[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
jdx/mise	uses-with	minor	2026.10.2 → 2026.11.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

jdx/mise

v2026.11.6: : Pick several tasks with mise run --multi, and use unprefixed bootstrap packages

Compare Source

mise run --multi lets you pick several tasks from a checklist. [bootstrap.packages] keys without a manager: prefix now install through one available package manager, and the npm backend can install from an HTTPS tarball URL. Custom daemons can name several ports, and launchd agents can set resource limits. This release also changes the default prompt theme to base16 and fixes problems with tasks, mise env --dotenv, and installs.

Added

• mise run --multi. Opens the task picker as a checklist. Press Space to check a task, / to filter, and Enter to run the checked tasks. They run as if you had joined them with :::, so they run in parallel unless one depends on another, and -j and the other mise run options still apply. Add --all to list tasks from every project in a monorepo. --multi needs an interactive terminal and can't be combined with a task name, --affected or --tag. #​15503 (@​jdx)

  mise run --multi
  mise run --multi --all

• Unprefixed [bootstrap.packages] keys. A key without a manager: prefix now installs through exactly one manager, so the same config works across distributions and operating systems. mise uses the first manager that is available and allowed by system_packages.managers. The default order is apt, dnf, pacman, zypper, apk, brew, winget, scoop, choco. #​15506 (@​jdx, @​thernstig)

  • The new system_packages.prefer setting (MISE_SYSTEM_PACKAGES_PREFER) replaces that order, and only the managers it lists are considered.
  • Use the new names option when a package has a different name under some managers.
  • mise picks the manager only by which managers are available, not by what their repositories contain. If the install fails, mise reports an error and does not try another manager.
  • If no manager can install a key, mise warns and skips it. mise bootstrap packages status lists it as skipped.
  • Prefixed keys such as "apt:git" work as before.

  [bootstrap.packages]
  git = "latest"
  openssl = { names = { apt = "libssl-dev", dnf = "openssl-devel" } }

• npm tools from HTTPS tarball URLs. The npm backend can now install a package from a tarball URL, such as a pkg.pr.new preview build. Use npm: followed by the full URL as the tool name, for example mise use 'npm:<tarball URL>'. The version is a prefix of the tarball's SHA-256, so latest means whatever the URL serves now, and mise up updates the tool when that content changes. #​15461 (@​jdx, @​kjanat)

  • Only HTTPS URLs work, and the checksum option isn't supported.
  • If the tarball depends on other URL packages, list them in allow_exotic_deps.
  • mise.lock records the version but not a dependency graph.

• Named ports on custom daemons. run and task daemons can now declare several ports in a ports table, as presets and containers already can. Before, mise passed these entries to pitchfork, which ignored them. Each port is exported as <DAEMON>_<NAME>_PORT. A fixed number is used as written. An auto port needs its own base, and each linked worktree gets a different port. Named ports are checked for collisions with other ports. #​15504 (@​jdx, @​ponko2)

  [daemons.stack]
  run = "docker compose up"
  ports.app = { auto = true, base = 8080 }
  ports.db = { auto = true, base = 5432 }
  ports.admin = 9000

• Resource limits for launchd agents. [bootstrap.macos.launchd.agents] entries accept soft_resource_limits and hard_resource_limits. You can now raise launchd's default limit of 256 open files without wrapping the program in a ulimit shell command. The keys are launchd's nine limits in snake case, such as number_of_files and number_of_processes. An empty table, or a soft limit above the hard limit, is an error. Based on @​disintegrator's implementation. #​15509 (@​jdx)

  [bootstrap.macos.launchd.agents.proxy]
  program = "~/.local/bin/proxy"
  soft_resource_limits = { number_of_files = 10240 }
  hard_resource_limits = { number_of_files = 65536 }

• history.lock_wait. Sets how long mise dot commands that change history wait when another history operation is running. Set it in config or with MISE_HISTORY_LOCK_WAIT. The default is 30s, 0 fails immediately, and any value above 1h is treated as 1h. mise dot watch and mise dot recover never wait. #​15498 (@​jdx, @​zachbornheimer)

