[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
erlang/rebar3	uses-with	minor	3.27.3 → 3.28.0
jdx/mise	uses-with	patch	2026.10.15 → 2026.10.17	v2026.10.19 (+1)
jdx/mise-action	action	patch	v5.2.1 → v5.2.2	v5.2.3
markdownlint-cli2	tools	minor	0.23.3 → 0.24.0
rebar	tools	minor	3.27.3 → 3.28.0
semgrep (changelog)	tools	minor	1.181.0 → 1.182.1
uv	tools	patch	0.13.3 → 0.13.5

---

Release Notes

erlang/rebar3

v3.28.0

Compare Source

Few interface changes, but some significant behavioural ones:

• Remove Certifi dependency and rely on root store
• Bump vendored hex_core to 0.20.1
• Improve description of rebar3 ct --dir option

Note that both the hex_core update and the certifi update are required for security. The removal of Certifi switches Rebar3 to use your operating system's root store, which may cause issues in some limited devices. However, since distrusted intermediary certificates are currently still in Certifi's hex package, we consider it safer to rely on operating system root stores.

If your device does not comply with the expected root store, you can configure one with {ssl_cacerts_path, "/path/to/cacerts.pem"}.

jdx/mise

v2026.10.17: : Shell names in bootstrap login_shell, templated doctor checks, and a per-plugin vfox cache directory

Compare Source

bootstrap.user.login_shell now accepts a shell name such as fish instead of a full path. [doctor.checks] can use templates, and vfox backend plugins get their own cache directory. This release also fixes PATH handling in zsh setups that deduplicate PATH, stale task cache hits, a pipx interpreter mix-up on macOS, and removes trust in the compromised eMudhra CA certificates.

It also includes the changes prepared for 2026.10.16, which was tagged but never published: relative and templated write_targets paths, version aliases from vfox backend plugins, keyring passwords for private PyPI indexes, vfox-backend: packslip plugin sources, and a change to where find_up starts (see Changed and Upgrading).

Added

• [bootstrap.user].login_shell accepts a shell name. A config shared across machines no longer needs to know where each system installs the shell. mise looks up the name when it checks or applies the setting, which happens after bootstrap.packages has installed the shell. It searches PATH first (never the mise shims directory), then common package-manager locations: /opt/homebrew/bin, /usr/local/bin, /home/linuxbrew/.linuxbrew/bin, ~/.linuxbrew/bin, /usr/bin and /bin. If no executable is found, mise bootstrap user apply fails without changing /etc/shells or the account, and status reports not installed. mise bootstrap user status shows the path it found, and --json output has a new resolved field. Absolute paths work as before. #​14770 (@​jdx)

  [bootstrap.packages]
  "brew:fish" = "latest"
  
  [bootstrap.user]
  login_shell = "fish"

• Doctor checks support templates. run, description and hint in [doctor.checks.*] are rendered with the template context of the config file that declares them, the same way hooks are. A check can now use a value from [vars] instead of hard-coding it. dir is not rendered. If a template fails, only that check reports ERROR and the other checks still run. Text that already contains {{ or {% in these fields is now parsed as a template. #​14771 (@​jdx)

  [doctor.checks."project-a:env"]
  description = "project-a has a .env file"
  run = 'test -f {{ vars.repos_dir | quote }}/project-a/.env'
  hint = "cp {{ vars.repos_dir }}/project-a/.env.example {{ vars.repos_dir }}/project-a/.env"

• vfox plugins get RUNTIME.cacheDirPath. This is a cache directory for each plugin at $MISE_CACHE_DIR/plugins/<plugin-name>. mise creates it before running any hook, and every hook of the plugin sees the same path. Unlike pluginDirPath, it is kept when the plugin is reinstalled. mise cache clear deletes it, so plugins must handle it being missing. It is nil when no cache directory is available. #​14776 (@​jdx)

