[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise-action	action	patch	v5.2.0 → v5.2.1	v5.2.3 (+1)

---

Release Notes

jdx/mise-action

v5.2.1: : Require the signed packslip for mise 2026.9.3 and later

Compare Source

The action now refuses to install mise 2026.9.3 or later if the release's signed packslip is missing. This closes a gap where verification could be downgraded to the weaker checksum check.

Fixed

• A missing packslip no longer weakens the check on recent mise releases. v5.2.0 started checking the mise binary against the release's signed packslip.sigstore.json. If that file wasn't found, though, the action quietly fell back to the minisign-signed SHASUMS256 checksums. Anyone who could hide the file could force the weaker check. Every mise release from 2026.9.3 on includes a packslip, so for those versions a missing bundle now stops the install with an error like this:

  mise v2026.10.11 must ship a signed packslip, but https://github.com/jdx/mise/releases/download/v2026.10.11/packslip.sigstore.json was not found
  

  Releases before 2026.9.3 don't include a packslip, so they're still checked against the signed checksums. A version string that isn't three dot-separated numbers also requires a packslip. If you set the sha256 input, it still takes precedence over both checks. A packslip that fails verification still never falls back to the checksums. (#​695 by @​jdx)

Full Changelog: jdx/mise-action@v5.2.0...v5.2.1

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: JACOCO-246

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating the pinned mise setup action changes CI tool-install verification; missing signed packslips for recent releases could now fail builds.

Bumps the jdx/mise-action GitHub Action from v5.2.0 to v5.2.1, which refuses to install mise 2026.9.3 or later when the signed packslip.sigstore.json is missing instead of falling back to the weaker checksum check. No issues found.

Verification Rules 1/3 met

Rules 2 failed 1 passed

❌ Approved GitHub Actions runners - .github/workflows/cleanup-cache.yml uses retired sonar-xs-public; replace with sonar-xs (Linux generic, no Docker). Other workflows use approved sonar-xs/sonar-m/warp-custom-windows-2022-m. Pre-existing, not introduced by this PR.
❌ Repository license compliance - sonar-jacoco's approved license file is LICENSE (LGPL-3.0), but the repo has LICENSE.txt; rename it to LICENSE (content is valid LGPL-3.0). Pre-existing, unrelated to this PR's action bump.
✅ Internal artifact registries

Functional validation No results

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.