v2026.4.14
jdx/misev2026.4.14Apr 15, 2026by mise-en-dev
AI Summary
Fixes GitHub artifact attestation verification failures for tools installed via the `github:` backend by bumping the `sigstore-verification` library.
Key Highlights
- Fixed GitHub artifact attestation verification for tools with specific SAN URL formats.
Full Release Notes
A small patch release that fixes GitHub artifact attestation verification failures affecting some tools installed via the `github:` backend. ## Fixed - **GitHub artifact attestation verification failing for some tools** -- Tools installed via the `github:` backend that use GitHub release attestations (e.g. `github:jdx/communique@0.1.9`, `github:jdx/fnox@1.20.0`) could fail verification because the upstream `sigstore-verification` library did not handle GitHub release attestation certificates whose Subject Alternative Name (SAN) URL lacked a trailing slash. The dependency has been bumped from 0.2.3 to 0.2.5, which includes the upstream fix. [#9128](https://github.com/jdx/mise/pull/9128) by @jdx **Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.13...v2026.4.14