• Progress in mise upgrade. After installing, mise upgrade checks every tracked config before removing old versions. This step now shows a checking tracked configs progress line, so the command no longer looks stuck. The check is also faster with many tracked configs: with about 930 configs, the same check in mise prune --dry-run dropped from about 12s to 2-4s. #​15489, #​15512 (@​jdx)

Changed

• Default prompt theme is now base16. Interactive prompts, such as the mise run task picker, were hard to read on light terminals that don't set COLORFGBG. The base16 theme now uses the terminal's named colors, and unselected options and help text use the terminal's normal text color. On dark terminals, prompts now look different by default. To keep the previous look, set color_theme = "charm" or color_theme = "auto". #​15494, #​15524 (@​jdx, @​AdrianDC)

Fixed

• Broken TOML task usage. A TOML task whose usage couldn't be loaded, such as a missing include file or a spec that didn't parse, used to break mise tasks --usage, mise generate task-docs and completion for every task. Now mise warns about that task and the others keep working. A broken task that doesn't use its spec, such as one with raw_args = true, still runs. mise tasks validate still reports the error. #​15465 (@​jdx)
• MISE_ORIGINAL_CWD with --cd. Tasks run with -C/--cd or MISE_CD now get the directory where mise was started, not the --cd target. #​15464 (@​jdx)
• Faster task freshness checks. Checking whether a task is up to date no longer reads directories that can't contain its sources or outputs. For example, sources = ["packages/*/src/**/*"] no longer reads every packages/*/node_modules, and mise skips directories excluded by !**/node_modules/**. Tasks still select the same files. #​15499 (@​jdx, @​2chanhaeng)
• mise env --dotenv output can be read back. Values are now quoted and escaped when needed, so values with #, newlines, quotes or $ stay the same when the file is loaded with _.file. Simple values stay unquoted. Tools that don't handle quotes, such as Docker --env-file, read the quotes as part of the value. #​15490 (@​jdx)
• Undefined {{ env.X }} errors. When a template referred to an undefined env field, the error listed the name of every environment variable, including secret names such as *_TOKEN. In an activated shell, mise printed this list at every prompt. The error now names only the missing field and suggests get_env(name=..., default=""). #​15510 (@​jdx)
• Nushell completion with activation. With mise activate nu, pressing Tab after mise now completes mise subcommands and arguments instead of file paths. On Nushell versions before 0.116, flags still need ^mise and the script from mise completion nu --install. #​15505 (@​jdx, @​Deano217)
• Command wrappers during installs. The cargo, npm, pipx and aube backends now run their install commands without command wrappers on PATH. For example, cargo install no longer fails when cargo is wrapped by mbx. mise exec, mise run and ordinary commands still use wrappers. #​15495 (@​jdx)
• cargo: tools with minimum_release_age. With an explicit minimum_release_age and "core:rust" = "stable", cargo: tools failed to install because mise looked for rust@stable instead of the dated Rust version it had installed. #​15460 (@​jdx)
• Date-only release ages for Rust beta and nightly. A date-only minimum_release_age, such as 2026-11-09, now includes rust@beta and rust@nightly builds from that day instead of falling back to the day before. #​15486 (@​jdx)
• packslip: releases in monorepos. In repositories that publish releases for several components, packslip: couldn't find releases listed after another component's releases. A pinned version is now looked up by its tag, and latest searches more of the release history. #​15501 (@​jdx, @​pepicrft)
• Faster GitHub fallback on 5xx errors. When a GitHub release download URL returns a 5xx error, mise now retries the check once, then switches to the API asset URL. Before, it used up all http_retries first, which could take minutes per file. #​15485 (@​jdx, @​csechuan)
• Long cache keys in the http: backend. Installs could fail with File name too long, for example Yarn 2+ from a packageManager with a Corepack checksum. Temporary directory names now stay under the filesystem's name length limit. #​15493 (@​jdx)
• Cleanup after failed installs. Installing a GitHub repo that isn't an asdf or vfox plugin no longer leaves its clone in the plugins directory. The error now suggests the github: backend. A failed install also removes its cache directory. #​15511 (@​jdx, @​gigaimage)
• Homebrew tap casks with zap :not_required. Previewing or installing these casks failed with an ArgumentError. #​15491 (@​jdx, @​cdenihan)

