[mise-en-dev]

🚀 Features

• (config) name sets of environments with env_sets in miserc.toml by @jdx in #15327
• (npm) accept gitlab.com CI provenance when npm.provenance is on by @jdx in #15335
• (npm) pin an npm tool to the repository its provenance showed by @jdx in #15338
• (vfox) show download progress for a PreInstall url by @jdx in #15323

🐛 Bug Fixes

• (activate) keep $? for the prompt mise wraps in pwsh by @meop in #15315
• (aqua) install Linux musl builds on Android by @i-api in #15347
• (backend) keep latest on non-numeric releases under the release-age cutoff by @jdx in #15360
• (config) skip a stale tracked file that no config type claims by @jdx in #15333
• (lock) keep a v0 lockfile's pin when an alias like lts moves by @jdx in #15301
• (lock) leave the global lockfile alone on project installs by @jdx in #15348
• (lock) quiet the unsigned-mirror warning and install's background lock rows, and restore the showreel by @jdx in #15346
• (npm) keep pnpm installs inside the install dir by @jdx in #15330
• (rust) stop querying GitHub when a rustup mirror is configured by @jdx in #15326
• (shim) run command wrappers on a read-only filesystem by @jdx in #15300
• (upgrade) skip out-of-range note for versions another entry already uses by @jdx in #15359
• (zig) install from the lockfile URL and fix the fallback archive name by @jdx in #15351

📚 Documentation

• (install) recommend the PowerShell script on Windows by @jdx in #15332

🧪 Testing

• (docs) accept curl flags in the showreel's README install check by @jdx in #15324

📦️ Dependency Updates

• lock file maintenance by @renovate[bot] in #15319
• update rust crate jsonschema to 0.60 by @renovate[bot] in #15311
• lock file maintenance by @renovate[bot] in #15325
• update rattler by @renovate[bot] in #15336
• ignore unmaintained astral-tokio-tar and pin-utils in cargo-deny by @jdx in #15352
• update jdx crates to v7.2.0 by @renovate[bot] in #15342
• update mise tools to latest by @renovate[bot] in #15350
• update github actions by @renovate[bot] in #15309

📦 Registry

• fix blaze test for the ra-jit to blaze rename by @jdx in #15371

Ci

• (docs) fail the docs deploy when the showreel has no render by @jdx in #15344

Security

• (npm) breaking verify npm provenance by default by @jdx in #15341

New Contributors

• @meop made their first contribution in #15315

📦 Aqua Registry Updates

Updated Packages (1)

• supabase/cli

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 2

• chore: release
• chore(main): release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: jdx/mise
• Branch: release
• File: .coderabbit.yaml
• Commit: 7040ebc
• Layers: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 20739606-ea29-47dc-9762-b1e3dd435e09

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with the previously reported runner restriction remaining a non-blocking concern.

Findings

1.   Runner restriction is ignored ▶

Summary

Prepares release 2026.11.1.

• mise package metadata now identifies the 2026.11.1 release.
• Aqua now checks Supabase CLI archives against their release checksums and attestations.

_{Reviews (24) · Last reviewed commit: "chore: release 2026.11.1" · Reviewed by Greptile}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[greptile-apps]

Runner restriction is ignored

The new Supabase recipe sets deny_self_hosted_runners: true, but AquaGithubArtifactAttestations has no field for it, so mise silently drops the restriction. A valid attestation from the required signer_workflow on a self-hosted runner can still pass. Users therefore get a weaker check than the recipe declares.

Add support for the field and enforce it when checking attestations; keep the vendored recipe unchanged.

How this was verified: The recipe’s runner restriction is absent from the parsed type, and the verification path forwards only the workflow and predicate requirements.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.