Recurring maintenance batch (2026-05-27) (#360)

Bundle of recurring overdue tasks:

- Ringtail flake update
- Security & compliance report review
- Tooling deps bump (prek, fly, mise, forgejo workflows)
- Top stale doc review
- Top stale service review (if trivial)

Larger items (service version bumps requiring upgrades, non-local container migration) split out as separate PRs.

Reviewed-on: #360

mise-tasks/branch-cleanup

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Delete branches that have been merged into main (local and remote)"
 #MISE alias="bc"

mise-tasks/container-build-and-release

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["typer==0.25.0", "httpx==0.28.1"]
+# dependencies = ["typer==0.26.2", "httpx==0.28.1"]
 # ///
 #MISE description="Trigger container build workflows via Forgejo API"
 #USAGE arg "<container>" help="Container name (directory under containers/)"

mise-tasks/container-list

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="List available containers and their recent tags"
 #USAGE arg "[name]" help="Optional container name to filter output"

mise-tasks/container-version-check

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Validate container version consistency across container.py, Dockerfiles, nix derivations, and service-versions.yaml"
 #USAGE flag "--all-files" help="Check all containers, not just changed ones"

mise-tasks/dns-acme-cleanup

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Delete orphaned ACME challenge TXT records in eblu.me"
 #USAGE flag "--dry-run" help="List orphans without deleting"

mise-tasks/docs-mikado

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "pyyaml==6.0.3", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="View active Mikado dependency chains for C2 changes"
 #USAGE arg "[card]" help="Card stem to show chain for"

mise-tasks/docs-preview

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Build docs with Dagger and serve locally, opening to a specific card"
 #USAGE arg "<card>" help="Card path relative to docs/, e.g. how-to/knowledgebase/review-documentation"

mise-tasks/docs-review

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Review the most stale documentation card by last-reviewed date"
 #USAGE flag "--limit <limit>" default="15" help="Number of docs to show in the table"

mise-tasks/docs-review-stale

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Report docs by git-last-modified date, highlighting stale ones"
 #USAGE flag "--threshold <threshold>" default="180" help="Days before a doc is considered stale"

mise-tasks/mikado-branch-invariant-check

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Validate Mikado Branch Invariant on mikado/* branches"
 #USAGE arg "[commit_msg_file]" help="Commit message file (passed by commit-msg hook)"

mise-tasks/op-backup

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Encrypt a 1Password .1pux export and send to indri for borgmatic"
 #USAGE arg "[export_path]" help="Path to .1pux export file (prompted if omitted)"

mise-tasks/pr-comments

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="List unresolved comments on a PR"
 #USAGE arg "<pr_number>" help="Pull request number"

mise-tasks/prune-ringtail-generations

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Prune old NixOS generations on ringtail, preserving rollback safety"
 #MISE alias="prg"

mise-tasks/review-compliance-reports

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["rich==15.0.0", "typer==0.25.0", "pyyaml==6.0.3"]
+# dependencies = ["rich==15.0.0", "typer==0.26.2", "pyyaml==6.0.3"]
 # ///
 #MISE description="Summarize the latest Prowler and Kingfisher compliance reports from sifaka"
 #USAGE flag "--full" help="Show all unmuted failures, not just new ones"

mise-tasks/runner-logs

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="List recent Forgejo Actions runs or fetch logs for a specific job"
 #USAGE arg "[run_number]" help="Run number to show jobs for (omit to list recent runs)"

mise-tasks/service-review

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Review the most stale service for version freshness"
 #USAGE flag "--limit <limit>" default="15" help="Number of services to show in the table"

mise-tasks/spork-create

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S uv run --script
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.25.0"]
+# dependencies = ["httpx==0.28.1", "rich==15.0.0", "typer==0.26.2"]
 # ///
 #MISE description="Create a spork (floating-branch soft-fork) of a mirrored upstream project"
 #USAGE arg "<repo_name>" help="Repository name in the mirrors/ org on forge (e.g. kingfisher)"