Full Changelog: jdx/mise@v2026.11.5...v2026.11.6

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.5: : mise dot files shows what is tracked in a directory

Compare Source

This release adds mise dot files to show which files in a directory are tracked, and a status.show_env_ignore setting to hide variables from the status line. It also lets dot commands accept relative paths, stops warning when you save dotfiles by hand, and fixes downloads that failed because ~/.netrc held a stale login.

Added

• mise dot files. Lists the files and subdirectories in a directory and shows the state of each one, so you no longer have to work out how [dotfiles] entries, their exclude/include lists and [history] exclude apply. The possible states are:

  • tracked: saved to history. The row shows the entry that covers it and whether it autosaves.
  • excluded: covered by an entry, but a rule leaves it out. The row names the rule.
  • omitted: selected, but capture skips it, for example a file that looks like a credential.
  • untracked: no entry covers it.
  • partial: a directory that isn't tracked itself but contains tracked files.
  • local: a path kept in local-only history (mode = "track-local").

  PATH defaults to the current directory and can be a relative path or a single file. -r/--recursive lists every file below the directory, --tracked and --untracked filter the rows, and --json prints one object per row. The command uses the same exclusion check as mise dot save, so the two always agree. #​15456 (@​jdx, @​farangkao)

  $ mise dot files ~/.config
  untracked  cache/
  partial    foot/   1 file tracked below
  tracked    hypr/   1 file · ~/.config/hypr (track, autosave)
  untracked  mise/

• status.show_env_ignore. With status.show_env on, mise lists every variable it sets each time you enter a directory, including variables that never change. This new setting takes variable names or shell globs to leave out of that line. You can also set it with MISE_STATUS_MESSAGE_SHOW_ENV_IGNORE as a comma-separated list. Changes to config files and paths are still shown. mise warns about malformed patterns and ignores them. #​15454 (@​jdx)

  [settings.status]
  show_env = true
  show_env_ignore = ["GO*", "DENO_INSTALL_ROOT"]

  With this config, mise +DENO_INSTALL_ROOT +GOBIN +GOROOT +LUA_INIT becomes mise +LUA_INIT.

Fixed

• Relative paths in mise dot commands. mise dot track config.toml used to fail with target must be absolute or start with ~/. track, untrack, add and edit now resolve relative paths from the current directory the way a shell does, including .. after a symlinked directory. A path inside your home directory is saved in its ~/ form. Exclude and include rules are still relative globs. #​15455 (@​jdx, @​farangkao)
• No warning when saving dotfiles by hand. If you haven't set up the history-watch service, mise dot track now prints an info message about saving with mise dot save instead of a warning, so --quiet hides it. mise dot status now lists automatic capture as manual, without a warning or a suggested next step. mise still warns if the watcher is set up but not running, or if captures fail. #​15455 (@​jdx, @​farangkao)
• 401 errors caused by stale ~/.netrc credentials. Some downloads failed with 401 Unauthorized even though the server would serve the file without logging in. For example, mise install glab failed against gitlab.com when ~/.netrc held a login that gitlab.com no longer accepted. If the only credentials came from netrc and the server returns 401, mise now retries once without them. Later retries of the same download also leave them out. Requests that carry their own Authorization header (such as forge tokens) and requests redirected to another host are not retried this way. #​15451 (@​jdx)

Full Changelog: jdx/mise@v2026.11.4...v2026.11.5

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.4: : zip:: includes for config and tasks

Compare Source

Config and task includes can now load from zip:: archives over HTTP(S). This release also fixes shim tab completion, [tool_alias] handling in enable_tools/disable_tools and mise prune, mise dot sync conflicts, and ufw firewall rule matching in mise bootstrap.

