test(deps): update dependency mise to v2026.4.25 (main)

[renovate]

This PR contains the following updates:

Package	Update	Change
mise	patch	2026.4.24 → 2026.4.25

---

Release Notes

jdx/mise (mise)

v2026.4.25: : Sharper task tooling and lockfile fixes

Compare Source

A patch release focused on smoothing rough edges in tasks (sandbox path resolution, dependency templates, a new --name-only listing) and fixing a handful of upgrade/ls-remote pitfalls.

Added

• (task) New --name-only flag on mise tasks ls (and mise tasks) prints one task name per line — no headers, no padding, no description column (#​9435) by @​jdx. It composes with --all, --global/--local, --hidden, --sort/--sort-order, and uses a broken-pipe-tolerant writer so dropping it into fzf Just Works:

  mise run "$(mise tasks ls --name-only --all | fzf)"

  Conflicts with --json, --extended, and --usage.

Fixed

• (task) Dependency templates can now branch on usage values inside Tera statement tags, not just output expressions, and boolean/array flags are passed through with their real types instead of stringified (#​9424) by @​jdx. So this finally does what it looks like:

  [tasks.lint]
  usage = 'flag "--run-post" default=#false'
  depends_post = ['''
      {%- if usage.run_post -%}
          postlint:**
      {%- else -%}
          noop
      {%- endif -%}
  ''']
  run = 'echo "lint ran"'

• (task) Tasks that define usage with subcommands but no top-level args/flags now correctly populate usage.cmd for dependency templates, fixing a regression from #​9424 where the early-return path skipped subcommand handling (#​9431) by @​jdx. The fix also de-duplicates make_usage_ctx between the script parser and the dep renderer so they can't drift again.

• (task) Sandbox allow_read / allow_write paths declared on a task are now resolved against the task's effective working directory rather than the shell's pwd (#​9428) by @​jdx. Previously, dir = "../bar" plus allow_read = ["."] opened up the caller's directory while the task itself ran in bar/ and got blocked. CLI overrides like mise run --allow-read=… still resolve against shell cwd. Closes #​9423.

• (lockfile) mise upgrade now updates the global lockfile (~/.config/mise/mise.lock) when bumping a fuzzy version such as latest (#​9442) by @​jdx. The grouping pass was excluding global config files entirely, and fuzzy requests could re-resolve through the stale lockfile entry mid-update. Newly installed versions are now overlaid before lockfiles are rewritten, so a global dummy = "latest" upgrading from 1.0.0 to 2.0.0 actually pins 2.0.0.

• (aqua) When list_releases_including_prereleases returned an empty list (paginated/cached edge case, throttling, or a repo that genuinely has no releases), aqua fell back to list_tags and pulled in every git tag in the repo (#​9443) by @​jdx. For monorepos that tag sub-crates, that meant ripgrep's grep-regex-0.1.1 and friends ended up in the shared mise-versions snapshot, so ripgrep = "latest" resolved to a tag with no matching release asset and 404'd on install. Empty release lists now propagate as empty version lists; packages that legitimately use tags as their version source still opt in via version_source = "github_tag". The remote_versions cache filename is also reverted to remote_versions.msgpack.z to avoid needlessly invalidating existing caches — VersionInfo already deserializes forward-compatibly. (Server-side mise-versions snapshots will need to be regenerated with this fix.)

• (ls-remote) mise ls-remote --json no longer emits "rolling":false,"prerelease":false on every entry (#​9439) by @​jdx. Dummy output is now [{"version":"1.0.0"},{"version":"1.1.0"},{"version":"2.0.0"}]. Backends that legitimately set either flag (rust nightly/beta/stable, github/aqua pre-releases) still emit the field; cached entries written by older builds continue to deserialize.

• (docs) The docs site no longer flickers between light/dark themes on initial load (#​9427) by @​vhespanha. VitePress's anti-flicker inline script is now marked data-cfasync="false" so Cloudflare's Rocket Loader stops deferring it. Fixes #​9393.

• (Dockerfile) copr-cli is now installed via dnf instead of pip, fixing ModuleNotFoundError: No module named 'rich' in the publish-copr workflow (#​9421) by @​bestagi.

Documentation

• The docs site swaps GoatCounter for a self-hosted page tracker proxied through a Cloudflare Worker at shrill.en.dev (#​9430) by @​jdx. GTM is unchanged.

New Contributors

• @​vhespanha made their first contribution in #​9427
• @​bestagi made their first contribution in #​9421

Full Changelog: jdx/mise@v2026.4.24...v2026.4.25

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.