Commit 7dca4ad
authored
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4&size=40){kind=avatar}
deps: update dependency jdx/mise to v2026.5.2 (#1392)
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | minor | `2026.4.19`
→ `2026.5.2` |
---
### Release Notes
<details>
<summary>jdx/mise (jdx/mise)</summary>
###
[`v2026.5.2`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.2):
: Stable monorepo task roots, fail-fast parallel tasks, and curated
lockfiles
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.5.1...vfox-v2026.5.2)
#### Added
- **(aqua)** Support registry libc variants (`gnu` vs `musl`) when
resolving package overrides on Linux, including cross-platform lock
targets like `linux-x64-musl`
([#​9652](https://redirect.github.com/jdx/mise/pull/9652)) by
[@​jdx](https://redirect.github.com/jdx).
- **(aqua)** Honor aqua registry `files[].link` and `files[].hard`
entries, creating relative symlink (or hard link) aliases next to
extracted binaries so tools that inspect `$0`/`argv[0]` (e.g.
`granted`/`assumego`, newer `pnpm`) launch correctly
([#​9610](https://redirect.github.com/jdx/mise/pull/9610)) by
[@​risu729](https://redirect.github.com/risu729).
- **(bin-paths)** New `mise bin-paths --bin-names` flag prints
executable names from active bin directories, and `--json` now emits
structured entries with `name`, `path`, and `symlink`
([#​9617](https://redirect.github.com/jdx/mise/pull/9617)) by
[@​risu729](https://redirect.github.com/risu729).
- **(task)** Added `MISE_MONOREPO_ROOT` env var pointing at the
directory of the config with `experimental_monorepo_root = true`
([#​9657](https://redirect.github.com/jdx/mise/pull/9657)) by
[@​jdx](https://redirect.github.com/jdx).
- **(registry)** Added `code-review-graph` via `pipx:code-review-graph`
([#​9673](https://redirect.github.com/jdx/mise/pull/9673)) by
[@​chautruonglong](https://redirect.github.com/chautruonglong).
#### Fixed
- **(task)** Parallel `mise run --jobs N` siblings now terminate
promptly when one task fails, via per-task process groups and `killpg`,
with a 10s pipe-drain timeout
([#​9655](https://redirect.github.com/jdx/mise/pull/9655)) by
[@​jdx](https://redirect.github.com/jdx).
- **(task)** `MISE_PROJECT_ROOT` for monorepo subproject tasks is now
stable regardless of invocation cwd
([#​9657](https://redirect.github.com/jdx/mise/pull/9657)) by
[@​jdx](https://redirect.github.com/jdx).
- **(install)** Don't force a remote-versions cache refresh in
`prefer_offline` mode; fixes a v2026.5.0 regression with shim
auto-install of `prefix:` requests
([#​9627](https://redirect.github.com/jdx/mise/pull/9627)) by
[@​jdx](https://redirect.github.com/jdx).
- **(lockfile)** Auto-lock during `mise install` now respects
user-curated lockfiles — removed platforms stay removed
([#​9621](https://redirect.github.com/jdx/mise/pull/9621)) by
[@​jdx](https://redirect.github.com/jdx).
- **(lock)** `mise lock` from a nested project scopes targets to the
active project root and stops churning parent lockfiles; `--global` is
now exclusive
([#​9319](https://redirect.github.com/jdx/mise/pull/9319)) by
[@​risu729](https://redirect.github.com/risu729).
- **(deps)** Fall through to source-hash freshness when a provider
returns no outputs, so `bundle install`, `pip install`, `go mod
download`, `poetry install`, and `uv sync` stop rerunning on every
invocation
([#​9622](https://redirect.github.com/jdx/mise/pull/9622)) by
[@​jdx](https://redirect.github.com/jdx).
- **(backend)** Inline tool option overrides (e.g.
`tool[asset_pattern=...]`) are now applied consistently across all
backends, with backend alias `[...]` options as a distinct overlay layer
([#​9306](https://redirect.github.com/jdx/mise/pull/9306)) by
[@​risu729](https://redirect.github.com/risu729).
- **(backend)** Skip the `mise-versions` host when locally overridden
tool options affect remote version listing
([#​9568](https://redirect.github.com/jdx/mise/pull/9568)) by
[@​risu729](https://redirect.github.com/risu729).
- **(backend)** Reject bare package-backend names like `cargo` and `gem`
as implicit `cargo:cargo`/`gem:gem` tools
([#​9608](https://redirect.github.com/jdx/mise/pull/9608)) by
[@​risu729](https://redirect.github.com/risu729).
- **(aqua)** Preserve configured file extensions (e.g. `.bat` scripts)
on Windows; avoid doubling `version_prefix`
([#​9611](https://redirect.github.com/jdx/mise/pull/9611)) by
[@​risu729](https://redirect.github.com/risu729).
- **(github)** Chmod only the explicitly configured `bin` target instead
of every archive file
([#​9609](https://redirect.github.com/jdx/mise/pull/9609)) by
[@​risu729](https://redirect.github.com/risu729).
- **(pipx)** Filter yanked PyPI releases from fuzzy/`latest` resolution
while keeping exact pinned installs available
([#​9607](https://redirect.github.com/jdx/mise/pull/9607)) by
[@​risu729](https://redirect.github.com/risu729).
- **(pipx)** Declare `python` as a backend dependency so `pipx.pyz`
resolves to mise-managed Python
([#​9678](https://redirect.github.com/jdx/mise/pull/9678)) by
[@​jdx](https://redirect.github.com/jdx).
- **(trust)** Run `enter` hooks after `mise trust` newly trusts a config
for the current directory
([#​9634](https://redirect.github.com/jdx/mise/pull/9634)) by
[@​risu729](https://redirect.github.com/risu729).
- **(ui)** Stop clearing the screen for confirmation prompts like `mise
prune` ([#​9619](https://redirect.github.com/jdx/mise/pull/9619))
by [@​jdx](https://redirect.github.com/jdx).
- Use `/bin/cp` on macOS for `mise sync` so it doesn't break when GNU
`cp` from Homebrew shadows it on `PATH`
([#​9656](https://redirect.github.com/jdx/mise/pull/9656)) by
[@​pdehlke](https://redirect.github.com/pdehlke).
- **(schema)** Update refs to `$defs` in `mise-registry-tool.json`
([#​9671](https://redirect.github.com/jdx/mise/pull/9671)) by
[@​risu729](https://redirect.github.com/risu729).
#### Changed
- **(registry)** Removed registry-level `depends` from generated
registry tools and added `test.tools` for tools whose dependencies are
only needed by `mise test-tool`
([#​9571](https://redirect.github.com/jdx/mise/pull/9571)) by
[@​risu729](https://redirect.github.com/risu729).