Added

• zip:: includes for config and tasks. Before, include and task_config.includes accepted local paths, git:: and oci:: sources. They now also accept a zip archive served over HTTP or HTTPS. mise downloads and unpacks the archive, then loads it the same way as an oci:: artifact. For task_config.includes it loads executable file tasks and .toml task files. For include it loads the mise.toml at the archive root. Zip entries don't reliably carry file permissions, so mise makes non-TOML files that start with a shebang executable. #​15439 (@​jdx)

  • Only HTTP and HTTPS URLs are accepted. Any other scheme fails with an error.
  • Task includes are still experimental, like the other remote sources.
  • A URL doesn't pin specific contents. mise refreshes a zip config include the way it refreshes a branch (fetch_remote_versions_cache), and paranoid mode rejects zip config includes.

  # replace <URL> with the archive's HTTP(S) URL
  include = ["zip::<URL of platform-config.zip>"]
  
  [task_config]
  includes = ["zip::<URL of shared-tasks-1.0.0.zip>"]

Fixed

• Tab completion through shims. Completing a command for a tool run through a mise shim (such as aube or pitchfork) showed mise's own subcommands instead of the tool's. mise now answers completion requests only when it is invoked as mise. Under a shim name, the request goes to the real tool. mise also skips version resolution, auto-install and auto-update while answering these requests. #​15429 (@​jdx)
• Tool aliases in enable_tools and disable_tools. If a tool was declared by its full backend ID, filtering by its [tool_alias] name did the wrong thing. MISE_ENABLE_TOOLS=myjq excluded the tool instead of selecting it, and MISE_DISABLE_TOOLS=myjq had no effect. An alias now matches the same tool as its full ID in both filters, including aliases with inline options. An explicit enable list still overrides disable_tools. If you disable an aliased python, _.python.venv is turned off too. Based on a fix by @​zeitlinger. #​15437 (@​jdx)
• mise prune and project tool aliases. When run from another directory, mise prune resolved a tracked project's [tools] entries against the current directory's config. Tools named through the project's own [tool_alias] caused "not found in mise tool registry" warnings, and mise couldn't tell whether those installs were still in use. These entries now resolve through the project's aliases, as well as the aliases in its parent and global configs. #​15438 (@​jdx)
• mise dot sync with exclusions added on two machines. When two machines each added their own mise dot exclude globs, sync failed with "enrollment conflict in exclusions". mise now merges the lists in this order: the shared base, then this machine's additions, then the other machine's. The same applies to an enrolled path's own exclude and include lists. A removal or a !glob added on both sides is still a conflict, because glob order matters. The error message now says how to recover. #​15449 (@​jdx)
• ufw rules with a source or destination CIDR. A [[bootstrap.linux.firewall.rules]] entry with a source or destination CIDR and no port never converged. mise read 10.42.0.0/16 as a port and a protocol, so mise bootstrap plan --detailed-exitcode kept reporting the rule. Firewall commands also now run with LC_ALL=C, so inspection no longer fails under non-English locales such as de_DE.UTF-8. #​15450 (@​jdx)
• Fedora 45 COPR builds. Releases are now built for Fedora 45 (x86_64 and aarch64) in the jdxcode/mise COPR repo. Before, Fedora 45 users were stuck on 2026.8.5. #​15441 (@​jdx)

Documentation

• The shell setup docs now say that fish 4.9.3 loads mise completions on its own, so you can skip mise completion fish --install there. #​15442 (@​jdx)

Full Changelog: jdx/mise@v2026.11.3...v2026.11.4

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.3: : Task history, saved task logs, and source-based --affected outside monorepos

Compare Source

This release adds three task features: mise tasks history shows how long past runs took, the opt-in task.logs setting saves each task's last output, and mise run --affected now works in any project by matching changed files against each task's sources. It also fixes problems with upgrade --bump, GitHub asset detection, locked lockfiles, Windows npm installs, prune and hung asdf plugins.

