Mend-hosted renovate fails to update mise lock due to not trusting config

[theZMC]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.194.0

Please tell us more about your question or problem

Renovate does not trust the mise config prior to attempting to update the lockfile, leading to a failure.

Logs (if relevant)

Logs

Only the relevant logs are below. Job ID is a4bfbe11-adbe-4b09-a42d-ada3b98a17e7

{
  "name": "renovate",
  "hostname": "jr-microvm",
  "pid": 730,
  "level": 20,
  "logContext": "5210a1be-90e1-4681-916c-1e795b9bdf74",
  "repository": "theZMC/dotfiles",
  "branch": "renovate/all-minor-patch",
  "err": {
    "cmd": "mise lock aws-cli bun deno docker-cli dotnet-core flux2 gh go go:github.com/charmbracelet/crush go:golang.org/x/tools/gopls helm kubectl npm npm:@a
nthropic-ai/claude-code npm:@astrojs/language-server npm:@playwright/cli npm:@playwright/mcp npm:@slidev/cli npm:@sveltejs/mcp npm:@upstash/context7-mcp npm:ag
ent-browser npm:ctx7 npm:opencode-ai npm:skills npm:svelte-language-server oh-my-posh pnpm pulumi python ruff sops terraform usage uv yazi",
    "stderr": "mise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERROR Config files in /tmp/renov
ate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more infor
mation.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stdout": "",
    "options": {
      "cwd": "/tmp/renovate/repos/github/theZMC/dotfiles/.config/mise",
      "env": [
        "GITHUB_TOKEN",
        "HOME",
        "PATH",
        "LC_ALL",
        "LANG",
        "CONTAINERBASE_CACHE_DIR"
      ],
      "maxBuffer": 10485760,
      "timeout": 900000,
      "stdin": "pipe",
      "stdout": "pipe",
      "stderr": "pipe"
    },
    "exitCode": 1,
    "name": "ExecError",
    "message": "Command failed: mise lock aws-cli bun deno docker-cli dotnet-core flux2 gh go go:github.com/charmbracelet/crush go:golang.org/x/tools/gopls hel
m kubectl npm npm:@anthropic-ai/claude-code npm:@astrojs/language-server npm:@playwright/cli npm:@playwright/mcp npm:@slidev/cli npm:@sveltejs/mcp npm:@upstash
/context7-mcp npm:agent-browser npm:ctx7 npm:opencode-ai npm:skills npm:svelte-language-server oh-my-posh pnpm pulumi python ruff sops terraform usage uv yazi\
nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERROR Config files in /tmp/renovate/repos/gith
ub/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.\nmise 
ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stack": "ExecError: Command failed: mise lock aws-cli bun deno docker-cli dotnet-core flux2 gh go go:github.com/charmbracelet/crush go:golang.org/x/tools/
gopls helm kubectl npm npm:@anthropic-ai/claude-code npm:@astrojs/language-server npm:@playwright/cli npm:@playwright/mcp npm:@slidev/cli npm:@sveltejs/mcp npm
:@upstash/context7-mcp npm:agent-browser npm:ctx7 npm:opencode-ai npm:skills npm:svelte-language-server oh-my-posh pnpm pulumi python ruff sops terraform usage
 uv yazi\nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERROR Config files in /tmp/renovate/r
epos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more informatio
n.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n\n    at ChildProcess.<anonymous> (file:///usr/local/renovate/lib/util/exec/common.ts
:169:13)\n    at ChildProcess.emit (node:events:521:24)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:intern
al/child_process:295:12)"
  },
  "durationMs": 603,
  "msg": "rawExec err",
  "time": "2026-05-24T04:07:42.334Z",
  "v": 0
}
{
  "name": "renovate",
  "hostname": "jr-microvm",
  "pid": 730,
  "level": 20,