- **(config)** Registry backend options now accept full TOML values
(booleans, integers, arrays, tables) instead of strings only
([#​9584](https://redirect.github.com/jdx/mise/pull/9584)) by
[@​risu729](https://redirect.github.com/risu729).
#### Documentation
- **(node)** Added tips for enabling node idiomatic version files
([#​9675](https://redirect.github.com/jdx/mise/pull/9675)) by
[@​fu050409](https://redirect.github.com/fu050409).
#### New Contributors
- [@​chautruonglong](https://redirect.github.com/chautruonglong)
made their first contribution in
[#​9673](https://redirect.github.com/jdx/mise/pull/9673)
- [@​pdehlke](https://redirect.github.com/pdehlke) made their
first contribution in
[#​9656](https://redirect.github.com/jdx/mise/pull/9656)
#### 💚 Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
###
[`v2026.5.1`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.1):
: Aqua cosign and a reshim rescue
[Compare
Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.5.0...vfox-v2026.5.1)
A small follow-up to v2026.5.0 that lands top-level cosign verification
for the aqua backend, fixes a `mise reshim` failure caused by stale
`latest` install directories, and tightens schema validation.
#### Added
- **(backend)** The aqua backend now honors top-level `cosign` metadata
when verifying packages, covering both checksum and artifact flows and
reusing the existing native sigstore path. Lockfiles record top-level
cosign provenance, with new e2e and lockfile regression coverage
([#​9111](https://redirect.github.com/jdx/mise/pull/9111)) by
[@​risu729](https://redirect.github.com/risu729).
- **(registry)** Added `wasm-tools` via
`aqua:bytecodealliance/wasm-tools` for working with the WebAssembly
Component Model
([#​9596](https://redirect.github.com/jdx/mise/pull/9596)) by
[@​2xdevv](https://redirect.github.com/2xdevv).
#### Fixed
- **(shim)** `mise reshim` no longer aborts with `failed to rebuild
shims: no versions found for <tool>` when an install directory literally
named `latest` (or any other non-resolvable name) is left on disk.
`Toolset::list_installed_versions` already reads concrete version
directory names, so it now constructs `ToolVersion` directly instead of
calling `.resolve()` (no network), and per-tool `ToolRequest::new`
failures are warned-and-skipped instead of aborting the entire rebuild
([#​9599](https://redirect.github.com/jdx/mise/pull/9599)) by
[@​jdx](https://redirect.github.com/jdx). Repro:
```sh
mkdir -p ~/.mise/installs/buck2/latest/bin
touch ~/.mise/installs/buck2/latest/bin/buck2
mise reshim # previously failed; now succeeds
```
- **(schema)** All files under `schema/` are now validated against
`draft/2020-12` in strict mode. Hand-written schemas and the
`BoolOrString` renderer in `schema.ts` use `oneOf` instead of union type
arrays so AJV's `strictTypes` no longer rejects them; the bogus
`--strict-schema` flag is replaced with `--strict-types=true
--strict-tuples=true`
([#​9594](https://redirect.github.com/jdx/mise/pull/9594)) by
[@​risu729](https://redirect.github.com/risu729).
- **(registry)** `elixir-ls` re-enables `symlink_bins` so the move to
the aqua backend stops exposing internal binaries that aren't meant to
be called directly
([#​9592](https://redirect.github.com/jdx/mise/pull/9592)) by
[@​AlternateRT](https://redirect.github.com/AlternateRT).
#### Changed
- **(registry)** `rebar` now installs from the GitHub backend
(`erlang/rebar3`) since rebar3 is just an `escript`; the asdf plugin
fallback is removed. Versions before rebar 3 are no longer supported,
and the installed executable remains `rebar3` to match upstream docs
([#​9576](https://redirect.github.com/jdx/mise/pull/9576)) by
[@​risu729](https://redirect.github.com/risu729).
- **(registry)** `bashly` drops the `asdf:mise-plugins/mise-bashly`
fallback and the redundant explicit `ruby` dependency, since the `gem`
backend already pulls in Ruby
([#​9578](https://redirect.github.com/jdx/mise/pull/9578)) by
[@​risu729](https://redirect.github.com/risu729).
- **(release)** Restored the "Sponsor mise" block on every successful
GitHub release. It had been accidentally scoped to the
communique-failure fallback in
[#​9395](https://redirect.github.com/jdx/mise/pull/9395), so
normal releases since v2026.4.22 lost it
([#​9580](https://redirect.github.com/jdx/mise/pull/9580)) by
[@​jdx](https://redirect.github.com/jdx).
#### Documentation
- **(dev-tools)** Clarified that vfox metadata `depends` runs install
hooks for the listed dependency tools
([#​9573](https://redirect.github.com/jdx/mise/pull/9573)) by
[@​risu729](https://redirect.github.com/risu729).
- **(plugins)** Removed outdated registry submission guidance from the
plugins docs
([#​9577](https://redirect.github.com/jdx/mise/pull/9577)) by
[@​risu729](https://redirect.github.com/risu729).
#### Aqua Registry Updates
New packages:
-
[`salesforce/reactive-grpc/protoc-gen-reactor-grpc`](https://redirect.github.com/salesforce/reactive-grpc)
- [`spinframework/spin`](https://redirect.github.com/spinframework/spin)
Updated:
- [`pnpm/pnpm`](https://redirect.github.com/pnpm/pnpm)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.5.0...v2026.5.1>
#### 💚 Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
###
[`v2026.5.0`](https://redirect.github.com/jdx/mise/releases/tag/v2026.5.0):
: Conda graduates, smarter prereleases, and Windows POSIX tasks
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.28...vfox-v2026.5.0)
#### Added
- **(conda)** Graduated the conda backend out of experimental
([#​9544](https://redirect.github.com/jdx/mise/pull/9544)) by
[@​jdx](https://redirect.github.com/jdx).
- **(deps)** Added `dart` and `flutter` deps providers backed by
`pubspec.yaml` / `pubspec.lock`
([#​9505](https://redirect.github.com/jdx/mise/pull/9505)) by
[@​tjarvstrand](https://redirect.github.com/tjarvstrand).
- **(task)** `sources` entries can now be prefixed with `!` to exclude
paths, and a new `sources_exclude` field is supported; exclusions apply
to freshness checks, `task_source_files`, and `mise watch`
([#​9496](https://redirect.github.com/jdx/mise/pull/9496)) by
[@​jlarmstrongiv](https://redirect.github.com/jlarmstrongiv).
- **(vfox)** Added `stat` to the Lua `file` module so plugins can read
file metadata
([#​9497](https://redirect.github.com/jdx/mise/pull/9497)) by
[@​esteve](https://redirect.github.com/esteve).
