fix(github-release): update release jdx/mise ( v2026.7.5 ➔ v2026.7.7 ) [automerge]

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
jdx/mise	patch	2026.7.5 → 2026.7.7	v2026.7.18 (+7)

---

Release Notes

jdx/mise (jdx/mise)

v2026.7.7: : Monorepo deps, systemd timers, and OAuth reliability

Compare Source

This release extends dependency providers and systemd bootstrap to monorepo and timer-based workflows, and hardens GitHub OAuth token refreshes and cache clearing against concurrent mise processes.

Added

• deps: experimental mise deps --monorepo runs dependency providers across every explicitly configured [monorepo].config_roots entry, aligned with mise install --monorepo. Provider IDs are qualified by config root (e.g. //apps/api:uv) so repeated provider names across subprojects no longer collide, and mise installs the union of tools declared across participating roots before running providers. Plain mise deps remains scoped to the current config root. (#​10975 by @​jdx)

  monorepo_root = true
  
  [monorepo]
  config_roots = ["apps/*", "packages/*"]

  mise deps --monorepo
  mise deps --monorepo --only //apps/api:uv

• bootstrap: manage systemd user timers alongside services via [bootstrap.linux.systemd.units]. Timer entries render to .timer units with scheduling (on_boot_sec, on_unit_active_sec, on_unit_inactive_sec, on_calendar), persistence, and timers.target linkage. Services gain optional directives including type, remain_after_exit, exec_stop, start/stop timeouts, no_new_privileges, and private_tmp. When a unit name switches between service and timer, the stale sibling unit is stopped, disabled, and removed on apply. (#​10984 by @​jdx)

Fixed

• github: serialize OAuth token refreshes across mise processes. Single-use refresh tokens were only guarded by an in-process mutex, so parallel mise runs could burn the same token or overwrite the cache with stale data. The full read-refresh-write cycle now holds a filesystem lock, re-reads the cache after acquiring it, and writes atomically. Rejected refreshes now surface a sanitized error with reauthorization guidance instead of falling back silently to anonymous requests. (#​10995 by @​jdx)
• cache: mise cache clear no longer fails with DirectoryNotEmpty when another mise process (e.g. hook-env) recreates cache files mid-removal. Removal now retries with bounded backoff and tolerates concurrently recreated entries, while permission and other errors still propagate. (#​10993 by @​jdx)
• github: skip OS package and installer assets (.apk, .deb, .rpm, DMG/PKG, MSI/MSIX/AppX and sidecars) during automatic asset selection for the github:, gitlab:, and forgejo: backends, so releases containing only unsupported packages now report that no platform asset matches instead of installing an unusable file. Explicit asset_pattern and URL selection are unchanged. (#​11001 by @​risu729)
• aqua: honor explicit false overrides for rosetta2, windows_arm_emulation, and no_asset, so a version or platform override can disable inherited emulation or asset flags instead of being treated as omitted. (#​11002 by @​risu729)
• vfox: support short annotated-tag refs in plugin source URLs (e.g. a .git URL followed by #v1.0.0), resolving explicit refs against exact remote branch and tag namespaces so annotated tags no longer fail to check out. (#​10998 by @​junior-ricon)
• task: render Tera templates in nested task-level tool option arrays and tables, and preserve their structure through resolution instead of dropping structured values. (#​10960 by @​risu729)
• bootstrap: add Homebrew-compatible Array#second, #third, #fourth, and #fifth helpers to the cask shim, fixing casks (such as OrbStack) that reference version.csv.second. (#​10992 by @​casparbreloh)
• status: status.show_env output now respects the status.truncate setting instead of always truncating. (#​10983 by @​ytjmt)
• schema: add bootstrap.macos.launchd.agents.<name>.start_calendar_interval to the published schema (single schedule or array), so strict TOML validators and editors accept valid launchd calendar configurations. (#​11008 by @​risu729)

Registry

• Add microsandbox (aqua:superradcompany/microsandbox) (#​10985 by @​joealden).

New Contributors

• @​junior-ricon made their first contribution in #​10998
• @​ytjmt made their first contribution in #​10983
• @​casparbreloh made their first contribution in #​10992

Full Changelog: jdx/mise@v2026.7.6...v2026.7.7

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.7.6: : Sandbox defaults, Flatpak bootstrap, and smarter task output

Compare Source

Added

• task: per-task output style field, decoupled from verbosity, so styles like prefix and quietness combine freely #​10885
• sandbox: global [settings.sandbox] deny defaults (deny_all, deny_read, deny_write, deny_net, deny_env) #​10940
• bootstrap: Flatpak package support for [bootstrap.packages] on Linux #​10951
• oci: reproducible host path copy layers via mise oci build --copy HOST_PATH:IMAGE_PATH and [[oci.copy]] #​10952
• doctor: mise doctor now warns when a mise shim is shadowed by an earlier executable in PATH #​10919
• aqua: support for private github_content and github_archive packages via authenticated GitHub API endpoints #​10915
• task: task-level timeout values now render Tera templates #​10959
• http: http_download_timeout setting caps total download wall-clock time (default 30 minutes) #​10920
• registry: add git-town (aqua:git-town/git-town) #​10935 and bundler (gem:bundler) #​10939

Fixed

• backend: reinstall rolling versions (e.g. nightly) when the installed content is outdated #​10827
• backend: align migrated backend resolution #​10969
• config: keep already-installed versions eligible when minimum_release_age is configured #​10973
• config: let user table-syntax tool options override registry defaults #​10924
• config: reload settings when config is reset so bootstrap phases use a consistent snapshot #​10945
• config: warn when a tool version uses an unsupported npm-style semver range #​10916
• config: add Tera contrib helpers #​10970
• task: preserve structured task-level tool options (arrays/tables such as os, depends, install_env) #​10958
• task: isolate usage_* variables per invocation so nested tasks don't inherit stale parser output #​10963
• task: invalidate auto freshness after a failed rerun #​10953
• task: respect configured includes directory when editing/adding file tasks #​10955
• s3: resolve cross-platform lockfile URLs for locked mode #​10873
• bootstrap: preserve symlinks when extracting DMGs and always detach on copy failure #​10949
• bootstrap: support localized brew casks (language, on_system_conditional) and reuse existing Ruby #​10950
• erlang: lock source install outcomes #​10937
• github: align SLSA provenance with the selected asset #​10928
• github: treat bin/rename_exe as install-time options #​10925
• npm: isolate version queries from project cwd #​10927
• cargo: own the cargo-binstall compile fallback #​10926
• registry: normalize backend platform selectors #​10938
• registry: rename the podman binary to podman-remote #​10826
• file: ignore malformed pax metadata during sparse detection #​10978
• copr: fix x86_64 builds (nasm/cmake for Fedora, PREBUILT_NASM for RHEL/EPEL) #​10947 and add PIE flag for aws-lc probe #​10974
• toolset: preserve ref selector install identity #​10942

Changed

• cargo: disable cargo-quickinstall by default; opt back in with cargo.binstall_quickinstall = true #​10923
• registry: revert preferring aqua for codex #​10922

Performance

• aqua: skip public reachability probes for packages marked private #​10914

Documentation

• aqua: document local custom registries #​10966
• config: clarify sub-version arithmetic #​10943

Breaking Changes

• task: --quiet / quiet = true / MISE_QUIET=1 no longer collapse task output to un-prefixed interleave; they now preserve the resolved style. Use --output quiet (or -o interleave) for the old behavior #​10885
• task: usage_* variables are now invocation-local; workflows that injected them as implicit inputs must declare an input with env= instead #​10963

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None