v2026.4.14

jdx/misev2026.4.14Apr 15, 2026by mise-en-dev

AI Summary

Fixes GitHub artifact attestation verification failures for tools installed via the `github:` backend by bumping the `sigstore-verification` library.

Key Highlights

  • Fixed GitHub artifact attestation verification for tools with specific SAN URL formats.

Full Release Notes

A small patch release that fixes GitHub artifact attestation verification failures affecting some tools installed via the `github:` backend.

## Fixed

- **GitHub artifact attestation verification failing for some tools** -- Tools installed via the `github:` backend that use GitHub release attestations (e.g. `github:jdx/communique@0.1.9`, `github:jdx/fnox@1.20.0`) could fail verification because the upstream `sigstore-verification` library did not handle GitHub release attestation certificates whose Subject Alternative Name (SAN) URL lacked a trailing slash. The dependency has been bumped from 0.2.3 to 0.2.5, which includes the upstream fix. [#9128](https://github.com/jdx/mise/pull/9128) by @jdx

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.13...v2026.4.14