Added

• mise run --affected outside a monorepo. Before, --affected worked only at a monorepo root and failed anywhere else. Outside a monorepo it now runs only the matching tasks affected by changed files. A task is affected when a changed file matches its sources, or when the config file or file script that defines it changed. Matching uses the same rules as the up-to-date check, including ! exclusions and paths relative to the task's directory.

  • Tasks with no sources, and tasks whose sources use {{usage.*}}, run whenever anything changed. When nothing changed, nothing runs.
  • Global tasks are left out. Dependencies of a selected task still run, subject to the up-to-date check.
  • The existing --affected-base, --affected-head, --affected-committed, --affected-uncommitted and --affected-untracked options decide which changes count. --affected-explain prints why each task was selected or skipped, and --affected-json reports the reasons (changed-source, task-config, task-file, no-sources, argument-sources).
  • Monorepo project selection is unchanged.

  #​15407 (@​jdx)

  [tasks."test:unit"]
  run = "cargo test"
  sources = ["src/**"]
  
  [tasks."test:docs"]
  run = "markdownlint docs"
  sources = ["docs/**"]

  mise run --affected --affected-explain 'test:*'

• mise tasks history. mise now records when each task run started, how long it took, its redacted arguments, its exit code and its status (ok, failed, cached, skipped or cancelled). mise tasks history [TASK] lists past runs. --summary shows each task's run count, failure count, median duration of successful runs, and last duration and status. --json prints the records as JSON. Recording is on by default and keeps the last 20 runs per task. You can change the limit with task.history_limit, or turn recording off with task.history = false. Dry runs and tasks that only have depends are not recorded, and a recording error never fails a run. #​15408 (@​jdx)

  $ mise tasks history --summary
  hello      3  0  89.0ms  88.0ms  ok
  test:unit  3  0  -       1.0ms   skipped

• Saved task output with mise tasks log. When the new task.logs setting (or MISE_TASK_LOGS=1) is on, mise keeps the full output of each task's last run. mise tasks log NAME prints it, and --path prints where the file is. This gets back output that the replacing, timed, silent and summary styles hide or shorten. When a task fails under one of those styles, mise prints a full output: <path> line. Logs are stored in $MISE_STATE_DIR/task-logs/ with owner-only permissions and are redacted the same way as terminal output. Each log keeps the newest 4 MiB. Output that mise doesn't pipe is not logged: raw and interactive tasks, and the default interleave mode when it has nothing to redact. The setting is off by default. #​15409 (@​jdx)

  [settings]
  task.logs = true

  The same PR changes every piped output style: lines longer than 1 MiB now arrive in pieces, so mise no longer holds a whole long line in memory. The pieces are split so that secrets and URL credentials are still fully redacted.

Fixed

• mise upgrade --bump no longer rewrites a two-part prefix such as { prefix = "1.23" } to the unresolvable prefix:prefix:1.1. It now bumps to the correct version, for example prefix:1.26. #​15426 (@​jdx, @​kjanat)
• When choosing a release asset automatically, the github: backend now skips Python wheels (.whl) and Ruby gems (.gem), as it already does for .deb and .rpm. Before, a manylinux wheel could be picked over the native binary. An explicit asset_pattern can still select these files. If an asset_pattern looks like a regular expression and matches nothing, the GitHub, GitLab and Forgejo error now explains that asset_pattern is a glob and suggests matching_regex. #​15423 (@​jdx)
• With tool_config.locked = true and lockfile_mode = "generate", installing or running one tool no longer writes another tool's unrecorded version into mise.lock. Before, this let the next run accept a pin nobody had reviewed. The lockfile now stays unchanged, and only mise lock records new versions. #​15428 (@​jdx, @​mikomiel)
• On Windows, npm: tools installed with aube are now reinstalled when a cache restore turned their dependency links into file symlinks. Before, mise install reported "already installed" while Node failed with ERR_MODULE_NOT_FOUND. #​15425 (@​jdx, @​Diapolo10)
• When run from outside a project, mise prune and mise upgrade no longer delete installs of task tools that the project names through its [tool_alias]. The "not found in mise tool registry" warning for these tools is also gone. #​15427 (@​jdx)
• fetch_remote_versions_timeout now stops an asdf plugin's bin/list-all that hangs. mise kills the script's process group and fails with timed out after ... and a hint about the setting. Before, mise waited until the script exited and held the version lock the whole time. ruby-install --update now follows the same timeout. bin/list-all now runs with stdin closed, so a script that reads stdin gets EOF. #​15424 (@​jdx, @​karngyan)

