chore(deps): update ⬆️ mise-packages by renovate[bot] · Pull Request #908 · scottames/dots

renovate · 2026-05-23T12:58:16Z

This PR contains the following updates:

Package	Update	Change	Pending
aqua:astral-sh/uv	patch	`0.11.14` → `0.11.15`	`0.11.16`
aqua:google/go-containerregistry	patch	`0.21.5` → `0.21.6`
aqua:psf/black	patch	`26.5.0` → `26.5.1`
aqua:sst/opencode	patch	`1.15.4` → `1.15.5`	`1.15.10` (+3)
github:agavra/tuicr	minor	`0.14.1` → `v0.15.0`	`v0.16.0`
github:always-further/nono	minor	`0.55.0` → `v0.56.0`	`v0.57.0`
github:janosmiko/lfk	patch	`0.12.0` → `v0.12.1`	`v0.12.3` (+1)
npm:socket	patch	`1.1.97` → `1.1.99`	`1.1.102` (+2)
npm:stylelint (source)	minor	`17.11.1` → `17.12.0`

Release Notes

astral-sh/uv (aqua:astral-sh/uv)

`v0.11.15`

Compare Source

Released on 2026-05-18.

Security

Fix a TAR partial differential, see GHSA-3cv2-h65g-fgmm (#19463)
Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#19464)

Enhancements

Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#18741)
Add support for Azure request signing (#19421)
Apply stricter validation to all wheel filename segments (#19364)
Reject empty strings as an invalid package name (#19435)
Use structured errors for signing authentication failures (#19422)

Preview

uv audit: Add JSON output (#19305)

Configuration

Respect required-environments in uv pip compile (#19378)

Performance

Avoid parsing JSON manifest when local Python is available (#19398)
Avoid walking nested directories in linker conflict registration (#19382)
Optimize async wheel ZIP writing (#19383)
Fix dead "already trimmed" fast-path in Version::only_release_trimmed (#19425)

Bug fixes

Apply workspace-member [tool.uv.sources] credentials under uv sync --frozen (#19423)
Skip empty directories in uv build outputs (#19437)
Fix Git submodule handling when using relative paths (#12156)
Fix line number reporting in netrc parsing (#19452)

Documentation

Move Bazel auth helper setup into integration guide (#19392)

google/go-containerregistry (aqua:google/go-containerregistry)

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

psf/black (aqua:psf/black)

`v26.5.1`

Compare Source

Stable style

Fix unstable formatting of annotated assignments whose subscript annotation contains
an inline comment (e.g. x: list[ # pyright: ignore[...]) (#5130)
Preserve inline comments (including # type: ignore) immediately before a
# fmt: skip line, avoiding AST equivalence failures (#5139)

Packaging

Correct the version in the published executables (#5137)

Documentation

Add Neovim integration guide covering conform.nvim, ALE, and simple command approaches
(#5124)

sst/opencode (aqua:sst/opencode)

`v1.15.5`

Compare Source

Core

Improvements

Preview the native OpenAI runtime path behind an experimental flag
Add --replay and --replay-limit to show recent history when resuming interactive runs

Bugfixes

Fix plugin tools using ask so tool calls complete correctly
Reduce missed /event updates caused by a subscription race
Sort the v2 session list by most recently updated

TUI

Improvements

Refresh the prompt layout after pasting content

Bugfixes

Keep file references scoped to the current workspace
Preserve pasted prompt content when copying
Collapse very long tool output lines to keep the layout readable
Use a higher-contrast paste summary badge color in some themes (@kagura-agent)

Desktop

Improvements

Allow desktop notifications from the renderer
Show free-limit and usage-exceeded dialogs in Desktop
Speed up large session timelines

Bugfixes

Fix question dock overflow and message layout clipping
Hide the prompt placeholder when the input only contains whitespace (@ShrootBuck)
Sync the PWA status bar color with the active theme (@heimoshuiyu)
Install the newest available desktop update instead of reusing a stale download

Thank you to 4 community contributors:

@heimoshuiyu:
- fix: sync PWA status bar theme-color with app color scheme (#28006)
@ShrootBuck:
- fix(app): hide prompt placeholder for whitespace input (#28101)
@kagura-agent:
- fix(tui): use contrast-aware foreground for paste summary badge (#27969)
@SpiritChen51:
- fix(ui): fallback to execCommand for clipboard copy when navigator.clipboard fails (#27993)

agavra/tuicr (github:agavra/tuicr)

