image(deps): update image builds

[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	patch	1.15.8 → 1.15.9
jdx/mise	patch	2026.8.8 → 2026.8.9
opentofu/opentofu	patch	1.12.5 → 1.12.6

---

Release Notes

hashicorp/terraform (hashicorp/terraform)

v1.15.9

Compare Source

1.15.9 (August 19, 2026)

BUG FIXES:

• validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#​38994)

NOTES:

• Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#​39036)

jdx/mise (jdx/mise)

v2026.8.9

Compare Source

🚀 Features

• (bootstrap) expose resource provenance by @​jdx in #​12100
• (bootstrap) support self-updating and adopted brew casks by @​ascarter in #​12074
• (bootstrap) compose config roots by @​jdx in #​12105
• (bootstrap) compose services and compose projects by @​jdx in #​12132
• (bootstrap) add symlink copy controls by @​jdx in #​12121
• (config) implicitly trust config for execution commands by @​jdx in #​12107
• (config) support environment-specific conf.d files by @​jdx in #​12151
• (config) support relative ignored config globs by @​jdx in #​12169
• (system) let plugins declare candidate package names by @​jdx in #​12149
• (vfox) pass tool options in hook contexts by @​jdx in #​12174

🐛 Bug Fixes

• (aqua) prefer glibc assets with musl fallback by @​jdx in #​12093
• (backend) keep flavour queries from crossing a '+' by @​Marukome0743 in #​12118
• (backend) key the remote version cache by listing tool options by @​JamBalaya56562 in #​12164
• (bootstrap) create missing directory parents by @​jdx in #​12096
• (docs) route tool search results to mise-versions by @​jdx in #​12097
• (github) match arm assets on arm64 by @​jdx in #​12098
• (hook-env) preserve runtime environment overrides by @​jdx in #​12094
• (http) order remote versions consistently by @​jdx in #​12170
• (python) resolve configured uv for automatic venv by @​jdx in #​12177
• (shell) branch on the exit code in the pwsh command-not-found hook by @​JamBalaya56562 in #​12089
• (shell) skip mise's own commands in the pwsh command-not-found hook by @​JamBalaya56562 in #​12131
• (shell) refresh the environment on auto-install when --no-hook-env omits the hook by @​JamBalaya56562 in #​12117
• (system) resolve dependency executables on Windows by @​jdx in #​12178
• (task) support azure devops cloud ssh urls (remote git sources) by @​cheesemans in #​12102
• (task) normalize Windows task environment paths by @​jdx in #​12173
• (use) scope global install hooks by @​jdx in #​12101
• (vfox) follow symlinks when fingerprinting plugin sources by @​jdx in #​12155
• (vfox) honor systemDependencies in embedded plugins by @​jdx in #​12152
• (vfox) apply netrc credentials to HTTP requests by @​jdx in #​12168
• (which) report uninstalled --tool version instead of "not active" by @​TrevorBurnham in #​12106
• asset selection for non-gz tar variants by @​sgammon in #​12156

🚜 Refactor

• (backend) remove legacy RTX environment variables by @​jdx in #​12172

📚 Documentation

• fix installing mise links by @​jdx in #​12104

⚡ Performance

• (activate) stop pwsh running hook-env twice per directory change by @​jdx in #​12147
• (cache) batch remote blob prefetch by @​jdx in #​12103
• (config) gate idiomatic file detection on idiomatic_version_file_enable_tools by @​jdx in #​12143
• (release) build windows with the serious profile and one TLS stack by @​jdx in #​12146
• (vfox) cache plugin metadata on disk by @​jdx in #​12145

🧪 Testing

• (java) cover version matching with unit tests instead of live metadata by @​Marukome0743 in #​12116

📦️ Dependency Updates

• update h2 to 0.4.16 for RUSTSEC-2026-0258 by @​Marukome0743 in #​12119
• update ghcr.io/jdx/mise:rpm docker digest to 50e4032 by @​renovate[bot] in #​12124
• update swatinem/rust-cache digest to 6323deb by @​renovate[bot] in #​12125
• update ghcr.io/jdx/mise:deb docker digest to bf1cd85 by @​renovate[bot] in #​12123
• update rust crate async-trait to v0.1.92 by @​renovate[bot] in #​12128
• update ghcr.io/jdx/mise:alpine docker digest to d21f898 by @​renovate[bot] in #​12122
• update rust crate blake3 to v1.8.6 by @​renovate[bot] in #​12129
• update rust crate clap to v4.6.6 by @​renovate[bot] in #​12130
• update dependency esbuild to v0.28.2 by @​renovate[bot] in #​12126
• update dependency python to v3.14.7 by @​renovate[bot] in #​12127
• lock file maintenance by @​renovate[bot] in #​12084
• update rust crate ctor to v1.0.13 by @​renovate[bot] in #​12134
• update rust crate expr-lang to v2 by @​renovate[bot] in #​12154
• update aws-sdk-rust monorepo to v1.10.1 by @​renovate[bot] in #​12139

📦 Registry

• point vlang at the maintained v backend by @​jdx in #​12153
• fix llama.cpp version test by @​jdx in #​12157

Chore

• (ci) refresh cursor cloud agent environment by @​jdx in #​12112
• (ci) prevent stale snapcraft releases by @​jdx in #​12142
• (ci) ignore dependency rust-version in automated builds by @​jdx in #​12159
• (ci) retry transient R2 upload failures by @​jdx in #​12158
• (ci) skip redundant release cargo check by @​jdx in #​12166
• (ci) propagate rust-version override to release build by @​jdx in #​12175

Security

• (backend) restrict forge tokens to api origin by @​jdx in #​12167
• block tool install code in safe mode by @​jdx in #​12140

New Contributors

• @​sgammon made their first contribution in #​12156
• @​ascarter made their first contribution in #​12074
• @​TrevorBurnham made their first contribution in #​12106

📦 Aqua Registry Updates

New Packages (3)

• Arata1202/ascdir
• Genymobile/scrcpy
• cloudsmith-io/cloudsmith-cli

opentofu/opentofu (opentofu/opentofu)

v1.12.6

Compare Source

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#​4422)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#​4472)

Full Changelog: opentofu/opentofu@v1.12.5...v1.12.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.