[home-infrastructure-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
yq	tools	patch	4.54.1 → 4.54.2	4.54.3

---

Release Notes

mikefarah/yq (yq)

v4.54.2

Compare Source

• Fixed command injection risk in shell output with -o=shell -r: unsafe values are now quoted and a warning is logged. Use --security-force-never-escape-shell-output to restore the previous unsafe behaviour (GHSA-h2cv-65fq-jgrp)
  • Fixed YAML structure being changed when assigning head comments (#​2847) Thanks @​rootsec1
  • Fixed ireduce to run per pipeline input, matching jq's reduce behaviour (#​2869) Thanks @​00200200
  • Fixed map_values to remove entries when the expression returns nothing (#​2862) Thanks @​yuefdev
  • Fixed preservation of comments on TOML inline table values (#​2879) Thanks @​iamhuman-cheolheelee
  • Fixed INI keys containing colons (#​2886)
  • Fixed YAML line numbers after header preprocessing (#​2939) Thanks @​imharjot
  • Fixed an extra leading comment blank line with CRLF input (#​2856) Thanks @​cestercian
  • Cleaned up failed in-place edits (#​2920) Thanks @​Boulea7
  • Bumped dependencies

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[home-infrastructure-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: .mise/mise.lock

�[33mmise�[0m �[33mWARN�[0m  /tmp/renovate/repos/github/denniseffing/containers/.mise/mise.lock uses lockfile format version 3; run `mise lock --upgrade` to enable the latest lockfile features
�[2mmise�[0m downloading artifact for lock-time provenance verification: yq_darwin_arm64
�[2mmise�[0m downloading artifact for lock-time provenance verification: yq_linux_arm64
�[2mmise�[0m downloading artifact for lock-time provenance verification: yq_linux_amd64
�[33mmise�[0m �[33mWARN�[0m  HTTP GET https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64 attempt 1 failed after 11.14s (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64); retrying in 174.030253ms
�[33mmise�[0m �[33mWARN�[0m  HTTP GET https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64 attempt 2 failed after 16.6ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64); retrying in 549.274828ms
�[33mmise�[0m �[33mWARN�[0m  HTTP GET https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64 attempt 3 failed after 16.7ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/yq_linux_amd64); retrying in 3.526223573s
�[2mmise�[0m lock            yq@4.54.2 linux-x64
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 1 failed after 11.20s (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 155.70685ms
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 1 failed after 11.20s (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 142.94413ms
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 2 failed after 18.8ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 935.423095ms
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 2 failed after 18.6ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 537.804071ms
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 3 failed after 18.8ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 3.518608015s
�[33mmise�[0m �[33mWARN�[0m  HTTP HEAD https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle attempt 3 failed after 18.9ms (transient): HTTP status server error (504 Gateway Timeout) for url (https://github.com/mikefarah/yq/releases/download/v4.54.2/checksums-bsd.bundle); retrying in 3.945139696s
�[2mmise�[0m lock            yq@4.54.2 linux-arm64
�[2mmise�[0m lock            yq@4.54.2 macos-arm64
�[31mmise�[0m �[31mERROR�[0m failed to resolve yq for linux-x64: lock-time provenance verification failed
�[31mmise�[0m �[31mERROR�[0m Version: 2026.11.5 linux-x64 (2026-11-09)
�[31mmise�[0m �[31mERROR�[0m �[2mRun with --verbose or MISE_VERBOSE=1 for more information�[0m