mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-02 18:43:40 +00:00
jdx
94f0219613
* feat(manager/mise): run mise lock in safe mode without allowedUnsafeExecutions When `constraints.mise` pins a version that supports mise safe mode (`MISE_SAFE=1`), run `mise lock` with safe mode enabled instead of requiring `mise` in `allowedUnsafeExecutions`. Safe mode is a hard boundary against project config executing code (templates exec/read_file, _.source, hooks, tasks, asdf scripts, plugin installs are all refused), so it — not the allowlist — protects the host. The existing allowlisted path is unchanged: allowlisted repos run `mise lock` exactly as before, without forcing safe mode, so configs that legitimately execute code during locking keep working. Safe mode also removes the need to pre-install node/npm/golang/ruby as resolver tools, since npm version listing uses mise's built-in registry HTTP client and go runs with GOTOOLCHAIN=local. Refs: jdx/mise#11146 (safe mode), jdx/mise#11145 (lock --bump) * fix: address oxlint and pin safe-mode min version to 2026.7.12 - logger.warn requires a static message with interpolated values in the metadata object (oxlint rule); move the version into metadata - set MISE_SAFE_MODE_MIN_VERSION to 2026.7.12, the expected first release containing safe mode (merged after v2026.7.11) * feat(manager/mise): use mise lock --bump for lock file maintenance lockFileMaintenance means "update to the latest versions", but plain `mise lock` only refreshes metadata for already-locked versions. Use `mise lock --bump` so fuzzy selectors (e.g. node = "22") advance to the latest matching version. `--bump` requires the same minimum mise version as safe mode, so it is gated on the mise constraint and falls back to a plain refresh otherwise. Generalizes the version-gate helper (miseConstraintGuarantees) shared by safe mode and --bump. * refactor(manager/mise): detect mise version at runtime instead of via constraints Determine safe-mode / --bump support by running `mise version` (which does not load or execute project config) rather than requiring a pinned `constraints.mise`. This works off whatever mise is actually installed, so no extra configuration is needed. The probe is skipped on the allowlisted, non-maintenance path, where the version cannot change the outcome — keeping that hot path unchanged. * feat(manager/mise): skip mise trust in safe mode Safe mode now makes an untrusted config fully inert and no longer requires trust to load it (jdx/mise#11151), so on the safe-mode path `mise trust` is unnecessary and is skipped — `mise lock` runs with `MISE_SAFE=1` alone. The allowlisted path is unchanged and still runs `mise trust`. * feat(manager/mise): confirm safe mode min version against v2026.7.12 release MISE_SAFE=1 safe mode and `mise lock --bump` first shipped in mise v2026.7.12 (released 2026-07-23), confirming the assumed MISE_SAFE_MODE_MIN_VERSION. Resolve the pending-release TODO and align the test version fixture with the real release date. Validated end-to-end against the real v2026.7.12 binary: `mise version` output matches the parser, `MISE_SAFE=1 mise lock` refreshes an untrusted config without trust, `mise lock --bump` advances fuzzy selectors, and project [env] is ignored under safe mode. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(manager/mise): cover mise version probe failure path Add a test for the detectMiseVersion catch branch (exec throwing), so the non-allowlisted path falls back to conservative behavior. Restores 100% patch coverage for the mise manager. * Update lib/modules/manager/mise/readme.md Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com> * Update lib/modules/manager/mise/readme.md Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com> * docs(mise): fix safe mode section link --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>