chore(deps): update dependency mise to v2026.5.15 (#2137)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.5.11` →
`v2026.5.15` |
| [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.5.5` →
`v2026.5.15` |

---

### Release Notes

<details>
<summary>jdx/mise (mise)</summary>

###
[`v2026.5.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.15):
: loongarch64 and riscv64 support

[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.5.14...v2026.5.15)

A small release that recognizes `loongarch64` and `riscv64` as valid
platform arches and refreshes the conda (rattler) backend.

##### Fixed

- Add `loongarch64` and `riscv64` to the set of arches accepted by
`Platform::validate()`. Previously, lockfiles targeting `linux-riscv64`
or `linux-loongarch64` would fall back to the common platform set
instead of resolving to the requested single platform, so installs on
those machines couldn't use lockfile-authoritative platform selection
([#&#8203;10038](https://redirect.github.com/jdx/mise/pull/10038) by
[@&#8203;k0tran](https://redirect.github.com/k0tran)).

##### Changed

- Bump `rattler` (used by the conda backend) from 0.42 to 0.43, picking
up upstream fixes for missing symlinks during Windows installs,
deterministic path ordering from `link_package_sync`, and accepting full
URLs as the OAuth issuer host
([#&#8203;10030](https://redirect.github.com/jdx/mise/pull/10030)).

##### New Contributors

- [@&#8203;k0tran](https://redirect.github.com/k0tran) made their first
contribution in
[#&#8203;10038](https://redirect.github.com/jdx/mise/pull/10038)

**Full Changelog**:
<jdx/mise@v2026.5.14...v2026.5.15>

##### 💚 Sponsor mise

mise is built by [@&#8203;jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.

If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.

###
[`v2026.5.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.14):
: Reject wrong-arch release assets

[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.5.13...v2026.5.14)

A small fix release that hardens GitHub release asset auto-selection
against picking binaries for the wrong CPU architecture.

#### Fixed

- **(github)** Asset auto-selection now hard-rejects any candidate whose
filename explicitly declares a non-matching architecture, even when
other scoring bonuses (preferred name, archive type, libc match) would
otherwise rank it first. This fixes cases like `cargo-msrv` on aarch64
Linux, where `cargo-msrv-x86_64-unknown-linux-gnu-*.tgz` was being
chosen over no-match-better-than-wrong-match. Explicit `asset_pattern`
configuration is unchanged
([#&#8203;10018](https://redirect.github.com/jdx/mise/pull/10018) by
[@&#8203;jdx](https://redirect.github.com/jdx)).

**Full Changelog**:
<jdx/mise@v2026.5.13...v2026.5.14>

#### 💚 Sponsor mise

mise is built by [@&#8203;jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.

If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.

###
[`v2026.5.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.13):
: Safer npm installs, faster shell completions

[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.5.12...v2026.5.13)

A focused release that tightens npm install safety by default, removes
network calls from shell completion generation, and fixes asset picking
so primary release binaries beat related sub-archives.

#### Added

- **(npm)** The npm backend now passes `--ignore-scripts=true` by
default when installing through `npm`, and no longer adds Bun's
`--trust` flag automatically. `npm_args` and `bun_args` remain the user
escape hatches and are appended after the defaults, so you can opt back
in per tool
([#&#8203;9913](https://redirect.github.com/jdx/mise/pull/9913) by
[@&#8203;risu729](https://redirect.github.com/risu729)):

  ```toml
  [tools]
  # opt back into npm lifecycle scripts for one tool
"npm:some-tool" = { version = "latest", npm_args =
"--ignore-scripts=false" }
  # opt into Bun's broad install-time script trust
  "npm:other-tool" = { version = "latest", bun_args = "--trust" }
  ```

For dependency build approvals, prefer `aube` or `pnpm` with
`--allow-build=<pkg>`; see the refreshed npm backend docs.

