[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise-action	action	patch	v5.2.4 → v5.2.5	v5.2.6

---

Release Notes

jdx/mise-action

v5.2.5: : Bundled packslip verifier updated to 1.11.0; README examples use v5

Compare Source

This release updates the packslip library that the action uses to verify downloaded mise releases, and updates the README examples to use the current major versions.

Changed

• packslip updated from 1.8.0 to 1.11.0. The action uses packslip to check a downloaded mise binary against the signed packslip.sigstore.json that ships with mise releases from 2026.9.3 onward. The new version runs extra checks on the signed statement: the identity it declares must match the certificate that signed it, and the certificate must belong to the github.com/jdx/mise repository. GitHub and GitLab repository names now match regardless of letter case. The action still asks for the same identity, issuer and tag as before, and there are no new inputs. (#​715)
• The README examples now use jdx/mise-action@v5 and actions/checkout@v7. (#​710 by @​deining)

Full Changelog: jdx/mise-action@v5.2.4...v5.2.5

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7305

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating the pinned mise action across build workflows changes release-signature verification, which could reject downloads and prevent CI jobs from starting.

Updates the jdx/mise-action GitHub Action from v5.2.4 to v5.2.5, which bumps the bundled packslip verifier to 1.11.0 and refreshes README examples to jdx/mise-action@v5. No issues found.

Verification Rules 2/3 met PRs 2 inspected

Rules 1 failed 2 passed

❌ Approved GitHub Actions runners - Retired sonar-xs-public label is used in build.yml (line 484) and PrepareNextIteration.yml (line 13); replace with sonar-xs per the runners policy (https://xtranet-sonarsource.atlassian.net/wiki/spaces/Platform/pages/3694231566/GitHub+Actions+Runners+-+GitHub).
✅ Internal artifact registries
✅ Repository license compliance

Functional validation No results

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 358: Update jdx/mise-action action to v5.2.5 Inspected
PR 146: Update jdx/mise-action action to v5.2.5 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.