- **(registry)** Added `neo4j`
([#​9525](https://redirect.github.com/jdx/mise/pull/9525)),
`rustfs`
([#​9530](https://redirect.github.com/jdx/mise/pull/9530)),
`expert`
([#​9498](https://redirect.github.com/jdx/mise/pull/9498)),
`systemctl-tui`
([#​9521](https://redirect.github.com/jdx/mise/pull/9521)),
`codon`
([#​9538](https://redirect.github.com/jdx/mise/pull/9538)), `yr`
([#​9542](https://redirect.github.com/jdx/mise/pull/9542)),
`betterleaks`
([#​9541](https://redirect.github.com/jdx/mise/pull/9541)),
`git-filter-repo`
([#​9550](https://redirect.github.com/jdx/mise/pull/9550)),
`umoci`
([#​9555](https://redirect.github.com/jdx/mise/pull/9555)),
`google-java-format`
([#​9488](https://redirect.github.com/jdx/mise/pull/9488)), an
aqua backend for `elixir-ls`
([#​9557](https://redirect.github.com/jdx/mise/pull/9557)), and
enabled `shellcheck` on Windows
([#​9487](https://redirect.github.com/jdx/mise/pull/9487)).
#### Fixed
- **(backend)** Stamp prerelease metadata via regex for backends that
don't expose it upstream
([#​9500](https://redirect.github.com/jdx/mise/pull/9500)) by
[@​jdx](https://redirect.github.com/jdx).
- **(backend)** Treat `-nightly`, `-canary`, `-experimental`,
`-insider`, `-edge` as prereleases
([#​9523](https://redirect.github.com/jdx/mise/pull/9523)) by
[@​jdx](https://redirect.github.com/jdx).
- **(backend)** Scope PEP 440 prerelease detection to Python backends
([#​9558](https://redirect.github.com/jdx/mise/pull/9558)) by
[@​jdx](https://redirect.github.com/jdx).
- **(backend)** Honor `dotnet.package_flags = "prerelease"` and
`--prerelease` for dotnet
([#​9551](https://redirect.github.com/jdx/mise/pull/9551)) by
[@​jdx](https://redirect.github.com/jdx).
- **(backend)** Suppress repeated `No versions found` warnings for
backends that support unresolved `latest`
([#​9548](https://redirect.github.com/jdx/mise/pull/9548)) by
[@​jdx](https://redirect.github.com/jdx).
- **(install)** Don't warn for configured tools when version is passed
via CLI ([#​9522](https://redirect.github.com/jdx/mise/pull/9522))
by [@​jdx](https://redirect.github.com/jdx).
- **(install)** Refresh `latest` before installing missing tools
([#​9545](https://redirect.github.com/jdx/mise/pull/9545)) by
[@​jdx](https://redirect.github.com/jdx).
- **(install)** Don't cache nonexistent install paths
([#​9553](https://redirect.github.com/jdx/mise/pull/9553)) by
[@​jdx](https://redirect.github.com/jdx).
- **(lockfile)** Don't propagate ad-hoc CLI overrides into the project
lockfile
([#​9562](https://redirect.github.com/jdx/mise/pull/9562)) by
[@​jdx](https://redirect.github.com/jdx).
- **(plugin)** Detect plugin types after cloning
([#​9540](https://redirect.github.com/jdx/mise/pull/9540)) by
[@​risu729](https://redirect.github.com/risu729).
- **(task)** Convert PATH to MSYS Unix form when spawning POSIX shells
on Windows
([#​9547](https://redirect.github.com/jdx/mise/pull/9547)) by
[@​JamBalaya56562](https://redirect.github.com/JamBalaya56562).
- **(cargo)** Apply `install_env` during `cargo install`
([#​9502](https://redirect.github.com/jdx/mise/pull/9502)) by
[@​c22](https://redirect.github.com/c22).
- **(github)** Skip attestations on non-default `api_url`
([#​9486](https://redirect.github.com/jdx/mise/pull/9486)) by
[@​jdx](https://redirect.github.com/jdx).
- **(github)** Retry IP allow list errors without auth
([#​9506](https://redirect.github.com/jdx/mise/pull/9506)) by
[@​risu729](https://redirect.github.com/risu729).
- **(http)** Update versions host tracking endpoint
([#​9527](https://redirect.github.com/jdx/mise/pull/9527)) by
[@​jdx](https://redirect.github.com/jdx).
- **(release)** Pass `--no-git-checks` to `aube publish`
([#​9483](https://redirect.github.com/jdx/mise/pull/9483)) by
[@​jdx](https://redirect.github.com/jdx).
- **(copr)** Drop `epel-9` chroots since rust >= 1.91 is unavailable
([#​9484](https://redirect.github.com/jdx/mise/pull/9484)) by
[@​jdx](https://redirect.github.com/jdx).
#### Changed
- **(registry)** Deny inline backend options in registry tool entries
([#​9565](https://redirect.github.com/jdx/mise/pull/9565)) by
[@​risu729](https://redirect.github.com/risu729).
- **(registry)** Update entry for `checkmake`
([#​9504](https://redirect.github.com/jdx/mise/pull/9504)) by
[@​eread](https://redirect.github.com/eread).
#### Deprecated
- `shorthands_file` setting / `MISE_SHORTHANDS_FILE` is deprecated;
warning starts in 2026.6.0, removal planned for 2026.12.0. Use
`[plugins]` instead
([#​9534](https://redirect.github.com/jdx/mise/pull/9534)) by
[@​risu729](https://redirect.github.com/risu729).
#### Documentation
- Document `ghtkn` as a GitHub `credential_command`
([#​9546](https://redirect.github.com/jdx/mise/pull/9546)) by
[@​jdx](https://redirect.github.com/jdx).
- Clarify registry backend acceptance policy
([#​9543](https://redirect.github.com/jdx/mise/pull/9543),
[7bbeebe](https://redirect.github.com/jdx/mise/commit/7bbeebe6dceabdb98dd3c59a55f6d58d7af34bd1))
by [@​jdx](https://redirect.github.com/jdx).
- Update `mise watch` docs to `pitchfork.en.dev`
([#​9536](https://redirect.github.com/jdx/mise/pull/9536)) by
[@​risu729](https://redirect.github.com/risu729).
- Use bash in `exec` example for variable echoing
([#​9567](https://redirect.github.com/jdx/mise/pull/9567)) by
[@​kuboon](https://redirect.github.com/kuboon).
#### 💚 Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
###
[`v2026.4.28`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.28):
: Remote tasks pinned by commit SHA
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.27...v2026.4.28)
A small patch release: remote tasks pinned to a commit SHA no longer
panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes
again.