`v0.15.0`

Compare Source

What's Changed

demo: automate README gif recording with bash + claude bookends by @agavra in #316
demo: nested fixture tree + cleaner claude tail by @agavra in #317
feat: add no_update_check config option by @MichaelXavier in #319
fix(config): honour wrap = false by @r-vdp in #323
perf(ui): bracket each frame in synchronized output (DEC 2026) by @r-vdp in #322
feat: allow --file to accept a directory for codebase review by @davenonymous in #321
fix(vcs): open worktrees from bare clones, and don't crash on unborn HEAD by @agavra in #325
feat: --all-files for whole-repo annotation by @N4M3Z in #324
add expand after end of diff by @natebrennand in #327
fix: pre-wrap comment box content to prevent border overflow by @daveyeb in #318
release: v0.15.0 by @github-actions[bot] in #330

New Contributors

@MichaelXavier made their first contribution in #319
@davenonymous made their first contribution in #321
@N4M3Z made their first contribution in #324
@daveyeb made their first contribution in #318

Full Changelog: agavra/tuicr@v0.14.1...v0.15.0

always-further/nono (github:always-further/nono)

`v0.56.0`

Compare Source

What's Changed

feat(cli): add option to configure process startup timeout by @lukehinds in #955

Full Changelog: always-further/nono@v0.55.0...v0.56.0

janosmiko/lfk (github:janosmiko/lfk)

`v0.12.1`

Compare Source

Features

add jump-back navigation history (#249) (#256) (c7eae4b)

Bug Fixes

port-forward: reuse local port on restart, fix setup-overlay UX (#253) (d065a5e)
sort: sort numeric/structured columns numerically (#255) (1a13ad0), closes #250

SocketDev/socket-cli (npm:socket)

`v1.1.99`

Compare Source

`v1.1.98`

Compare Source

stylelint/stylelint (npm:stylelint)

`v17.12.0`

Compare Source

It fixes 3 bugs, including a false negative one.

Fixed: block-no-empty reported range when using comments (#9294) (@romainmenke).
Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@romainmenke).
Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@romainmenke).

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- Between 03:00 AM and 05:59 AM (* 3-5 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-23T12:58:20Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mise/mise.lock


mise ERROR mise lock is disabled in --locked mode
hint: Remove --locked or unset MISE_LOCKED=1
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

Command failed: mise lock aqua:astral-sh/uv aqua:google/go-containerregistry aqua:psf/black aqua:sst/opencode github:agavra/tuicr github:always-further/nono github:janosmiko/lfk npm:stylelint
mise ERROR mise lock is disabled in --locked mode
hint: Remove --locked or unset MISE_LOCKED=1
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