#### Fixed

- **(completion)** `mise completion` is often invoked on shell init. It
no longer refreshes remote version metadata while building the toolset,
so slow networks and timeouts don't delay every new shell
([#&#8203;10010](https://redirect.github.com/jdx/mise/pull/10010) by
[@&#8203;sargunv-headway](https://redirect.github.com/sargunv-headway)).
- **(github)** Auto-detection scoring now gives a small bonus to assets
whose platform-stripped filename matches the repo/tool name, and treats
`manylinux*` / `musllinux*` asset names as Linux with the right
glibc/musl libc. This fixes installs like `opengrep/opengrep`, where
`opengrep-core_linux_aarch64.tar.gz` was previously winning over the
primary `opengrep_*` binary. Explicit `asset_pattern` configuration is
unchanged
([#&#8203;10008](https://redirect.github.com/jdx/mise/pull/10008) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(shim)** Optioned tool aliases (e.g. GitHub `tool_alias` entries
with per-alias `asset_pattern` / `bin_path`) are now visible to runtime
symlink and shim rebuilds. Previously these alias backends bypassed the
global backend cache and could be missed after install, leaving `latest`
symlinks or executable shims unbuilt
([#&#8203;9848](https://redirect.github.com/jdx/mise/pull/9848) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(release)** The embedded `mise-plugins` vfox plugin set now includes
`vfox-groovy`, `vfox-php`, and `vfox-scala` as fallbacks after the
default asdf backend
([#&#8203;9832](https://redirect.github.com/jdx/mise/pull/9832) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(doctor)** The `mise doctor` version-check request now uses the
regular HTTP client and the configured `http_timeout` (controllable via
`MISE_HTTP_TIMEOUT`), instead of an unconfigurable 3s timeout. Timeout
error messages now point at the real setting
([#&#8203;9977](https://redirect.github.com/jdx/mise/pull/9977) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(config)** Tool options coming from the install manifest are tracked
as their own source layer, kept below config and inline backend args in
precedence, and no longer serialized back out as inline backend args
([#&#8203;9958](https://redirect.github.com/jdx/mise/pull/9958) by
[@&#8203;risu729](https://redirect.github.com/risu729)).

#### Changed

- **(registry)** `vector` now uses the aqua backend, which has
Vector-specific `vdev-*` release filtering. This avoids resolving stray
`vdev-*` GitHub releases as the latest Vector
([#&#8203;10011](https://redirect.github.com/jdx/mise/pull/10011) by
[@&#8203;jdx](https://redirect.github.com/jdx)).
- **(registry)** `vale` now tracks its updated aqua-registry location
([#&#8203;10002](https://redirect.github.com/jdx/mise/pull/10002) by
[@&#8203;eread](https://redirect.github.com/eread)).
- **(dotnet)** The .NET backend reads `prerelease` (and other tool
options) through a local typed option reader, with the legacy
package-flag fallback preserved
([#&#8203;9962](https://redirect.github.com/jdx/mise/pull/9962) by
[@&#8203;risu729](https://redirect.github.com/risu729)).

**Full Changelog**:
<jdx/mise@v2026.5.12...v2026.5.13>

#### 💚 Sponsor mise

mise is built by [@&#8203;jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.

If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.

###
[`v2026.5.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.12):
: minimum-release-age, global edit, and install_env fixes

[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.5.11...v2026.5.12)

A focused release that renames the release-age cutoff flag to something
more discoverable, deprecates the legacy `default_packages_file`
mechanism, and fixes several `install_env` propagation gaps across
backends.

#### Added

- **(cli)** `mise edit --global` / `-g` opens the global config file
(`~/.config/mise/config.toml`, or `$MISE_GLOBAL_CONFIG_FILE` if set),
bringing `mise edit` in line with `mise use --global`, `mise settings
set --global`, and other commands. A positional path still wins over the
flag ([#&#8203;9953](https://redirect.github.com/jdx/mise/pull/9953) by
[@&#8203;fru1tworld](https://redirect.github.com/fru1tworld)).
- **(cli)** The release-age cutoff flag on `mise install`, `use`,
`upgrade`, and `latest` has been renamed from `--before` to
`--minimum-release-age`, matching the per-tool option and global setting
of the same name. The old `--before` spelling is kept as a hidden alias
so existing scripts keep working
([#&#8203;9768](https://redirect.github.com/jdx/mise/pull/9768) by
[@&#8203;risu729](https://redirect.github.com/risu729)):

  ```sh
  mise latest node --minimum-release-age 2024-01-01
  mise install --minimum-release-age 90d
  ```

#### Fixed

- **(aqua)** Verify cosign bundles that ship a long-lived public key via
`cosign.opts --key` locally, instead of routing them through
`sigstore-verify`'s unsupported public-key bundle path. This fixes
installs like `aqua:stackrox/kube-linter@0.8.3`, which previously failed
with `public key verification not yet supported`
([#&#8203;9972](https://redirect.github.com/jdx/mise/pull/9972) by
[@&#8203;jdx](https://redirect.github.com/jdx)).
- **(backend)** Per-tool `install_env` is now passed into tool-level
`postinstall` hook commands
([#&#8203;9930](https://redirect.github.com/jdx/mise/pull/9930) by
[@&#8203;risu729](https://redirect.github.com/risu729)) and applied to
command-backed install paths across package-manager backends, vfox
`cmd.exec` hooks, SPM build/probe commands, and core language
install-time commands
([#&#8203;9929](https://redirect.github.com/jdx/mise/pull/9929) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(cargo)** Fall back to `cargo install` (instead of `cargo-binstall`)
when tool options require source-build feature selection.
`cargo-binstall` is still used for compatible options such as `bin`,
`crate`, and `locked`
([#&#8203;9928](https://redirect.github.com/jdx/mise/pull/9928) by
[@&#8203;risu729](https://redirect.github.com/risu729)).
- **(config)** Restore the `env_file` setting and the `MISE_ENV_FILE`
env var, which had been incorrectly marked deprecated. `env._.file` in
`mise.toml` is the right replacement for legacy top-level `env_file`
entries, but it's not behaviorally equivalent to `MISE_ENV_FILE=.env`,
which uses `FindUp` from the current directory
([#&#8203;9903](https://redirect.github.com/jdx/mise/pull/9903) by
[@&#8203;risu729](https://redirect.github.com/risu729)).

