[dependabot]

Bumps the actions group with 2 updates: jdx/mise-action and jdx/jactionlint.

Updates jdx/mise-action from 5.2.1 to 5.2.3

Release notes

Sourced from jdx/mise-action's releases.

v5.2.3: Faster cache key computation in large workspaces

The cache key no longer comes from searching the whole workspace for mise config files. In repos that already contain node_modules or vendor/bundle, this removes a delay of several minutes in "Restoring mise cache".

Fixed

• "Restoring mise cache" no longer takes minutes after installing dependencies. To build the cache key, the action used to match about 25 **/… glob patterns. That meant it walked every subdirectory of the workspace, including node_modules and vendor/bundle, before checking the cache at all. When the action ran after a step like pnpm install or ruby/setup-ruby with bundler-cache: true, this could take 3–7 minutes. The action now looks for mise config files the same way mise does: only in the working directory and each parent directory up to the workspace root. It checks for mise.toml, .mise.toml, .config/mise/…, conf.d fragments, .tool-versions, and their local, env-specific and .lock variants. The step also logs Hashed mise config files in N.Ns. (#703 by @​jdx and @​corsicanec82)
  • If you set a custom cache_key that doesn't use {{file_hash}} or {{default}}, the action no longer hashes config files at all.
  • Config files in subdirectories, such as monorepo sub-projects, no longer affect the cache key. mise only loads them with --monorepo.
  • Cache keys change, so the first run after you upgrade will miss the cache.

New Contributors

• @​corsicanec82 made their first contribution in 91e7f82 (#703)

Full Changelog: jdx/mise-action@v5.2.2...v5.2.3

v5.2.2: Include conf.d config fragments in the cache key

The cache key now includes mise conf.d/*.toml config fragments, so changing one of them invalidates the cache.

Fixed

• Editing a conf.d fragment now invalidates the cache. mise can load config from single-file fragments in conf.d/ directories, but the action didn't hash those files when it built the cache key. As a result, adding or changing tools in a fragment could restore an outdated cache. The cache key now also hashes conf.d/*.toml files under .config/mise/, .mise/ and mise/. If your repo already uses these fragments, the cache will miss once after you upgrade. (#698 by @​rileymichael)

New Contributors

• @​rileymichael made their first contribution in #698

Full Changelog: jdx/mise-action@v5.2.1...v5.2.2

Changelog

Sourced from jdx/mise-action's changelog.

5.2.3 - 2026-10-24

🐛 Bug Fixes

• (cache) hash mise config files without walking the workspace (#703) by @​jdx in #703

---

5.2.2 - 2026-10-21

🐛 Bug Fixes

• hash conf.d config fragments in cache key (#698) by @​rileymichael in #698

New Contributors

• @​rileymichael made their first contribution in #698

---

Commits

• 82a612c chore: release v5.2.3 (#704)
• 2d0418b chore(deps): update dependency hk to latest (#705)
• e891dde chore(deps): update jdx/mise-action action to v5.2.0 (#706)
• 91e7f82 fix(cache): hash mise config files without walking the workspace (#703)
• 9a35c22 chore(deps): update github actions (#701)
• 8418fed chore: release v5.2.2 (#699)
• bb33e9b chore(deps): update communique, hk in mise.lock (#700)
• 0cc9f84 fix: hash conf.d config fragments in cache key (#698)
• 7ce9a02 chore(deps): lock file maintenance (#697)
• See full diff in compare view

Updates jdx/jactionlint from 2.2.0 to 2.3.0

Release notes

Sourced from jdx/jactionlint's releases.

v2.3.0: allow-unused for config ignores, and a Go toolchain fix for online checks

jactionlint 2.3.0 adds an allow-unused option to ignores entries in the config file and fixes a workflow-call-permissions false positive for OIDC. It is also built with Go 1.27.3, so online checks reject certificates from the compromised eMudhra CA.

Added

• allow-unused for durable ignores. An ignores entry with allow-unused: true is not reported as unused-ignore when it suppresses nothing. Use it for findings that come and go, such as one caused by a moving tag. expired-ignore still reports the entry when it expires. The default is false, and any value other than true or false is a config error. The option is also in the config JSON Schema. (#297, @​jdx)

  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true

Fixed

• workflow-call-permissions no longer reports a missing id-token: write when the caller sets no permissions: and assume-default-permissions is permissive or not set. In that case, GitHub gives the called job an OIDC token. With assume-default-permissions: restricted, jactionlint still reports it. (#299, @​jdx)
• Online checks reject forged certificates from the compromised eMudhra CA. Release binaries are now built with Go 1.27.3, which rejects these certificate chains. Older binaries do not have this fix, so replace them with this release if you use --online. (#301, @​jdalton)

New Contributors

• @​jdalton made their first contribution in #292

Full Changelog: jdx/jactionlint@v2.2.0...v2.3.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

Changelog

Sourced from jdx/jactionlint's changelog.

2.3.0 (2026-10-21)

Features

• config: add allow-unused to durable ignores (#297) (69311d3)
• upstream: catch workflow analyzer gaps earlier (#288) (439e97d)

Bug Fixes

• build with Go 1.27.3 to reject compromised eMudhra certificates (#301) (cca9bb8)
• workflow-call-permissions: grant id-token to a silent caller under the permissive default (#299) (493a916)

Commits

• a65ab04 chore(main): release 2.3.0 (#295)
• cca9bb8 fix: build with Go 1.27.3 to reject compromised eMudhra certificates (#301)
• 4aa701f test(schema): pin the latest actions/runner schemas (#300)
• 493a916 fix(workflow-call-permissions): grant id-token to a silent caller under the p...
• 69311d3 feat(config): add allow-unused to durable ignores (#297)
• 439e97d feat(upstream): catch workflow analyzer gaps earlier (#288)
• 1bcb264 docs: rewrite the README and redesign the home page (#293)
• 8f0ce5d ci: parallelize unit tests and builds (#292)
• e278392 docs: generate the social image in the docs build (#291)
• dfd49ed docs: refresh the social image for 2.2 (#290)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Bumps jdx/mise-action to 5.2.3 and jdx/jactionlint to 2.3.0 in the Actions lock, CI, docs, and release workflows.

• jdx/mise-action builds cache keys faster (no more workspace-wide glob walk) and now hashes conf.d fragments; cache keys change, so the first run after this upgrade misses the cache.
• jdx/jactionlint adds an allow-unused option for config ignores, fixes a workflow-call-permissions false positive, and rejects certificates from the compromised eMudhra CA.

^{Written for commit 15b5e5b. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.