Full Changelog: jdx/mise@v2026.11.2...v2026.11.3

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.2: : Task tags, summary output, JSON run reports, and mise run --at

Compare Source

This release adds four mise run features that help CI scripts and coding agents: tags for selecting tasks, a summary output style that only shows failures, a JSON run report, and --at for running tasks at another git revision. It also fixes problems with safe-mode lockfiles, symlink-each dotfiles, shims and shell completion.

Added

• Task tags. You can label tasks with tags, then run every task that has a tag with mise run --tag. A tag can be a string or a list. File tasks set them with #MISE tags=[...], and templates add their tags to the tasks that extend them. You can repeat --tag, and a task matches if it has any of the given tags. Dependencies run whatever their tags are. If you also give a pattern, such as mise run --tag slow 'test:*', mise runs only the matching tasks that have the tag. mise tasks ls --tag filters the task list, and tasks ls --json, tasks info and the MCP task list now include tags. #​15406 (@​jdx)

  [tasks."lint:docs"]
  run = "markdownlint docs"
  tags = ["lint", "docs"]
  
  [tasks."test:e2e"]
  run = "./e2e/run"
  tags = ["test", "slow"]

  mise run --tag lint
  mise tasks ls --tag slow

• summary task output style. mise holds each task's output until the task ends. A task that passed prints one line, such as [unit] passed in 4.2s. A task that failed prints everything it wrote. Tasks that mise stopped print [name] cancelled. This style is opt-in: use --output summary, MISE_TASK_OUTPUT=summary, task.output, or a task's output. mise keeps up to 64 KiB of output per task and drops the oldest output past that. A long-running task such as a dev server prints nothing until it exits, so give those tasks output = "interleave". #​15403 (@​jdx)

  $ mise run --output summary test
  [lint] $ cargo clippy -- -D warnings
  [lint] error: unused variable: `x`
  [unit] passed in 4.2s
  [lint] ERROR task failed

• JSON run reports. mise run --report-file <PATH>, or MISE_TASK_REPORT_FILE, writes a JSON report when the run ends. This happens whether the run passes, fails, is interrupted or hits --timeout.

  • The report has the run's status (passed, failed, cancelled or timed_out) and every scheduled task, dependencies included.
  • Each task has its status (passed, failed, cancelled, skipped, cached or not_run), exit code, duration and timestamps.
  • Task arguments are redacted the same way as in terminal output.
  • The flag can't be combined with --dry-run. Tasks don't inherit the variable, so a nested mise run can't overwrite the outer report.

  #​15405 (@​jdx)

• mise run --at REV. Runs tasks at another git revision without touching your checkout. mise checks the revision out into a temporary detached worktree, runs the task with that revision's own config and tasks, then removes the worktree. It also removes it after a failure, a timeout or Ctrl-C. --at-setup CMD prepares the worktree first, for example by installing dependencies.

  • Submodules are initialized.
  • Tasks and the setup command get MISE_RUN_AT_SOURCE (your checkout) and MISE_RUN_AT_REV (the commit).
  • Config at that revision gets your main checkout's trust, and you can't bypass this with a prompt or --yes.
  • Paranoid mode always refuses a config at that revision.

