chore(deps): update dependency jdx/mise to v2026

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	New value	References	Sourcegraph
jdx/mise	uses-with	major	2026.8.6	source

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

---

Release Notes

jdx/mise (jdx/mise)

v2026.8.6: : Resumable downloads, richer Homebrew casks, and monorepo task fixes

Compare Source

This release adds resumable HTTP downloads, expands Homebrew cask support, and lands a large batch of fixes across tasks, config, install, and platform-specific behavior — with a particular focus on monorepos and Windows.

Highlights

• Interrupted artifact downloads now resume instead of restarting from zero, and more transient network failures (including HTTP/2 REFUSED_STREAM) are retried automatically.
• The Homebrew cask backend gained structured symlinks, generic artifacts, and copy/installer flight steps, closing several gaps in cask installation.
• A wide round of monorepo task, config precedence, and Windows path handling fixes.

Added

• http: interrupted downloads now resume via HTTP Range requests when a strong ETag or Last-Modified validator is available, keeping validated partial files across retries and mise invocations instead of re-downloading from byte zero. mise falls back to a clean restart when validators do not match, and abandoned partials expire after 30 days. (#​11866 by @​Marukome0743)

• brew: the Homebrew cask backend now supports structured symlink steps (with path bases, templates, guards, source globs, and sudo control), generic cask artifacts, and copy/installer flight steps, with transactional rollback if an install fails. (#​11962, #​11963, #​11964 by @​jdx)

• task: mise run --all opens the interactive task picker with tasks from the entire monorepo, matching the load path already used by mise tasks ls --all. The default picker stays scoped to the current directory hierarchy. (#​11920 by @​jdx)

  mise run --all

• task: add task.cache.audit_report (MISE_TASK_CACHE_AUDIT_REPORT) to write the complete cache-audit report to a JSON Lines file. The console still caps at 20 paths per task, but the file now captures every undeclared read and write so large audits (e.g. Jest over node_modules) are actually usable. (#​11997 by @​stevenpollack)

  MISE_TASK_CACHE_AUDIT_REPORT=audit.jsonl mise run --force build

• dotfiles: whole-file [dotfiles] entries can now declare their body inline with content = "..." instead of requiring a separate source file, useful for small configs and user-writable paths outside $HOME. content cannot be combined with source, mode, or exclude. (#​11983 by @​jdx)

• deps: deps provider config fields (paths, commands, env, descriptions, timeouts) now render Tera templates using the defining config file's context, with shell-style environment expansion and rendered env values folded into freshness identity. Template errors surface as clear configuration errors before commands run. (#​11886 by @​Marukome0743)

• config: add a config-root-scoped [tool_config] locked = true policy that requires tools declared by configs sharing that root to resolve and install from their lockfiles, without forcing global or parent-root tools into strict mode. [settings] locked, --locked, and MISE_LOCKED remain invocation-wide. (#​11940 by @​jdx)

