Repository navigation
Commit 89191b4
authored
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4&size=40){kind=avatar}
chore(deps): update dependency jdx/mise to v2026.8.15 (#2436)
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | uses-with | minor |
`v2026.8.11` → `v2026.9.7` |
---
### Release Notes
<details>
<summary>jdx/mise (jdx/mise)</summary>
###
[`v2026.9.7`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.7):
: Lockfile revision 2 with npm and Python dependency graphs, dotfile
conflict inspection
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.9.6...v2026.9.7)
This release introduces `mise.lock` revision 2, which records complete
transitive dependency graphs for npm tools (via embedded aube) and
Python tools (via uv) in native sidecar files, and adds `mise bootstrap
dotfiles conflicts` for inspecting dotfile sync conflicts before
resolving them. It also lets dotfile templates consume bootstrap
secrets, stops `minimum_release_age` from rejecting versions already
committed to a lockfile, and closes a security gap in
`history.describe_command`.
##### Added
- **lock:** Lockfile revision 2 records the full dependency graph of npm
tools installed by embedded aube and of `pypi:` tools installed by uv,
then replays it with a strict frozen install so two projects on the same
top-level version can still receive their own reviewed transitive graph.
Graphs live in native sidecar files (`uv.lock` / `aube-lock.yaml` plus a
manifest) under `.mise/locks/<backend-tool>/<version>/`, referenced from
`mise.lock` by relative path and SHA-256 digest, so the lockfile itself
stays small. Commit the sidecar directory with `mise.lock`. New
lockfiles use revision 2; existing revision 0 and 1 files keep their
format until you run `mise lock --upgrade`. `mise lock --bump <tool>`
refreshes a tool's transitive graph even when its top-level version is
unchanged, ordinary `mise install` validates and accepts hand-edited
sidecars, and `mise install --locked` rejects digest mismatches until
you run `mise lock`. Python graph locking requires uv 0.12.10 or newer
and published wheels for the target platform; Git sources, standalone
pipx installs, and free-form `uvx_args`/`pipx_args` stay version-only.
([#​13131](https://redirect.github.com/jdx/mise/pull/13131),
[#​13146](https://redirect.github.com/jdx/mise/pull/13146) by
[@​jdx](https://redirect.github.com/jdx))
```sh
mise lock --upgrade # move an existing lockfile to revision 2 and
resolve graphs
mise install --locked # replay the recorded graphs
mise lock --bump pypi:black # refresh Black's dependencies without
changing its version
```
- **pypi:** `pypi:` is now the preferred name for the Python CLI
backend; `pipx:` remains fully supported as an alias with no warnings,
and settings accept both `pypi.*` and `pipx.*` names. The two spellings
are distinct tool identities (`pypi-black` vs `pipx-black` install
directories and lock entries), so switching spelling creates a new
installation.
([#​13146](https://redirect.github.com/jdx/mise/pull/13146) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `mise bootstrap dotfiles conflicts [PATH...]` shows a
read-only comparison of the saved local and fetched remote versions of a
conflicted dotfile so you can decide between `--take-remote` and
`--keep-local` with full context. The default output is a unified diff
including file-mode changes; `--difftool` opens the configured Git
`diff.tool` (falling back to `merge.tool`) and `--tool <name>` picks one
explicitly. Encrypted contents are decrypted only into private temporary
files, and inspection never modifies either side or marks the conflict
resolved. Bootstrap secrets are also now resolved from the same composed
config maps as dotfile discovery, so root-scoped dotfile templates can
use secrets declared by their bootstrap root.
([#​13144](https://redirect.github.com/jdx/mise/pull/13144) by
[@​jdx](https://redirect.github.com/jdx))
```sh
mise bootstrap dotfiles conflicts ~/.config/mise/config.toml
mise bootstrap dotfiles conflicts --difftool ~/.config/mise/config.toml
```
- **dotfiles:** Dotfile templates (`mode = "template"`) can reference
`[bootstrap.secrets]` values with `{{ secret(name="...") }}`, matching
managed bootstrap file templates. Dotfiles commands that render
templates (`add`, `apply`, `diff`, `edit`, `status`, `unapply`) accept
`--prompt-secrets`; without an available value, rendering fails closed.
A full `mise bootstrap` run preflights dotfile templates before making
changes, `mise bootstrap status` reports secrets used only by dotfiles,
and textual diffs redact resolved secret values.
([#​13140](https://redirect.github.com/jdx/mise/pull/13140) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.secrets]
api_token = "EXAMPLE_API_TOKEN"
[dotfiles."~/.config/example/credentials"]
source = "dotfiles/credentials.tmpl"
mode = "template"
```
##### Fixed
- **lock:** Installing from a committed `mise.lock` no longer fails when
the locked release is younger than `minimum_release_age`. The cutoff
still applies when resolving unlocked fuzzy requests and when generating
or bumping a lockfile, and `npm:`/`pypi:` still forward it to unpinned
transitive dependencies, but a reviewed lock entry now reproduces
immediately in CI instead of waiting for the release to cool.
([#​13128](https://redirect.github.com/jdx/mise/pull/13128) by
[@​jdx](https://redirect.github.com/jdx))
- **config:** A `.python-version` (or other idiomatic version file)
containing `system` selects the system interpreter without printing the
mise-specific `@system` deprecation warning, matching the existing
`.tool-versions` exception. Explicit `python@system` requests from mise
configuration or command arguments still warn.
([#​13132](https://redirect.github.com/jdx/mise/pull/13132) by
[@​jdx](https://redirect.github.com/jdx))
- **npm:** Embedded aube is updated to 2.2.16, fixing the Bun checksum
install regression and ensuring local npm tarballs keep their manifest
package name.
([#​13145](https://redirect.github.com/jdx/mise/pull/13145) by
[@​jdx](https://redirect.github.com/jdx))
- **registry:** The `mc` shorthand uses `aqua:minio/mc` again now that
the upstream Aqua registry entry is restored, with
`asdf:mise-plugins/mise-mc` kept as the fallback.
([#​13124](https://redirect.github.com/jdx/mise/pull/13124) by
[@​jdx](https://redirect.github.com/jdx))
##### Security
- **history:** `history.describe_command` is now global-only. Previously
an implicitly trusted project could set it and have a later dotfiles
history checkpoint execute the project-controlled command with
unencrypted tracked-file diffs. The setting is honored only from
system/global configuration or `MISE_HISTORY_DESCRIBE_COMMAND`; project
values are ignored with a warning.
([#​13134](https://redirect.github.com/jdx/mise/pull/13134) by
[@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci build` now renders dotfile templates with a
restricted engine: `secret()` is rejected and the `env` context,
`get_env()`, `exec()`, and `read_file()` are unavailable, so ambient
credentials cannot be baked into a publishable image layer.
([#​13140](https://redirect.github.com/jdx/mise/pull/13140) by
[@​jdx](https://redirect.github.com/jdx))
##### Breaking Changes
- **Lockfile revision 2 is not readable by older mise versions.** Newly
created lockfiles use revision 2, and existing files switch only when
you run `mise lock --upgrade`. Upgrade collaborators and CI to this
release before committing a revision 2 `mise.lock`, and commit the
`.mise/locks/` (or `.config/mise/locks/`) sidecar directory alongside
it. Revision 2 `--locked` installs fail if a recorded graph is missing
or its digest does not match. If you gitignore `mise.local.lock`, also
ignore its matching sidecar subdirectory (for example
`.mise/locks/mise.local/`).
- **`history.describe_command` in project configuration is ignored.**
Move it to `~/.config/mise/config.toml` or set
`MISE_HISTORY_DESCRIBE_COMMAND`.
- **`mise oci build` dotfile templates** can no longer call `secret()`,
`get_env()`, `exec()`, or `read_file()` or read the `env` context.
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.9.6...v2026.9.7>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.9.6`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.6):
: Project daemons, mise doctor project, and vfox backend tool discovery
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.5...v2026.9.6)
This release adds experimental project daemons backed by pitchfork, a
`mise doctor project` command for project-declared diagnostic checks,
and tool discovery from vfox backend plugins in `mise search`. It also
changes the HTTP backend's default install layout so uninstall and prune
reclaim disk space, speeds up warm `lockfile_mode = "generate"` installs
and repeated OCI builds, and fixes a batch of nushell, monorepo,
lockfile, brew, and Windows bootstrap issues.
#### Highlights
- **Services next to tools:** `[daemons]` declares background processes
and PostgreSQL/Redis presets in `mise.toml`, managed through `mise
daemons` and optionally started when you enter the project.
`[doctor.checks.<name>]` lets projects declare their own environment
probes for `mise doctor project`.
- **Discovery and output:** `mise search`, shell completion, and
interactive `mise use` now include tools published by installed vfox
backend plugins, and `settings.truncate` / `--no-truncate` disable
terminal-width truncation (automatically when a coding agent is
detected).
- **Storage and speed:** HTTP tools now extract into their own install
directory by default (opt back into deduplication with
`shared_extraction = true`), warm generate-mode installs skip needless
lockfile rewrites, and OCI builds share a local tool-layer cache.
#### Added
- **daemons:** New experimental `[daemons]` section and `mise daemons`
command family (`start`, `stop`, `restart`, `ls`, `status`, `logs`,
`tui`) manage project background processes with pitchfork. PostgreSQL
and Redis presets install the database as a tool (participating in
lockfiles), supply connection environment variables and readiness
checks, and keep project data across stop/start. Daemons with `auto =
["start", "stop"]` start when entering the project from an activated
Bash, Zsh, or Fish shell and are released when the last shell session
leaves. Requires `experimental = true` and pitchfork 2.25.0 or later;
database presets are Unix-only and PostgreSQL uses loopback trust
authentication intended for local development.
([#​13085](https://redirect.github.com/jdx/mise/pull/13085) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[settings]
experimental = true
[daemons]
postgres = "18"
redis = "8"
[daemons.web]
run = "npm run dev"
port = 3000
auto = ["start", "stop"]
```
- **doctor:** `mise doctor project` runs checks declared in
`[doctor.checks.<name>]` with the project's environment and installed
tools, reporting PASS/FAIL/error/skipped per check in text or `--json`.
Checks support `description`, `hint`, `timeout` (default `10s`), `dir`,
`shell`, and `os` selectors, run concurrently under the `jobs` limit,
and exit nonzero when any check fails. Ordinary `mise doctor` does not
run them, and hints are never executed. A follow-up aligned `dir`
resolution with task conventions (config root for project configs
including `~/mise.toml`, `~/` expansion), fixed head-of-line blocking
when one probe hangs, and kept `nohup mise doctor project` alive on
SIGHUP.
([#​13062](https://redirect.github.com/jdx/mise/pull/13062),
[#​13089](https://redirect.github.com/jdx/mise/pull/13089) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[doctor.checks.openssl]
description = "OpenSSL development files are discoverable"
run = "pkg-config --exists openssl"
hint = "Run `mise bootstrap packages apply` to install the declared
build dependencies."
timeout = "5s"
os = ["linux", "macos"]
```
- **vfox:** Tools provided by installed vfox backend plugins now appear
in `mise search`, shell completion, and interactive `mise use`,
namespaced as `<plugin>:<tool>`. Plugins can implement
`BackendListTools` for a finite catalog and/or `BackendSearchTools` for
query-driven discovery in large ecosystems; a prefixed query like
`npm:eslint` is routed only to that plugin. Results are cached, slow
plugins fall back to stale cache, and existing plugins need no changes.
`mise registry` remains registry-only.
([#​13111](https://redirect.github.com/jdx/mise/pull/13111) by
[@​jdx](https://redirect.github.com/jdx))
- **cli:** New `settings.truncate` (and `MISE_TRUNCATE`, default `true`)
controls terminal-width shortening of table cells and task metadata.
`mise ls`, `mise config ls`, and `mise bootstrap dotfiles status` gain
`--truncate` / `--no-truncate`, and output is kept complete
automatically when a known coding agent is detected.
([#​13112](https://redirect.github.com/jdx/mise/pull/13112) by
[@​jdx](https://redirect.github.com/jdx))
```sh
mise bootstrap dotfiles status --no-truncate
```
- **bootstrap:** `[bootstrap.macos.dock]` gains `apps`, an ordered list
of pinned application paths. Status compares identity and order
(ignoring Dock-added metadata), apply adds, removes, and reorders
application tiles while preserving other tiles and `persistent-others`,
and an empty list removes all application tiles. Paths must be absolute
or home-relative `.app` bundles.
([#​13075](https://redirect.github.com/jdx/mise/pull/13075) by
[@​azohra](https://redirect.github.com/azohra))
```toml
[bootstrap.macos.dock]
apps = [
"/System/Applications/Utilities/Terminal.app",
"/Applications/Firefox.app",
]
```
- **bootstrap:** `mise bootstrap packages where brew:<formula>` prints
an installed formula's stable `opt` root (for example
`/opt/homebrew/opt/unzip`), so scripts can put keg-only executables on
PATH without hardcoding the Homebrew prefix or Cellar version. Missing
installs exit nonzero with empty stdout.
([#​13083](https://redirect.github.com/jdx/mise/pull/13083) by
[@​himkt](https://redirect.github.com/himkt))
- **dotfiles:** Destination `variants` can omit `source` when every
variant sets a `target`; the entry key is then resolved as a relative
path under `settings.dotfiles.root` instead of next to `mise.toml`.
Parent traversal is rejected.
([#​13087](https://redirect.github.com/jdx/mise/pull/13087) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles."vscode/settings.json"]
mode = "copy"
variants = [
{ os = "macos", target = "~/Library/Application
Support/Code/User/settings.json" },
{ os = "linux", target = "~/.config/Code/User/settings.json" },
]
```
- **fmt:** `mise fmt` now sorts lists whose order has no meaning:
`redactions` lexically, and task `sources`/`outputs`, `task_templates`
sources/outputs, `task_config.global_inputs`, and `input_groups` by
reach (`@group:` references, then globs, then literal paths). Lists
containing `!` exclusions, entries starting with template syntax, or
comments are left untouched, and precedence-sensitive lists such as
`env_file`, `tools.*`, `includes`, and `depends` are never sorted.
([#​13058](https://redirect.github.com/jdx/mise/pull/13058) by
[@​jrandolf](https://redirect.github.com/jrandolf))
- **oci:** `mise oci build` gains `--no-cache` to bypass the new local
tool-layer cache; entries live under each tool's cache directory and are
removed by `mise cache clear TOOL`.
([#​13056](https://redirect.github.com/jdx/mise/pull/13056) by
[@​jdx](https://redirect.github.com/jdx))
#### Changed
- **http:** New `http:` installations extract directly into their own
install directory, so `mise uninstall` and `mise prune` now remove their
files instead of leaving payloads in `$MISE_DATA_DIR/http-tarballs/`.
Set `shared_extraction = true` on a tool to keep the previous
deduplicated symlink layout. Existing symlinked installs keep working;
`mise install --force <tool>` migrates one to independent files without
disturbing other installs that share the content. Legacy `http-tarballs`
entries are not reclaimed automatically. Shared raw and compressed
binary caches now also include the executable filename in their key, so
differently named tools no longer reuse the wrong filename.
([#​13059](https://redirect.github.com/jdx/mise/pull/13059) by
[@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci push --no-cache` now bypasses both the remote
registry cache and the local tool-layer cache.
([#​13056](https://redirect.github.com/jdx/mise/pull/13056) by
[@​jdx](https://redirect.github.com/jdx))
- **registry:** `postgres`, `redis`, and `mongodb` now prefer `conda:`
backends, installing prebuilt conda-forge binaries in seconds instead of
compiling through vfox; vfox and asdf remain as fallbacks.
`conda:redis-server` covers Linux and macOS only.
([#​13061](https://redirect.github.com/jdx/mise/pull/13061) by
[@​jdx](https://redirect.github.com/jdx))
#### Performance
- **lockfile:** Warm `mise install` runs in `lockfile_mode = "generate"`
skip scheduling work for tools whose artifact metadata is already
reusable, and skip rebuilding, serializing, and staging the lockfile
entirely when nothing was installed and the on-disk lock already matches
(preserving comments in the file). Explicit `mise lock`, forced
provenance verification, upgrades, and new platforms still regenerate.
([#​13101](https://redirect.github.com/jdx/mise/pull/13101),
[#​13103](https://redirect.github.com/jdx/mise/pull/13103) by
[@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci push --from BASE` no longer downloads base layers
when the base and target live in the same repository, and `oci build`,
`oci run`, and `oci push` share a local cache of packaged tool layers
keyed on file contents, so repeated builds with overlapping tools skip
tar and gzip work.
([#​13055](https://redirect.github.com/jdx/mise/pull/13055),
[#​13056](https://redirect.github.com/jdx/mise/pull/13056) by
[@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **nushell:** `mise activate nu` no longer throws
`env_variable_not_found` on every prompt or `cd` when a variable to hide
is absent from the current scope; `hide-env` is now wrapped in `try`,
matching the no-op behavior of other shells.
([#​13071](https://redirect.github.com/jdx/mise/pull/13071) by
[@​i-api](https://redirect.github.com/i-api))
- **task:** Task-level tools are now auto-installed for tasks referenced
from `run` entries, including names rendered at runtime, right before
they execute; `--skip-tools` is honored and install failures are
reported as task failures without blocking siblings.
([#​13086](https://redirect.github.com/jdx/mise/pull/13086) by
[@​jdx](https://redirect.github.com/jdx))
- **config:** `[monorepo]` settings are now merged across same-directory
config layers (base plus `mise.<env>.toml` overlays): omitted fields are
inherited, an overlay's `config_roots` replaces the base list, and
`monorepo_root = false` in an overlay disables the root and its
descendant trust.
([#​13084](https://redirect.github.com/jdx/mise/pull/13084) by
[@​jdx](https://redirect.github.com/jdx))
- **lockfile:** Runtime tool requests such as `mise which hk --tool
hk@latest` now use the lockfile belonging to the config that effectively
defines the tool, instead of merging project and global pins and
reporting a false "multiple resolutions" ambiguity or selecting an
overridden pin. `mise which --tool` warns when a lower-precedence config
has a matching pin the effective config lacks.
([#​13042](https://redirect.github.com/jdx/mise/pull/13042) by
[@​nettlesh](https://redirect.github.com/nettlesh))
- **lockfile:** Complete lockfile generation for Packslip tools skips
platforms with no published artifact while still writing supported
targets, and a verified Packslip signer may now replace legacy
`github-attestations` metadata on upgrade instead of being rejected as a
provenance downgrade.
([#​13102](https://redirect.github.com/jdx/mise/pull/13102),
[#​13105](https://redirect.github.com/jdx/mise/pull/13105) by
[@​jdx](https://redirect.github.com/jdx))
- **upgrade:** `mise upgrade` now detects updates between
letter-suffixed versions such as tmux `3.7b` to `3.7c`; `sub-N` aliases
keep resolving numeric components as before.
([#​13119](https://redirect.github.com/jdx/mise/pull/13119) by
[@​jdx](https://redirect.github.com/jdx))
- **brew:** Formulae that are keg-only solely because macOS ships them
(such as `brew:zip` and `brew:unzip`) are now linked into `<prefix>/bin`
on Linux, matching Homebrew. Kegs installed by earlier mise versions
stay unlinked until the next `mise bootstrap packages upgrade` or a
reinstall.
([#​13108](https://redirect.github.com/jdx/mise/pull/13108) by
[@​lil-lon](https://redirect.github.com/lil-lon))
- **brew-cask:** Tap casks with `preflight_steps` or `postflight_steps`
no longer fail during metadata extraction; declarative `run` steps are
captured as structured steps and executed by mise, with support for
`must_succeed = false`.
([#​13060](https://redirect.github.com/jdx/mise/pull/13060) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `mise bootstrap remote` on Windows now finds `ssh.exe`
and `tar.exe` on PATH instead of failing with `required command 'ssh'
not found`.
([#​13117](https://redirect.github.com/jdx/mise/pull/13117) by
[@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- **bootstrap:** macOS defaults status explains type mismatches, showing
for example `2 (real; expected integer)` instead of two
identical-looking values marked `differs`.
([#​13096](https://redirect.github.com/jdx/mise/pull/13096) by
[@​jdx](https://redirect.github.com/jdx))
- **dotfiles:** `mise bootstrap dotfiles track` honors the global `yes`
setting for confirmations, and warns when tracking a symlink whose
resolved source is not itself tracked, suggesting the command to enroll
it. ([#​13072](https://redirect.github.com/jdx/mise/pull/13072) by
[@​nettlesh](https://redirect.github.com/nettlesh),
[#​13095](https://redirect.github.com/jdx/mise/pull/13095) by
[@​jdx](https://redirect.github.com/jdx))
- **schema:** The JSON schema now models Git directory `manifest`
dotfile entries, restricting explicit modes to `copy` or `symlink-each`
and rejecting combinations with inline content or file-edit fields.
([#​12741](https://redirect.github.com/jdx/mise/pull/12741) by
[@​risu729](https://redirect.github.com/risu729))
- **asdf:** `mise asdf install` and `mise asdf reshim` no longer
re-enter the full CLI dispatch, avoiding stack overflows on small-stack
Linux environments; `asdf install` now follows the same implicit config
trust as `mise install`. Bash completions are regenerated for the
updated usage-rs word-break handling.
([#​13114](https://redirect.github.com/jdx/mise/pull/13114) by
[@​jdx](https://redirect.github.com/jdx))
#### Registry
- Added `mpv` (`conda:mpv`, Linux and macOS)
([#​13049](https://redirect.github.com/jdx/mise/pull/13049) by
[@​i-api](https://redirect.github.com/i-api)), `agent-browser`
(`aqua:vercel-labs/agent-browser`)
([#​13088](https://redirect.github.com/jdx/mise/pull/13088) by
[@​3w36zj6](https://redirect.github.com/3w36zj6)), and `himalaya`
(`github:pimalaya/himalaya`)
([#​13091](https://redirect.github.com/jdx/mise/pull/13091) by
[@​i-api](https://redirect.github.com/i-api)).
- `editorconfig-checker` installs again after 4.0.1 renamed its assets
and executable; the shorthand now uses the GitHub backend.
([#​13098](https://redirect.github.com/jdx/mise/pull/13098) by
[@​jdx](https://redirect.github.com/jdx))
- `mc` installs from MinIO's GitHub releases instead of the retired Aqua
download URL that returned HTTP 410.
([#​13113](https://redirect.github.com/jdx/mise/pull/13113) by
[@​jdx](https://redirect.github.com/jdx))
#### Documentation
- The docs landing page gains interactive diagrams for project
environment switching, bootstrap machine resources, tool configuration
precedence, artifact cache execution, and tracked dotfile
synchronization.
([#​13065](https://redirect.github.com/jdx/mise/pull/13065),
[#​13066](https://redirect.github.com/jdx/mise/pull/13066),
[#​13067](https://redirect.github.com/jdx/mise/pull/13067),
[#​13068](https://redirect.github.com/jdx/mise/pull/13068),
[#​13069](https://redirect.github.com/jdx/mise/pull/13069) by
[@​jdx](https://redirect.github.com/jdx))
- The task-running guide is reorganized around finding and running
tasks, passing arguments, then controlling execution.
([#​13077](https://redirect.github.com/jdx/mise/pull/13077) by
[@​azohra](https://redirect.github.com/azohra))
#### New Contributors
- [@​lil-lon](https://redirect.github.com/lil-lon) made their
first contribution in
[#​13108](https://redirect.github.com/jdx/mise/pull/13108)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.9.5...v2026.9.6>
#### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.9.5`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.5):
: macOS defaults, per-platform dotfiles, and complete lockfiles
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.4...vfox-v2026.9.5)
This release deepens macOS bootstrap support with current-host and
nested defaults, lets dotfiles and tasks adapt to the platform and to
parsed arguments, and adds an opt-in trial of complete lockfile
generation. It also carries a batch of install progress, self-update,
brew-cask, and sandbox fixes.
#### Added
- **bootstrap:** New `[[bootstrap.macos.defaults_entries]]` blocks let
you set macOS preferences explicitly with `domain`, `key`, `value`, and
an optional `host` (`any` by default, or `current`), covering
preferences normally written via `defaults -currentHost` while keeping
the existing `[bootstrap.macos.defaults]` shorthand. Entries also accept
an optional `path` to patch a nested dictionary value without replacing
its siblings, preserving property-list types and creating missing
parents.
([#​12983](https://redirect.github.com/jdx/mise/pull/12983) by
[@​azohra](https://redirect.github.com/azohra),
[#​12984](https://redirect.github.com/jdx/mise/pull/12984) by
[@​azohra](https://redirect.github.com/azohra))
```toml
[[bootstrap.macos.defaults_entries]]
domain = "com.apple.dock"
key = "autohide"
value = true
host = "current"
```
- **bootstrap:** More friendly macOS preferences: Finder folder sorting
and default cloud save location, Dock autohide delay and timing
(integers or floats), and keyboard automatic capitalization and spelling
correction, all using snake\_case names consistent with the existing
sections.
([#​13032](https://redirect.github.com/jdx/mise/pull/13032) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `[bootstrap.files]` and `[bootstrap.directories]`
entries gain `phase = "pre-packages"` so repository definitions, apt
sources, and signing keys can be applied before package installation
instead of only afterward. Existing declarations default to
`"post-packages"`.
([#​13052](https://redirect.github.com/jdx/mise/pull/13052) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.files."/etc/apt/sources.list.d/vendor.sources"]
source = "./files/vendor.sources"
phase = "pre-packages"
```
- **bootstrap:** Ordinary `[bootstrap.files]` templates can now
reference resolved `[vars]` values, alongside the existing
`config_root`, `target`, and `secret()` helpers.
([#​13033](https://redirect.github.com/jdx/mise/pull/13033) by
[@​nettlesh](https://redirect.github.com/nettlesh))
- **dotfiles:** A single dotfiles source can deploy to different
destinations per operating system, architecture, or mise profile using
`variants` with an optional `target`. This works for `copy`, `symlink`,
`symlink-each`, and `template` modes.
([#​13050](https://redirect.github.com/jdx/mise/pull/13050) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles.settings]
source = "dotfiles/vscode/settings.json"
mode = "copy"
variants = [
{ os = "macos", target = "~/Library/Application
Support/Code/User/settings.json" },
{ os = "linux", target = "~/.config/Code/User/settings.json" },
]
```
- **task:** Task `sources` and `outputs` can now use `{{usage.*}}`
templates, resolved per invocation from parsed arguments and flags
before freshness and artifact-cache checks run, so different argument
values track freshness independently.
([#​13051](https://redirect.github.com/jdx/mise/pull/13051) by
[@​jdx](https://redirect.github.com/jdx))
- **brew-cask:** Casks with structured `set_permissions`
preflight/postflight steps now install correctly (for example
`brew-cask:blender`), running an unprivileged `chmod` over resolved
staged or appdir paths instead of failing with an unsupported step-type
error. ([#​13043](https://redirect.github.com/jdx/mise/pull/13043)
by [@​azohra](https://redirect.github.com/azohra))
- **lock:** Opt-in trial of complete lockfile generation via
`lockfile_mode = "generate"` (or `MISE_LOCKFILE_MODE=generate`). The
default remains incremental `merge`. Generate mode rebuilds lockfiles
from current requests while treating the previous file as an immutable
baseline, reusing unchanged artifacts and publishing through staged
atomic writes so failures or concurrent edits do not clobber a good
lockfile. This mode records only cryptographically verified provenance
per target platform; `provenance_verified` is no longer treated as a
trust signal.
([#​13031](https://redirect.github.com/jdx/mise/pull/13031) by
[@​jdx](https://redirect.github.com/jdx))
- **self-update:** New `disable_update_warning` setting
(`MISE_DISABLE_UPDATE_WARNING`) suppresses "newer mise available"
notices in `mise version`, `mise --version`, and `mise doctor`. Explicit
self-update and automatic updates are unaffected.
([#​13028](https://redirect.github.com/jdx/mise/pull/13028) by
[@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **install:** Interactive installs no longer leave a permanent line for
every resolved, skipped, or already-installed tool; live progress shows
what is happening while the final summary lists what changed (for
example `installed 1 tool in 1.1s: dummy@1.0.0`). `mise upgrade` no
longer duplicates its old to new version list.
([#​13030](https://redirect.github.com/jdx/mise/pull/13030) by
[@​jdx](https://redirect.github.com/jdx))
- **install:** Long non-TTY installs no longer flood CI logs with a
snapshot every three seconds. The heartbeat now scales to roughly 10% of
elapsed time, clamped between 3 seconds and 1 minute.
([#​13036](https://redirect.github.com/jdx/mise/pull/13036) by
[@​jdx](https://redirect.github.com/jdx))
- **self-update:** On 32-bit ARM, `mise self-update` now selects the
correct `linux-armv7` archive instead of requesting a missing
`linux-arm` one and falling back to an ARM64 binary that failed
signature verification. A missing archive now fails asset selection
rather than picking the wrong architecture.
([#​13023](https://redirect.github.com/jdx/mise/pull/13023) by
[@​jdx](https://redirect.github.com/jdx))
- **self-update:** npm installs now ship the instructions file that
redirects update guidance to the package manager, so they no longer
advertise `mise self-update`.
([#​13028](https://redirect.github.com/jdx/mise/pull/13028) by
[@​jdx](https://redirect.github.com/jdx))
- **brew-cask:** `mise bootstrap packages upgrade` no longer replaces
the bundle of a running self-updating app (for example Chrome), which
could strand helper processes and blank out tabs. Such apps are skipped
while running and left to update themselves.
([#​13041](https://redirect.github.com/jdx/mise/pull/13041) by
[@​azohra](https://redirect.github.com/azohra))
- **brew-cask:** The cask metadata fetch error no longer includes stale
advice about installing with `brew` and a broken documentation anchor;
it now gives a short, accurate message.
([#​12800](https://redirect.github.com/jdx/mise/pull/12800) by
[@​Marukome0743](https://redirect.github.com/Marukome0743))
- **bootstrap:** `mise bootstrap dotfiles origin set <url>` now uses the
repository's own default branch when `--branch` is omitted, so
repositories on `master` connect correctly instead of publishing a
second root branch. A missing requested branch is now reported clearly
rather than mistaken for an empty repository.
([#​13037](https://redirect.github.com/jdx/mise/pull/13037) by
[@​Dhaulagiri](https://redirect.github.com/Dhaulagiri))
- **dotfiles:** History watcher locks now live alongside the history
store in the state directory instead of being hashed into the cache
directory, so a launchd watcher and an interactive shell using different
cache directories coordinate correctly and `dotfiles status` no longer
misreports `declared-not-running`. Existing watchers must be stopped and
restarted with the updated binary.
([#​13038](https://redirect.github.com/jdx/mise/pull/13038) by
[@​ascarter](https://redirect.github.com/ascarter))
- **sandbox:** The macOS Seatbelt profile now allows
`file-read-metadata` on the ancestors of readable paths, fixing
`Operation not permitted` failures when a portable Ruby resolves its own
executable during third-party tap evaluation. Symlinked data directories
and allow-listed paths are also handled.
([#​13039](https://redirect.github.com/jdx/mise/pull/13039) by
[@​Marukome0743](https://redirect.github.com/Marukome0743))
#### Registry
- Added `clipboard`
([github:Slackadays/Clipboard](https://redirect.github.com/Slackadays/Clipboard))
by [@​i-api](https://redirect.github.com/i-api) in
[#​13044](https://redirect.github.com/jdx/mise/pull/13044)
#### New Contributors
- [@​Dhaulagiri](https://redirect.github.com/Dhaulagiri) made
their first contribution in
[#​13037](https://redirect.github.com/jdx/mise/pull/13037)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.9.4...v2026.9.5>
#### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.9.4`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.4):
: Nix Bootstrap, Environment Selectors, and Man Pages
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.3...vfox-v2026.9.4)
This release expands the bootstrap package model with Nix support and
environment selectors, teaches packslip tools to ship man pages, and
adds a task-scoped quiet setting. It also carries a wide batch of
packslip, bootstrap, and cross-platform fixes plus a major speedup to
dotfiles history rebuilds.
#### Added
- **bootstrap:** Nix is now a built-in `[bootstrap.packages]` manager on
Linux and macOS. Declare packages with the `nix:` prefix and apply them
through your normal Nix profile; the manager supports use, apply, status
JSON, and targeted upgrades while leaving Nix sources, caches, trust,
and profile rollback under Nix control. This also adds `mise bootstrap
packages export --format nix` to emit a deterministic NixOS module from
your `nix:` declarations and `packages use --no-install` to record
declarations without touching package managers.
([#​13013](https://redirect.github.com/jdx/mise/pull/13013) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"nix:ripgrep" = "latest"
```
- **bootstrap:** `[bootstrap.packages]` entries gain an `env` selector
(a single environment or a list), so a package is only enabled when one
of its listed mise environments is active via `-E` or `MISE_ENV`. When
both `os` and `env` are set, both must match. Packages for inactive
environments stay declared and are protected from pruning.
([#​12956](https://redirect.github.com/jdx/mise/pull/12956) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"brew:postgresql" = { version = "latest", env = ["dev", "test"] }
```
- **packslip:** Packslip-installed tools can now ship man pages declared
as static `man` resources, alongside completions and agent skills. While
a tool version is active, mise prepends its man root to `MANPATH` and
keeps system and caller-defined paths visible, so `man <tool>` works.
Existing installs need to be reinstalled to pick up man pages.
([#​13012](https://redirect.github.com/jdx/mise/pull/13012) by
[@​jdx](https://redirect.github.com/jdx))
- **task:** New `task.quiet` setting (and `MISE_TASK_QUIET`) suppresses
mise's own task messages, prefixes, and command-echo headers without
hiding task output or affecting other commands. The bundled `output =
"quiet"` mode is deprecated in favor of explicit output style plus this
setting; removal is scheduled for 2027.9.3.
([#​12980](https://redirect.github.com/jdx/mise/pull/12980) by
[@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **install:** A lazy tool whose `depends` target is also lazy now
installs correctly on first use through a shim, `mise x`, or a task;
mise installs the provider together with its still-missing configured
dependencies instead of failing the preflight.
([#​12997](https://redirect.github.com/jdx/mise/pull/12997) by
[@​balintant](https://redirect.github.com/balintant))
- **backend:** 32-bit ARM resolution now uses Go's canonical `arm`
architecture name for Aqua (so registry replacements apply), and
automatic GitHub release asset selection no longer picks a generic
`source.tar.gz` when no published binary targets the host.
([#​13004](https://redirect.github.com/jdx/mise/pull/13004) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** Homebrew bottles with hard-linked Mach-O executables
are now signed correctly on macOS. Every hard-link alias is tracked and
included in the signing list after relocation, fixing cases like fish
where an aliased binary was killed with SIGKILL after a successful
install.
([#​12988](https://redirect.github.com/jdx/mise/pull/12988) by
[@​nettlesh](https://redirect.github.com/nettlesh))
- **packslip:** `mise lock --platform` now verifies the signed release
manifest and records the correct URL, checksum, size, and signer for
each requested target platform (including Windows x64), so locked
installs work across platforms.
([#​13002](https://redirect.github.com/jdx/mise/pull/13002) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** On glibc Linux, an artifact's `glibc_min` is now honored
during selection: when the GNU build requires a newer glibc than the
host, mise falls back to a matching static musl build if one exists.
([#​13009](https://redirect.github.com/jdx/mise/pull/13009) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** Windows installs now link shims with the correct `.exe`
filename, while Unix keeps extensionless names.
([#​13006](https://redirect.github.com/jdx/mise/pull/13006) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** Activated man roots are now scoped to Packslip-backed
tool versions, and the caller's original `MANPATH` is included in the
environment-cache identity so one cached process cannot serve another
caller's `MANPATH`.
([#​13016](https://redirect.github.com/jdx/mise/pull/13016) by
[@​jdx](https://redirect.github.com/jdx))
- **prune:** `mise prune` no longer exits successfully without pruning
when it cannot show a confirmation prompt; it now fails with guidance to
pass `--yes` or set `MISE_YES=1`. Follow-up prunes from commands like
`mise unuse` still leave installs in place when nobody can answer.
([#​13003](https://redirect.github.com/jdx/mise/pull/13003) by
[@​jdx](https://redirect.github.com/jdx))
- **generate:** `mise generate tool-stub` now respects a stub's
top-level `os` selector when deciding whether to write a Windows `.cmd`
launcher, so a linux/macos-only stub no longer produces a launcher even
with `--lock`.
([#​13008](https://redirect.github.com/jdx/mise/pull/13008) by
[@​jdx](https://redirect.github.com/jdx))
- **dotfiles:** History path filters resolve correctly when `HOME` is a
symlink, so aliased, canonical, and tilde paths address the same history
entry and `show latest`/`diff` no longer report a missing checkpoint.
([#​12982](https://redirect.github.com/jdx/mise/pull/12982) by
[@​azohra](https://redirect.github.com/azohra))
- **brew:** The published crate now includes the tap formula and cask
metadata shims, fixing `cargo install --locked mise` builds from
crates.io.
([#​13001](https://redirect.github.com/jdx/mise/pull/13001) by
[@​jdx](https://redirect.github.com/jdx))
#### Changed
- **bootstrap:** `[bootstrap].config_roots` and the `mise bootstrap
config-roots` command are now deprecated (hidden from help and removed
from public docs), with removal scheduled for mise 2027.3.3. Existing
configurations keep working during the compatibility window but emit a
warning directing users to global or system bootstrap configuration.
([#​13010](https://redirect.github.com/jdx/mise/pull/13010) by
[@​jdx](https://redirect.github.com/jdx))
- **registry:** Added basecamp to the registry.
([#​13024](https://redirect.github.com/jdx/mise/pull/13024))
#### Performance
- **history:** Dotfiles history index rebuilds are dramatically faster,
reconstructing checkpoint metadata in-process with gix instead of
spawning Git per checkpoint. On an 80-checkpoint, 44-file reproducer
this cut a rebuild from roughly 26-28 seconds and thousands of Git
processes down to under a second. Removed annotations are now correctly
dropped after a rebuild, and SHA-256 history repositories are supported.
([#​13011](https://redirect.github.com/jdx/mise/pull/13011) by
[@​jdx](https://redirect.github.com/jdx))
#### Deprecated
- The task `output = "quiet"` mode (use `task.quiet` instead; removal in
2027.9.3)
([#​12980](https://redirect.github.com/jdx/mise/pull/12980)).
- `[bootstrap].config_roots` and `mise bootstrap config-roots` (removal
in mise 2027.3.3)
([#​13010](https://redirect.github.com/jdx/mise/pull/13010)).
#### New Contributors
- [@​balintant](https://redirect.github.com/balintant) made their
first contribution in
[#​12997](https://redirect.github.com/jdx/mise/pull/12997)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.9.3...v2026.9.4>
#### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.9.3`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.3):
: Winget bootstrap, signed vfox plugins, and faster inline commands
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.2...vfox-v2026.9.3)
This release brings Windows bootstrap into the package-manager era with
WinGet support, extends the packslip signing model to vfox plugins, and
speeds up simple tasks by skipping the shell on Unix. It also carries a
batch of bootstrap, sandbox, and Windows ARM64 fixes.
##### Added
- **bootstrap:** WinGet is now a built-in `[bootstrap.packages]` manager
on Windows, so `mise bootstrap packages` can check status, install, and
upgrade apps by exact package ID. It supports version pins, source
refresh, and automatic source-agreement acceptance. Scoop, Chocolatey,
and package removal remain future work.
([#​12928](https://redirect.github.com/jdx/mise/pull/12928) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"winget:Microsoft.PowerShell" = "latest"
```
- **vfox:** External vfox plugins can now be installed from signed
packslip archives instead of a Git clone, reusing the packslip backend's
release selection, signature verification, digest checks, and signer
pins. This is aimed at non-registry plugins; registry defaults and
embedded plugins are unchanged.
([#​12948](https://redirect.github.com/jdx/mise/pull/12948) by
[@​jdx](https://redirect.github.com/jdx))
```sh
mise plugins install vfox:bfs 'packslip:mise-plugins/vfox-bfs#0.1.0'
```
- **bootstrap:** Dotfile line edits gain `position = "prepend"` to
insert a managed line at the top of a file instead of appending (the
default). An existing exact match is left in place, and unrelated bytes,
CRLF endings, and a UTF-8 BOM are preserved.
([#​12941](https://redirect.github.com/jdx/mise/pull/12941) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles]
"/etc/zshrc/zdotdir" = { line = 'ZDOTDIR=$HOME/.config/zsh/', position =
"prepend" }
```
- **bootstrap:** macOS bootstrap `defaults` now support nested TOML
arrays and tables (for example Dock `persistent-apps`), reading and
writing preferences through Core Foundation so booleans, numbers,
strings, arrays, and dictionaries keep their plist types. Collections
apply as whole-value replacements; datetimes and binary plist data are
still skipped with a warning.
([#​12947](https://redirect.github.com/jdx/mise/pull/12947) by
[@​jdx](https://redirect.github.com/jdx))
##### Changed
- **bootstrap:** Adopting global configuration or a shared
dotfile-history setup repository is now spelled `mise bootstrap --adopt`
(and `mise bootstrap remote --adopt`), separate from `mise bootstrap
--from` for running a bootstrap project. The dotfiles, history, setup,
and services guides were reorganized to lead with usable examples. The
previous `--from-git` spelling still works as a hidden alias but warns
and is scheduled for removal in mise 2026.10.0.
([#​12953](https://redirect.github.com/jdx/mise/pull/12953) by
[@​jdx](https://redirect.github.com/jdx))
##### Fixed
- **github:** Git operations (clones, fetches, submodules) that GitHub
now challenges with HTTP 401 on public repositories can authenticate
using mise's existing GitHub token sources via a command-scoped
`github.com` HTTPS credential helper. Tokens are kept out of command
arguments and URLs, and Enterprise hosts are out of scope.
([#​12945](https://redirect.github.com/jdx/mise/pull/12945) by
[@​jdx](https://redirect.github.com/jdx))
- **config:** The default inline task shell is now `sh -o errexit -c` so
shells that consume the argument right after `-c` (such as FreeBSD sh)
run your command instead of trying to execute `-o`.
([#​12949](https://redirect.github.com/jdx/mise/pull/12949) by
[@​jdx](https://redirect.github.com/jdx))
- **windows:** Fixed two Windows ARM64 issues: stale command-wrapper
shims (like a leftover `cargo.exe`) that caused recursive `.exe`/`.cmd`
dispatch after shim-mode changes are now pruned, and Aqua ARM64
emulation candidates apply the registry's `amd64` replacement so tools
like LuaLS resolve their published `win32-x64` assets.
([#​12931](https://redirect.github.com/jdx/mise/pull/12931) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** Bootstrap no longer aborts on Arch when `pacman -Q`
prints a file advisory for a missing package that shares its name with a
directory in the current working directory (for example a `fish/` folder
in a dotfiles checkout).
([#​12932](https://redirect.github.com/jdx/mise/pull/12932) by
[@​nettlesh](https://redirect.github.com/nettlesh))
- **sandbox:** Read-restricted macOS Seatbelt profiles now allow
metadata-only access to `/private`, fixing startup failures for
load-relative binaries like Ruby 4.0.6 when run under `/private/tmp`.
Directory listings and descendant reads stay denied.
([#​12940](https://redirect.github.com/jdx/mise/pull/12940) by
[@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** The macOS notification helper is now built and
Developer ID-signed at release time and spawned with a start handshake,
so short `dotfiles sync` runs no longer race the helper and macOS
accepts it. Unsigned source builds (such as Homebrew) disable
notifications and warn during origin setup.
([#​12946](https://redirect.github.com/jdx/mise/pull/12946) by
[@​jdx](https://redirect.github.com/jdx))
- **vfox:** vfox install phases now flow through the active install
progress reporter, mapping noisy download, checksum, attestation, and
extraction lines into concise phases instead of scrolling log output.
([#​12944](https://redirect.github.com/jdx/mise/pull/12944) by
[@​jdx](https://redirect.github.com/jdx))
- **java:** The `java -version` banner shown during install verification
now stays inside the interactive install progress row instead of
printing to the terminal.
([#​12943](https://redirect.github.com/jdx/mise/pull/12943) by
[@​jdx](https://redirect.github.com/jdx))
- **version:** The auto-update hint from `mise version` now uses the
`mise settings auto_update=true` syntax to match the rest of `mise
settings`.
([#​12957](https://redirect.github.com/jdx/mise/pull/12957) by
[@​jdx](https://redirect.github.com/jdx))
##### Performance
- On Unix, plain inline commands (like `node build.js`) now run directly
when a conservative planner deems them safe, skipping the shell wrapper.
Anything involving shell syntax, quoting, expansion, builtins, ambiguous
PATH lookup, explicit shell settings, or sandboxed/audited tasks still
uses the shell, and Windows is unchanged. In a microbenchmark of short
commands this cut about 11% off elapsed time.
([#​12950](https://redirect.github.com/jdx/mise/pull/12950) by
[@​jdx](https://redirect.github.com/jdx))
##### Registry
- Added cargo-deny, kingfisher, nushell, shellharden, sherif, and
tauri-cli.
([#​12938](https://redirect.github.com/jdx/mise/pull/12938) by
[@​jrandolf](https://redirect.github.com/jrandolf))
##### Documentation
- Restored the prominent project name and pronunciation on the homepage.
([#​12936](https://redirect.github.com/jdx/mise/pull/12936) by
[@​jdx](https://redirect.github.com/jdx))
- Dropped the "you need Git installed" prerequisite from the install
docs. ([#​12958](https://redirect.github.com/jdx/mise/pull/12958)
by [@​jdx](https://redirect.github.com/jdx))
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.9.2...v2026.9.3>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.9.2`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.2):
: Packslip Backend, SSH Relay, and Reimagined Install Progress
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.1...vfox-v2026.9.2)
This is a large release headlined by the new stable `packslip:` backend
for installing tools from a vendor's own signed release manifest, a
read-only GitHub SSH relay for remote onboarding, redesigned install
progress for both terminals and CI logs, and a rebuilt dotfiles-tracking
model for bootstrap. It also carries dozens of fixes across shims,
tasks, brew, Go, npm, and the schema, plus two security fixes.
##### Highlights
- The `packslip:` backend is now generally available: install tools
directly from a project's cryptographically signed release manifest,
with signer pinning, trusted stampers, host-requirement checks, shell
completions, and agent skills all driven from the same signed source.
- Install output was reimagined end to end. Interactive terminals get a
live region with a fractional install-wide bar and permanent completion
lines, while CI logs, pipes, and AI-agent terminals get a compact
append-only reporter instead of thousands of scrolling rows.
- Bootstrap grows a read-only GitHub SSH relay and `--from-git`
onboarding, an AUR package manager, and a rebuilt dotfiles-history model
that tracks files through ordinary Git commits synchronized with an
origin.
##### Added
- **packslip:** New `packslip:` backend installs tools from a
vendor-published, signed release manifest (a sigstore bundle) that names
every artifact with its digest, platform, format, and executables. The
tool name is a pin, like a `known_hosts` entry:
`packslip:github.com/owner/repo` accepts only a packslip signed by that
repository's release workflow, and signature, log entry, statement,
digest, and size are all verified before anything is unpacked. Custom
hosts and monorepo tools are supported. The backend is no longer
experimental.
([#​12778](https://redirect.github.com/jdx/mise/pull/12778),
[#​12811](https://redirect.github.com/jdx/mise/pull/12811) by
[@​jdx](https://redirect.github.com/jdx))
```toml
[tools]
"packslip:github.com/oxc-project/oxc/oxlint" = "latest"
```
- **packslip:** Signer pinning remembers, per project, the signer that
signed the first accepted release in a `pins.toml` file (like SSH's
known\_hosts) and records the signer in `mise.lock`, so a later release
signed by anyone else, or one that weakens provenance, is refused. `mise
packslip pins` lists what is pinned and `mise packslip forget <project>`
accepts an announced key rotation.
([#​12783](https://redirect.github.com/jdx/mise/pull/12783) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** New `packslip.stampers` setting lets you require that a
trusted host has stamped a version before mise offers or installs it (a
scanning service, a mirror, or eventually the registry), with a per-tool
`trust = "vendor"` override.
([#​12782](https://redirect.github.com/jdx/mise/pull/12782) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** Declared host requirements (OS/glibc minimums, shared
libraries, required commands) are checked before download; confirmed
failures refuse the install, gaps mise cannot verify warn only, and
`ignore_requirements = true` overrides hard failures. `latest` also
resolves from verified vendor recommendations.
([#​12804](https://redirect.github.com/jdx/mise/pull/12804),
[#​12805](https://redirect.github.com/jdx/mise/pull/12805) by
[@​jdx](https://redirect.github.com/jdx))
- **packslip:** A tool's packslip can ship shell completions and agent
skills. `mise completion <shell> --tool <name>` prints (or `--install`
writes a version-aware stub for) completions for whichever version is
active in the current directory, and `mise skills ls` / `mise skills
sync` link a tool's Agent Skills into `.claude/skills` at the pinned
version. Completions are also loaded automatically in activated shells.
([#​12779](https://redirect.github.com/jdx/mise/pull/12779),
[#​12780](https://redirect.github.com/jdx/mise/pull/12780),
[#​12848](https://redirect.github.com/jdx/mise/pull/12848) by
[@​jdx](https://redirect.github.com/jdx))
- **install:** Redesigned install progress. Interactive terminals now
show
> ❗ **Important**
>
> ✂ PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 4am on Monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/prometheus/client_java).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>1 parent 3f8cfbd commit 89191b4
16 files changed
Lines changed: 32 additions & 32 deletions
File tree
- .github/workflows
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
18 | | - | |
19 | | - | |
| 18 | + | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
37 | | - | |
38 | | - | |
| 37 | + | |
| 38 | + | |
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
18 | | - | |
| 17 | + | |
| 18 | + | |
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
38 | | - | |
39 | | - | |
| 38 | + | |
| 39 | + | |
40 | 40 | | |
41 | 41 | | |
42 | 42 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
23 | | - | |
24 | | - | |
| 23 | + | |
| 24 | + | |
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
42 | | - | |
43 | | - | |
| 42 | + | |
| 43 | + | |
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
33 | 33 | | |
34 | 34 | | |
35 | 35 | | |
36 | | - | |
37 | | - | |
| 36 | + | |
| 37 | + | |
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
24 | 24 | | |
25 | 25 | | |
26 | 26 | | |
27 | | - | |
28 | | - | |
| 27 | + | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
26 | | - | |
27 | | - | |
| 26 | + | |
| 27 | + | |
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
35 | | - | |
36 | | - | |
| 35 | + | |
| 36 | + | |
37 | 37 | | |
38 | 38 | | |
39 | 39 | | |
| |||
0 commit comments