  #​15410 (@​jdx)

  mise run --at main test
  mise run --at HEAD~1 --at-setup "npm ci" test

Fixed

• Lockfiles and safe mode
  • MISE_SAFE=1 MISE_LOCKED=1 mise install works again for node, python and go when mise.lock has their checksums. It used to fail with "No lockfile URL found". These tools now work out their own download URL and check it against the locked checksum. If safe mode is the reason a URL is missing, the error now says so. #​15392 (@​jdx)
  • npm: tools locked through aube now install in safe mode and in untrusted projects. mise keeps the lockfile's dependency graph if it only fetches from the registry using integrity hashes. Graphs that name tarball URLs, git sources or local paths are still dropped. #​15401 (@​jdx)
  • mise lock java@temurin-27 no longer rewrites java = "temurin-26" to the broken temurin-temurin. It now writes temurin-27, with the same precision as the original request. Switching vendor at the same version, as in java@zulu-26, is saved too. #​15386 (@​jdx)
  • When mise lock tool@3.0.1 changes tool = "2" to tool = "3" in the config, the lockfile entry now records "3", the request the config holds, instead of "3.0.1". Before, later lookups for that request couldn't find the entry. #​15404 (@​jdx)
• Dotfiles and bootstrap
  • mise bootstrap now writes mise's own config files first and plans the rest of the dotfiles from the result, as mise dot apply already did. If a dotfile entry deploys a conf.d file, the entries in that file now apply in the same run, not the next one. --dry-run previews them as well. #​15387 (@​jdx, @​webkaz)
  • A symlink-each entry no longer writes through a directory symlink you made inside its target. That symlink is now reported as a conflict that needs --force. unapply also no longer deletes a directory symlink as if it were an empty folder. #​15399 (@​jdx)
  • On the first apply, a symlink-each source that contains a dangling symlink no longer loses its link right after creating it. #​15395 (@​jdx)
  • mise dot unapply --group and mise dot apply --prune now delete a group's leftover symlink-each state records once none of its links remain. #​15390 (@​jdx)
  • On a second machine whose local history holds no files, mise dot origin set now adopts the origin's history. It used to fail with "local and origin histories are unrelated". If origin set refuses to connect, it no longer writes [history.origin]. #​15394 (@​jdx)
  • History snapshots no longer start a git process for each encrypted tracked file. This speeds up mise bootstrap and the dotfile history commands when you have many encrypted files. #​15393 (@​jdx)
• Shims
  • On macOS, when a due tool_update.global_auto check ran from a shim, the tool was launched with mise's internal arguments (jq: Unknown option --id). mise now runs the update itself. #​15389 (@​jdx)
  • When the installed version ships other executables but not the one you called, as after mprocs was renamed to dekit, the shim and mise which errors no longer suggest a reinstall that can't help. They now show the error mprocs@0.10.3 does not provide mprocs (it provides: dekit), or name another installed version that does provide it. #​15388 (@​jdx)
• Completion
  • In mise x -- <cmd> <Tab>, every word after the command now completes file names, as it would in a plain shell. The same applies to mise dot capture --, mise bootstrap repos exec -- and mise ssh. #​15396 (@​jdx, @​Yasushi)
  • When a task has the same name as a built-in command, such as upgrade, completing mise up now shows the built-in command's description. mise run <TAB> still shows the task. #​15385 (@​jdx)
• Installs and config
  • Go tool installs now retry go install after temporary network errors from the module proxy or checksum database, using the http_retries setting. When the retries run out, mise shows the network error, not a misleading unknown revision. #​15384 (@​jdx)
  • On Windows, aqua raw downloads whose URL ends in .exe now keep the extension when the recipe sets complete_windows_ext: false. Before, aqua:SonarSource/sonarqube-cli installed sonar instead of sonar.exe. #​15412 (@​jdx)
  • mise no longer crashes with PermissionDenied if it can't resolve a config path. This happened on Windows inside workspace sandboxes. A config trusted outside the sandbox may show as untrusted inside it; MISE_TRUSTED_CONFIG_PATHS works around that. #​15383 (@​jdx)
  • With skills.auto_sync, a tool that only your global config declares no longer has its agent skills linked into every project as well. Global tools are linked only under your home directory. mise skills sync without --dir or --global follows the same rule. Links that are already in project directories stay until you run mise skills sync --prune. #​15391 (@​jdx)

