Mise update of PyPI-backed Ansible fails with Python lock mismatch

[esafak]

Environment

• Renovate 44.103.7
• Mise 2026.10.17 linux-x64
• Tool: ansible = { version = "latest", expose = ["ansible-core"] }
• Mise backend: pypi:ansible
• Existing locked version: 14.4.0; Renovate is updating it to 14.5.0

Problem

During a normal Mise tool update, Renovate invokes mise lock ansible. Mise fails because the existing Python/uv sidecar does not match the newly requested tool version, and specifically recommends mise lock --bump ansible.

Relevant output from the failed Renovate run (ANSI color codes removed):

DEBUG: Executing command (repository=foo/bar, baseBranch=renovate/reconfigure, branch=renovate/ansible-14.x-lockfile)
       "command": "mise lock ansible"
       "env": ["GITHUB_TOKEN", "HOME", "PATH", "CI", "RUSTUP_HOME", "CARGO_HOME", "MISE_DATA_DIR", "MISE_GLOBAL_CONFIG_FILE", "MISE_TRUSTED_CONFIG_PATHS"]
→ Targeting 7 platform(s) for /tmp/renovate/repos/github/foo/bar/mise.lock
→ Processing 1 tool(s): ansible@14.5.0
mise ERROR Python lock does not match the requested tool; run `mise lock --bump ansible`
mise ERROR Version: 2026.10.17 linux-x64 (2026-10-21)

Expected

Renovate should regenerate the Python sidecar and lock artifacts when updating a PyPI-backed Mise tool, while preserving the configured selector (latest) and not bumping unrelated tools.

Actual

Artifact generation fails with the lock-mismatch error, so Renovate cannot produce the lock update for the new Ansible version.

Investigation

In Renovate 44.103.7, the Mise artifact updater's normal dependency-update path runs mise lock <updated tools>; --bump is only selected for lock-file maintenance. See artifacts.ts.

There is related but distinct work in PR #46847; its regular tool-update path still uses targeted mise lock <tool>.

Is there a supported way to regenerate this sidecar during normal version updates, or should the Mise manager use a different command/flow for Python-backed tools?

[Muguett-DBY]

For repairing this branch, try targeting the exact version Renovate selected:

mise lock --bump ansible@14.5.0

The explicit version matters here: mise lock --bump ansible re-resolves latest, which could move past 14.5.0. The command above keeps version = "latest" in mise.toml and only targets Ansible. Commit the resulting mise.lock and its changed dependency sidecars together.

I checked this with the released mise 2026.10.17 Windows binary and uv 0.13.5, using your expose = ["ansible-core"] setting and an unrelated pypi:cowsay entry. I first generated a valid 14.4.0 lock, then changed just its recorded version to 14.5.0 while retaining the old graph:

Command	Result
mise lock ansible	Same Python lock mismatch, exit 1
mise lock --bump ansible@14.5.0	Regenerated the graph, exit 0
mise lock ansible afterwards	Exit 0

mise.toml and the cowsay sidecars stayed byte-for-byte unchanged; the cowsay lock entry was unchanged too. This was a reduced lockfile reproduction, not a run of your Linux Renovate job.

In mise, populate_uv_locks validates an existing graph unless forced; --bump forces regeneration. So the manager fix should preserve both the targeted tool and the version Renovate selected, rather than broadly bumping all tools. One implementation detail in the 44.103.7 updater: allowlisted, non-maintenance runs currently skip the mise version probe. A version-gated --bump fix would need to cover that path as well.

The command above is a branch repair, not a persistent Renovate configuration fix. The mise lock reference documents the distinction between lockfile bumping and rewriting configured pins.

[esafak]

I am not trying to repair the local renovate branch. I want renovate to bump properly on its own.

[Muguett-DBY]

You're right. The manual repair doesn't solve the automatic update you asked for.

I've submitted a manager fix in draft PR #47341. It makes Renovate regenerate the Python sidecar at its selected version before the normal lock refresh, preserving latest and leaving unrelated tools alone. It also checks the mise version on the allowlisted path before using --bump.

The reproduction repository calls the actual Renovate artifact updater. With the original source it returns your lock-mismatch error; with the patch, both allowlisted and safe-mode runs return the updated lockfile and Python sidecars. Ansible reaches 14.5.0, while the config and Cowsay files stay unchanged. These runs were on Windows, not your hosted Linux job.

This still needs maintainer review and a release before Renovate can do it for you automatically. The implementation and this reply were prepared with Codex.