From a50e56ae58a849568c23b28035e79ef9404096ad Mon Sep 17 00:00:00 2001 From: Keith Huster Date: Sun, 11 Oct 2026 17:01:30 -0600 Subject: [PATCH 1/2] fix(renovate): look up the 1Password CLI under its aqua name The hosted Renovate app runs mise lock in safe mode, which refuses to install the vfox plugin behind op. Repositories that switch to the built-in aqua:1password/cli backend still need the custom datasource. --- renovate/mise.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate/mise.json b/renovate/mise.json index 07bca6e..1991469 100644 --- a/renovate/mise.json +++ b/renovate/mise.json @@ -38,7 +38,7 @@ { "description": "1Password publishes the CLI only on its own site. Its release history lists every version, and betas are skipped because their paths carry a suffix after the patch number. rangeStrategy pin rejects versions from this datasource as invalid, so this rule uses replace.", "matchManagers": ["mise"], - "matchDepNames": ["1password", "op", "vfox:op"], + "matchDepNames": ["1password", "aqua:1password/cli", "op", "vfox:op"], "overrideDatasource": "custom.1password-cli", "overridePackageName": "1password-cli", "extractVersion": "/op2/pkg/v(?\\d+\\.\\d+\\.\\d+)/op_darwin_arm64_", From 33bb93d6453d1bc9f6d68b103b2fd97cd684d4da Mon Sep 17 00:00:00 2001 From: Keith Huster Date: Sun, 11 Oct 2026 17:01:40 -0600 Subject: [PATCH 2/2] docs: add the v2.1.2 changelog entry --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90e6356..5982429 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## v2.1.2 + +- `renovate/mise` points `aqua:1password/cli` at the 1Password CLI datasource. The hosted Renovate app locks mise tools in safe mode, which can't install the vfox plugin behind `op`, so repositories pin the CLI through mise's built-in aqua backend instead. + ## v2.1.1 - The repository guides add a rule for secrets several repos share: a shared vault is for people and local tooling only, and a repo's automation gets its own credential from the provider instead of reading the shared vault.