#### Fixed
- **(task)** Remote tasks referenced by commit SHA (a `git::` source
with `?ref=<40-char hex>`) no longer crash mise with `we map by name
only and have no object-id in refspec` from `gix`
([#​9473](https://redirect.github.com/jdx/mise/pull/9473)) by
[@​jdx](https://redirect.github.com/jdx). `gix-refspec` parses any
40- or 64-char hex string as an `ObjectId` refspec, but
`gix::clone::fetch::util::find_custom_refname` only handles name-based
matches and `expect()`s on the result, so passing a bare SHA to
`prepare_clone.with_ref_name()` triggered a hard process panic on every
cache miss. `Git::clone` now detects SHA-shaped refs via a
`looks_like_sha` heuristic, skips both the `with_ref_name()` and `git
clone -b` paths (neither accepts bare SHAs), drops `--depth 1` since
shallow clones may not contain the requested object, and checks out the
SHA after the clone via the existing CLI-backed update. Named branches
and tags continue to use the existing fast paths. Closes
[#​9472](https://redirect.github.com/jdx/mise/discussions/9472).
- **(copr)** The `copr-publish` workflow no longer pins a stale
`ghcr.io/jdx/mise:copr` image digest, and `docker.yml` now rebuilds the
`:copr` image whenever `packaging/copr/Dockerfile` changes on `main`
([#​9451](https://redirect.github.com/jdx/mise/pull/9451)) by
[@​bestagi](https://redirect.github.com/bestagi). Previously the
workflow kept hitting `ModuleNotFoundError: No module named 'rich'` even
after [#​9421](https://redirect.github.com/jdx/mise/pull/9421)
switched `copr-cli` to `dnf install`, because the hardcoded digest still
pointed at the old pip-installed image.
#### New Contributors
- [@​bestagi](https://redirect.github.com/bestagi) made their
first contribution in
[#​9451](https://redirect.github.com/jdx/mise/pull/9451)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.27...v2026.4.28>
###
[`v2026.4.27`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.27):
: npm install args, smarter watch, and a macOS shim recursion fix
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.25...v2026.4.27)
A focused release: more control over how npm-backed tools get installed,
smarter `mise watch` that follows task dependencies, and a fix for a
nasty macOS shim recursion that could lock up a shell during `mise up
--bump`.
#### Added
- **(backend)** New `npm_args`, `pnpm_args`, `bun_args`, and `aube_args`
tool options on the npm backend
([#​9109](https://redirect.github.com/jdx/mise/pull/9109)) by
[@​risu729](https://redirect.github.com/risu729). Each one is
forwarded to the matching package manager when it's the active
`settings.npm.package_manager`, mirroring the `pipx` backend's style.
The args are also recorded in the lockfile and at install time:
```toml
[tools]
"npm:npm" = { version = "latest", aube_args = "--reporter append-only" }
"npm:tiny" = { version = "latest", pnpm_args = "--loglevel=warn" }
```
- **(env)** External vfox environment plugins now get `ctx.config_root`
in their `MiseEnv` / `MisePath` hooks
([#​9465](https://redirect.github.com/jdx/mise/pull/9465)) by
[@​hisaac](https://redirect.github.com/hisaac). This matches what
built-in directives like `_.file` already see, so plugins (e.g.
[`mise-xcode`](https://redirect.github.com/hisaac/mise-xcode)) can
resolve user-supplied relative paths against the project root regardless
of the shell's cwd. `watch_files` returned from a plugin are now also
absolutized against `config_root` instead of `current_dir()`.
- **(task)** `mise watch` now follows the task graph and watches the
sources of each chosen task's dependencies as well as its own
([#​9437](https://redirect.github.com/jdx/mise/pull/9437)) by
[@​43081j](https://redirect.github.com/43081j). Pass `--skip-deps`
(or set `skip_deps`) to restore the previous "task sources only"
behavior. Explicit `--glob` overrides still win.
- **(release)** `scripts/gen-aqua-changelog.sh` now diffs the previous
tag's `registry.yaml` against the current one and emits `New Packages` /
`Updated Packages` sections in the release PR, instead of dumping the
aqua-registry release tags rolled into the release
([#​9471](https://redirect.github.com/jdx/mise/pull/9471)) by
[@​jdx](https://redirect.github.com/jdx). This restores the
pre-[#​9043](https://redirect.github.com/jdx/mise/pull/9043)
behavior for the merged-registry world.
#### Fixed
- **(backend)** When `_list_remote_versions` returned an empty list
(invalid module path, throttling, etc.) the empty result was cached as
if it were authoritative, poisoning both the on-disk cache file and the
in-memory `OnceCell` for up to an hour
([#​9444](https://redirect.github.com/jdx/mise/pull/9444)) by
[@​c22](https://redirect.github.com/c22). The cache is now cleared
in both places when the list comes back empty, so the next call
re-fetches.
- **(shims)** Fixed an infinite shim recursion on macOS reported in
[#​9462](https://redirect.github.com/jdx/mise/discussions/9462)
where `mise up --bump` against npm packages would loop `mise -> npm shim
-> mise -> npm shim -> ...` and sometimes crash the session
([#​9468](https://redirect.github.com/jdx/mise/pull/9468)) by
[@​jdx](https://redirect.github.com/jdx). The trigger was a
case-mismatched `$HOME` in `PATH` (`/Users/Olfway/...` vs.
`/Users/olfway/...`) — the shims-stripping in `Backend::dependency_env`
compared byte-equal, so on case-insensitive APFS/HFS+ volumes it was a
no-op and `npm` re-resolved to the mise shim. A new `file::paths_eq`
does case-insensitive compares on macOS/Windows and byte-equal on Linux,
and is now used everywhere mise asks "is this PATH entry the shims
directory?" — including `path_env_without_shims`, `which_no_shims`,
`PathEnv` partitioning, `cli::exec` program resolution, and the doctor's
`shims_on_path` check (which had been silently reporting `no` for
affected users).
- **(task)** Under `deny_env = true` on Linux, every env var was being
stripped from the child process — including the `PATH` / `HOME` / `USER`
/ `SHELL` / `TERM` / `LANG` that `filter_env` and the docs say should
pass through
([#​9467](https://redirect.github.com/jdx/mise/pull/9467)) by
[@​jdx](https://redirect.github.com/jdx), fixing
[#​9466](https://redirect.github.com/jdx/mise/discussions/9466).
`apply_sandbox()` was calling `Command::env_clear()` *after* the task
executor populated explicit envs via `.envs(filtered_env)`, wiping both.
The Linux branch now snapshots the explicit envs before clearing and
re-applies them; macOS already did this. A new `path_test` task in
`e2e/sandbox/test_sandbox_task` guards against regressions.