🤖 I have created a release *beep* *boop* --- ## [0.46.0](v0.45.0...v0.46.0) (2026-05-31) ### Updates & Misc Chores * **agents:** note local projects + fix opencode npm perms ([de3de3a](de3de3a)) * **chezmoi:** external cleanup ([7b2c0db](7b2c0db)) * **deps:** lock file maintenance ([#898](#898)) ([5e4aca8](5e4aca8)) * **deps:** lock file maintenance ([#903](#903)) ([321821f](321821f)) * **deps:** update ⬆️ aqua-packages ([#888](#888)) ([898fc89](898fc89)) * **deps:** update ⬆️ aqua-packages ([#889](#889)) ([a691018](a691018)) * **deps:** update ⬆️ aqua-packages ([#894](#894)) ([8e096e1](8e096e1)) * **deps:** update ⬆️ aqua-packages ([#896](#896)) ([64a517a](64a517a)) * **deps:** update ⬆️ aqua-packages ([#897](#897)) ([f84e074](f84e074)) * **deps:** update ⬆️ aqua-packages ([#899](#899)) ([dc24aea](dc24aea)) * **deps:** update ⬆️ aqua-packages ([#901](#901)) ([863ada6](863ada6)) * **deps:** update ⬆️ aqua-packages to v4.514.0 ([#904](#904)) ([536e854](536e854)) * **deps:** update ⬆️ aqua-packages to v4.515.0 ([#910](#910)) ([f23b713](f23b713)) * **deps:** update ⬆️ dagger to v0.20.8 ([#891](#891)) ([569a0fb](569a0fb)) * **deps:** update ⬆️ github-actions to v1.3.1 ([#905](#905)) ([99a46a3](99a46a3)) * **deps:** update ⬆️ github-actions to v2.2.2 ([#892](#892)) ([4200758](4200758)) * **deps:** update ⬆️ github-actions to v3 ([#893](#893)) ([99445d2](99445d2)) * **deps:** update ⬆️ mise-packages ([#886](#886)) ([525df2a](525df2a)) * **deps:** update ⬆️ mise-packages ([#887](#887)) ([1a146ff](1a146ff)) * **deps:** update ⬆️ mise-packages ([#895](#895)) ([cd5d32a](cd5d32a)) * **deps:** update ⬆️ mise-packages ([#902](#902)) ([8a9ff12](8a9ff12)) * **deps:** update ⬆️ mise-packages ([#907](#907)) ([a9b6df2](a9b6df2)) * **deps:** update ⬆️ mise-packages ([#908](#908)) ([8dd7d80](8dd7d80)) * **deps:** update ⬆️ mise-packages ([#909](#909)) ([c7c2835](c7c2835)) * **deps:** update ⬆️ mise-packages ([#911](#911)) ([c5ec4ef](c5ec4ef)) * **deps:** update ⬆️ mise-packages ([#912](#912)) ([f730659](f730659)) * **deps:** update ⬆️ mise-packages ([#914](#914)) ([c1a7f75](c1a7f75)) * **deps:** update ⬆️ mise-packages to v4 ([#915](#915)) ([462b7f1](462b7f1)) * **deps:** update ⬆️ mise-packages to v4.2.0 [security] ([#900](#900)) ([62761bc](62761bc)) * **init:** true-up to leverage mise ([cd573e4](cd573e4)) * **opencode:** add permissions ([4292fee](4292fee)) * **openpackage:** true-up w/ .agents ([d96f454](d96f454)) * rm unused abandoned deps ([546aa15](546aa15)) * rm unused abandoned deps ([9ddb5a4](9ddb5a4)) * upgrade trunk ([#890](#890)) ([a844314](a844314)) * upgrade trunk ([#906](#906)) ([c93e0f2](c93e0f2)) * upgrade trunk ([#913](#913)) ([a0d5e61](a0d5e61)) * **zen:** migrate keybinds (+dyff helper) ([126ffc0](126ffc0)) * **zen:** updates to keybinds ([a6a8988](a6a8988)) ### Features * add voxtype (rm hark) ([fa7d8a5](fa7d8a5)) * **agents:** notes regarding recent gotchas ([ea01f33](ea01f33)) * **chezmoi:** add .agents personal repo ([7337181](7337181)) * **fish:** improve startup time ([1ef9303](1ef9303)) * **mise:** add talosctl ([05bf11f](05bf11f)) * **nvim:** keybind for yank buffer path ([7541fff](7541fff)) * **openpackage:** add mattpocock skills ([1d8953e](1d8953e)) * **zellij:** layout split-edit +stacked pane ([b0f2c27](b0f2c27)) ### Bug Fixes * .local/bin path over mise ([fda4825](fda4825)) * gum refs ([44dc219](44dc219)) * **mise:** bash shell integration ([ee6a691](ee6a691)) * **nvim:** disable copilot-ls when not in use ([b2f0617](b2f0617)) * **opencode:** tui keys + permissions ([f25066c](f25066c)) * **voxtype:** support distrobox ([c2e71d3](c2e71d3)) * **zellij-status:** support clear notification ([33d9eea](33d9eea)) ### Code Refactoring * **aqua:** migrate to mise ([0418644](0418644)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: scottames-github-bot[bot] <162828115+scottames-github-bot[bot]@users.noreply.github.com>

chore(deps): update ⬆️ mise-packages

7e0c624

renovate Bot added the dependencies label May 23, 2026

renovate Bot requested a review from scottames as a code owner May 23, 2026 12:58

renovate Bot added the dependencies label May 23, 2026

renovate Bot enabled auto-merge (squash) May 23, 2026 12:58

renovate-approve Bot approved these changes May 23, 2026

View reviewed changes

chore(mise): lock

ca142f2

renovate Bot merged commit 8dd7d80 into main May 23, 2026
5 checks passed

renovate Bot deleted the renovate/mise-packages branch May 23, 2026 13:02

scottames-github-bot Bot mentioned this pull request May 23, 2026

chore(main): release 0.46.0 #885

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update ⬆️ mise-packages#908

chore(deps): update ⬆️ mise-packages#908
renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages

renovate Bot commented May 23, 2026

Uh oh!

renovate Bot commented May 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 23, 2026

Release Notes

Security

Enhancements

Preview

Configuration

Performance

Bug fixes

Documentation

What's Changed

New Contributors

Stable style

Packaging

Documentation

Core

Improvements

Bugfixes

TUI

Improvements

Bugfixes

Desktop

Improvements

Bugfixes

What's Changed

New Contributors

What's Changed

Features

Bug Fixes

Configuration

Uh oh!

renovate Bot commented May 23, 2026

⚠️ Artifact update problem

File name: mise/mise.lock

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants