Repository navigation
Commit e1b4ad2
authored
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4&size=40){kind=avatar}
chore(deps): update dependency jdx/mise to v2026.10.14 (#2575)
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | uses-with | patch |
`v2026.10.2` → `v2026.10.14` |
---
### Release Notes
<details>
<summary>jdx/mise</summary>
###
[`v2026.10.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.14):
: Global override config, mise config explain, and stricter tool option
checks
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.13...vfox-v2026.10.14)
A global `config.override.toml` can now take precedence over project
config, and `mise config explain` describes each key in a config file.
Paranoid mode can be turned on per category, and in that mode dotenv
files need their own content-bound trust. Installs now fail when a tool
has an option its backend doesn't read, which affects existing configs
(see Changed).
##### Added
- **Global override files.** `~/.config/mise/config.override.toml`, and
`config.<env>.override.toml` for each `MISE_ENV`, rank above every
project file, including `mise.local.toml` and `mise.<env>.toml`. This
covers `[env]`, `[tools]`, `[settings]`, `[tasks]`, hooks and the other
sections. Anything the override file doesn't set still comes from the
project. mise never writes to these files by default. To write to one,
pass `--override` to `use`, `unuse`, `set`, `unset`, `settings
set|add|unset` or `config get|set`. A tool declared in an override file
resolves from the global `mise.lock` and is exempt from the project's
`--locked` check. If `MISE_GLOBAL_CONFIG_FILE` is set, override files
are not loaded. `mise config ls` shows a `Tier` column and `mise doctor`
labels the files.
[#​14610](https://redirect.github.com/jdx/mise/pull/14610)
([@​jdx](https://redirect.github.com/jdx))
```toml
# ~/.config/mise/config.override.toml
[env]
AWS_PROFILE = "personal"
[tools]
node = "24"
```
- **`mise config explain [KEY]`** lists each key a config file sets,
with its line number and its description from the schema. It flags
unknown keys with a "did you mean" suggestion and marks deprecated keys.
It reads the file as plain TOML, so it also works on a config mise
refuses to load. Pass a key such as `tasks` to show only that section,
`--json` for machine-readable output, and `--file`, `--global`,
`--system` or `--override` to pick a file.
[#​14642](https://redirect.github.com/jdx/mise/pull/14642)
([@​jdx](https://redirect.github.com/jdx))
- **Paranoid mode can be turned on per category.** `paranoid` now
accepts a list of `config`, `env_files`, `plugins` and `provenance` in
addition to `true`/`false`. `MISE_PARANOID=config,env_files` also works.
`true` still turns on all four categories. An unknown category name is
an error.
[#​14609](https://redirect.github.com/jdx/mise/pull/14609)
([@​jdx](https://redirect.github.com/jdx),
[@​thernstig](https://redirect.github.com/thernstig))
```toml
[settings]
paranoid = ["env_files"]
```
- **`env_file` takes several filenames**, for example `env_file =
[".env", ".env.local"]` or `MISE_ENV_FILE=.env:.env.local`. The file
nearest the current directory wins. Within one directory, a name later
in the list wins. A single string still works.
[#​14606](https://redirect.github.com/jdx/mise/pull/14606)
([@​jdx](https://redirect.github.com/jdx),
[@​thernstig](https://redirect.github.com/thernstig))
- **A `find_up` entry in `env._.file` can search several names
together.** Give one entry a `path` list, and mise searches directory by
directory. The closest directory wins, then the later name within a
directory. With two separate entries, a `.env.local` in a parent
directory still overrides the project's `.env`. The docs now explain
this difference and how `env_file` differs from `_.file`.
[#​14620](https://redirect.github.com/jdx/mise/pull/14620),
[#​14602](https://redirect.github.com/jdx/mise/pull/14602)
([@​jdx](https://redirect.github.com/jdx))
```toml
[env]
_.file = { path = [".env", ".env.local"], find_up = true }
```
- **`#MISE` headers in file tasks accept the same keys as
`[tasks.<name>]`**, including `timeout`, `vars` and the
`deny_*`/`allow_*` sandbox keys. Before, these keys were ignored with a
warning. If one header value is invalid, mise warns and skips that key,
and every other task still loads. An invalid `confirm` or `deny_*` value
is still an error, so a typo can't remove a confirmation prompt or a
sandbox restriction. Before, a template named with `extends` overrode a
header's `silent`. Now the header's value wins.
[#​14637](https://redirect.github.com/jdx/mise/pull/14637)
([@​jdx](https://redirect.github.com/jdx))
- **Interactive `mise.toml` reference** in the docs at
[configuration/reference](https://mise.jdx.dev/configuration/reference.html).
It lists every key with its type, choices and default, and you can
filter keys and link to them directly. Plain Markdown copies are also
published for agents.
[#​14641](https://redirect.github.com/jdx/mise/pull/14641)
([@​jdx](https://redirect.github.com/jdx))
##### Changed
- **Installs fail on tool options the backend doesn't read.** Before,
such options were silently ignored. A typo or a key meant for another
backend now stops the install, and the error names the option:
`cargo:eza: option 'asset_pattern' is not used by the cargo backend`.
Keys under `platforms` are checked too. So far this applies to the
cargo, conda, gem, github, gitlab, forgejo, go, http, npm, packslip,
pipx, s3, spinel, spm and ubi backends. aqua, plugin and core-language
tools are not checked. The npm backend accepts the `checksum` option
that comes from a `packageManager` field in `package.json`.
[#​14629](https://redirect.github.com/jdx/mise/pull/14629),
[#​14655](https://redirect.github.com/jdx/mise/pull/14655)
([@​jdx](https://redirect.github.com/jdx))
- **Paranoid mode needs content-bound trust for env files.** In paranoid
mode, files loaded through `_.file`, found by the `env_file` setting, or
run by `_.source` each need their own trust. Editing one of these files
revokes its trust. Before, trusting `mise.toml` also approved these
files, and later edits went unchecked. Running `mise trust` with no path
trusts the project's config and every env file it loads. The error names
the file but prints none of its values. To exempt a file by path, add it
to `trusted_config_paths` in your global config. With a category list,
this check belongs to `env_files`.
[#​14604](https://redirect.github.com/jdx/mise/pull/14604)
([@​jdx](https://redirect.github.com/jdx),
[@​thernstig](https://redirect.github.com/thernstig))
- **More specific config error messages.**
- A warning about an unknown `mise.toml` key now gives the line and
column, and suggests a close match, for example `mise.toml:5:1:
settings.experimantal (did you mean experimental?)`.
[#​14639](https://redirect.github.com/jdx/mise/pull/14639)
([@​jdx](https://redirect.github.com/jdx))
- A wrong value for a hook, a task `run`/`depends` entry or an `[env]`
variable now says which forms are accepted, or names the unknown key.
Before, the error was `data did not match any variant of untagged enum`.
An unknown key in a `run` or `depends` table now gets a warning. Before,
it was silently ignored.
[#​14640](https://redirect.github.com/jdx/mise/pull/14640)
([@​jdx](https://redirect.github.com/jdx))
- **`[bootstrap.linux.firewall]` is validated on every OS.** macOS and
Windows still skip the section at bootstrap time, but an invalid value
such as `backend = "iptables"` is now an error there too.
[#​14615](https://redirect.github.com/jdx/mise/pull/14615)
([@​jdx](https://redirect.github.com/jdx))
- **Editor schema updates.** Editors now flag unknown keys in most
`[bootstrap]` tables and in `[dotfiles]` entries. The schema now
documents launchd `keep_alive_on_failure` and `nice`, and dotfile
`autosave` and `enabled`. It also accepts valid configs it used to
reject: templated `login_shell`, `queue_directories` and `umask`, nested
macOS defaults values, and `tools` on `[vars]` entries. On Windows,
`[bootstrap.brew].adopt` no longer causes an unknown-field warning.
[#​14616](https://redirect.github.com/jdx/mise/pull/14616),
[#​14644](https://redirect.github.com/jdx/mise/pull/14644),
[#​14613](https://redirect.github.com/jdx/mise/pull/14613)
([@​jdx](https://redirect.github.com/jdx))
- `mise dot status` and `mise dot sync` are faster with many tracked
files. They start one git process per tracked file instead of three,
which took about 10s down to 4s for 860 files.
[#​14607](https://redirect.github.com/jdx/mise/pull/14607)
([@​waynehoover](https://redirect.github.com/waynehoover))
##### Fixed
- With an external rustup that keeps its proxies in a shared directory,
such as pacman's `/usr/bin`, mise no longer puts that directory ahead of
its own tools. Before, `mise exec -- node` could run the system Node.
Only the Rust proxies are now exposed, through a directory that mise
owns. [#​14597](https://redirect.github.com/jdx/mise/pull/14597)
([@​jdx](https://redirect.github.com/jdx))
- The cargo backend now honors `rename_exe`. Before, it ignored the
option and installed the executable under its original name.
[#​14626](https://redirect.github.com/jdx/mise/pull/14626)
([@​jdx](https://redirect.github.com/jdx))
- Locked `pypi:` installs through uv now pass the configured mise Python
to `uv sync`. Before, mise passed an empty path, so uv could pick
another interpreter and fail on `--no-build` tools such as `yamllint`.
[#​14593](https://redirect.github.com/jdx/mise/pull/14593)
([@​jdx](https://redirect.github.com/jdx),
[@​hollow](https://redirect.github.com/hollow))
- When the TLS root store or a CA file can't be loaded, the npm backend
now reports an error instead of crashing mise with a core dump.
[#​14595](https://redirect.github.com/jdx/mise/pull/14595)
([@​jdx](https://redirect.github.com/jdx))
- On fish, mise no longer recurses until fish hits its call stack limit
after `mise implode`.
[#​14594](https://redirect.github.com/jdx/mise/pull/14594)
([@​jdx](https://redirect.github.com/jdx),
[@​thernstig](https://redirect.github.com/thernstig))
- `mise bootstrap` now finds Nix in `/nix/var/nix/profiles/default/bin`
when a `pre-packages` hook installed it earlier in the same run, so
`nix:` packages install.
[#​14596](https://redirect.github.com/jdx/mise/pull/14596)
([@​jdx](https://redirect.github.com/jdx))
- `MISE_WATCH_FILES_GIT_REWRITTEN` is no longer set when HEAD stayed on
the same commit, for example after `git checkout -b`, `git reset` or
`git branch -m`. Before, format-on-edit hooks skipped files you had just
edited. [#​14585](https://redirect.github.com/jdx/mise/pull/14585)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- Command wrapper templates can now use `config_root` and
`config_source`. Relative paths in template functions resolve from the
wrapper's config file instead of the current directory.
[#​14628](https://redirect.github.com/jdx/mise/pull/14628)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
##### Upgrading
- **Unsupported tool options:** if an install now fails with `option
'...' is not used by the ... backend`, remove the option or fix its
spelling. `mise config explain tools` shows which keys mise doesn't
recognize.
- **Paranoid mode:** after upgrading, run `mise trust` in each project
to approve its env files. Run it again after editing them. If you only
want the env-file check, set `paranoid = ["env_files"]`.
- **Firewall config on macOS and Windows:** if a shared config has an
invalid `[bootstrap.linux.firewall]` value, it now fails to load on
macOS and Windows too. Correct the value.
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.10.13...v2026.10.14>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.10.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.13):
: Untrusted project configs can no longer change settings
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.12...vfox-v2026.10.13)
mise now ignores `[settings]` in a project config until you trust it.
This release also adds per-version-range backend options to the registry
and template support for command wrappers and `[bootstrap.repos]`. It
fixes several bugs in lockfiles, tasks and multi-version tool options.
##### Security
- **`[settings]` from untrusted project configs is ignored.** Before, a
cloned repo's `mise.toml` could change settings as soon as mise found
it, with no trust prompt. That included settings that redirect downloads
or feed build commands, such as `node.mirror_url`, `python.pyenv_repo`
and `ruby.precompiled_url`. These settings now apply only after `mise
trust`, like `[env]`, `[hooks]` and `[tools]` options already did.
Trusted projects, global and system config, environment variables and
CLI flags work as before. Commands that trust the active config
implicitly (`mise run`, `mise exec`, `mise install`) reload settings
after trusting it, so the project's settings still apply to that same
command. Settings files are now parsed once per load.
[#​14538](https://redirect.github.com/jdx/mise/pull/14538),
[#​14553](https://redirect.github.com/jdx/mise/pull/14553)
([@​jdx](https://redirect.github.com/jdx))
For example, if an untrusted repo sets `[settings.python] pyenv_repo` to
its own URL, `mise settings get python.pyenv_repo` returns the default
pyenv repository until you run `mise trust`.
- mise's own `zip` dependency moved to 9.x, which fixes
GHSA-4684-h2q9-2vcp. Older versions applied Unix permissions through
extracted symlinks without checking that the target stayed inside the
destination. mise uses this code to extract downloaded `.zip` tool
archives.
[#​14577](https://redirect.github.com/jdx/mise/pull/14577)
([@​jdx](https://redirect.github.com/jdx))
##### Added
- **One registry backend can carry different options for each version
range.** A registry entry can list the same backend more than once, each
time with its own `min_version`/`max_version` and `options`. Tools whose
release assets changed at some version can then stay on one backend. Two
entries can't give the same version different options unless their
`platforms` don't overlap. Table syntax such as `tool = { version =
"1.4.0" }` now takes its registry defaults from the entry that version
selects. Older mise releases apply only the first entry's options to
every version.
[#​14543](https://redirect.github.com/jdx/mise/pull/14543)
([@​jdx](https://redirect.github.com/jdx))
```toml
backends = [
{ full = "github:example/tool", min_version = "2.0.0", options = {
asset_pattern = "tool-v2-*" } },
{ full = "github:example/tool", max_version = "2.0.0", options = {
asset_pattern = "tool-*" } },
]
```
- **`mise ls-remote` lists every version range of a registry tool.**
When a tool's backends serve different version ranges, mise now lists
each range from the backend that serves it. Before, it listed only the
first backend's range. For example, `mise ls-remote hk` now starts at
0.1.4 instead of 1.58.1. Explicit backends, overrides, `--all` and
`--strict-metadata` behave as before.
[#​14544](https://redirect.github.com/jdx/mise/pull/14544)
([@​jdx](https://redirect.github.com/jdx))
- **Command wrapper values render as templates.** `command`, `args` and
`env` in `[wrappers]` can use `vars`, `env` and the usual template
functions. `tools` and `config_root` are not available. A command that
renders blank is an error. Use `{% raw %}` to keep literal braces, such
as Docker's `{{.Names}}`.
[#​14565](https://redirect.github.com/jdx/mise/pull/14565)
([@​jdx](https://redirect.github.com/jdx))
```toml
[wrappers.foo]
command = "foo-real"
args = ["--mode={{ vars.mode }}"]
env = { FOO_HOME = "{{ [xdg_data_home, 'foo'] | join_path }}" }
```
- **`[bootstrap.repos]` supports templated `url`/`ref` and clone
options.** `url` and `ref` render from `[vars]` or the process
environment. Values from a config's `[env]` table are not available.
`filter`, `depth` and `submodules = true` are passed to the first `git
clone` as `--filter`, `--depth` and `--recurse-submodules`. Existing
checkouts are left as they are. `depth` can't be combined with a commit
SHA or a `refs/…` ref.
[#​14548](https://redirect.github.com/jdx/mise/pull/14548)
([@​jdx](https://redirect.github.com/jdx),
[@​ovidiubuligan](https://redirect.github.com/ovidiubuligan))
```toml
[bootstrap.repos]
"~/src/large" = { url = "git@github.com:example/large.git", ref = "{{
vars.branch }}", filter = "blob:none", depth = 1 }
```
- **`{{ system_brew_prefix }}` template variable.** It resolves to the
Homebrew prefix that `mise bootstrap` installs into: `/opt/homebrew` on
macOS and `/home/linuxbrew/.linuxbrew` on Linux, or the value of
`MISE_SYSTEM_BREW_PREFIX`. It does not detect a Homebrew install
somewhere else. `[bootstrap.user].login_shell` now renders templates
too, so `login_shell = "{{ system_brew_prefix }}/bin/zsh"` works.
[#​14572](https://redirect.github.com/jdx/mise/pull/14572),
[#​14570](https://redirect.github.com/jdx/mise/pull/14570)
([@​jdx](https://redirect.github.com/jdx))
- **vfox `PreInstall` hooks can return a `headers` table** next to `url`
and `sha256`. Plugins can now download private or token-gated artifacts
through the normal install path, which handles checksums, retries and
lockfile URLs. Headers are sent only to the origin of `url`, are dropped
on cross-origin redirects, are redacted in debug output and are never
written to `mise.lock`. An explicit `Authorization` header overrides
netrc and the automatic GitHub token.
[#​14531](https://redirect.github.com/jdx/mise/pull/14531)
([@​jdx](https://redirect.github.com/jdx))
- **`mise doctor` reports a stale `mise-shim.exe` on Windows.** In
`windows_shim_mode = "exe"`, shims are copies of the `mise-shim.exe`
that sits beside `mise.exe`. If that template is older than mise, or has
no version tag (every template built before this release), `mise doctor`
reports it and `mise reshim` warns. To fix it, update mise with the
package manager that installed it, or run `mise self-update`, and then
run `mise reshim --force`.
[#​14586](https://redirect.github.com/jdx/mise/pull/14586)
([@​jdx](https://redirect.github.com/jdx))
##### Fixed
- **Lockfiles**
- Running `mise lock` on Windows now records `ruby` entries for Windows,
Linux and macOS platforms. Before, it skipped them, and `mise install
--locked` then failed.
[#​14520](https://redirect.github.com/jdx/mise/pull/14520),
[#​14529](https://redirect.github.com/jdx/mise/pull/14529)
([@​jdx](https://redirect.github.com/jdx))
- Commands that rewrite `mise.lock` without locking again, such as `mise
link`, no longer delete other platforms' option variants (for example,
per-platform `asset_pattern` entries).
[#​14519](https://redirect.github.com/jdx/mise/pull/14519)
([@​jdx](https://redirect.github.com/jdx))
- A `mise link` for one version of a tool no longer makes `mise install
--locked` fail for that tool's other versions. A link now bypasses the
lockfile only when the requested version could select it.
[#​14539](https://redirect.github.com/jdx/mise/pull/14539)
([@​jdx](https://redirect.github.com/jdx))
- `mise install --locked` for Java no longer fetches the mise-java
catalog when `mise.lock` already has the download URL, so locked
installs work in air-gapped or proxied environments.
[#​14534](https://redirect.github.com/jdx/mise/pull/14534)
([@​jdx](https://redirect.github.com/jdx))
- **Tasks and shims**
- `mise run` no longer hangs when parallel tasks need to install the
same tool.
[#​14536](https://redirect.github.com/jdx/mise/pull/14536)
([@​jdx](https://redirect.github.com/jdx))
- Running `mise install` inside a task no longer removes the shims for
that task's `lazy` tools.
[#​14533](https://redirect.github.com/jdx/mise/pull/14533)
([@​jdx](https://redirect.github.com/jdx))
- Task hooks (such as `postinstall = { task = "setup" }`) and
`watch_files` task hooks now run with mise even when a tool shim
triggered them. Before, they could fail with errors like `jq: Unknown
option --cd`.
[#​14550](https://redirect.github.com/jdx/mise/pull/14550)
([@​jdx](https://redirect.github.com/jdx),
[@​alitas](https://redirect.github.com/alitas))
- `mise watch` exits quietly with status 130 when you interrupt
watchexec with Ctrl+C, instead of printing an error.
[#​14541](https://redirect.github.com/jdx/mise/pull/14541)
([@​jdx](https://redirect.github.com/jdx))
- **Per-version tool options**
- When a `github:`, `gitlab:` or `forgejo:` tool lists several versions
in config, each version now installs with its own options. Before, an
option such as `rename_exe` set only on the first entry applied to every
version.
[#​14537](https://redirect.github.com/jdx/mise/pull/14537)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `vfox:` plugin hooks now receive only the options configured for the
version they handle.
[#​14562](https://redirect.github.com/jdx/mise/pull/14562)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `mise install` now restores `cargo`, `rustc` and the host's `rust-std`
when they are missing from a Rust toolchain with the `minimal` or
`default` profile. Before, mise reported such a toolchain as installed.
[#​14525](https://redirect.github.com/jdx/mise/pull/14525)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562),
[@​risu729](https://redirect.github.com/risu729))
- The uv, pip and poetry deps providers now run again after mise
recreates a deleted venv in a later process. Before, the new venv stayed
empty. [#​14532](https://redirect.github.com/jdx/mise/pull/14532)
([@​halms](https://redirect.github.com/halms))
- vfox plugins now report an error, instead of crashing mise, when the
HTTP client can't be built (for example, when no CA certificates are
installed).
[#​14576](https://redirect.github.com/jdx/mise/pull/14576)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- MCP resource read errors now include the underlying cause, such as the
untrusted-config message and its `mise trust` hint.
[#​14566](https://redirect.github.com/jdx/mise/pull/14566)
([@​diogochaves](https://redirect.github.com/diogochaves))
##### Registry
- `xcsift` 1.7.0 and later installs from signed Packslip releases and
now supports Linux x64 as well as macOS ARM64.
[#​14540](https://redirect.github.com/jdx/mise/pull/14540)
([@​jdx](https://redirect.github.com/jdx))
- `protoc-gen-connect-go` 2.x now installs from the `/v2` Go module
path, and 1.x versions keep working.
[#​14545](https://redirect.github.com/jdx/mise/pull/14545)
([@​jdx](https://redirect.github.com/jdx))
- Added `rea` (`npm:rea-agents`).
[#​14421](https://redirect.github.com/jdx/mise/pull/14421)
([@​phucisstupid](https://redirect.github.com/phucisstupid))
##### Documentation
- The docs now state that OpenTelemetry export and spinel installs
require `experimental = true`.
[#​14552](https://redirect.github.com/jdx/mise/pull/14552)
([@​ZainnQureshii](https://redirect.github.com/ZainnQureshii))
##### New Contributors
- [@​phucisstupid](https://redirect.github.com/phucisstupid) made
their first contribution in
[#​14421](https://redirect.github.com/jdx/mise/pull/14421)
- [@​diogochaves](https://redirect.github.com/diogochaves) made
their first contribution in
[#​14566](https://redirect.github.com/jdx/mise/pull/14566)
- [@​ZainnQureshii](https://redirect.github.com/ZainnQureshii)
made their first contribution in
[#​14552](https://redirect.github.com/jdx/mise/pull/14552)
- [@​fang2hou](https://redirect.github.com/fang2hou) made their
first contribution in
[#​14551](https://redirect.github.com/jdx/mise/pull/14551)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.10.12...v2026.10.13>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.10.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.12):
: Per-tool Python runtimes for PyPI tools, Gradle workspace discovery,
and env file find_up
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.11...vfox-v2026.10.12)
PyPI and pipx tools can now choose their own Python runtime, the
workspace graph can read Gradle multi-module builds, and `env._.file`
can search parent directories. When mise-versions is having an outage,
GitHub lookups now retry on `api.github.com`, and `_.source` scripts no
longer pick up `~/.bashrc` when mise is launched from an editor.
##### Added
- **Per-tool Python for `pypi:` tools.** Set `python` to a minor series
or an exact version, and mise installs that runtime and passes it to uv
or pipx for that tool only. The runtime stays private to the tool and
does not become your shell's default Python. `mise lock` records the
selected Python with the tool, and `mise prune` keeps any runtime that a
retained tool environment still uses. You can't combine `python` with
`--python`/`-p` in `uvx_args` or `pipx_args`. Tools that don't set
`python` behave as before.
[#​14479](https://redirect.github.com/jdx/mise/pull/14479)
([@​jdx](https://redirect.github.com/jdx))
```toml
[tools]
"pypi:black" = { version = "latest", python = "3.12" }
"pypi:ruff" = { version = "latest", python = "3.12.12" }
```
If you change a tool's `python`, mise installs a new environment instead
of reusing the old one. If that install fails, the previous working
environment is left untouched.
[#​14504](https://redirect.github.com/jdx/mise/pull/14504)
([@​jdx](https://redirect.github.com/jdx))
- **Gradle workspace discovery.** `mise tasks graph` and `mise run
--affected` now find projects listed by `include` in `settings.gradle`
or `settings.gradle.kts`, using Groovy or Kotlin syntax. Project IDs
follow Gradle paths: `:app` becomes `gradle::app`, and the root project
is `gradle::`. Literal `project(":lib")` references in a project's
top-level `dependencies {}` block become graph edges. mise reads the
scripts as text and never runs Gradle. If an `include` is computed or
conditional, a `projectDir` isn't a plain `file("...")` literal, or both
settings files exist, mise reports an error that points to
`[monorepo.projects."gradle:..."]` overrides. Editing the settings
script marks every Gradle project as affected. Based on a prototype by
[@​Jarvvski](https://redirect.github.com/Jarvvski).
[#​14512](https://redirect.github.com/jdx/mise/pull/14512)
([@​jdx](https://redirect.github.com/jdx))
- **`find_up` for `env._.file`.** With `find_up = true`, mise looks for
a relative path in the current directory and in every parent, so a
global config can load each project's `.env` files. Files load from the
root down, so values in closer files win. The default is `false`, and
the option has no effect on absolute paths.
[#​14497](https://redirect.github.com/jdx/mise/pull/14497)
([@​jdx](https://redirect.github.com/jdx))
```toml
# ~/.config/mise/config.toml
[env]
_.file = [
{ path = ".env", find_up = true },
{ path = ".env.local", find_up = true },
]
```
- **Detect git-rewritten files in `watch_files` hooks.** mise sets
`MISE_WATCH_FILES_GIT_REWRITTEN=1` when every changed file was last
written before git's most recent HEAD move (checkout, pull, rebase).
Commits don't count as HEAD moves. Hooks such as format-on-edit can use
this to skip files the user didn't edit. `git stash pop`/`apply` don't
move HEAD, so mise doesn't detect them.
[#​14511](https://redirect.github.com/jdx/mise/pull/14511)
([@​jdx](https://redirect.github.com/jdx))
```toml
[[watch_files]]
patterns = ["**/*.go"]
run = '[ -n "$MISE_WATCH_FILES_GIT_REWRITTEN" ] || { IFS=:; hk fix
$MISE_WATCH_FILES_MODIFIED; }'
```
- **`.tera` sources inferred for dotfile group templates.** A `mode =
"template"` entry in `[dotfile_groups]` no longer needs a `source` just
to point at a `.tera` file. If the exact path doesn't exist, mise falls
back to the same path with `.tera` added. An explicit `source` still
takes precedence, and the `.tera` file is not also deployed under its
suffixed name.
[#​14502](https://redirect.github.com/jdx/mise/pull/14502)
([@​jdx](https://redirect.github.com/jdx))
- **`mise lock` warns about unsupported platforms.** If you name
platforms with `lockfile_platforms` or `mise lock --platform`, mise
prints a warning for each tool version that has no build for one of
them, for example `apko@0.30.0 is not available for windows-x64; it will
not install there`. The default platform set still only logs this at
debug level, and the exit status is unchanged.
[#​14500](https://redirect.github.com/jdx/mise/pull/14500)
([@​jdx](https://redirect.github.com/jdx))
- Registry: added `martin` (`github:maplibre/martin`).
[#​14488](https://redirect.github.com/jdx/mise/pull/14488)
([@​ivan-ivkovic](https://redirect.github.com/ivan-ivkovic),
[@​jdx](https://redirect.github.com/jdx))
##### Fixed
- **GitHub lookups survive mise-versions outages.** If mise-versions
times out, drops the connection, or returns `429` or `5xx`, mise now
retries the lookup on `api.github.com`, using your GitHub token if one
is set. This covers releases, tags, repository contents, attestations
and `self-update`. A `404`, `403` or empty answer from mise-versions is
still trusted and not retried, so normal use doesn't spend GitHub's
anonymous rate limit. If both sources fail, the error shows both
failures, and a previously cached version list is still used.
[#​14501](https://redirect.github.com/jdx/mise/pull/14501)
([@​jdx](https://redirect.github.com/jdx))
- **`_.source` no longer loads `~/.bashrc`.** When mise's stdin was a
socket and `SHLVL` was unset, which happens when an editor extension
such as the VS Code mise extension starts it, bash sourced `~/.bashrc`
before the script. That leaked variables into the environment and could
drop the script's `PATH` entries. The script now runs with `--norc`.
[#​14487](https://redirect.github.com/jdx/mise/pull/14487)
([@​pikeas](https://redirect.github.com/pikeas))
- **Each version entry uses its own options.** When a tool listed
several versions, options set only on the first entry leaked into the
later ones. For example, `prerelease = true` on a `latest` entry made a
separate `"1"` entry resolve to a prerelease.
[#​14476](https://redirect.github.com/jdx/mise/pull/14476)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562),
[@​risu729](https://redirect.github.com/risu729))
- **Project overrides now work when a workspace provider fails.**
Previously, if a provider couldn't read its manifest (for example, a
malformed `go.work`), `mise tasks graph` and `mise run --affected`
failed for the whole repo. Declaring a project in that provider's
namespace under `[monorepo.projects]` now replaces the provider's output
and clears its error. Providers with no declared projects still fail
loudly. [#​14508](https://redirect.github.com/jdx/mise/pull/14508)
([@​jdx](https://redirect.github.com/jdx))
##### Documentation
- Explained why `mise activate` keeps shims on `PATH`
[#​14493](https://redirect.github.com/jdx/mise/pull/14493)
([@​jdx](https://redirect.github.com/jdx)), and clarified the
platform-specific mise cache paths for CI
[#​14506](https://redirect.github.com/jdx/mise/pull/14506)
([@​zeitlinger](https://redirect.github.com/zeitlinger)).
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.10.11...v2026.10.12>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.10.11`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.11):
: Much faster installs and far fewer GitHub API calls
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.10...vfox-v2026.10.11)
mise is much faster in this release and calls the GitHub API far less.
Version lists, release tags, attestations and other public GitHub
metadata now come from mise-versions, so everyday commands like `mise
install`, `exec`, shims, `outdated`, `lock` and `self-update` are
quicker and users without a GitHub token no longer run into the
60-requests-an-hour limit. Cached version lists are reused for longer,
so repeat installs skip most lookups. It also adds `mise bootstrap
--upgrade` and `mise env --paths`, and closes a trust gap in remote task
files.
##### Speed and GitHub API usage
Cold-cache timings for v2026.10.10 versus v2026.10.11, measured with
hyperfine on one Linux x64 machine with no GitHub token set:
| Command | v2026.10.10 | v2026.10.11 |
| ----------------------------------------------------- | ----------- |
----------- |
| `mise ls-remote python` | 961 ms | 93 ms |
| `mise install` (jq, ripgrep, fd, bat, gh, shellcheck) | 1.49 s | 1.08
s |
| `mise outdated` (same six tools installed) | 433 ms | 272 ms |
The install and `outdated` runs are noisy (±0.1–0.4s over 4 runs) and
the install time includes downloads, so treat them as rough. Requests to
`api.github.com` in a cold `mise install` of `github:` tools dropped
from 2 to 0. Cold `mise outdated` made 8 network requests before and
none now.
- **Public GitHub metadata comes from mise-versions.** With
`use_versions_host` on (the default), release lists, `latest`, git tags
(aqua `github_tag` packages, ubi and go), artifact attestations
(including aqua's `predicate_type` filters) and the digest in the
checksum-mismatch hint are read from mise-versions instead of
`api.github.com`. GitHub is still asked directly for repositories
mise-versions doesn't list when you have a token (the private-repository
case), and in paranoid mode for attestations. The direct API is also
used with `use_versions_host = false`, GitHub `url_replacements` and
custom `api_url`s.
[#​14460](https://redirect.github.com/jdx/mise/pull/14460),
[#​14461](https://redirect.github.com/jdx/mise/pull/14461),
[#​14469](https://redirect.github.com/jdx/mise/pull/14469),
[#​14481](https://redirect.github.com/jdx/mise/pull/14481),
[#​14477](https://redirect.github.com/jdx/mise/pull/14477),
[#​14443](https://redirect.github.com/jdx/mise/pull/14443)
- Other requests also moved off the GitHub API:
- `mise x`, `mise exec`, shims and `hook-env` use mise-versions when
they auto-install a tool.
[#​14458](https://redirect.github.com/jdx/mise/pull/14458)
- `mise self-update` reads mise's releases from mise-versions and
downloads the archive from github.com release downloads. Packslip and
zipsign verification are unchanged.
[#​14464](https://redirect.github.com/jdx/mise/pull/14464)
- `mise lock` downloads artifacts for provenance checks from github.com
instead of the API asset endpoint.
[#​14465](https://redirect.github.com/jdx/mise/pull/14465)
- Aqua registries hosted on GitHub are fetched from
raw\.githubusercontent.com.
[#​14470](https://redirect.github.com/jdx/mise/pull/14470)
- Ruby looks up the latest ruby-build release through mise-versions.
[#​14471](https://redirect.github.com/jdx/mise/pull/14471)
- **Fewer version-list fetches.** `mise install`, `use` and `run` now
reuse a cached version list for the tool's `minimum_release_age` window
minus one hour, clamped to 1–24h. With the default 24h cutoff, that is
23h. `outdated`, `upgrade`, `ls-remote`, `lock` and `latest` still
refresh after 1h. If you set `fetch_remote_versions_cache` yourself,
your value applies to every command.
[#​14484](https://redirect.github.com/jdx/mise/pull/14484),
[#​14485](https://redirect.github.com/jdx/mise/pull/14485),
[#​14457](https://redirect.github.com/jdx/mise/pull/14457)
- **Faster version resolution:**
- Multi-tool commands such as `mise outdated` can resolve many registry
tools with one request to the mise-versions index.
[#​14473](https://redirect.github.com/jdx/mise/pull/14473)
- `latest` is resolved without refetching the list.
[#​14456](https://redirect.github.com/jdx/mise/pull/14456)
- Explicit backend args such as `aqua:jqlang/jq` reuse the registry
tool's version list.
[#​14459](https://redirect.github.com/jdx/mise/pull/14459)
- Release tags come from the versions host instead of being listed or
guessed.
[#​14442](https://redirect.github.com/jdx/mise/pull/14442)
- Packslip installs no longer re-download what resolution already
verified.
[#​14466](https://redirect.github.com/jdx/mise/pull/14466)
- Install tracking and the Python version list are served from static
assets. [#​14441](https://redirect.github.com/jdx/mise/pull/14441)
- **Python version listing no longer clones pyenv.** `mise ls-remote
python`, `outdated`, `upgrade` and fuzzy `mise use python@3.12` read the
python-build definitions from mise-versions. A cold listing took about
960ms before and about 90ms now. pyenv is still cloned when mise
compiles Python, when `python.pyenv_repo` points at a fork, when you're
offline, or when `use_versions_host = false`. Some definitions that had
no date before now have one, so they are held back by
`minimum_release_age` until they are old enough.
[#​14455](https://redirect.github.com/jdx/mise/pull/14455)
- `mise oci build` now requires root for `apt:` packages, as it already
did for apk, and fails up front with a clear message. If apt-get still
fails, the error now includes the last lines of dpkg's output.
[#​14447](https://redirect.github.com/jdx/mise/pull/14447)
- Registry: `native-sdk` now installs from npm (`@native-sdk/cli`), so
the `native` command works. It requires Node 24+.
[#​14431](https://redirect.github.com/jdx/mise/pull/14431)
##### Security
- **Remote task files now need trust before their headers render.** A
`mise.toml` with only `[tasks]` loads without trust. Before this fix, if
one of those tasks set `file` to a remote URL, `mise tasks ls`, `mise
tasks info` and `mise tasks validate` rendered the file's `#MISE`
headers, so a template like `{{ exec(...) }}` ran without a trust
prompt. Remote files now follow the same rule as local task includes: if
the headers contain template syntax, the config that references them
must be trusted first. Remote files with plain headers still list
without trust, and braces in the script body need no trust.
[#​14416](https://redirect.github.com/jdx/mise/pull/14416)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562),
[@​risu729](https://redirect.github.com/risu729))
- Updated rustls to 0.23.46 to address a RustSec advisory.
[#​14434](https://redirect.github.com/jdx/mise/pull/14434)
##### Added
- **`mise bootstrap --upgrade`** installs what is missing and then
upgrades what is already installed, in a single run. In the packages
phase it runs the same upgrade as `mise bootstrap packages upgrade`, and
pins are respected. In the tools phase it runs `mise upgrade` without
`--bump`, so configured version ranges hold. Both run before the
matching post hooks and dependent services. `--dry-run` previews both
steps and `--skip` works as before. It does not update mise itself,
repositories or images, and it does not restart services.
[#​14433](https://redirect.github.com/jdx/mise/pull/14433)
```sh
mise self-update --yes && mise bootstrap --upgrade
```
- **`mise env --paths`** prints the PATH entries mise manages, one per
line and in PATH order: tool bin directories, `_.path` entries, and
inherited directories that mise moves forward, such as `~/.cargo/bin`.
This lets CI integrations export only mise's additions without diffing
`PATH`. [#​14429](https://redirect.github.com/jdx/mise/pull/14429)
```console
$ mise env --paths
/home/me/.local/share/mise/installs/node/24.11.0/bin
/home/me/.cargo/bin
```
- **The install script downloads pinned versions from mise.jdx.dev.**
`curl https://mise.run | MISE_VERSION=<version> sh` now tries
mise.jdx.dev first and falls back to GitHub Releases if that download
fails. Checksums for pinned versions still come only from GitHub's
`SHASUMS256.txt`. If no checksum is found, the script refuses to
install. `MISE_INSTALL_FROM_GITHUB=1` still uses GitHub only.
[#​14446](https://redirect.github.com/jdx/mise/pull/14446)
- Registry: `gdal` installs the GDAL/OGR command-line tools from
conda-forge (`conda:libgdal-core`).
[#​14440](https://redirect.github.com/jdx/mise/pull/14440)
([@​ivan-ivkovic](https://redirect.github.com/ivan-ivkovic))
##### Fixed
- **A bare `mise upgrade` no longer installs lazy tools that have never
been installed.** Naming the tool still installs it. A lazy tool that
already has a version installed upgrades as before. A missing lazy tool
is still installed if an upgraded tool depends on it. `mise outdated`
now marks these tools as `[MISSING] (lazy)`, and the bare upgrade no
longer looks up their versions.
[#​14422](https://redirect.github.com/jdx/mise/pull/14422)
([@​ryanrhughes](https://redirect.github.com/ryanrhughes)),
[#​14444](https://redirect.github.com/jdx/mise/pull/14444)
- Fixed false `stack limit reached` errors on the static musl builds,
for example on Ubuntu 26.04. These errors broke aqua `version_filter`
parsing and made shims such as kubectl's report "not a valid shim".
[#​14450](https://redirect.github.com/jdx/mise/pull/14450)
- `mise lock --platform ...` run on Alpine or NixOS no longer records
Node source builds for other platforms. Only an explicit `node.compile`
or `all_compile = true` forces source builds for those targets.
[#​14432](https://redirect.github.com/jdx/mise/pull/14432)
- `mise upgrade --bump` and hand-edited version pins no longer drop a
pipx tool's locked uv dependency graph. Before, `mise install --locked`
then failed on a fresh checkout.
[#​14426](https://redirect.github.com/jdx/mise/pull/14426)
([@​wislertt](https://redirect.github.com/wislertt))
- Packslip prefixes such as `fnox@1` now skip releases this host can't
install, the same way `latest` does. Each skipped release gets a
warning, and if no match can be installed, mise reports a clear error.
[#​14467](https://redirect.github.com/jdx/mise/pull/14467)
- A `bash` shim ahead of `/bin` no longer causes a false "shim fallback
recursion detected" error for commands like `bash -c 'bash --version'`.
The docs now recommend installing shells with the system package manager
instead of `[tools]`.
[#​14475](https://redirect.github.com/jdx/mise/pull/14475)
- Bootstrap UFW rules with an `interface` now render the incoming
direction (`ufw allow in on tailscale0 ...`), which fixes `Invalid token
'on'` errors.
[#​14480](https://redirect.github.com/jdx/mise/pull/14480)
- Dotfiles:
- Before the `files: apply` prompt, mise now lists each file it will
create, overwrite or remove and warns that local edits will be replaced.
The prompt now defaults to No.
[#​14430](https://redirect.github.com/jdx/mise/pull/14430)
- `mise dot add --changed` now also captures edited files that a
copy-mode `dotfile_groups` root discovers automatically, not just files
listed explicitly in `entries`.
[#​14436](https://redirect.github.com/jdx/mise/pull/14436)
##### Documentation
- The docs now recommend committing `mise.lock`, so CI and Docker builds
skip version lookups.
[#​14453](https://redirect.github.com/jdx/mise/pull/14453)
##### New Contributors
- [@​ivan-ivkovic](https://redirect.github.com/ivan-ivkovic) made
their first contribution in
[#​14440](https://redirect.github.com/jdx/mise/pull/14440)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.10.10...v2026.10.11>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.10.10`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.10):
: Task skip_if, snap and COPR in bootstrap, and dotfiles pull fixes
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.9...vfox-v2026.10.10)
Tasks can now skip themselves with a `skip_if` check, and bootstrap
gains Snap packages, Fedora COPR repositories, and branch selection for
`--adopt`. This release also fixes several `mise dot pull` problems that
could loop, stall, or leave sharing paused on long histories. On the
Windows side, it fixes `.mise-bins` executables and npm installs
restored from a cache.
##### Added
- **`skip_if` for tasks.** Before a task runs, mise runs its `skip_if`
shell command. If the command exits 0, mise skips the task and counts it
as successful. Any other exit status runs the task as usual.
[#​14399](https://redirect.github.com/jdx/mise/pull/14399)
```toml
[tasks.setup]
skip_if = "test -f .initialized"
run = "touch .initialized"
```
The check runs after `depends` and before `confirm`. It uses the task's
directory, shell, environment, sandbox and `timeout`, and it supports
Tera templates and task arguments. Its output is discarded and it gets
no stdin. It does not receive the task's `secrets`. File tasks can set
it with `#MISE skip_if="..."`. `mise run --force` skips the check,
`--dry-run` prints it without running it, and `mise tasks info` shows
it. If the check can't start, times out, or is killed, the task fails.
- **Snap packages in bootstrap.** On Linux, you can declare snaps in
`[bootstrap.packages]` alongside apt and flatpak, with optional
`channel` and `classic`, and `state = "absent"` to remove a snap. If a
snap tracks a different channel than you declared, `status` shows it and
`apply` moves it with `snap refresh --channel`. snapd can't install or
hold a specific version, so `apply` and `upgrade` skip entries with a
version pin and print a warning.
[#​14402](https://redirect.github.com/jdx/mise/pull/14402)
```toml
[bootstrap.packages]
"snap:jq" = "latest"
"snap:node" = { channel = "22/stable", classic = true }
```
- **COPR repositories with `[bootstrap.dnf.repos]`.** You can declare a
COPR next to the `dnf:` packages that come from it, instead of using a
`pre-packages` hook. mise writes the same `/etc/yum.repos.d` file that
`dnf copr enable` does. It does not need the copr plugin, so this also
works on Fedora Atomic hosts that layer packages. The chroot is chosen
from `/etc/os-release` (Fedora, EL, Amazon Linux). Without `--yes`, mise
asks before enabling any COPR. mise never disables or removes
repositories, but `mise bootstrap unapply` names any leftover files.
[#​14401](https://redirect.github.com/jdx/mise/pull/14401)
```toml
[bootstrap.dnf.repos]
ghostty = { copr = "scottames/ghostty" }
[bootstrap.packages]
"dnf:ghostty" = "latest"
```
- **`mise bootstrap --adopt <url>?ref=<branch>`** adopts a branch other
than the default, either for global config or for a setup history. This
also works with `mise bootstrap remote`. The ref must be a branch: tags,
commits and missing branches are refused before anything is cloned. mise
never switches an existing `~/.config/mise` checkout to another branch,
even with `--update`, so use `git switch` first. The docs now also
explain how `mise dot origin set` relates to an adopted global config.
[#​14400](https://redirect.github.com/jdx/mise/pull/14400)
- **GitHub OAuth refresh token in the Secure Enclave.** On a Mac with
Touch ID, set `github.oauth_cache_secure_enclave = true` to keep the
native GitHub OAuth refresh token behind Touch ID instead of in
plaintext in `github-oauth-tokens.toml`. Touch ID asks for a fingerprint
only when the token needs refreshing. If you cancel the prompt, mise
skips the refresh and keeps the cached access token. This needs the
Developer ID-signed release build. Homebrew and source builds print a
warning and keep the token in the cache file.
[#​14413](https://redirect.github.com/jdx/mise/pull/14413)
##### Changed
- On Windows, `experimental = true` now turns on the [identity install
layout](https://mise.jdx.dev/dev-tools/install-layout.html) by itself,
which keeps deep npm, pipx and Java trees under the 260-character path
limit. Only new installs use it. Existing installs stay where they are,
and `mise installs migrate` can move them. To keep the old layout, set
`install_layout = "legacy"` (or `MISE_INSTALL_LAYOUT=legacy`). Linux and
macOS still need `install_layout = "identity"` set explicitly.
[#​14392](https://redirect.github.com/jdx/mise/pull/14392)
##### Fixed
##### Dotfiles
- Machines that share an origin and track an encrypted file no longer
swap ciphertext back and forth forever. age encryption gives different
ciphertext for the same content, so `mise dot watch` could publish
commits endlessly without any real edits. Now mise keeps the ciphertext
that history already has whenever it decrypts to the same content, mode
and recipients. Machines that are already looping settle after one more
sync. [#​14405](https://redirect.github.com/jdx/mise/pull/14405)
- `mise dot pull` on long histories is much faster. The number of git
processes no longer grows with the length of the history: in one test
with 2,000 commits, a pull went from 137 s to under 6 s.