• settings.write_targets accepts relative and templated paths. Before, only absolute or ~/ paths worked, so dotfiles shared between machines with different MISE_CONFIG_DIR or XDG_CONFIG_HOME had to hardcode the config directory. Templates are now rendered, and a relative result is joined to the config_root of the settings file that declares it. For a global file that is $HOME, so the portable spelling uses the file's own directory. The resolved path must still be a global config file that mise loads. If a template fails to render, mise warns, and mise use --global fails with "must resolve to an absolute path" instead of writing to the default file. #​14742 (@​jdx)

  # ~/.config/mise/conf.d/settings.toml
  [settings.write_targets]
  tools = "{{ config_source | dirname }}/tools.toml"

• vfox backend plugins can report version aliases. BackendListVersions can return an aliases table, so a registry's moving names resolve to real versions. Before, "mise-ghcup:ghc" = "recommended" passed the literal string to the plugin, installed into installs/.../recommended, never followed the tag when it moved, and showed recommended in mise ls and the lockfile. Now ghc@recommended resolves to 9.10.3, installs into 9.10.3/, and the lockfile records 9.10.3. Aliases you define in config still win. They are cached like the version list, and an expired cache still answers offline. Older mise versions ignore the aliases field, so plugins can adopt it right away. #​14732 (@​jdx, @​cprecioso)

  return {
    versions = { "9.8.4", "9.10.3", "9.14.1" },
    aliases = { recommended = "9.10.3" },
  }

• mise lock and version listing work with a PyPI index that uses a keyring. With an index such as Azure Artifacts and artifacts-keyring, mise install worked because uv read the password from its keyring provider, but mise's own requests sent no credentials and failed with 401 Unauthorized. Set the new pypi.keyring_provider (disabled by default, or subprocess; env var MISE_PYPI_KEYRING_PROVIDER) and give the registry URL a username without a password. mise then runs keyring get <url> <username>, as uv does, and sends the result as HTTP Basic credentials when it lists versions and when mise lock reads a release's requires-python. The password is never written to the lockfile or the version cache. The keyring executable must be on PATH. If it is missing or has no entry, mise sends the request without credentials. #​14733 (@​jdx)

  [settings.pypi]
  keyring_provider = "subprocess"
  registry_url = "https://VssSessionToken@pkgs.dev.azure.com/org/project/_packaging/feed/pypi/simple/{}/"

• vfox-backend: works as a prefix for packslip plugin sources. A vfox backend plugin can be installed from a signed packslip archive, both from the CLI and in [plugins]. Before, mise plugins install vfox-backend:foo 'packslip:owner/repo#1.0.0' failed with packslip plugin sources require the vfox plugin type. An explicit asdf: or package: prefix is still rejected, and the error now says "vfox or vfox-backend". The archive still declares extensions.mise.plugin = "vfox". #​14727 (@​jdx)

  mise plugins install vfox-backend:my-backend 'packslip:your-org/my-backend#1.0.0'

• mise bootstrap packages list is now an alias for status, alongside ls. #​14709 (@​himkt)

Changed

• find_up in env._.file starts at the config root. Every other relative path in a config resolves against the config root, but find_up started at the current directory. A relative find_up path now starts at the config root and walks up through its parents, which suits a monorepo whose root .env applies to every package. An absolute path starts at its own directory. A global config that wants to search from wherever mise runs can use cwd. The env_file setting still discovers dotenv files up from the current directory and is unchanged. See Upgrading. #​14734 (@​jdx, @​thernstig)

  # ~/.config/mise/config.toml
  [env]
  _.file = { path = "{{cwd}}/.env", find_up = true }

• allow_builds approves only the packages it lists. With the embedded aube installer, allow_builds = ["re2"] also ran the install scripts of every package on aube's bundled trusted-dependencies list, such as dtrace-provider. For a package list, mise now turns that default list off, so only the packages you name build. allow_builds = true and the default with no option are unchanged. This updates the embedded aube to 2.8.0. #​14731 (@​jdx)