  "logContext": "5210a1be-90e1-4681-916c-1e795b9bdf74",
  "repository": "theZMC/dotfiles",
  "branch": "renovate/pnpm-11.x",
  "err": {
    "cmd": "mise lock pnpm",
    "stderr": "mise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERROR Config files in /tmp/renov
ate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more infor
mation.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stdout": "",
    "options": {
      "cwd": "/tmp/renovate/repos/github/theZMC/dotfiles/.config/mise",
      "env": [
        "GITHUB_TOKEN",
        "HOME",
        "PATH",
        "LC_ALL",
        "LANG",
        "CONTAINERBASE_CACHE_DIR"
      ],
      "maxBuffer": 10485760,
      "timeout": 900000,
      "stdin": "pipe",
      "stdout": "pipe",
      "stderr": "pipe"
    },
    "exitCode": 1,
    "name": "ExecError",
    "message": "Command failed: mise lock pnpm\nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise
 ERROR Config files in /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.
dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stack": "ExecError: Command failed: mise lock pnpm\nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.t
oml\nmise ERROR Config files in /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https:/
/mise.en.dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n\n    at ChildProcess.<anonymous> (fil
e:///usr/local/renovate/lib/util/exec/common.ts:169:13)\n    at ChildProcess.emit (node:events:521:24)\n    at ChildProcess.emit (node:domain:489:12)\n    at P
rocess.ChildProcess._handle.onexit (node:internal/child_process:295:12)"
  },
  "durationMs": 602,
  "msg": "rawExec err",
  "time": "2026-05-24T04:08:02.600Z",
  "v": 0
}
{
  "name": "renovate",
  "hostname": "jr-microvm",
  "pid": 730,
  "level": 20,
  "logContext": "5210a1be-90e1-4681-916c-1e795b9bdf74",
  "repository": "theZMC/dotfiles",
  "branch": "renovate/lock-file-maintenance",
  "err": {
    "cmd": "mise lock",
    "stderr": "mise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERROR Config files in /tmp/renov
ate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more infor
mation.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stdout": "",
    "options": {
      "cwd": "/tmp/renovate/repos/github/theZMC/dotfiles/.config/mise",
      "env": [
        "GITHUB_TOKEN",
        "HOME",
        "PATH",
        "LC_ALL",
        "LANG",
        "CONTAINERBASE_CACHE_DIR"
      ],
      "maxBuffer": 10485760,
      "timeout": 900000,
      "stdin": "pipe",
      "stdout": "pipe",
      "stderr": "pipe"
    },
    "exitCode": 1,
    "name": "ExecError",
    "message": "Command failed: mise lock\nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\nmise ERRO
R Config files in /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/c
li/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stack": "ExecError: Command failed: mise lock\nmise ERROR error parsing config file: /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml\n
mise ERROR Config files in /tmp/renovate/repos/github/theZMC/dotfiles/.config/mise/config.toml are not trusted.\nTrust them with `mise trust`. See https://mise
.en.dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n\n    at ChildProcess.<anonymous> (file:///
usr/local/renovate/lib/util/exec/common.ts:169:13)\n    at ChildProcess.emit (node:events:521:24)\n    at ChildProcess.emit (node:domain:489:12)\n    at Proces
s.ChildProcess._handle.onexit (node:internal/child_process:295:12)"
  },
  "durationMs": 473,
  "msg": "rawExec err",
  "time": "2026-05-24T04:08:11.927Z",
  "v": 0
}