#### New Contributors
- [@​43081j](https://redirect.github.com/43081j) made their first
contribution in
[#​9437](https://redirect.github.com/jdx/mise/pull/9437)
- [@​hisaac](https://redirect.github.com/hisaac) made their first
contribution in
[#​9465](https://redirect.github.com/jdx/mise/pull/9465)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.26...v2026.4.27>
###
[`v2026.4.25`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.25):
: Sharper task tooling and lockfile fixes
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.24...v2026.4.25)
A patch release focused on smoothing rough edges in tasks (sandbox path
resolution, dependency templates, a new `--name-only` listing) and
fixing a handful of upgrade/`ls-remote` pitfalls.
#### Added
- **(task)** New `--name-only` flag on `mise tasks ls` (and `mise
tasks`) prints one task name per line — no headers, no padding, no
description column
([#​9435](https://redirect.github.com/jdx/mise/pull/9435)) by
[@​jdx](https://redirect.github.com/jdx). It composes with
`--all`, `--global`/`--local`, `--hidden`, `--sort`/`--sort-order`, and
uses a broken-pipe-tolerant writer so dropping it into `fzf` Just Works:
```sh
mise run "$(mise tasks ls --name-only --all | fzf)"
```
Conflicts with `--json`, `--extended`, and `--usage`.
#### Fixed
- **(task)** Dependency templates can now branch on `usage` values
inside Tera statement tags, not just output expressions, and
boolean/array flags are passed through with their real types instead of
stringified
([#​9424](https://redirect.github.com/jdx/mise/pull/9424)) by
[@​jdx](https://redirect.github.com/jdx). So this finally does
what it looks like:
```toml
[tasks.lint]
usage = 'flag "--run-post" default=#false'
depends_post = ['''
{%- if usage.run_post -%}
postlint:**
{%- else -%}
noop
{%- endif -%}
''']
run = 'echo "lint ran"'
```
- **(task)** Tasks that define `usage` with subcommands but no top-level
args/flags now correctly populate `usage.cmd` for dependency templates,
fixing a regression from
[#​9424](https://redirect.github.com/jdx/mise/pull/9424) where the
early-return path skipped subcommand handling
([#​9431](https://redirect.github.com/jdx/mise/pull/9431)) by
[@​jdx](https://redirect.github.com/jdx). The fix also
de-duplicates `make_usage_ctx` between the script parser and the dep
renderer so they can't drift again.
- **(task)** Sandbox `allow_read` / `allow_write` paths declared on a
task are now resolved against the task's effective working directory
rather than the shell's `pwd`
([#​9428](https://redirect.github.com/jdx/mise/pull/9428)) by
[@​jdx](https://redirect.github.com/jdx). Previously, `dir =
"../bar"` plus `allow_read = ["."]` opened up the *caller's* directory
while the task itself ran in `bar/` and got blocked. CLI overrides like
`mise run --allow-read=…` still resolve against shell cwd. Closes
[#​9423](https://redirect.github.com/jdx/mise/discussions/9423).
- **(lockfile)** `mise upgrade` now updates the global lockfile
(`~/.config/mise/mise.lock`) when bumping a fuzzy version such as
`latest`
([#​9442](https://redirect.github.com/jdx/mise/pull/9442)) by
[@​jdx](https://redirect.github.com/jdx). The grouping pass was
excluding global config files entirely, and fuzzy requests could
re-resolve through the stale lockfile entry mid-update. Newly installed
versions are now overlaid before lockfiles are rewritten, so a global
`dummy = "latest"` upgrading from `1.0.0` to `2.0.0` actually pins
`2.0.0`.
- **(aqua)** When `list_releases_including_prereleases` returned an
empty list (paginated/cached edge case, throttling, or a repo that
genuinely has no releases), aqua fell back to `list_tags` and pulled in
every git tag in the repo
([#​9443](https://redirect.github.com/jdx/mise/pull/9443)) by
[@​jdx](https://redirect.github.com/jdx). For monorepos that tag
sub-crates, that meant ripgrep's `grep-regex-0.1.1` and friends ended up
in the shared `mise-versions` snapshot, so `ripgrep = "latest"` resolved
to a tag with no matching release asset and 404'd on install. Empty
release lists now propagate as empty version lists; packages that
legitimately use tags as their version source still opt in via
`version_source = "github_tag"`. The `remote_versions` cache filename is
also reverted to `remote_versions.msgpack.z` to avoid needlessly
invalidating existing caches — `VersionInfo` already deserializes
forward-compatibly. (Server-side `mise-versions` snapshots will need to
be regenerated with this fix.)
- **(ls-remote)** `mise ls-remote --json` no longer emits
`"rolling":false,"prerelease":false` on every entry
([#​9439](https://redirect.github.com/jdx/mise/pull/9439)) by
[@​jdx](https://redirect.github.com/jdx). Dummy output is now
`[{"version":"1.0.0"},{"version":"1.1.0"},{"version":"2.0.0"}]`.
Backends that legitimately set either flag (rust nightly/beta/stable,
github/aqua pre-releases) still emit the field; cached entries written
by older builds continue to deserialize.
- **(docs)** The docs site no longer flickers between light/dark themes
on initial load
([#​9427](https://redirect.github.com/jdx/mise/pull/9427)) by
[@​vhespanha](https://redirect.github.com/vhespanha). VitePress's
anti-flicker inline script is now marked `data-cfasync="false"` so
Cloudflare's Rocket Loader stops deferring it. Fixes
[#​9393](https://redirect.github.com/jdx/mise/discussions/9393).
- **(Dockerfile)** `copr-cli` is now installed via `dnf` instead of pip,
fixing `ModuleNotFoundError: No module named 'rich'` in the publish-copr
workflow
([#​9421](https://redirect.github.com/jdx/mise/pull/9421)) by
[@​bestagi](https://redirect.github.com/bestagi).
#### New Contributors
- [@​vhespanha](https://redirect.github.com/vhespanha) made their
first contribution in
[#​9427](https://redirect.github.com/jdx/mise/pull/9427)
- [@​bestagi](https://redirect.github.com/bestagi) made their
first contribution in
[#​9421](https://redirect.github.com/jdx/mise/pull/9421)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.24...v2026.4.25>
###
[`v2026.4.24`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.24):
: Resilient downloads and global pre-release opt-in
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.23...v2026.4.24)
A small release that hardens HTTP downloads against flaky networks and
adds a global way to surface pre-release versions, plus refreshed intro
messaging.
#### Added
- **(ls-remote)** New global `prereleases` setting
(`MISE_PRERELEASES=1`) and a `--prerelease` flag for `mise ls-remote`
([#​9415](https://redirect.github.com/jdx/mise/pull/9415)) by
[@​jdx](https://redirect.github.com/jdx). Acts as `prerelease =
true` applied to every tool, so GitHub releases flagged `prerelease:
true` show up in `ls-remote`, `latest` resolves against the full list,
and fuzzy queries like `1.2` can match pre-release tags. Currently
honored by the `github:` and `aqua:` backends; draft releases are still
excluded.