Changed

• Registry: temporal now installs the Temporal CLI from aqua:temporalio/cli, which includes temporal server start-dev. Before, it installed the server bundle. If you need the server bundle, use mise use aqua:temporalio/temporal. #​15373 (@​jdx)
• Registry: odin on Windows now gets an odin shim. Before, only the bundled linker tools were shimmed. #​15400 (@​jdx)

Documentation

• The site search can now find individual keys on the mise.toml reference page, such as doctor.checks. #​15375 (@​jdx)

Full Changelog: jdx/mise@v2026.11.1...v2026.11.2

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.1: : npm provenance verified by default, with repository pins in mise.lock

Compare Source

npm: tools now have their Sigstore provenance verified by default. The first install records the repository that built the package in mise.lock, and later installs must come from that same repository. This release also adds named environment sets in miserc.toml and fixes a range of lockfile, install and shell issues. See Breaking Changes before you upgrade: some installs that worked before can now fail, and new lockfiles use format version 4.

Added

• npm provenance repository pins. When provenance verification is on, mise install records the GitHub or GitLab repository that an npm: package's provenance names. Later installs of that version fail if the provenance comes from a different repository, or if the package stops publishing provenance. This protects against a release published from somewhere else, for example after a maintainer account is compromised. The pin is written by mise install, not mise lock. #​15338 (@​jdx)

  [[tools."npm:@sigstore/bundle"]]
  version = "3.1.0"
  backend = "npm:@sigstore/bundle"
  provenance = { repository = "github.com/sigstore/sigstore-js" }

• gitlab.com CI provenance for npm. npm provenance built on gitlab.com CI/CD now verifies the same way GitHub Actions provenance does, including projects in subgroups. Before, these packages failed with verified attestation names no source repository. Self-hosted GitLab is not supported. #​15335 (@​jdx)

• Named environment sets. A shared miserc.toml can now define [env_sets]. You can then select a set by name in env, MISE_ENV or -E, and mise expands it to the environments it lists. Sets expand one level only, keep their listed order, and drop duplicate entries. A project .miserc.toml cannot redefine a set from the system or global miserc.toml. The new mise bootstrap --save-env writes the environments given with -E or MISE_ENV to miserc.local.toml, so later mise bootstrap --update runs select the same ones. #​15327 (@​jdx, @​owpac)

  # miserc.toml
  [env_sets]
  server = ["server", "ssh", "pac"]
  workstation = ["workstation", "ssh", "pac", "raycast"]

  mise bootstrap --from <url> -E workstation --save-env

• Download progress for vfox plugins. When a vfox plugin's PreInstall returns a url, the install line now shows the amount downloaded, the total size and the speed. Before, it showed only the elapsed time. #​15323 (@​jdx, @​carlosemart)

Fixed

• Lockfiles
  • Fixed mise install --locked failing with node@lts is not in the lockfile after an alias such as lts moved to a new version, in lockfiles with no lockfile_version line (format 0). If the tool has exactly one matching entry, mise uses it as the pin. mise lock --upgrade now keeps that pin and binds it to the alias, where before it re-resolved the alias and dropped the old entry. #​15301 (@​jdx, @​simonbuchan)
  • mise install in a project no longer rewrites ~/.config/mise/mise.lock unless it installs a global tool. A global tool that a project also declares is now relocked under the backend its own lockfile records. This fixes lockfile generation would change the recorded signer errors from mise lock --global and mise upgrade --global. #​15348 (@​jdx, @​drewbitt)
  • mise lock no longer warns on every run that the node checksum files from unofficial-builds.nodejs.org (used for the musl targets) are unsigned. Signature failures on nodejs.org or a node.mirror_url still fail as before. mise install with the default lockfile_mode = "generate" also stops drawing extra progress rows for lockfile entries it prepares in the background. #​15346 (@​jdx)
• Zig: zig installs now download from the URL pinned in mise.lock without fetching index.json, and still check the minisign signature. When the index can't be read, mise now builds the correct archive name for 0.14.1 and later (zig-{arch}-{os}-…, .zip on Windows) instead of failing with a 404, and it shows the index error

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.