[BrianHicks]

Having the same issue here, so leaving a +1 rather than opening a new request. Also hosted by Mend, 43.194.0, GitHub. Here's the relevant log in my case (job ID 019e5f14-69cc-79f2-a83f-4c1014541e24):

Relevant log line

WARN: Error updating mise.lock (branch="renovate/pnpm-10.x-lockfile")
{
  "err": {
    "cmd": "mise lock pnpm",
    "stderr": "mise ERROR error parsing config file: /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml\nmise ERROR Config files in /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stdout": "",
    "options": {
      "cwd": "/tmp/renovate/repos/github/bytes-zone/alitempe",
      "env": [
        "GITHUB_TOKEN",
        "HOME",
        "PATH",
        "LC_ALL",
        "LANG",
        "CONTAINERBASE_CACHE_DIR"
      ],
      "maxBuffer": 10485760,
      "timeout": 900000,
      "stdin": "pipe",
      "stdout": "pipe",
      "stderr": "pipe"
    },
    "exitCode": 1,
    "name": "ExecError",
    "message": "Command failed: mise lock pnpm\nmise ERROR error parsing config file: /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml\nmise ERROR Config files in /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n",
    "stack": "ExecError: Command failed: mise lock pnpm\nmise ERROR error parsing config file: /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml\nmise ERROR Config files in /tmp/renovate/repos/github/bytes-zone/alitempe/mise.toml are not trusted.\nTrust them with `mise trust`. See https://mise.en.dev/cli/trust.html for more information.\nmise ERROR Run with --verbose or MISE_VERBOSE=1 for more information\n\n    at ChildProcess.<anonymous> (file:///usr/local/renovate/lib/util/exec/common.ts:169:13)\n    at ChildProcess.emit (node:events:521:24)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:295:12)"
  }
}

[viceice]

@zeitlinger can you please have a look?

[onedr0p]

I tried to update my config to allow this

  allowedEnv: [
    "MISE_TRUSTED_CONFIG_PATHS"
  ],
  env: {
    MISE_TRUSTED_CONFIG_PATHS: "/tmp/renovate/repos"
  },

However I see this issue:

{
  "error": {
    "validationSource": ".renovaterc.json5",
    "validationError": "The renovate configuration file contains some invalid settings",
    "validationMessage": "Env variable name `MISE_TRUSTED_CONFIG_PATHS` is not allowed by this bot's `allowedEnv`.",
    "message": "config-validation",
    "stack": "Error: config-validation\n    at mergeRenovateConfig (file:///usr/local/renovate/lib/workers/repository/init/merge.ts:266:19)\n    at processTicksAndRejections (node:internal/process/task_queues:104:5)\n    at getRepoConfig (file:///usr/local/renovate/lib/workers/repository/init/config.ts:14:12)\n    at initRepo (file:///usr/local/renovate/lib/workers/repository/init/index.ts:58:12)\n    at instrument.attributes (file:///usr/local/renovate/lib/workers/repository/index.ts:84:18)\n    at renovateRepository (file:///usr/local/renovate/lib/workers/repository/index.ts:58:42)\n    at instrument.attributes (file:///usr/local/renovate/lib/workers/global/index.ts:212:11)\n    at start (file:///usr/local/renovate/lib/workers/global/index.ts:197:7)\n    at file:///usr/local/renovate/lib/renovate.ts:26:22"
  }
}

Which makes sense because I don't think allowedEnv works using the mend app.

[jamietanna]

#43606 looks like this may be the solution we want

[mxmehl]

@jamietanna, may I ask why you marked this problem as answered? As a user of the Mend app it seems I cannot do anything to fix the error, e.g. appearing in OpenRailAssociation/website#161 (comment)

[die-herdplatte]

@mxmehl The Renovate version of the Mend app is at 43.209.4 (fix was included in 43.210.1)

[mxmehl]

Ah, I didn't see this PR. Thanks!

[mxmehl]

Will the Mend app add mise to its allowed unsafe extensions?

From the linked PR:

Self-hosted administrators must explicitly allow this path by including mise in the global allowedUnsafeExecutions setting.
When mise is allowed and an existing mise.lock is present, Renovate explicitly runs mise trust before mise lock from the repository checkout. This makes the trust step visible in logs and lets mise own any future trust behavior changes.

In particular:

• an existing mise.lock is required
• self-hosted administrators decide whether this unsafe execution is acceptable for their environment