[#​14407](https://redirect.github.com/jdx/mise/pull/14407),
[#​14415](https://redirect.github.com/jdx/mise/pull/14415)
- When a pull's plan went out of date because another operation saved
first, it was treated as a failed apply and paused sharing until someone
ran `mise dot pull` by hand. Now, if nothing has been written yet, mise
retries on the next attempt and the watcher keeps applying changes.
[#​14414](https://redirect.github.com/jdx/mise/pull/14414)
- After an interrupted history operation, `mise dot pull --yes` no
longer fails with "local saved history changed since planning". The pull
now recovers the interrupted operation before it plans.
[#​14410](https://redirect.github.com/jdx/mise/pull/14410)
- A file that already has the incoming version (content and mode) is no
longer held as an unsaved edit or conflict that pauses sharing. Running
`mise dot pull --take-remote <path>` again for a path an earlier pull
already resolved no longer fails with "is not a conflict".
[#​14411](https://redirect.github.com/jdx/mise/pull/14411)
##### Windows
- `mise x` and shims now run the original executable instead of its copy
in `.mise-bins`, for tools installed with aqua `symlink_bins`, github
`filter_bins`, or packslip. Programs that look for DLLs or data next to
their own executable, such as exiftool, now start correctly. Tools
installed by older versions need `mise install --force` to get this. A
shell from `mise activate` that finds the copy on `PATH` still runs the
copy. [#​14397](https://redirect.github.com/jdx/mise/pull/14397)
- npm tools installed with the built-in aube installer are reinstalled
if their dependency links are missing, for example after a CI cache
restore drops NTFS junctions. Before, mise reported them as installed
and they failed at run time with `ERR_MODULE_NOT_FOUND`.
[#​14418](https://redirect.github.com/jdx/mise/pull/14418)
##### Tools and installs
- `rust@nightly`, `mise ls-remote rust`, and `mise outdated`/`upgrade`
now read the nightly manifest from `RUSTUP_DIST_SERVER`, so a mirror
such as panamax no longer needs access to `static.rust-lang.org`. If
`[env]` sets `RUSTUP_DIST_SERVER` or `RUSTUP_UPDATE_ROOT`, mise also
passes them to `rustup-init` and `rustup toolchain install`.
[#​14384](https://redirect.github.com/jdx/mise/pull/14384)
- With a global `minimum_release_age`, `mise use --tool-option
minimum_release_age=0s <tool>` now installs the actual latest version
instead of the version the global cutoff allows.
[#​14398](https://redirect.github.com/jdx/mise/pull/14398)
([@​halms](https://redirect.github.com/halms))
- Upgrading a global npm tool that `mise lock --global` locked with a
dependency graph now regenerates the graph for the new version,
including with `--bump`. Before, the upgrade dropped the graph and the
next `mise install --locked` failed.
[#​14419](https://redirect.github.com/jdx/mise/pull/14419)
([@​altendky](https://redirect.github.com/altendky))
- Reinstalling a packslip tool signed by a shared reusable workflow
works again with its saved pin. In v2026.10.9, mise rejected the
unchanged signer as "not a workflow of" the tool's repository. Signer,
workflow or repository changes are still refused.
[#​14408](https://redirect.github.com/jdx/mise/pull/14408)
- Building Erlang from source now shows `compiling with kerl` while the
build runs, instead of staying on `verifying checksum`. kerl's output
now prints above the progress row instead of writing over it.
[#​14391](https://redirect.github.com/jdx/mise/pull/14391)
- `mise prune` now shows a progress line while it scans for unused
versions, instead of printing nothing for what could be a long time.
[#​14420](https://redirect.github.com/jdx/mise/pull/14420)
- The JSON schema now rejects unknown keys in `env._.python` and its
`venv` options, matching what mise already refused at load time. Editors
now flag these mistakes.
[#​14387](https://redirect.github.com/jdx/mise/pull/14387)
([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562),
[@​risu729](https://redirect.github.com/risu729))
##### Documentation
- The configuration docs now explain how mise searches for config before
listing the per-directory file names.
[#​14390](https://redirect.github.com/jdx/mise/pull/14390)
- The bootstrap overview and run order now include
`[bootstrap.apt.sources]`.
[#​14396](https://redirect.github.com/jdx/mise/pull/14396)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.10.9...v2026.10.10>
##### 💚 Sponsor mise
mise is built and maintained by
[@​jdx](https://redirect.github.com/jdx), an open source developer
at [**entire.io**](https://entire.io/), the title sponsor of his open
source work.
If mise saves you or your team time, please consider becoming an
[individual or company sponsor](https://jdx.dev/sponsors.html). Your
support funds ongoing development and helps keep mise fast, free, and
independent.
###
[`v2026.10.9`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.9):
: path: tool versions require trust; apt repositories, login items and
run0/doas in bootstrap
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.8...vfox-v2026.10.9)
This release fixes a trust bypass: an untrusted `path:` tool version
could put a directory on `PATH`. It also adds several bootstrap
features: apt repositories and PPAs, macOS login items, rpm-ostree
layering on Fedora Atomic, and `run0`/`doas` support. Beyond that, it
improves `mise dot status`, adds GitHub OAuth conveniences, and fixes
problems across npm, prune, brew and dotfiles sync.
#### Se
> [!IMPORTANT]
> ✂ PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 4am on Monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/prometheus/client_java).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>1 parent eadfb6d commit e1b4ad2
16 files changed
Lines changed: 32 additions & 32 deletions
File tree
- .github/workflows
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
18 | | - | |
19 | | - | |
| 18 | + | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
37 | | - | |
38 | | - | |
| 37 | + | |
| 38 | + | |
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
18 | | - | |
| 17 | + | |
| 18 | + | |
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
38 | | - | |
39 | | - | |
| 38 | + | |
| 39 | + | |
40 | 40 | | |
41 | 41 | | |
42 | 42 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
23 | | - | |
24 | | - | |
| 23 | + | |
| 24 | + | |
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
42 | | - | |
43 | | - | |
| 42 | + | |
| 43 | + | |
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
33 | 33 | | |
34 | 34 | | |
35 | 35 | | |
36 | | - | |
37 | | - | |
| 36 | + | |
| 37 | + | |
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
24 | 24 | | |
25 | 25 | | |
26 | 26 | | |
27 | | - | |
28 | | - | |
| 27 | + | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
26 | | - | |
27 | | - | |
| 26 | + | |
| 27 | + | |
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
35 | | - | |
36 | | - | |
| 35 | + | |
| 36 | + | |
37 | 37 | | |
38 | 38 | | |
39 | 39 | | |
| |||
0 commit comments