build(deps): bump jdx/mise-action from 4.3.0 to 5.0.1

[dependabot]

Bumps jdx/mise-action from 4.3.0 to 5.0.1.

Release notes

Sourced from jdx/mise-action's releases.

v5.0.1: Verify cached mise binaries before running them

mise-action now checks the integrity of an already-installed mise binary before running it. This fixes a security issue that was reported privately.

Fixed

• An existing mise binary is verified before it is run. When a mise binary is already on the runner (for example, restored from cache or in mise_dir), the action now checks it before calling it. If you set a sha256 input, the binary must match that checksum and report the requested version. Otherwise, it must match the signed release checksums for the version being installed. If the check fails, the action prints a warning, deletes the binary and installs the requested release again. Before this fix, the action could run a cached binary before checking it. (#637 by @​jdx)

Changed

Changes to how the action handles an existing binary, also from #637:

• Switching versions uses a full install. If the cached binary doesn't match the requested version, the action downloads and installs that version. It no longer runs mise self-update.
• Unpinned runs always pick a release. Without a version input, the action now selects a release every time, using minimum_release_age, even when mise is already installed. It then checks the existing binary against that release, and reinstalls if the binary doesn't match.
• Older releases need a sha256 input to reuse a cached binary. Some older mise releases have no signed checksums. With the sha256 input set, a cached binary of one of these releases can still be reused without a download. Without it, the action can't verify the binary and installs it again.

Full Changelog: jdx/mise-action@v5.0.0...v5.0.1

v5.0.0: Default minimum release age of 24 hours for mise

If you don't pin a version, mise-action now installs the newest stable mise release that is at least 24 hours old. Upgrading mise on a runner that already has it is also less likely to hit GitHub API rate limits.

Breaking Changes

minimum_release_age now defaults to 24h (#632 by @​jdx)

Before this release, minimum_release_age was an opt-in setting. It now defaults to 24h. If you don't set version, the action picks the highest-numbered stable mise release published at least 24 hours ago. A mise release that just shipped won't be installed until it's a day old.

To get the latest stable release right away, as in v4, set the delay to 0s. You can also choose a longer delay:

- uses: jdx/mise-action@v5
  with:
    minimum_release_age: 0s   # or e.g. 7d

• An explicit version input still takes precedence and skips the delay.
• The setting applies only to the mise binary, not to tools installed by mise.
• The action now gets the release list from a public CDN index (releases.tsv on mise.jdx.dev) instead of paging through the GitHub Releases API. Picking a release doesn't use GitHub API quota, even when an installed binary is reused. If the index is missing or malformed, the action fails instead of skipping the release-age check.
• Replacing an older installed binary still runs mise self-update, which may call the GitHub API to fetch that exact release.

Fixed

• mise self-update now runs with MISE_GITHUB_TOKEN. When a runner already had a different mise version installed, the action runs mise self-update to switch versions. That GitHub API call used to go out without authentication, so busy shared or self-hosted runners could hit the rate limit and fail with HTTP 403 RateLimitedError. If you already set a token in your environment, the action leaves it unchanged. (#619 by @​hegde5)

New Contributors

• @​hegde5 made their first contribution in #619

Full Changelog: jdx/mise-action@v4.3.0...v5.0.0

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.0.1 - 2026-09-30

🐛 Bug Fixes

• verify cached mise before execution (#637) by @​jdx in #637

---

5.0.0 - 2026-09-28

🚀 Features

• breaking default minimum release age to 24 hours (#632) by @​jdx in 279d505

🐛 Bug Fixes

• fix: authenticate mise self-update to avoid GitHub API rate limits (#619) by @​hegde5 in #619

⚙️ Miscellaneous Tasks

• (entire) store checkpoints in a private repository by @​jdx in 15b2b0f
• (entire) commit codex session hooks by @​jdx in b0eb15f
• (entire) commit claude session hooks by @​jdx in 6ac0f83
• (entire) restore lower-cost trail findings by @​jdx in aa79241
• remove entire and codex agent hooks by @​jdx in 07f40cf
• add entire trail runners (#624) by @​jdx in #624
• remove Entire trail runners (#630) by @​jdx in #630
• float jdx tools and aube on latest without a release-age delay (#631) by @​jdx in #631

New Contributors

• @​hegde5 made their first contribution in #619

---

4.3.0 - 2026-08-25

🚀 Features

• add minimum release age for mise (#604) by @​jdx in #604

---

4.2.5 - 2026-08-13

🐛 Bug Fixes

• retry mise downloads after transient failures (#597) by @​jdx in #597

---

... (truncated)

Commits

• 7a4e45a chore: release v5.0.1 (#638)
• c4102d4 fix: verify cached mise before execution (#637)
• baf7eb4 chore(deps): update dependency aube to latest (#636)
• c75796c chore(deps): update dependency communique to latest (#635)
• ec2665b chore(deps): update github actions (#633)
• 342b4c0 chore(deps): update dependency aube to latest (#634)
• 9149ea8 chore: release v5.0.0 (#620)
• 279d505 feat!: default minimum release age to 24 hours (#632)
• aa79241 chore(entire): restore lower-cost trail findings
• 6ac0f83 chore(entire): commit claude session hooks
• Additional commits viewable in compare view

[dependabot]

Looks like jdx/mise-action is up-to-date now, so this is no longer needed.