```sh
mise ls-remote github:cli/cli --prerelease
# or, persistently:
export MISE_PRERELEASES=1
```
#### Fixed
- **(http)** HTTP requests now retry transient failures with a jittered
backoff schedule (\~200ms / 1s / 4s / 15s, then capped at 15s) and the
default `http_retries` is bumped from `0` to `3`
([#​9414](https://redirect.github.com/jdx/mise/pull/9414)) by
[@​jdx](https://redirect.github.com/jdx). Retries fire on 5xx,
408, 429, and network-layer errors (connect refused, timeout, mid-stream
body drops); deterministic 4xx responses like 404 fail fast without
retry. Downloads wrap the full request + body so a chunk failure
mid-stream restarts from byte 0 instead of failing the install. Each
retry logs a `warn!` immediately so flaky infrastructure surfaces in
real time, and the same logic now powers vfox plugin downloads (which
honor `MISE_HTTP_RETRIES` too). Set `MISE_HTTP_RETRIES=0` to opt out.
The `http`→`https` fallback now only triggers on connection-level
errors, not on HTTP status errors.
- **(release)** `scripts/publish-s3.sh` now purges the `mise.en.dev`
Cloudflare zone (alongside `jdx.dev` and `mise.run`) after each S3
publish ([#​9416](https://redirect.github.com/jdx/mise/pull/9416))
by [@​jdx](https://redirect.github.com/jdx). Because `install.sh`
is uploaded with `immutable` cache-control, missing the purge could
leave one zone serving the previous release's `install.sh` next to a new
release's `install.sh.minisig`.
#### Documentation
- Refreshed the project tagline and intro across the README, docs site,
landing page, man page, snapcraft/RPM/DEB/npm packaging metadata, and
CLI help text to "Dev tools, env vars, and tasks in one CLI" with a
clearer "what is it?" pitch focused on what mise does rather than what
it replaces
([#​9418](https://redirect.github.com/jdx/mise/pull/9418)) by
[@​jdx](https://redirect.github.com/jdx).
- The docs site's GitHub star count is now prefixed with a ★ glyph for
clarity ([#​9417](https://redirect.github.com/jdx/mise/pull/9417))
by [@​jdx](https://redirect.github.com/jdx).
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.23...v2026.4.24>
###
[`v2026.4.23`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.23):
: Pre-releases, libc preference, and a Node musl fix
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.22...v2026.4.23)
A patch release that adds a global `libc` preference and pre-release
opt-in for `github:`/`aqua:` backends, alongside fixes for Node musl
downloads, read-only system installs, and `mise prune` network hangs.
#### Added
- **(backend)** Per-tool `prerelease = true` opt-in for the `github:`
and `aqua:` backends
([#​9329](https://redirect.github.com/jdx/mise/pull/9329)) by
[@​jakedgy](https://redirect.github.com/jakedgy). When set, GitHub
releases flagged `prerelease: true` show up in `mise ls-remote`,
`latest` resolves against the full list including pre-releases, and
fuzzy queries like `1.2` can match pre-release tags. Default behavior is
unchanged; draft releases are still excluded.
```toml
[tools]
"github:myorg/mytool" = { version = "latest", prerelease = true }
"aqua:owner/tool" = { version = "latest", prerelease = true }
```
- **(backend)** Global `libc` setting for selecting Linux precompiled
binary variants
([#​9404](https://redirect.github.com/jdx/mise/pull/9404)) by
[@​jdx](https://redirect.github.com/jdx). Accepts `musl`, `glibc`,
or `gnu` and threads through `Platform::current()`/`PlatformTarget` so
generic GitHub asset matching, aqua registry replacements (e.g.
`unknown-linux-gnu` ↔ `unknown-linux-musl`), Bun, Python precompiled
builds, Node, and vfox `envType` all honor the preference.
```sh
export MISE_LIBC=musl
```
#### Fixed
- **(install)** Stop rewriting healthy runtime symlinks
([#​9410](https://redirect.github.com/jdx/mise/pull/9410)) by
[@​jdx](https://redirect.github.com/jdx). The rebuild path was
unconditionally `remove_all` + recreating every `latest -> X.Y.Z`
symlink, which became a hard failure under the common Docker pattern
where root populates `/usr/local/share/mise/installs/` at build time and
a non-root user runs `mise install` at runtime. Healthy symlinks now
take a no-op path; the read-only system dir is no longer touched. If a
write is genuinely required and can't happen, the install fails loudly
instead of silently leaving a stale `latest`.
- **(node)** Route musl tarball URLs to `unofficial-builds.nodejs.org`
([#​9409](https://redirect.github.com/jdx/mise/pull/9409)) by
[@​jdx](https://redirect.github.com/jdx). After
[#​9404](https://redirect.github.com/jdx/mise/pull/9404) Node
started appending `-musl` to filenames but kept routing through
`nodejs.org/dist/` (which doesn't host them), causing 404s and lockfiles
where the URL had a `-musl` suffix while the checksum was still pinned
to the glibc tarball. The tarball URL and matching `SHASUMS256.txt` now
come from the same host, and a custom `node.mirror_url` still passes
through unchanged. Lockfile merging is also hardened to drop stale
`checksum`/`size`/`url_api` when URLs disagree.
- **(prune)** Skip remote version resolution for tracked configs
([#​9406](https://redirect.github.com/jdx/mise/pull/9406)) by
[@​jdx](https://redirect.github.com/jdx). `mise prune` was hitting
npm, the Go proxy, and the GitHub API to resolve tracked-config tool
versions, which could hang on slow or failing registries. Since prune
only protects *installed* versions from deletion, an `offline` flag is
now threaded through `ResolveOptions` for prune. `mise upgrade` is
unchanged and still queries fresh remote data. Closes
[#​9405](https://redirect.github.com/jdx/mise/discussions/9405).
- **(backend)** Allow unresolved `latest` opt-in
([#​9401](https://redirect.github.com/jdx/mise/pull/9401)) by
[@​jdx](https://redirect.github.com/jdx). `latest` now falls back
to an unresolved selector only when a backend's unfiltered remote
version list is empty *and* the backend opts in via
`unresolved_latest_version()`. `pipx` opts in for git-backed requests;
backends that require concrete versions continue to fail rather than
create literal `latest/` installs. If `minimum_release_age` filters all
candidates out, mise still reports no matching version.
- **(schema)** Allow array values in tool `additionalProperties`
([#​9400](https://redirect.github.com/jdx/mise/pull/9400)) by
[@​JP-Ellis](https://redirect.github.com/JP-Ellis). Configs like
`rust = { version = "1.77", components = ["rustfmt", "clippy"] }` are no
longer flagged as invalid by linters such as tombi.