#### Changed

- **(core)** Default package files are now on a deprecation timeline
([#&#8203;9970](https://redirect.github.com/jdx/mise/pull/9970) by
[@&#8203;jdx](https://redirect.github.com/jdx)). The settings
`go.default_packages_file`, `node.default_packages_file`,
`python.default_packages_file`, and `ruby.default_packages_file` (i.e.
`~/.default-go-packages`, `~/.default-npm-packages`,
`~/.default-python-packages`, `~/.default-gems`) will start emitting a
warning in `2026.11.0` and be removed in `2027.11.0`. The recommended
replacements are package-manager backends for CLIs:

  ```toml
  [tools]
  "npm:typescript" = "latest"
  "pipx:black"     = "latest"
  "gem:rubocop"    = "latest"
  "go:github.com/jesseduffield/lazygit" = "latest"
  ```

or a tool-level `postinstall` hook for packages that really should be
installed into every runtime version:

  ```toml
  [tools]
  node = { version = "22", postinstall = "npm install -g typescript" }
  ```

- **(cli)** User-facing help, docs, and the man page now use
tool/backend wording instead of plugin/runtime where tools are not
necessarily plugins, including renaming `MISE_${PLUGIN}_VERSION`
references to `MISE_${TOOL}_VERSION`. `mise tool-alias` now prefers
`--tool` as the primary long flag, with `--plugin` retained as an alias
([#&#8203;9906](https://redirect.github.com/jdx/mise/pull/9906) by
[@&#8203;risu729](https://redirect.github.com/risu729)).

- **(registry)** The `qsv` shorthand now resolves to `aqua:dathere/qsv`
first, falling back to the existing `github:dathere/qsv` and
`asdf:vjda/asdf-qsv` entries
([#&#8203;9910](https://redirect.github.com/jdx/mise/pull/9910) by
[@&#8203;risu729](https://redirect.github.com/risu729)).

- **(snap)** The snap package is now built and published for `arm64` in
addition to `amd64`, so `snap install mise` works on arm64 desktops
([#&#8203;9948](https://redirect.github.com/jdx/mise/pull/9948) by
[@&#8203;jnsgruk](https://redirect.github.com/jnsgruk)).

#### New Contributors

- [@&#8203;jnsgruk](https://redirect.github.com/jnsgruk) made their
first contribution in
[#&#8203;9948](https://redirect.github.com/jdx/mise/pull/9948)
- [@&#8203;fru1tworld](https://redirect.github.com/fru1tworld) made
their first contribution in
[#&#8203;9953](https://redirect.github.com/jdx/mise/pull/9953)

**Full Changelog**:
<jdx/mise@v2026.5.11...v2026.5.12>

#### 💚 Sponsor mise

mise is built by [@&#8203;jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.

If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 4am on Monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/prometheus/client_java).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Jay DeLuca <jaydeluca4@gmail.com>

Author: renovate[bot]

.github/workflows/acceptance-tests.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
       - name: Run acceptance tests
         run: mise run acceptance-test

.github/workflows/build.yml

@@ -14,8 +14,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:

.github/workflows/generate-protobuf.yml

@@ -21,8 +21,8 @@ jobs:
           persist-credentials: true
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:

.github/workflows/github-pages.yaml

@@ -39,8 +39,8 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
           cache: "false"
       - name: Setup Pages
         id: pages

.github/workflows/java-version-matrix-tests.yml

@@ -33,8 +33,8 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
 
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

.github/workflows/lint.yml

@@ -23,8 +23,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
 
       - name: Lint
         env:

.github/workflows/micrometer-compatibility.yml

@@ -25,8 +25,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.5
-          sha256: 3aaab5c05a8a94a93b42b4f581779bbd5c44ddb251e7f3639fc671ec5c6aab8a
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:

.github/workflows/native-tests.yml

@@ -15,8 +15,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
           working_directory: .mise/envs/native
       - name: Run native tests
         working-directory: .mise/envs/native

.github/workflows/nightly-benchmarks.yml

@@ -36,8 +36,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
 
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

.github/workflows/release.yml

@@ -29,8 +29,8 @@ jobs:
 
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: v2026.5.11
-          sha256: 9bb41ae4dbe2bcdfdbe36cf3c737a8bdb72035c03af3b7218a70780988f62b9b
+          version: v2026.5.15
+          sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
           cache: false
 
       - name: Build release version