Fixed

• task: in monorepo mode, running a task by its bare or :-prefixed name now works from any directory below a config root, resolving to the nearest enclosing project instead of failing. (#​11941 by @​pikeas)
• task: normalize task cwd for source freshness (#​11987 by @​jdx), bound buffered command output (#​11922), avoid zsh process-substitution hangs (#​11904), and normalize variadic usage env values (#​11881) by @​Marukome0743; mask archive modes in remote cache nodes (#​11877 by @​stevenpollack).
• http: retry send failures that never produced a response, including HTTP/2 REFUSED_STREAM, which CDNs emit as backpressure and which previously failed on the first attempt even with retries enabled. (#​11961 by @​mariadeluna-tomtom)
• http: honor system install destinations for downloads. (#​11851 by @​Marukome0743)
• aqua: when a downloaded checksum file lists per-file hashes but none match the target filename, mise now errors instead of silently returning a wrong checksum. (#​11973 by @​jakedgy)
• pipx: discover wheel-only package versions from PEP 503 Simple API indexes, so packages published only as wheels now appear in mise ls-remote and latest resolution. (#​11959 by @​jdx)
• rust: the rolling nightly channel now resolves to a concrete nightly-YYYY-MM-DD toolchain via the official channel manifest, making nightly lock, outdated, upgrade, and offline reuse reproducible while keeping mise.toml on nightly. (#​11980 by @​Marukome0743)
• ruby: support ruby-build CLI options. (#​11918 by @​Marukome0743)
• conda: preserve cross-platform lock data (#​11946 by @​jdx) and honor URL replacements (#​11930 by @​Marukome0743).
• npm: render lifecycle logs through the progress display. (#​11939 by @​jdx)
• oci: strip the tag from name:tag@digest references so pulling a base image by combined tag-and-digest no longer produces a malformed token scope, while preserving registry ports. (#​11979 by @​fire-ant)
• install: write tool manifests atomically. (#​11957 by @​jdx)
• lock: include task-specific tools in the lockfile. (#​11976 by @​Marukome0743)
• deps: invalidate deps state when a provider's command, environment, working directory, or shell changes, so an edited run command is no longer skipped as fresh (#​11849); honor source and output overrides (#​11896) by @​Marukome0743.
• hooks: skip tool installation in preinstall tasks. (#​11927 by @​Marukome0743)
• exec: allow a symlinked resolv.conf inside the sandbox. (#​11958 by @​jdx)
• generate: honor absolute localized directories. (#​11975 by @​NgoQuocViet2001)
• config: allow typing j/k to filter in the mise edit tool picker (#​11969 by @​jakedgy); create the config directory before writing into it (#​11934) and stop a conf.d drop-in from becoming the write target (#​11917) by @​JamBalaya56562.
• bootstrap: avoid sudo for user-writable files (#​11984) and allow Windows bootstrap without system files (#​12003) by @​jdx.
• semver: stop labeling a mangled value as a semver range. (#​11949 by @​JamBalaya56562)

Windows fixes

• cli: mise activate and mise completion now both accept pwsh and powershell, and shell detection recognizes .exe suffixes. (#​11928 by @​JamBalaya56562)
• shell: resolve a shell named by a full Windows path. (#​11950 by @​JamBalaya56562)
• shims: stop treating a full-path argv[0] as a shim name. (#​11982 by @​JamBalaya56562)
• toolset: accept a Windows tool path spelled with backslashes (#​11937) and reject cmd.exe metacharacters in a Windows tool path (#​11947) by @​JamBalaya56562.
• dotfiles: treat an unmanaged file as a conflict on Windows too. (#​11981 by @​JamBalaya56562)
• tasks: stop telling Windows users to run chmod +x. (#​11923 by @​JamBalaya56562)

Changed

• upgrade/outdated: -b is now the shorthand for --bump. The old -l bump shorthand is hidden and deprecated (removal planned for 2027.8.5) so -l can later mean --local. When tools are current within configured ranges but a bump is available outside them, both commands now say so instead of reporting everything up to date. (#​11945 by @​jdx)
• cli: mise use --global alongside a path is now rejected instead of silently ignored. (#​11935 by @​JamBalaya56562)

Deprecated

• config: the automatic all_compile = true default on NixOS is deprecated and scheduled for removal in 2027.8.0. It currently forces source builds for Node, Python, Erlang, and Ruby even when precompiled binaries work through nix-ld; mise now warns and points to enabling nix-ld or setting all_compile = true explicitly. Alpine's source-build default is unchanged. (#​11956 by @​jdx)

Registry

• Added native-sdk (github:vercel-labs/native) by @​phall1 in #​11942
• Added restate binaries (github:restatedev/restate) by @​Bing-su in #​11953
• Added mailpit (aqua:axllent/mailpit) by @​joealden in #​11960

New Contributors

• @​stevenpollack made their first contribution in #​11997
• @​mariadeluna-tomtom made their first contribution in #​11961
• @​pikeas made their first contribution in #​11941
• @​phall1 made their first contribution in #​11942

Full Changelog: jdx/mise@v2026.8.5...v2026.8.6

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.5: : PyPy on the precompiled path, Node source patches, and a broad batch of fixes

Compare Source

This release lets mise install PyPy on the precompiled path (including on Windows), adds Node source-build patching, and lands a wide set of fixes across config precedence, install hooks, version pinning, and the Rust, conda, and vfox backends.