Fixed

• exec() in [env] values, and other commands mise runs with the pre-activation environment, can now find commands in a _.path directory that was already on PATH before activation, even if the shell deduplicates PATH (for example zsh with typeset -U path PATH). #​14772 (@​jdx)
• With task.source_freshness_hash_contents = true, a task now re-runs when a source file is changed to content of the same size and its old mtime is restored (for example by rsync -a, cp -p or touch -r). On Unix, mise now also compares the file's ctime. Cache entries written by older versions are rehashed once. #​14778 (@​jdx)
• On macOS, pipx: installs no longer fail when aqua:aws/aws-cli is in the toolset. Because macOS filesystems ignore case by default, mise's lookup for python matched aws-cli's executable Python shared library and passed it to uv as the interpreter. This lookup now requires the exact case. #​14769 (@​jdx)
• An aqua registry template with an unterminated string literal now fails with an "unterminated string literal" error instead of hanging. Escaped quotes after backslashes are also detected correctly. #​14752 (@​Huge, @​jdx)
• The built-in npm backend no longer trusts the eight eMudhra intermediate CA certificates whose private keys were compromised. The fix comes from updating its bundled root certificates (webpki-root-certs 1.0.10, rustls-webpki 0.103.16). Builds that use the OS trust store are fixed by OS updates instead. #​14781 (@​jdx)
• A [bootstrap.compose] project no longer reports drift on every run when a service uses a service: reference such as network_mode: service:vpn. Compose hashes the reference as written but stamps the container with the hash of the resolved container:<id>, so the two never matched. mise now pins these references (network_mode, ipc, pid, volumes_from) to the running container before it asks compose for the hash. This needs an explicit files list in the project's config. Projects without one hash as before. #​14729 (@​jdx)
• vfox plugins now keep symlinks when they extract .zip archives returned by PreInstall. Before, entries such as bin/npm -> ../lib/node_modules/npm/bin/npm-cli.js became regular files holding the link target, and the tool failed with No such file or directory. Links that resolve outside the install directory are still rejected. The http: backend and tarballs were not affected. #​14730 (@​jdx)
• [daemons.<name>] task = "worker" now finds a file task such as .mise/tasks/worker.sh, as mise run worker does. Before, it failed with daemon srv runs unknown task "worker" unless you wrote worker.sh. #​14741 (@​jdx)
• On Windows, mise self-update no longer replaces the winget mise-shim.exe link with a copy. It updates the real mise-shim.exe next to the real mise.exe. Before, mise reshim kept warning that the shim was older than mise. #​14737 (@​jdx)
• An inherited [dotfiles] entry turned off with only enabled = false no longer prints no recognized operation (block, source, or line), ignoring entry on every command. Other tables with no recognized operation, such as a misspelled line, still warn. #​14726 (@​jdx, @​ponko2)

Upgrading

• find_up in a global config: a relative find_up entry in env._.file used to search from the current directory. It now searches from the config root, which is ~ for a global config, so it no longer finds project files. To keep the old behavior, put {{cwd}}/ in front of the path. find_up was added in 2026.10.12.

Documentation

• The dotfiles docs now explain that a group entry with only permissions does not inherit the group's mode, so it deploys nothing. Removing mode from an entry that used to deploy a file leaves that file orphaned, and --prune deletes it. To deploy a file and set its permissions, use { mode = "copy", permissions = "0600" }. #​14768 (@​jdx)

New Contributors

• @​Huge made their first contribution in #​14752

Full Changelog: jdx/mise@v2026.10.15...v2026.10.17

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

jdx/mise-action

v5.2.2: : Include conf.d config fragments in the cache key

Compare Source

The cache key now includes mise conf.d/*.toml config fragments, so changing one of them invalidates the cache.

Fixed

• Editing a conf.d fragment now invalidates the cache. mise can load config from single-file fragments in conf.d/ directories, but the action didn't hash those files when it built the cache key. As a result, adding or changing tools in a fragment could restore an outdated cache. The cache key now also hashes conf.d/*.toml files under .config/mise/, .mise/ and mise/. If your repo already uses these fragments, the cache will miss once after you upgrade. (#​698 by @​rileymichael)