#### Registry
- Use aqua for `rumdl`
([#​9397](https://redirect.github.com/jdx/mise/pull/9397)) by
[@​scop](https://redirect.github.com/scop)
- Add `llmfit`
([#​9412](https://redirect.github.com/jdx/mise/pull/9412)) by
[@​jylenhof](https://redirect.github.com/jylenhof)
#### New Contributors
- [@​JP-Ellis](https://redirect.github.com/JP-Ellis) made their
first contribution in
[#​9400](https://redirect.github.com/jdx/mise/pull/9400)
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.22...v2026.4.23>
###
[`v2026.4.22`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.22):
: Repaired latest resolution and clearer deps output
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.21...v2026.4.22)
A focused patch release that repairs two `@latest` regressions, gives
`mise deps` clearer per-provider output labels, and renames the
`install_before` setting to `minimum_release_age` to match the wider
ecosystem.
#### Highlights
- `@latest` resolution is fixed for Go modules that only publish
pseudo-versions, and stale `installs/<tool>/latest/` directories are now
repaired automatically.
- The `install_before` setting has been renamed to
`minimum_release_age`; the old name keeps working as a deprecated alias.
- `mise deps` output is now labeled by provider (e.g. `[deps.codegen]`)
instead of repeating the raw command.
- Fedora 44 and Rawhide are now supported in the COPR build.
#### Fixed
- **(backend)** Two separate `@latest` issues are repaired in
[#​9383](https://redirect.github.com/jdx/mise/pull/9383) by
[@​jdx](https://redirect.github.com/jdx):
- Go modules that enumerate zero versions now resolve `@latest` via `go
list -m -json <module>@​latest`, so modules that only publish
pseudo-versions still install a concrete version.
- Stale real `installs/<tool>/latest/` directories are now repaired
generically by the runtime symlink migration. The migration reruns under
a new marker and refreshes only `install_state` after rewriting
directories, so the current process picks up the repaired layout without
rebuilding the backend map (which previously broke config aliases).
Numeric partial-version dirs such as `installs/<tool>/25/` are left
alone, and real direct-URL `latest` installs (e.g. UBI URL installs) are
preserved when there is no concrete version to replace them with.
- **(task)** `mise deps` output is now labeled with a stable
`[deps.<provider>]` prefix on stdout/stderr (and in the progress
message) instead of using the raw `run` command as the prefix, making
repeated output from commands like `pip install -r requirements.txt`
much easier to follow. `mise deps add/remove` continues to run
unprefixed.
([#​9385](https://redirect.github.com/jdx/mise/pull/9385)) by
[@​jdx](https://redirect.github.com/jdx)
#### Changed
- **(config)** The `install_before` setting and per-tool option have
been renamed to `minimum_release_age`, matching pnpm's terminology. The
old `install_before` name is preserved as a hidden, deprecated alias —
global settings are migrated at load time, per-tool options resolve
through the new key, and the JSON schema marks the old name as
deprecated. Precedence is unchanged: `--before` > per-tool > global.
([#​9384](https://redirect.github.com/jdx/mise/pull/9384)) by
[@​jdx](https://redirect.github.com/jdx)
#### Added
- **(copr)** Fedora 44 and Rawhide are now supported by the COPR build
script. ([#​9391](https://redirect.github.com/jdx/mise/pull/9391))
by [@​bestagi](https://redirect.github.com/bestagi)
#### Documentation
- The docs site nav now displays the current release version (read from
`Cargo.toml` at build time), linking to the GitHub releases page. The
build emits a warning if the version cannot be parsed instead of
silently falling back.
([#​9388](https://redirect.github.com/jdx/mise/pull/9388),
[#​9389](https://redirect.github.com/jdx/mise/pull/9389)) by
[@​jdx](https://redirect.github.com/jdx)
#### Aqua Registry
Updated
[aqua-registry](https://redirect.github.com/aquaproj/aqua-registry) from
[v4.498.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.498.0)
to
[v4.499.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.499.0).
#### Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors. If mise saves you or your team time, please consider
sponsoring at [en.dev](https://en.dev).
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.21...v2026.4.22>
###
[`v2026.4.21`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.21):
: untrust command and prune lockfile fixes
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.20...v2026.4.21)
A patch release that adds a new `mise untrust` command, teaches `mise
prune` to skip tools tracked in lockfiles, and tightens GitHub asset
auto-detection.
> \[!NOTE]
> This release was tagged but the publish job failed before assets were
uploaded. v2026.4.22 ships the same fixes alongside additional changes —
install that release instead. These notes are preserved here for the
changelog.
#### Highlights
- New `mise untrust` command revokes trust on a config file.
- `mise prune` now respects tracked lockfiles and no longer removes
tools listed in them.
- GitHub asset auto-detection prefers the shortest asset name as a
tiebreaker, avoiding spurious matches on longer-named variants.
- New `--security` flag on `mise registry` includes security info in
JSON output.
#### Added
- **(registry)** `--security` flag on `mise registry` includes security
info in JSON output.
([#​9364](https://redirect.github.com/jdx/mise/pull/9364)) by
[@​jdx](https://redirect.github.com/jdx)
- **(trust)** New `mise untrust` command.
([#​9370](https://redirect.github.com/jdx/mise/pull/9370)) by
[@​jdx](https://redirect.github.com/jdx)
#### Fixed
- **(config)** Resolved backend opts are now limited to aliases.
([#​9315](https://redirect.github.com/jdx/mise/pull/9315)) by
[@​risu729](https://redirect.github.com/risu729)
- **(github)** Asset auto-detection prefers the shortest asset name as a
tiebreaker.
([#​9361](https://redirect.github.com/jdx/mise/pull/9361)) by
[@​jdx](https://redirect.github.com/jdx)
- **(java)** Newer Zulu versions are detected correctly — they use a
different directory structure than older releases.
([#​9365](https://redirect.github.com/jdx/mise/pull/9365)) by
[@​roele](https://redirect.github.com/roele)
- **(prune)** `mise prune` now respects tracked lockfiles.
([#​9373](https://redirect.github.com/jdx/mise/pull/9373)) by
[@​jdx](https://redirect.github.com/jdx)
- **(task)** Tool installation is skipped for missing naked tasks
instead of failing the run.
([#​9374](https://redirect.github.com/jdx/mise/pull/9374)) by
[@​jdx](https://redirect.github.com/jdx)
#### Documentation
- The docs site dismissible banner stacks its message and link on
mobile. ([#​9362](https://redirect.github.com/jdx/mise/pull/9362))
by [@​jdx](https://redirect.github.com/jdx)
- Ruby compile message updated.