Added

• python: PyPy can now be installed on the precompiled path — when python.compile=false, and unconditionally on Windows, where PyPy versions previously never appeared in mise ls-remote python and could not be installed at all. mise reads the upstream downloads.python.org/pypy index, downloads and extracts the correct archive, runs ensurepip, and records a blake3 checksum in the lockfile on first install (PyPy publishes no machine-readable checksums). (#​11846 by @​JamBalaya56562)

  mise install python@pypy3.10-7.3.17

• node: add node.apply_patches (MISE_NODE_APPLY_PATCHES) to apply local or remote patches to the Node source build before ./configure runs, mirroring ruby.apply_patches. It accepts a newline-separated list of patch files or URLs. Strip level is auto-detected from git- or diff-style markers, and patches are recorded in the lockfile since they change the built artifact. If patches are set but a precompiled Node was installed, mise now warns instead of silently dropping them. (#​11850 by @​JamBalaya56562)

  [settings.node]
  compile = true
  apply_patches = "./patches/local.patch"

Fixed

• config: global config precedence inside ~/.config/mise now matches the documentation — config.local.toml overrides config.toml, which overrides conf.d/*.toml. Previously the order was reversed for [settings], [tools], and [env] when ~/.config/mise was outside the cwd walk. (#​11906 by @​halms)
• config: mise use now updates a single tool version in place within a standard [tools.<name>] table, preserving comments, key ordering, whitespace, and nested option tables instead of collapsing the table to inline form. (#​11848 by @​Marukome0743)
• install: inline preinstall and postinstall hooks now run from the owning project root, so relative paths resolve consistently even when mise install is started from a subdirectory. The invocation directory remains available through MISE_ORIGINAL_CWD. (#​11857 by @​jdx)
• use: mise use --pin now prefers an exact available release when pinning, instead of reusing a more-specific installed fuzzy match. For example mise use --pin erlang@27.3 will pin 27.3 if that exact release exists remotely, rather than depending on which versions happen to be installed. (#​11838 by @​Marukome0743)
• task: editing a root [task_templates.*] definition or a monorepo task default now correctly invalidates affected tasks, so stale outputs are no longer marked up to date after a template change. (#​11858 by @​jdx)
• rust: mise now reuses a complete external rustup installation (for example one installed by Homebrew) when the default Rust homes are not initialized, instead of downloading and initializing its own. Explicitly configured Cargo/Rustup homes continue using the mise-managed path. (#​11840 by @​Marukome0743)
• conda: conda package commands now run through prefix-aware launchers that activate each command's own conda prefix, fixing tools like jdtls that expand ${CONDA_PREFIX} and rely on activation scripts. Dependency executables stay isolated from the user's shell PATH. (#​11855 by @​Marukome0743)
• python: disable_tools = ["python"] (and allowlist forms like enable_tools = ["node"]) now also suppress the _.python.venv directive, so a disabled Python no longer leaves its virtualenv activated on PATH. (#​11885 by @​JamBalaya56562)
• vfox: configured vfox tool options are now exposed to plugin hooks through MISE_TOOL_OPTS__* (with legacy RTX_TOOL_OPTS__* aliases), so hooks reading os.getenv("MISE_TOOL_OPTS__...") see the resolved options during install, uninstall, exec-env, and lock paths. (#​11884 by @​Marukome0743)
• aqua: explicit github_release package-type overrides from version and platform overrides are now applied, fixing installs such as recent Claude Code releases that failed with "relative URL without a base". (#​11901 by @​Marukome0743)

Changed

• cache: remote build-cache prefetch now downloads output blobs concurrently (up to 48 in parallel) while reserving foreground slots for compiler lookups, dramatically speeding up large Rust cache restores that previously downloaded thousands of small artifacts serially. (#​11905 by @​jdx)

