Skip to content

v2026.3.16: Fix unnecessary GitHub API calls during locked installs

Choose a tag to compare

View all tags
@mise-en-dev mise-en-dev released this 26 Mar 11:20
· 90 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2026.3.16
This tag was signed with the committer’s verified signature.
mise-en-dev
GPG key ID: 8B81C9D17413A06D
Verified
Learn about vigilant mode.
ad051de
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A small patch release that fixes mise install --locked making unnecessary GitHub Releases API calls even when the lockfile already contains pre-resolved URLs and checksums.

Fixed

  • mise install --locked no longer makes unnecessary GitHub API calls -- The aqua backend's cosign verification path was unconditionally downloading checksum files via the GitHub Releases API, even when cosign was disabled in settings or the package had no cosign configuration. This caused mise install --locked to fail in restricted network environments despite the lockfile having everything needed to install offline. The fix checks settings.aqua.cosign and whether the package actually has cosign configured before attempting any download. #8753 by @jdx

Full Changelog: v2026.3.15...v2026.3.16

Contributors

jdx
Assets 47
Loading