New Contributors

• @​rileymichael made their first contribution in #​698

Full Changelog: jdx/mise-action@v5.2.1...v5.2.2

DavidAnson/markdownlint-cli2 (markdownlint-cli2)

v0.24.0

Compare Source

• Update dependencies (including markdownlint)

semgrep/semgrep (semgrep)

v1.182.0

### Added

• Added Objective-C language support (objc, alpha): tree-sitter based parsing of .m files with semgrep pattern syntax (metavariables, ellipsis in argument/statement/message-keyword positions, deep ellipsis), enabling search-mode and taint-mode rules on Objective-C code. Message sends, blocks, control flow, class/method definitions, and Objective-C literals are modeled; remaining constructs parse and degrade gracefully. Objective-C++ (.mm) support will follow separately. (gh-9265)

### Changed

• c-sharp-pro grammar update (v0.23.1):

  • C# (Pro) parsing and rule patterns now support Unicode escape sequences in identifiers (e.g. x\u0062), and matching follows C# identifier equality: @class, cl\u0061ss, and class (or a\u200Cb and ab) are the same name.
  • C# (Pro) now parses identifiers using Unicode XID characters such as ℘ (U+2118) and · (U+00B7), and still accepts formatting characters (e.g. soft hyphen) inside identifiers.

  (c-sharp-pro-v0.23.1)

• hcl grammar update (v1.2.0):

  • Terraform target parsing now supports namespaced function calls such as provider::local::fn(...).
  • Terraform parsing now represents conditional and loop template directives with their conditions, binders, and bodies.
  • Terraform parsing now binds attribute and index traversal more tightly than unary operators.

  (hcl-v1.2.0)

• lua grammar update (v0.5.0):

  • Lua parsing now supports Lua 5.4 variable attributes and Lua 5.5 leading attributes, global declarations, and named vararg parameters.
  • Lua parsing now accepts Unicode identifiers, hashbang lines, and additional numeric forms including LuaJIT binary, LL/ULL, and imaginary literals.
  • Lua AST conversion now preserves elseif branches in source order, including when an else branch is present, and correctly retains member-assignment receivers and colon-method declaration names.
  • Lua string ASTs now separate single-quoted and long-bracket delimiters from their content, consistently with double-quoted strings. Escape contents remain uninterpreted.
  • Lua parsing now handles builtin names such as next as ordinary callable identifiers.

  (lua-v0.5.0)

### Fixed

• Fix C++ range-based for loops with structured bindings so they parse and preserve findings in the rest of the file. (CODE-10028)
• Python only: a requirements.txt line declared as a version range or bare name is now reported as a direct dependency even when a requirements.in manifest is present. Such a line can only have been written by hand, since pip-compile emits exact pins, so it is a direct declaration regardless of whether the manifest names the package. Exact pins keep using the manifest to decide between direct and transitive. (SC-4242)

### Infra/Release Changes

• Update the bundled Tree-sitter Elixir grammar to v0.3.5 and regenerate its parser with Tree-sitter 0.26.3; no language syntax changes. (elixir-v0.3.5)

astral-sh/uv (uv)

v0.13.5

Compare Source

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements

• Report incompatible self-dependencies directly in resolution errors (#​21845)

Python

• Add CPython 3.15.1, 3.14.9, and 3.13.17 (#​22802)

Preview features

• Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#​22535, #​22536, #​22687, #​22688)

Performance

• Reduce peak memory use when resolving dependencies across multiple environments (#​22769, #​22770, #​22784)
• Speed up exports with complex transitive extras by resolving activation across the dependency graph (#​22751)
• Reduce uv's binary size by keeping additional error formatters out of line (#​22775)
• Reduce overhead when parsing custom build cache keys (#​22749)

Bug fixes

• Lock packages distributed only as Android wheels without a source distribution (#​22806)
• Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#​22751)
• Reject invalid custom build cache keys instead of silently falling back to the defaults (#​22749)

Security

• Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#​22777)
• Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#​22773)

v0.13.4

Compare Source

Released on 2026-10-20.

Preview features

• Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under wheel-variants (#​22512)

Other changes

• Update the bundled Mozilla root certificates via webpki-root-certs 1.0.10 (#​22760)

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ccdc6758-55c1-4562-8462-1a3e283f5f22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ccdc6758-55c1-4562-8462-1a3e283f5f22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}