Documentation

• env: clarified _.source PATH handling. (#​11889 by @​jdx)
• task: fixed boolean flag usage examples. (#​11887 by @​Marukome0743)

Registry

• Use aqua for helmsman. (#​11908 by @​scop)

Breaking Changes

• If you relied on disable_tools = ["python"] while still keeping a _.python.venv activated, that virtualenv will no longer be activated. The existing venv remains on disk and is restored automatically when Python is re-enabled. (#​11885)

Full Changelog: jdx/mise@v2026.8.4...v2026.8.5

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.4: : Cross-backend ls, semver ordering, and bootstrap cask pruning

Compare Source

This release adds explicit semantic version ordering for major backends, teaches mise ls and mise install --force to work across backends, extends bootstrap package management with platform filters and cask pruning, and lands a broad batch of task, config, and platform-specific fixes.

Added

• backend: tools can now declare an explicit version_order (source or semver) so that latest and version-prefix resolution follow semantic precedence instead of source/chronological order. This is enabled for Aqua, GitHub, GitLab, Forgejo, and HTTP backends, and fixes cases where a backport or older release line was picked ahead of a newer version (for example neo4j, victoria-metrics, go-getter, talosctl, rpk, and tealdeer). mise ls-remote continues to show upstream source order. (#​11774 by @​jdx)

• ls: mise ls <name> now matches a tool installed from multiple backends. Previously, installing a tool from both its registry backend and, say, a cargo: or ubi: build would show only one of them under mise ls <name> even though both were on PATH. Spelling out a backend (e.g. mise ls ubi:jqlang/jq) still narrows to that single backend. (#​11822 by @​JamBalaya56562)

• install: mise install --force now works without tool arguments, reinstalling every configured, OS-supported tool (or the monorepo union with --monorepo). (#​11802 by @​Marukome0743)

• upgrade: add an upgrade.auto_prune setting (default true) that controls whether mise upgrade removes the version it replaced, plus a --prune flag to force removal on for a single run when the setting is off. Useful when a mise-managed interpreter backs a virtualenv you do not want deleted on unattended upgrades. (#​11788 by @​JamBalaya56562)

  [settings]
  upgrade.auto_prune = false

• bootstrap: mise bootstrap packages prune --manager brew-cask can now conservatively remove mise-owned Homebrew casks that are no longer declared in [bootstrap.packages]. Removal is gated by install-time receipt metadata, fingerprint checks, and ownership validation, and Homebrew-owned, pkg, lifecycle, drifted, or shared casks are skipped with an explicit reason. (#​11810 by @​jdx)

• bootstrap: [bootstrap.packages] entries can now use table form with a version and [tools]-style os selectors, so a single config can target macOS-only casks and Linux fonts. Platform-incompatible packages surface as unavailable in status output instead of aborting the run, while explicit requests for unsupported packages still error. (#​11809 by @​jdx)

• brew: the brew-cask manager now supports installing font casks directly from git URLs, including selecting a branch and staging files from a subdirectory. (#​11781 by @​roele)

• aqua: relative aqua.registries entries in a config file are now resolved against that config's root, so a registry.yaml committed inside a project repository can be referenced without a machine-specific absolute path. (#​11804 by @​JamBalaya56562)

  [settings]
  aqua.registries = ["registry.yaml"]

• spm: spm: installs can now be pinned to a commit via rev:<commit> (and compatible ref:<commit>), building from source. (#​11815 by @​Marukome0743)

• generate: generated git hooks can now carry extra mise flags. Anything after -- is inserted between mise and run, so a hook can target config in a subdirectory or set other global flags. (#​11820 by @​JamBalaya56562)

  mise generate git-pre-commit --task lint -- -C subdir -E ci

Fixed

• watch: mise watch with no task name now runs the default task, matching mise run, instead of failing with "No tasks specified". (#​11836 by @​Marukome0743)
• activate: --silent and --log-level are now forwarded into the generated activation hook, so per-directory hook-env output can actually be silenced. (#​11831 by @​JamBalaya56562)
• sops: SOPS files decrypted through the external sops CLI (sops.rops = false) are no longer skipped when no age key is present, so KMS, Vault, PGP, and other key services work in non-strict mode. (#​11834 by @​Marukome0743)
• conda: on Windows, dependency DLLs are now placed beside the binaries in .mise-bins, fixing tools such as conda:postgresql and conda:zstd that previously failed to start with a missing-DLL error. (#​11825 by @​JamBalaya56562)
• ruby: on Windows, mise now installs the highest RubyInstaller2 build revision (-2, -3, …) instead of always using the superseded -1 build. (#​11807 by @​JamBalaya56562)
• rust: concurrent toolchain installs are now serialized to avoid conflicts, and Rust homes are resolved from the config environment. (#​11794, #​11798 by @​Marukome0743)
• task: Azure DevOps remote git includes are now handled correctly. (#​11768 by @​cheesemans)
• task: project-qualified monorepo tasks now match without requiring the leading //. (#​11782 by @​williamsjokvist)
• task: incomplete task outputs are now detected, and task arguments are validated before dependencies run. (#​11786, #​11787 by @​Marukome0743)
• hooks: hook arrays are now parsed before run tables, fixing certain hook configurations. (#​11792 by @​jgillich)
• vfox: a non-table hook response now returns an error instead of panicking, and URL replacements are honored. (#​11793 by @​JamBalaya56562, #​11795 by @​Marukome0743)
• aqua: package metadata is now looked up by aqua package name, and version bounds with four components and the != operator are accepted. (#​11828, #​11832 by @​JamBalaya56562)
• generate: generated git hooks forward hook arguments, and nested task stub conflicts are handled. (#​11801 by @​JamBalaya56562, #​11800 by @​Marukome0743)
• config: dropped the --file alias where -f means --force, and ignored_config_paths now matches on Windows. (#​11789, #​11818 by @​JamBalaya56562)
• settings: config-file writes are now refused for env-only settings, list settings no longer panic when set from the environment, and the go.set_gopath deprecation message is corrected. (#​11791, #​11799 by @​JamBalaya56562, #​11835 by @​jdx)
• exec: resolution failures now name installed-but-inactive tools to point you at the fix. (#​11803 by @​JamBalaya56562)
• go: go list diagnostics are kept out of default output. (#​11816 by @​JamBalaya56562)
• tera: the pat argument is honored on v1 trim_start/trim_end. (#​11811 by @​JamBalaya56562)
• link: install path aliases are now rejected. (#​11785 by @​NgoQuocViet2001)
• cli: the base of sub-N: version prefixes is resolved before subtracting. (#​11796 by @​JamBalaya56562)
• core: zero jobs is now treated as one, and forced colors are honored in tables. (#​11790 by @​Marukome0743, #​11847 by @​jdx)
• bootstrap: compose is now planned before dependency installation. (#​11829 by @​jdx)
• registry: flutter URLs no longer double the -stable suffix. (#​11808 by @​JamBalaya56562)

Documentation

• Clarified what the not-found handler can install (#​11830 by @​JamBalaya56562), what libc detection actually does (#​11813 by @​JamBalaya56562), and task_config.shell in the task.shell defaults (#​11775 by @​pynappo).
• Linked the Homebrew cask cookbook for cask lifecycle concepts (#​11773 by @​himkt) and fixed dead bootstrap package-plugin example URLs (#​11780 by @​Bartok9).

Registry

• Added android-cli (#​11797 by @​ggoggam) and zk (#​11827 by @​laraochan).

New Contributors

• @​laraochan made their first contribution in #​11827
• @​williamsjokvist made their first contribution in #​11782
• @​NgoQuocViet2001 made their first contribution in #​11785
• @​jgillich made their first contribution in #​11792
• @​pynappo made their first contribution in #​11775
• @​cheesemans made their first contribution in #​11768

Full Changelog: jdx/mise@v2026.8.3...v2026.8.4

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.3: : Flatpak, Font Casks, and Task Precedence Fixes

Compare Source

This release expands bootstrap package management with per-user Flatpak support and Linux font casks, adds a per-tool pipx registry option and a shim safety setting, and lands a batch of task precedence, lockfile, and Python fixes.

Added

• bootstrap: manage per-user Flatpak installations with a new flatpak-user package manager. The existing flatpak:<id> entries stay system-scoped, and you can now declare both scopes in the same config, including the same application ID. (#​11757 by @​jdx)

• brew: the built-in brew-cask manager now works on Linux for font-only casks, installing fonts under $XDG_DATA_HOME/fonts via Linuxbrew. Non-font casks on Linux fail with a clear unsupported-platform error. (#​11758 by @​jdx)

  mise bootstrap packages use brew-cask:font-heavy-data-nerd-font

• pipx: add a per-tool registry_url option so version listing and latest resolution can target a private PyPI-style index without changing the global pipx.registry_url. The latest-version cache is keyed by registry URL to avoid cross-registry reuse. (#​11754 by @​jdx)

• shim: add a not_found_system_fallback setting (MISE_NOT_FOUND_SYSTEM_FALLBACK, default true). Setting it to false prevents a shim for a missing tool from silently falling back to a same-named binary on PATH, failing loudly instead — useful for hardened environments that pin an explicit allowlist of tools. (#​11755 by @​richid)

Fixed

• task: inline [tasks.<name>] definitions now take precedence over a same-named task from an included TOML file instead of being silently discarded. Metadata-only inline blocks overlay the included command rather than replacing it. (#​11734 by @​jdx)
• task: a metadata-only inline task in a higher-precedence file such as mise.local.toml now overlays the command-bearing definition from a lower file instead of wiping out its run. Command-bearing higher-precedence tasks still fully replace the lower one. (#​11745 by @​jdx)
• task: tasks declaring double_dash="required" again accept values passed after --, which had regressed to being rejected. (#​11729 by @​jdx)
• config: configured backend options such as postinstall are now applied to explicitly requested runtime versions (e.g. mise install solidity@0.8.2) that carry registry defaults, instead of being skipped. (#​11550 by @​risu729)
• lockfile: setting lockfile = true now creates missing project lockfiles during mise use, mise install, and upgrade flows. An unset setting continues to update existing lockfiles only. (#​11746 by @​jdx)
• python: a plain mise lock now preserves the python-build-standalone artifact already recorded for each platform instead of churning the lockfile to the newest build. Use mise lock --bump to advance the PBS build explicitly. (#​11747 by @​jdx)
• python: skip junctions when syncing installs to uv to avoid errors on Windows. (#​11683 by @​risu729)
• github: release-age filters like minimum_release_age now use GitHub's published_at timestamp rather than the commit created_at, so a newly published release pointing at an older commit no longer bypasses the filter. Applies across Aqua, GitHub, Ubi, SPM, Pipx, and GitHub-backed core tools. (#​11756 by @​jdx)
• use: adding multiple tools in a single mise use now keeps an already-sorted [tools] table alphabetically ordered. (#​11713 by @​jdx)
• rust: expand ~ in the home setting. (#​11752 by @​xqm32)
• vfox: resolve backend aliases for custom plugins. (#​11736 by @​jdx)
• vfox: cancel in-flight HTTP retries when interrupted with Ctrl-C. (#​11735 by @​jdx)
• npm shim: npm link <package-name> (and its npm ln alias) now triggers an auto-reshim, since it installs a package globally. (#​11748 by @​cheezmil)
• ls-remote: suppress the minimum_release_age warning during shell completions. (#​11727 by @​beisenherz)
• docs: fix an incorrect ripgrep URL in the tool-stub docs. (#​11725 by @​arti5an)

New Contributors

• @​richid made their first contribution in #​11755
• @​xqm32 made their first contribution in #​11752
• @​cheezmil made their first contribution in #​11748
• @​arti5an made their first contribution in #​11725
• @​beisenherz made their first contribution in #​11727

Full Changelog: jdx/mise@v2026.8.2...v2026.8.3

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.2: : Declarative System Bootstrap

Compare Source

This release turns mise bootstrap into a full declarative host-provisioning system: alongside packages, mise can now converge privileged files, Linux users and groups, systemd services, Docker Compose projects, and firewall rules — all with plan/apply/status workflows, secret handling, and the ability to run over SSH against remote hosts. It also makes Ruby's ruby.compile=false a strict precompiled-only mode and lands a batch of install and lockfile fixes.

Highlights

• mise bootstrap gains a Terraform-style declarative model. A new mise bootstrap plan previews changes with table or JSON output and detailed exit codes, and each resource type has its own apply/status commands that converge only when something actually differs.
• Bootstrap can now provision far more than tools and packages: privileged files and directories, Linux accounts, systemd services, Compose projects, and host firewall rules, with dependency ordering, fail-closed safety checks, and secret inputs sourced from environment variables (never stored in config).
• The same bootstrap project can be applied to remote machines over SSH via mise bootstrap remote, including automatic detection of the target's OS/arch/libc and signature-verified download of the matching mise binary.

Added

• bootstrap: declarative resource plans. mise bootstrap plan previews what bootstrap would change before applying, with table or --json output and optional --detailed-exitcode (0 = no changes, 2 = changes, 1 = error). Resources have stable identities, dependency graphs, and validation for duplicates, missing dependencies, and cycles. (#​11669 by @​jdx)
• bootstrap: manage privileged files and directories via [bootstrap.files] and [bootstrap.directories], with content (inline or from a source), ownership, mode, and explicit present/absent state. Writes are atomic, removal is opt-in (and requires recursive = true for non-empty directories), and privileged work runs through hidden helpers that never expose file content in argv or logs. (#​11674 by @​jdx)
• bootstrap: secret inputs for managed files. [bootstrap.secrets] references sensitive values through environment variables so nothing is stored in config, and managed files with template = true can render them via {{ secret(name="...") }}. mise bootstrap secrets status reports availability without revealing values, and --prompt-secrets prompts securely for anything missing. (#​11680 by @​jdx)
• bootstrap: manage Linux users and groups via [bootstrap.users] and [bootstrap.groups], with create/update/remove, supplementary groups, home handling, and explicit state = "absent". Accounts converge before the files that reference them, and UID/GID collisions fail closed. (#​11681 by @​jdx)
• bootstrap: manage Linux systemd services via [bootstrap.services] for running/stopped, enabled/disabled, and masked state. Managed files and directories can set notify to trigger reload, restart, or reload_or_restart handlers, but only after a real file change. (#​11688 by @​jdx)
• bootstrap: manage Docker Compose projects via [bootstrap.compose] for running, stopped, and absent states, with pull/build/recreate/wait policies, one-shot services, orphan/volume/image removal, and explicit dependencies. Convergence compares live container runtime and health to the rendered Compose model (Compose v2 only). (#​11689 by @​jdx)
• bootstrap: manage Linux host firewall rules via [bootstrap.linux.firewall] with nftables, firewalld, and UFW backends (backend = "auto"). Includes SSH-lockout protection (default-deny requires a covering allow rule or allow_lockout = true), drift detection, and preservation of undeclared rules unless exclusive is set. (#​11694 by @​jdx)
• bootstrap: run bootstrap over SSH with mise bootstrap remote, targeting a named [bootstrap.remote.hosts] inventory or ad-hoc user@host targets. mise archives and stages your project, provisions a compatible mise binary on the host, runs bootstrap with forwarded flags, and cleans up staging afterward. (#​11690 by @​jdx)
• bootstrap: remote provisioning now detects each target's OS, architecture, and Linux libc (glibc vs musl) and, when the local binary is not compatible, downloads the matching raw executable for the same release from GitHub with minisign-verified checksums. Custom or debug builds fail closed and require an explicit mise_bin, remote_mise, or bootstrap_command. (#​11693 by @​jdx)

Changed

• ruby: ruby.compile = false is now a strict precompiled-only mode, matching python.compile. Installs error with no precompiled ruby found instead of silently falling back to ruby-build, and version listings (mise ls-remote ruby, fuzzy resolution) are filtered to versions that actually have a precompiled binary for your platform. Previously false was a no-op after precompiled binaries became the default in 2026.8.0. Unset and compile = true are unchanged; Windows is unaffected. (#​11710 by @​jdx)
• task: workspace task inference is now opt-in per provider via task.auto_infer (e.g. task.auto_infer = ["node"]) instead of running whenever experimental features are enabled. Explicit mise tasks always take precedence over inferred package scripts on name and alias collisions. (#​11706 by @​jdx)

Fixed

• brew: :any_skip_relocation bottles no longer leave unresolved @@HOMEBREW_*@@ placeholders in scripts and config files. That tag now only skips binary linkage relocation while text placeholders are still replaced. (#​11665 by @​jdx)
• brew-cask: detect extensionless DMG downloads (such as Raycast) by their UDIF trailer instead of treating them as raw executables and failing to find the app bundle. (#​11692 by @​jacobbednarz)
• lock: mise lock --bump now errors instead of writing an incomplete lockfile when a version bump would drop platform coverage that the previous locked version had. Best-effort skips are retained for platforms a tool never supported. (#​11664 by @​jdx)
• pipx: release-age gating now uses PyPI's precise RFC3339 upload_time_iso_8601 timestamp instead of the timezone-naive upload_time, which previously made freshly released packages appear up to ~24h younger and over-gated them under minimum_release_age. (#​11662 by @​Guria)
• pacman: pacman -Q is now parsed under LC_ALL=C so missing-package detection works in non-English locales; previously [bootstrap.packages] could bail on a translated "was not found" message. (#​11673 by @​rarandeyo)
• sync: clear stale incomplete markers when an external link (from uv, nvm, pyenv, nodenv, or Homebrew) is confirmed healthy, so mise where no longer treats a working external version as incomplete after an interrupted install. (#​11172 by @​risu729)
• completions: an explicit -- no longer hijacks task argument completion after usage v5. mise run <task> -- <TAB> again offers the task's declared choices instead of falling back to filenames, while still forwarding extra arguments. (#​11711 by @​jdx)
• registry: shim auto-install uses new declared bins metadata to pick the correct provider before falling back to incidental executables, fixing cases where invoking the npm shim could run Node's bundled npm instead of the configured npm version. (#​11666, #​11671, #​11676, #​11677, #​11678 by @​jdx)

New Contributors

• @​jacobbednarz made their first contribution in #​11692
• @​rarandeyo made their first contribution in #​11673

Full Changelog: jdx/mise@v2026.8.1...v2026.8.2

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.1: : Task Cache Goes Remote, Affected Tasks, and Config Ergonomics

Compare Source

This release rounds out mise's experimental task artifact cache with size/age limits, inspection tooling, and a full local-plus-remote cache backend (including authenticated CI caching), adds experimental mise run --affected for monorepos, and lands a batch of config, upgrade, and install fixes.

Highlights

• The experimental task output cache now supports remote sharing: a composite store reads locally first, promotes remote hits, and mirrors writes, with authenticated requests backed by token files or GitHub Actions OIDC. Cache entries can be inspected, cleared per-task, and bounded by size and age.
• Experimental mise run --affected runs only the tasks in monorepo projects touched by your Git changes, using workspace dependency graphs, global task inputs, and provider lockfile attribution to decide what is affected.
• The config-writing flags are now more forgiving: --file and --path are interchangeable across the commands that write config, so you no longer have to remember which name each subcommand expects.

Added

• task: experimental mise run --affected selects and runs only the tasks in projects affected by Git changes, combining the workspace dependency graph, global_inputs, and provider lockfile diffs. Base and head revisions can be overridden with --affected-base/--affected-head or MISE_AFFECTED_*. Includes JSON output and an --explain breakdown of why each task was selected. ([#​11590](https://redirect.github.com/jdx/mise/pull

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.