[dependabot]

Bumps jdx/mise-action from 4 to 5.

Release notes

Sourced from jdx/mise-action's releases.

v5.0.0: Default minimum release age of 24 hours for mise

If you don't pin a version, mise-action now installs the newest stable mise release that is at least 24 hours old. Upgrading mise on a runner that already has it is also less likely to hit GitHub API rate limits.

Breaking Changes

minimum_release_age now defaults to 24h (#632 by @​jdx)

Before this release, minimum_release_age was an opt-in setting. It now defaults to 24h. If you don't set version, the action picks the highest-numbered stable mise release published at least 24 hours ago. A mise release that just shipped won't be installed until it's a day old.

To get the latest stable release right away, as in v4, set the delay to 0s. You can also choose a longer delay:

- uses: jdx/mise-action@v5
  with:
    minimum_release_age: 0s   # or e.g. 7d

• An explicit version input still takes precedence and skips the delay.
• The setting applies only to the mise binary, not to tools installed by mise.
• The action now gets the release list from a public CDN index (releases.tsv on mise.jdx.dev) instead of paging through the GitHub Releases API. Picking a release doesn't use GitHub API quota, even when an installed binary is reused. If the index is missing or malformed, the action fails instead of skipping the release-age check.
• Replacing an older installed binary still runs mise self-update, which may call the GitHub API to fetch that exact release.

Fixed

• mise self-update now runs with MISE_GITHUB_TOKEN. When a runner already had a different mise version installed, the action runs mise self-update to switch versions. That GitHub API call used to go out without authentication, so busy shared or self-hosted runners could hit the rate limit and fail with HTTP 403 RateLimitedError. If you already set a token in your environment, the action leaves it unchanged. (#619 by @​hegde5)

New Contributors

• @​hegde5 made their first contribution in #619

Full Changelog: jdx/mise-action@v4.3.0...v5.0.0

v4.3.0: Install age-filtered mise releases

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

5.2.3 - 2026-10-24

🐛 Bug Fixes

• (cache) hash mise config files without walking the workspace (#703) by @​jdx in #703

---

5.2.2 - 2026-10-21

🐛 Bug Fixes

• hash conf.d config fragments in cache key (#698) by @​rileymichael in #698

New Contributors

• @​rileymichael made their first contribution in #698

---

5.2.1 - 2026-10-19

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

... (truncated)

Commits

• 6be3c7e chore: release v5.2.4 (#709)
• 40dafec fix(cache): reuse signed checksums saved with a cached mise (#708)
• ed63289 chore(deps): lock file maintenance (#707)
• 82a612c chore: release v5.2.3 (#704)
• 2d0418b chore(deps): update dependency hk to latest (#705)
• e891dde chore(deps): update jdx/mise-action action to v5.2.0 (#706)
• 91e7f82 fix(cache): hash mise config files without walking the workspace (#703)
• 9a35c22 chore(deps): update github actions (#701)
• 8418fed chore: release v5.2.2 (#699)
• bb33e9b chore(deps): update communique, hk in mise.lock (#700)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}