([#​9338](https://redirect.github.com/jdx/mise/pull/9338)) by
[@​fladson](https://redirect.github.com/fladson)
#### Registry
- Fix `flux-operator-mcp` aqua path.
([#​9357](https://redirect.github.com/jdx/mise/pull/9357)) by
[@​monotek](https://redirect.github.com/monotek)
- Remove `openshift-install`.
([#​9372](https://redirect.github.com/jdx/mise/pull/9372)) by
[@​jdx](https://redirect.github.com/jdx)
- Remove `go-sdk`.
([#​9371](https://redirect.github.com/jdx/mise/pull/9371)) by
[@​jdx](https://redirect.github.com/jdx)
#### New Contributors
- [@​fladson](https://redirect.github.com/fladson) made their
first contribution in
[#​9338](https://redirect.github.com/jdx/mise/pull/9338)
#### Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors. If mise saves you or your team time, please consider
sponsoring at [en.dev](https://en.dev).
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.20...v2026.4.21>
###
[`v2026.4.20`](https://redirect.github.com/jdx/mise/releases/tag/v2026.4.20):
: Lockfile cleanup and path: fixes
[Compare
Source](https://redirect.github.com/jdx/mise/compare/v2026.4.19...v2026.4.20)
A focused patch release that cleans up two long-standing lockfile and
path-resolution bugs, makes GitHub attestation verification tolerant of
regex-based aqua registry URLs, and reworks how the aqua registry is
baked into mise.
#### Highlights
- `mise lock tool@latest` now writes a concrete version and heals
lockfiles already poisoned with `version = "latest"`.
- `path:` tool versions with relative paths resolve correctly against
the config root.
- Aqua registry is now baked from the upstream merged `registry.yaml`,
pinned by tag.
- GitHub artifact attestation works for registry entries that use regex
URLs.
#### Fixed
- **(config)** Relative `path:` tool versions are now resolved at parse
time against the config's root directory (or CWD for CLI args), with
`~/` expansion and leading `./` stripped. Previously, a value like
`path:./packages/logr` was joined with `installs_path` at install time
and produced a bogus directory such as
`~/.local/share/mise/installs/logr/./packages/logr`.
([#​9320](https://redirect.github.com/jdx/mise/pull/9320)) by
[@​jdx](https://redirect.github.com/jdx)
- **(lock)** `mise lock` handling of `@latest` has been overhauled
([#​9321](https://redirect.github.com/jdx/mise/pull/9321) by
[@​jdx](https://redirect.github.com/jdx)):
- `mise lock tool@latest` now resolves `latest` to the newest installed
version instead of writing the literal string `"latest"` into the
lockfile.
- `mise lock` no longer produces duplicate `[[tools.<name>]]` entries
when the config uses `tool = "latest"`.
- Lockfiles already poisoned with `version = "latest"` are cleaned up in
a single `mise lock` run.
- GitHub artifact attestation verification now works when the aqua
registry entry uses a regex in the workflow URL, unblocking installs
such as `aqua:updatecli/updatecli`.
([#​9327](https://redirect.github.com/jdx/mise/pull/9327)) by
[@​monotek](https://redirect.github.com/monotek)
#### Changed
- **(aqua)** The baked aqua registry source has been swapped for the
upstream merged `registry.yaml`, pinned by tag via
`crates/aqua-registry/aqua-registry/metadata.json`. The build script
generates a canonical package-id map plus an alias lookup table, so
runtime lookups only parse the selected package YAML. The pinned tag is
now visible in `mise doctor`.
([#​9043](https://redirect.github.com/jdx/mise/pull/9043)) by
[@​risu729](https://redirect.github.com/risu729)
#### Added
- New registry entry: `grafana-kubernetes-plugin`.
([#​9300](https://redirect.github.com/jdx/mise/pull/9300)) by
[@​monotek](https://redirect.github.com/monotek)
#### Documentation
- A dismissible announcement banner has been added to the docs site,
driven by a remote JSON config. Link schemes are restricted to
`http`/`https`, dismissals persist per-id in `localStorage`, and the
banner height is kept in sync with `--vp-layout-top-height` via a
`ResizeObserver`. The `expires` field is respected so banners
automatically hide after a given date.
([#​9326](https://redirect.github.com/jdx/mise/pull/9326),
[#​9330](https://redirect.github.com/jdx/mise/pull/9330),
[#​9334](https://redirect.github.com/jdx/mise/pull/9334)) by
[@​jdx](https://redirect.github.com/jdx)
#### Aqua Registry
Updated
[aqua-registry](https://redirect.github.com/aquaproj/aqua-registry) from
[v4.492.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.492.0)
to
[v4.498.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.498.0),
which includes:
-
[v4.493.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.493.0)
-
[v4.494.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.494.0)
-
[v4.494.1](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.494.1)
-
[v4.495.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.495.0)
-
[v4.496.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.496.0)
-
[v4.497.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.497.0)
-
[v4.498.0](https://redirect.github.com/aquaproj/aqua-registry/releases/tag/v4.498.0)
#### Sponsor mise
mise is built by [@​jdx](https://redirect.github.com/jdx) under
[**en.dev**](https://en.dev) — an independent studio making developer
tooling (mise, [aube](https://aube.en.dev/), and more). Development is
funded by sponsors.
If mise saves you or your team time, please consider sponsoring at
[en.dev](https://en.dev). Individual and company sponsorships keep mise
fast, free, and independent.
**Full Changelog**:
<https://github.com/jdx/mise/compare/v2026.4.19...v2026.4.20>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/hetznercloud/cli).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzkuNyIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>1 parent 5a9d962 commit 7dca4ad
3 files changed
Lines changed: 7 additions & 7 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
21 | | - | |
| 21 | + | |
22 | 22 | | |
23 | 23 | | |
24 | 24 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
21 | | - | |
| 21 | + | |
22 | 22 | | |
23 | 23 | | |
24 | 24 | | |
| |||
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
41 | | - | |
| 41 | + | |
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
| |||
63 | 63 | | |
64 | 64 | | |
65 | 65 | | |
66 | | - | |
| 66 | + | |
67 | 67 | | |
68 | 68 | | |
69 | 69 | | |
| |||
92 | 92 | | |
93 | 93 | | |
94 | 94 | | |
95 | | - | |
| 95 | + | |
96 | 96 | | |
97 | 97 | | |
98 | 98 | | |
| |||
115 | 115 | | |
116 | 116 | | |
117 | 117 | | |
118 | | - | |
| 118 | + | |
119 | 119 | | |
120 | 120 | | |
121 | 121 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
24 | 24 | | |
25 | 25 | | |
26 | 26 | | |
27 | | - | |
| 27 | + | |
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
| |||
0 commit comments