(mise): Update mise tools - #90

Open
home-infrastructure-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mise-tools
Open

chore(mise): Update mise tools#90
home-infrastructure-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mise-tools

Conversation

@home-infrastructure-renovate

@home-infrastructure-renovate home-infrastructure-renovate Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Type Update Change Age Confidence
gh tools minor 2.96.0 → 2.97.0 age confidence
hadolint tools minor 2.14.0 → 2.15.1 age confidence
oxfmt (source) tools minor 0.58.0 → 0.61.0 age confidence
zizmor tools minor 1.26.1 → 1.28.0 age confidence

Release Notes

cli/cli (gh)

v2.97.0: GitHub CLI 2.97.0

Compare Source

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@&#8203;me" --field "Status" --field "Priority"

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.96.0...v2.97.0

hadolint/hadolint (hadolint)

v2.15.1

Compare Source

What's Changed

Full Changelog: hadolint/hadolint@v2.15.0...v2.15.1

v2.15.0

Compare Source

What's Changed

New Contributors

Full Changelog: hadolint/hadolint@v2.14.0...v2.15.0

oxc-project/oxc (oxfmt)

v0.61.0

Compare Source

v0.60.0

Compare Source

v0.59.0

Compare Source

🐛 Bug Fixes
  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#​24286) (leaysgur)
zizmorcore/zizmor (zizmor)

v1.28.0

Compare Source

Security 🔒🔗

  • v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

    Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

  • The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

  • The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

  • sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

  • Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#​2199)

  • Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

  • Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

v1.27.0

Compare Source

New Features 🌈🔗

  • zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#​2153)
    Enhancements 🌱🔗

  • zizmor's handling of paths is now more consistent, particularly when run on Windows (#​2163)

  • zizmor now emits a helpful warning when being run in implicit offline mode (#​2180)

Bug Fixes 🐛🔗

  • Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#​2157)

  • Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#​2177)

  • Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#​2185)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@home-infrastructure-renovate

home-infrastructure-renovate Bot commented Jul 24, 2026

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands
File name: undefined
Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

@home-infrastructure-renovate
home-infrastructure-renovate Bot force-pushed the renovate/mise-tools branch 3 times, most recently from 51defc0 to 9a74cf3 Compare July 31, 2026 02:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/mise type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants