chore(deps): update dependency mise to v2026.8.3 - #2364

v2026.8.3: : Flatpak, Font Casks, and Task Precedence Fixes

Compare Source

This release expands bootstrap package management with per-user Flatpak support and Linux font casks, adds a per-tool pipx registry option and a shim safety setting, and lands a batch of task precedence, lockfile, and Python fixes.

Added

• bootstrap: manage per-user Flatpak installations with a new flatpak-user package manager. The existing flatpak:<id> entries stay system-scoped, and you can now declare both scopes in the same config, including the same application ID. (#​11757 by @​jdx)

• brew: the built-in brew-cask manager now works on Linux for font-only casks, installing fonts under $XDG_DATA_HOME/fonts via Linuxbrew. Non-font casks on Linux fail with a clear unsupported-platform error. (#​11758 by @​jdx)

  mise bootstrap packages use brew-cask:font-heavy-data-nerd-font

• pipx: add a per-tool registry_url option so version listing and latest resolution can target a private PyPI-style index without changing the global pipx.registry_url. The latest-version cache is keyed by registry URL to avoid cross-registry reuse. (#​11754 by @​jdx)

• shim: add a not_found_system_fallback setting (MISE_NOT_FOUND_SYSTEM_FALLBACK, default true). Setting it to false prevents a shim for a missing tool from silently falling back to a same-named binary on PATH, failing loudly instead — useful for hardened environments that pin an explicit allowlist of tools. (#​11755 by @​richid)

Fixed

• task: inline [tasks.<name>] definitions now take precedence over a same-named task from an included TOML file instead of being silently discarded. Metadata-only inline blocks overlay the included command rather than replacing it. (#​11734 by @​jdx)
• task: a metadata-only inline task in a higher-precedence file such as mise.local.toml now overlays the command-bearing definition from a lower file instead of wiping out its run. Command-bearing higher-precedence tasks still fully replace the lower one. (#​11745 by @​jdx)
• task: tasks declaring double_dash="required" again accept values passed after --, which had regressed to being rejected. (#​11729 by @​jdx)
• config: configured backend options such as postinstall are now applied to explicitly requested runtime versions (e.g. mise install solidity@0.8.2) that carry registry defaults, instead of being skipped. (#​11550 by @​risu729)
• lockfile: setting lockfile = true now creates missing project lockfiles during mise use, mise install, and upgrade flows. An unset setting continues to update existing lockfiles only. (#​11746 by @​jdx)
• python: a plain mise lock now preserves the python-build-standalone artifact already recorded for each platform instead of churning the lockfile to the newest build. Use mise lock --bump to advance the PBS build explicitly. (#​11747 by @​jdx)
• python: skip junctions when syncing installs to uv to avoid errors on Windows. (#​11683 by @​risu729)
• github: release-age filters like minimum_release_age now use GitHub's published_at timestamp rather than the commit created_at, so a newly published release pointing at an older commit no longer bypasses the filter. Applies across Aqua, GitHub, Ubi, SPM, Pipx, and GitHub-backed core tools. (#​11756 by @​jdx)
• use: adding multiple tools in a single mise use now keeps an already-sorted [tools] table alphabetically ordered. (#​11713 by @​jdx)
• rust: expand ~ in the home setting. (#​11752 by @​xqm32)
• vfox: resolve backend aliases for custom plugins. (#​11736 by @​jdx)
• vfox: cancel in-flight HTTP retries when interrupted with Ctrl-C. (#​11735 by @​jdx)
• npm shim: npm link <package-name> (and its npm ln alias) now triggers an auto-reshim, since it installs a package globally. (#​11748 by @​cheezmil)
• ls-remote: suppress the minimum_release_age warning during shell completions. (#​11727 by @​beisenherz)
• docs: fix an incorrect ripgrep URL in the tool-stub docs. (#​11725 by @​arti5an)

New Contributors

• @​richid made their first contribution in #​11755
• @​xqm32 made their first contribution in #​11752
• @​cheezmil made their first contribution in #​11748
• @​arti5an made their first contribution in #​11725
• @​beisenherz made their first contribution in #​11727

Full Changelog: jdx/mise@v2026.8.2...v2026.8.3

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.2: : Declarative System Bootstrap

Compare Source

This release turns mise bootstrap into a full declarative host-provisioning system: alongside packages, mise can now converge privileged files, Linux users and groups, systemd services, Docker Compose projects, and firewall rules — all with plan/apply/status workflows, secret handling, and the ability to run over SSH against remote hosts. It also makes Ruby's ruby.compile=false a strict precompiled-only mode and lands a batch of install and lockfile fixes.

Highlights

• mise bootstrap gains a Terraform-style declarative model. A new mise bootstrap plan previews changes with table or JSON output and detailed exit codes, and each resource type has its own apply/status commands that converge only when something actually differs.
• Bootstrap can now provision far more than tools and packages: privileged files and directories, Linux accounts, systemd services, Compose projects, and host firewall rules, with dependency ordering, fail-closed safety checks, and secret inputs sourced from environment variables (never stored in config).
• The same bootstrap project can be applied to remote machines over SSH via mise bootstrap remote, including automatic detection of the target's OS/arch/libc and signature-verified download of the matching mise binary.

Added

• bootstrap: declarative resource plans. mise bootstrap plan previews what bootstrap would change before applying, with table or --json output and optional --detailed-exitcode (0 = no changes, 2 = changes, 1 = error). Resources have stable identities, dependency graphs, and validation for duplicates, missing dependencies, and cycles. (#​11669 by @​jdx)
• bootstrap: manage privileged files and directories via [bootstrap.files] and [bootstrap.directories], with content (inline or from a source), ownership, mode, and explicit present/absent state. Writes are atomic, removal is opt-in (and requires recursive = true for non-empty directories), and privileged work runs through hidden helpers that never expose file content in argv or logs. (#​11674 by @​jdx)
• bootstrap: secret inputs for managed files. [bootstrap.secrets] references sensitive values through environment variables so nothing is stored in config, and managed files with template = true can render them via {{ secret(name="...") }}. mise bootstrap secrets status reports availability without revealing values, and --prompt-secrets prompts securely for anything missing. (#​11680 by @​jdx)
• bootstrap: manage Linux users and groups via [bootstrap.users] and [bootstrap.groups], with create/update/remove, supplementary groups, home handling, and explicit state = "absent". Accounts converge before the files that reference them, and UID/GID collisions fail closed. (#​11681 by @​jdx)
• bootstrap: manage Linux systemd services via [bootstrap.services] for running/stopped, enabled/disabled, and masked state. Managed files and directories can set notify to trigger reload, restart, or reload_or_restart handlers, but only after a real file change. (#​11688 by @​jdx)
• bootstrap: manage Docker Compose projects via [bootstrap.compose] for running, stopped, and absent states, with pull/build/recreate/wait policies, one-shot services, orphan/volume/image removal, and explicit dependencies. Convergence compares live container runtime and health to the rendered Compose model (Compose v2 only). (#​11689 by @​jdx)
• bootstrap: manage Linux host firewall rules via [bootstrap.linux.firewall] with nftables, firewalld, and UFW backends (backend = "auto"). Includes SSH-lockout protection (default-deny requires a covering allow rule or allow_lockout = true), drift detection, and preservation of undeclared rules unless exclusive is set. (#​11694 by @​jdx)
• bootstrap: run bootstrap over SSH with mise bootstrap remote, targeting a named [bootstrap.remote.hosts] inventory or ad-hoc user@host targets. mise archives and stages your project, provisions a compatible mise binary on the host, runs bootstrap with forwarded flags, and cleans up staging afterward. (#​11690 by @​jdx)
• bootstrap: remote provisioning now detects each target's OS, architecture, and Linux libc (glibc vs musl) and, when the local binary is not compatible, downloads the matching raw executable for the same release from GitHub with minisign-verified checksums. Custom or debug builds fail closed and require an explicit mise_bin, remote_mise, or bootstrap_command. (#​11693 by @​jdx)

Changed

• ruby: ruby.compile = false is now a strict precompiled-only mode, matching python.compile. Installs error with no precompiled ruby found instead of silently falling back to ruby-build, and version listings (mise ls-remote ruby, fuzzy resolution) are filtered to versions that actually have a precompiled binary for your platform. Previously false was a no-op after precompiled binaries became the default in 2026.8.0. Unset and compile = true are unchanged; Windows is unaffected. (#​11710 by @​jdx)
• task: workspace task inference is now opt-in per provider via task.auto_infer (e.g. task.auto_infer = ["node"]) instead of running whenever experimental features are enabled. Explicit mise tasks always take precedence over inferred package scripts on name and alias collisions. (#​11706 by @​jdx)

Fixed

• brew: :any_skip_relocation bottles no longer leave unresolved @@HOMEBREW_*@@ placeholders in scripts and config files. That tag now only skips binary linkage relocation while text placeholders are still replaced. (#​11665 by @​jdx)
• brew-cask: detect extensionless DMG downloads (such as Raycast) by their UDIF trailer instead of treating them as raw executables and failing to find the app bundle. (#​11692 by @​jacobbednarz)
• lock: mise lock --bump now errors instead of writing an incomplete lockfile when a version bump would drop platform coverage that the previous locked version had. Best-effort skips are retained for platforms a tool never supported. (#​11664 by @​jdx)
• pipx: release-age gating now uses PyPI's precise RFC3339 upload_time_iso_8601 timestamp instead of the timezone-naive upload_time, which previously made freshly released packages appear up to ~24h younger and over-gated them under minimum_release_age. (#​11662 by @​Guria)
• pacman: pacman -Q is now parsed under LC_ALL=C so missing-package detection works in non-English locales; previously [bootstrap.packages] could bail on a translated "was not found" message. (#​11673 by @​rarandeyo)
• sync: clear stale incomplete markers when an external link (from uv, nvm, pyenv, nodenv, or Homebrew) is confirmed healthy, so mise where no longer treats a working external version as incomplete after an interrupted install. (#​11172 by @​risu729)
• completions: an explicit -- no longer hijacks task argument completion after usage v5. mise run <task> -- <TAB> again offers the task's declared choices instead of falling back to filenames, while still forwarding extra arguments. (#​11711 by @​jdx)
• registry: shim auto-install uses new declared bins metadata to pick the correct provider before falling back to incidental executables, fixing cases where invoking the npm shim could run Node's bundled npm instead of the configured npm version. (#​11666, #​11671, #​11676, #​11677, #​11678 by @​jdx)

New Contributors

• @​jacobbednarz made their first contribution in #​11692
• @​rarandeyo made their first contribution in #​11673

Full Changelog: jdx/mise@v2026.8.1...v2026.8.2

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.1: : Task Cache Goes Remote, Affected Tasks, and Config Ergonomics

Compare Source

This release rounds out mise's experimental task artifact cache with size/age limits, inspection tooling, and a full local-plus-remote cache backend (including authenticated CI caching), adds experimental mise run --affected for monorepos, and lands a batch of config, upgrade, and install fixes.

Highlights

• The experimental task output cache now supports remote sharing: a composite store reads locally first, promotes remote hits, and mirrors writes, with authenticated requests backed by token files or GitHub Actions OIDC. Cache entries can be inspected, cleared per-task, and bounded by size and age.
• Experimental mise run --affected runs only the tasks in monorepo projects touched by your Git changes, using workspace dependency graphs, global task inputs, and provider lockfile attribution to decide what is affected.
• The config-writing flags are now more forgiving: --file and --path are interchangeable across the commands that write config, so you no longer have to remember which name each subcommand expects.

Added

• task: experimental mise run --affected selects and runs only the tasks in projects affected by Git changes, combining the workspace dependency graph, global_inputs, and provider lockfile diffs. Base and head revisions can be overridden with --affected-base/--affected-head or MISE_AFFECTED_*. Includes JSON output and an --explain breakdown of why each task was selected. (#​11590, #​11587, #​11589, #​11591, #​11593 by @​jdx)

  mise run --affected test
  mise run --affected --affected-base main test

• task: remote task cache. A composite store layers local and remote backends, reading local first and promoting remote hits, then committing locally before mirroring writes so a remote failure never loses a local hit. Requests are hardened, verified, streamed, and support read/write access modes. (#​11622, #​11623, #​11624, #​11626, #​11627 by @​jdx)

• task: authenticated remote cache. Credentials resolve in fixed precedence: an explicit bearer token, a global-only token file (MISE_TASK_CACHE_REMOTE_TOKEN_FILE), then GitHub Actions OIDC when MISE_TASK_CACHE_REMOTE_OIDC_AUDIENCE is set. HTTPS is enforced except for loopback development endpoints. (#​11625, #​11653 by @​jdx)

• task: task.cache_max_size and task.cache_max_age settings cap the task output cache independently of the global prune age, evicting least-recently-accessed entries after writes and rejecting expired entries on restore. (#​11610 by @​jdx)

• task: inspect and selectively clear the cache with mise cache task <task> (table or --json, reporting stored size, restorable bytes, saved time, last access, and outputs) and mise cache clear --task <task>, which removes only that task's entries without touching your working-tree outputs. (#​11604 by @​jdx)

• task: mise run --task-cache-explain <task> prints a structural breakdown of what feeds a task's cache key (input categories, counts, env/var names and presence, platform) without emitting secret-derived hashes, and works under --dry-run. Companion changes report cache miss reasons, cache statistics, resolved cache paths, and add JSON explanation output. (#​11595, #​11597, #​11599, #​11600, #​11601 by @​jdx)

• task: cache artifacts are now checksum-verified and cache declarations are audited on load. (#​11605, #​11617 by @​jdx)

• config: --file and --path are now interchangeable across the commands that write config: mise use, mise set, mise unuse, mise unset, mise config get, and mise config set. (#​11577, #​11616, #​11631, #​11640 by @​JamBalaya56562)

  mise use --file mise.local.toml node@22
  mise set --path mise.local.toml FOO=bar

• upgrade: mise upgrade --no-prune keeps the version being replaced instead of uninstalling it, so external references such as virtualenvs built from a mise-managed Python keep working. Also works with --bump. (#​11639 by @​JamBalaya56562)

• env: on Windows, mise now warns when the generated PATH exceeds the ~8191-character length at which cmd.exe silently drops the variable, which otherwise makes every command appear unrecognized. (#​11643 by @​JamBalaya56562)

• vfox: Lua plugins gain strip_components = 1 on archiver.decompress plus sorted file.list, file.glob, and file.move, letting plugins flatten versioned archive roots and rename executables portably without shelling out. (#​11652 by @​jdx)

Fixed

• config: tool versions may now contain a colon, so templated versions like {{ exec(...) | split(pat=': ') | last }} and selectors resolved from templates no longer fail config loading. (#​11580 by @​JamBalaya56562)
• config: config writes no longer pick a target that config loading would ignore, honor ignore filters when a --path <dir> is given, and no longer write the global config into a conf.d drop-in. (#​11571, #​11609, #​11633 by @​JamBalaya56562)
• upgrade: mise upgrade --bump now applies every eligible tool bump in the same config file instead of letting the last save overwrite earlier ones, and preserves successful bumps when another tool in the file fails to install. (#​11572 by @​Marukome0743)
• install: a failed backend install no longer leaves runtime aliases such as latest pointing at the removed version; mise rebuilds valid symlinks (or removes dangling ones) after cleanup. (#​11579 by @​Marukome0743)
• brew: Linux Homebrew bottles containing shebang executables with binary payloads (such as Watchman's watchman-diag zipapp) now relocate correctly with long Linuxbrew prefixes. (#​11632 by @​Marukome0743)
• pipx: extras are now applied to git-based installs. (#​11586 by @​jdx)
• prune: read-only shared installs are excluded from pruning. (#​11644 by @​Marukome0743)
• task: dangling task symlinks are skipped, wildcard task matching respects group boundaries, shared pre/post dependencies are supported, and task-list flags are rejected on subcommands. Task cache writes are serialized and abandoned partial writes are cleaned up. (#​11574, #​11581, #​11578 by @​Marukome0743; #​11638, #​11606, #​11608 by @​jdx)
• schema: JSON schemas are now published alongside the documentation. (#​11596 by @​jdx)

Documentation

• Recommend installing official release binaries, clarify Node dependency behavior for npm-backed tools, offer shims as a workaround for the Windows PATH length limit, and fix a dead tool-stub example URL and an npmmirror node.mirror_url example. (#​11615, #​11637 by @​jdx; #​11642 by @​JamBalaya56562; #​11377, #​11460 by @​Bartok9)
• Document the remote cache protocol and its trust requirements. (#​11621, #​11628 by @​jdx)

Full Changelog: jdx/mise@v2026.8.0...v2026.8.1

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.0: : 15% faster shims, multi-language workspaces, and precompiled Ruby

Compare Source

This release makes mise noticeably faster on Linux x64: shims have 15% lower latency, while config-aware commands are 8–11% faster in local release-to-release benchmarks. It also significantly expands the experimental monorepo task workflow with dependency inference across Cargo, uv (Python), Go, and Node workspaces, and makes precompiled Ruby binaries the default.

⚡ Performance: up to 15% lower latency

Official checksum-verified Linux x64 GNU binaries were compared on an AMD Ryzen 9 7950X3D using an isolated offline fixture with warm filesystem caches (20 warmups and 200 measured runs per command):

Release downloads are smaller as well:

The raw executable file is 2.5% larger because of the BOLT file layout, despite its smaller allocated sections and compressed artifacts. Shim dispatch was measured in two reversed-order 300-run rounds. These are whole-release results against v2026.7.18, so they include all changes between the releases rather than isolating BOLT alone.

Highlights

• Workspace inference now spans four ecosystems. mise tasks graph discovers projects and internal dependency edges from Cargo, uv, Go, and Node workspace metadata without needing the underlying toolchain installed, and --explain attributes every project, edge, and task field to its source.
• Precompiled Ruby binaries are now the default, cutting install times for most users while keeping source builds available on demand.

Added

• task: Cargo workspaces are now inferred for the task graph. mise parses root and member Cargo.toml files (no cargo binary required) to build cargo:<package> projects and internal edges from normal, dev, build, target-specific, renamed, and inherited workspace = true path dependencies, with provenance surfaced in graph output. (#​11554 by @​jdx)

• task: uv (Python) workspaces are inferred from pyproject.toml. When [tool.uv.workspace] is present, member globs and exclusions define uv:<package> projects and edges come from [tool.uv.sources] workspace = true / local path entries across main, optional, dependency-group, and legacy dev dependencies — again without invoking uv or Python. (#​11556 by @​jdx)

• task: Go workspaces are discovered from go.work use directives and each module's go.mod, registering stable go:<module-path> projects without running the go binary. Dependency ordering is supplied explicitly via [monorepo.projects] overrides. (#​11559 by @​jdx)

• task: workspace providers can now contribute task suggestions. The Node provider imports supported inputs, outputs, cache, and dependsOn metadata from matching turbo.json entries for inferred package scripts, tracking turbo.json as a task definition source. Unsupported Turbo expressions are left unset. (#​11543 by @​jdx)

• task: mise tasks graph --explain shows provider and metadata-source provenance for every inferred project, dependency edge, task, and provider-suggested field, and --json now serializes the same attribution. Config overrides are labeled as configuration rather than misattributed to inference. (#​11547 by @​jdx)

  mise tasks graph --explain

• task: mise watch gains a per-task watch.no_vcs_ignore option so tasks can watch sources that are excluded by .gitignore (such as generated files). VCS ignores stay enabled by default to avoid scanning broad build directories; one opted-in task enables it for the combined watch process. (#​11535 by @​Marukome0743)

  [tasks.generate]
  run = "process generated/output.json"
  sources = ["generated/output.json"]
  watch = { no_vcs_ignore = true }

• task: groundwork for affected-project task selection: mise can now resolve affected Git base/head revisions (with MISE_AFFECTED_BASE/MISE_AFFECTED_HEAD overrides and CI auto-detection for GitHub Actions and GitLab), map changed files to the workspace projects that own them, and expand that set through transitive reverse-dependency edges across providers. (#​11585, #​11569, #​11583 by @​jdx)

Changed

• ruby: precompiled Ruby binaries are now the default when ruby.compile is unset — installs try jdx/ruby binaries first and fall back to a source build when none are available. Set ruby.compile = true to force a source build as before. (#​11584 by @​jdx)

Fixed

• config: --path <dir> now targets a config file inside that directory for use, unuse, set, unset, dotfiles add, and the system subcommands. Previously --path was silently discarded when the current directory already had a config in scope, so mise unuse --path ../other could remove a tool from the wrong file. (#​11575 by @​JamBalaya56562)
• task: Ctrl-C is now treated as an interruption rather than a task failure. mise run stops starting new work, exits with status 130, and no longer prints no exit status or task failed, while still allowing post-dependency cleanup to run. (#​11511 by @​Marukome0743)
• task: sources and outputs now support brace globs (e.g. {a,b}/**), and literal single-element braces are preserved rather than being mangled. (#​11555, #​11565 by @​Marukome0743)
• python: mise run --tool python@3.12 now honors the selected interpreter when creating a _.python.venv, instead of building the venv from the first [tools] python entry. (#​11567 by @​JamBalaya56562)
• unuse: mise unuse node@20 on node = ["20", "22"] now removes only the matching version and preserves the rest, including structured options and .tool-versions entries. The whole tool key is removed only for an unversioned request or after the last version is unused. (#​11563 by @​Marukome0743)
• env: an explicit redact = false on a variable now excludes it from matching redactions patterns, so a short opted-out value no longer leaks into the global scrubber and partially redacts unrelated secrets. (#​11564 by @​jdx)
• hook-env: if a shell command overwrites a mise-managed variable or removes a PATH entry added by mise, hook-env now detects the drift and restores it, while leaving user-owned variables, added PATH entries, and PATH reordering untouched. (#​11568 by @​Marukome0743)
• dotfiles: symlink-each no longer recursively walks shared targets like ~ for status, apply, and unapply. mise now records exact source-to-target pairs in a manifest under $MISE_STATE_DIR/dotfiles, avoiding traversal of unrelated and unreadable home-directory trees. Existing installs are backfilled on their next apply. (#​11549 by @​jdx)
• asdf: dependencies declared via [tools].depends are now on the PATH given to bin/download and bin/install scripts during the same mise install, fixing first-install failures where a dependency's executable was still missing. bin/install now also fails when it installs nothing. (#​11531 by @​Marukome0743, #​11553 by @​JamBalaya56562)
• vfox: plugins whose pre_install hook returns a sha1 or md5 checksum are now verified instead of panicking with not implemented: sha1. (#​11536 by @​JamBalaya56562)
• aqua: checksum files that carry a byte-order mark are now read correctly, and the checksum manifest is fetched with the text-fetching path again. (#​11552, #​11558 by @​JamBalaya56562)
• brew-cask: direct cask pours are hardened with transactional activation, content-fingerprinted receipts, validated paths, and structured terminate_process/postflight handling, covering current cask shapes such as Cloudflare WARP, TablePlus, Zoom, OrbStack, Surge, Plex Media Server, and Zed Preview. Homebrew-owned casks are left byte-for-byte untouched. (#​11215 by @​donbeave)
• forgejo: the new fj macOS key path is now supported. (#​11545 by @​jdx)
• github, gitlab: gh/glab config is now found on Windows. (#​11508 by @​JamBalaya56562)
• http: HTTP client initialization failures are now handled gracefully instead of aborting. (#​11561 by @​Marukome0743)

Performance

• shim: shims reuse the resolved toolset and config roots, reducing per-invocation overhead. (#​11534 by @​jdx)
• task: workspace discovery caches its filesystem access. (#​11562 by @​jdx)
• release: the Linux x64 binary is optimized with BOLT and overall release binary size is reduced. (#​11533, #​11520 by @​jdx)

Documentation

• task: workspace task precedence is now documented. (#​11542 by @​jdx)

Registry

• Updated the herdr repository. (#​11518 by @​ogulcancelik)

Full Changelog: jdx/mise@v2026.7.18...v2026.8.0

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

v2026.7.18: : Monorepo task ergonomics and a broad round of fixes

Compare Source

This release refines mise's experimental monorepo task workflow with relative dependency paths and a compact dependency tree view, and lands a wide batch of fixes across Cargo installs, plugins, PATH handling, Windows program resolution, Aqua locks, GitLab pagination, and more.

Added

• task: mise tasks deps gains a --compact flag that expands each shared dependency subtree only once and marks later references as (already shown), keeping every incoming edge visible while avoiding the recursive blow-up that wildcard-heavy monorepo graphs produced. Default output is unchanged unless you pass the flag. (#​11502 by @​jdx)

  mise tasks deps --compact

• task: monorepo task dependencies now support ./-prefixed relative paths, resolved from the declaring task's own monorepo location, so one aggregate declaration works unchanged at the root, in nested apps, and in leaves without hard-coded absolute paths. Trailing ... patterns now include the base project itself in addition to its descendants. (#​11503 by @​jdx)

  [tasks.test]
  depends = [{ task = "./...:groups:tests:*", optional = true }]

Fixed

• cargo: installs now record the effective install options (features, default-features, bin, crate, locked) and reinstall automatically when any of them change, so changing feature flags or the selected binary no longer silently reuses the wrong artifact. Incompatible shared/system installs are shadowed in your primary install directory instead of being modified. (#​11480 by @​Marukome0743)
• plugins: [plugins] entries can now point at local filesystem paths (absolute, ~/, or explicit .//../ relative to the config root). Local asdf, vfox, vfox-backend, and package plugins are installed as symlinks so source edits take effect immediately, while Git URLs, refs, archives, and file:// sources keep their existing behavior. (#​11487 by @​Marukome0743)
• plugins: batch plugins install, plugins install --all, and plugins update now finish every plugin even when one fails, preserving successful changes and reporting all failures together (in deterministic order) with a failing exit status. (#​11490 by @​Marukome0743)
• env: computed environments (mise env, mise x child PATHs, mise doctor) now collapse exact duplicate PATH entries first-wins, fixing the runaway _.path accumulation that appeared in nested shells and IDE terminals that inherit an activated PATH without mise's state vars. The live shell PATH is intentionally left untouched. (#​11491 by @​JamBalaya56562)
• install: installing a tool no longer touches your loaded config files, so editors stop reporting spurious "file changed on disk" warnings. hook-env still detects installs and PATH changes via the mise data directory. (#​11495 by @​Marukome0743)
• prune: mise prune --tools no longer discards references from untrusted idiomatic version files and plain .tool-versions, preventing removal of versions still in use by other projects. (#​11501 by @​jdx)
• monorepo: idiomatic_version_file_enable_tools set in a config root's own [settings] is now honored by monorepo-wide commands like mise ls --monorepo and mise install --monorepo, instead of only being applied when mise runs from inside that root. (#​11463 by @​kaii-zen)
• asdf: bin/list-all and bin/latest-stable scripts now receive your resolved mise [env] values, removals, and _.path additions, so plugins that need a credential or helper on PATH can list versions. Caches are partitioned per environment so results are never reused across differing configs. (#​11492 by @​Marukome0743)
• aqua: locked HTTP installs (such as Cabal artifacts on downloads.haskell.org) again retain prefix-scoped format and file metadata, so archives are extracted correctly rather than copied as the executable. (#​11499 by @​jdx)
• gitlab: authentication headers are now sent on every page of paginated release/tag requests, fixing anonymous page-2 requests on private or rate-limited GitLab projects when MISE_LIST_ALL_VERSIONS is set. (#​11507 by @​JamBalaya56562)
• backend (Windows): mise now resolves a genuinely spawnable program instead of a bare name, fixing program not found errors when a tool is present only as a .cmd shim (for example a scoop- or pip-installed pipx.cmd). Interpreter-only files such as .ps1 and .vbs are recognized correctly, with .vbs file tasks routed through cscript. (#​11486, #​11489 by @​JamBalaya56562)
• watch: mise watch --wrap-process group is now honored on macOS instead of being silently dropped for watchexec's platform default of session. The --help text also documents the platform-dependent defaults. (#​11512 by @​JamBalaya56562)
• lockfile: monorepo legacy path discovery is now cached, avoiding redundant work during lockfile operations. (#​11500 by @​jdx)

Registry

• Added witr. (#​11505 by @​Jelenkee)

New Contributors

• @​Jelenkee made their first contribution in #​11505
• @​kaii-zen made their first contribution in #​11463

Full Changelog: jdx/mise@v2026.7.17...v2026.7.18

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.7.17: : Monorepo Task Inference and Root Defaults

Compare Source

This release builds out mise's experimental monorepo task story: Node workspaces now infer project dependency graphs, import package scripts as first-class tasks, and can share configuration through root task defaults and upstream (^task) dependencies. It also adds per-tool control over idiomatic version files, a smoother dotfiles workflow, and a batch of fixes across shell activation, hook-env, Homebrew casks, Aqua, and Python uv environments.

Highlights

• Node monorepo workspaces gain end-to-end task support: inferred project dependency edges, imported package.json scripts as node:<package>#<script> tasks, root task defaults shared by task name, and experimental ^task upstream dependencies for "build upstream projects first" ordering.
• New optional = true task dependencies run when they match and are silently skipped when they don't, and idiomatic version files can now be disabled per tool so .nvmrc and package.json no longer fight over your Node version.
• A round of environment and shell fixes stops hook-env from reloading every prompt after unrelated file writes, keeps the fish cd hook working during compound commands, and fixes zsh activation under POSIX_IDENTIFIERS.

Added

• task: Node workspace packages now expose their package.json scripts as mise tasks without needing a mise.toml in every package. Scripts get stable IDs like node:@scope/app#build plus monorepo path aliases such as //packages/app:build, run in their package root through the detected package manager (npm/pnpm/Yarn/Bun) with raw argument passthrough, and explicit tasks take precedence while keeping both names linked. (#​11466 by @​jdx)

• task: Node workspaces now infer project dependency edges by matching declared internal package names (dependencies, devDependencies, optionalDependencies, peerDependencies) to other discovered packages, surfaced through mise tasks graph. This is the graph that powers dependency-aware ordering. (#​11435 by @​jdx)

• task: experimental root task defaults via [monorepo.task_defaults.<name>] in the root mise.toml, applied by task name to both inferred and explicit workspace tasks. Task-local config and extends templates still win. (#​11473 by @​jdx)

  [monorepo.task_defaults.build]
  sources = ["src/**", "package.json"]
  outputs = ["dist/**"]
  cache = { enabled = true }
  
  [monorepo.task_defaults.test]
  env = { NODE_ENV = "test" }

• task: experimental ^task upstream dependency syntax so a task can require the same task in every upstream workspace project before it runs, expanding through the project graph (including transitive upstreams) and skipping projects that lack the task. Supported in depends only. (#​11476 by @​jdx)

  [monorepo.task_defaults.build]
  depends = ["^build"]

• task: optional dependencies via optional = true on structured task dependencies. Optional deps run all matches when present and are silently omitted when nothing matches, while invalid selectors still error. Works across depends, depends_post, and wait_for. (#​11471 by @​jdx)

• config: idiomatic_version_file_disable_files lets you disable individual idiomatic version files per tool using tool:filename pairs, so you can keep .nvmrc selecting Node while ignoring package.json devEngines, with pnpm still reading package.json. (#​11470 by @​jdx)

  mise settings add idiomatic_version_file_disable_files node:package.json

• dotfiles: mise bootstrap dotfiles add now applies captured entries by default (use --no-apply for capture-only workflows), moves real paths into the dotfiles source before linking, normalizes and sorts [dotfiles] entries, and reports config writes and concrete apply actions, with rollback on failure. (#​11451 by @​jdx)

Fixed

• hook-env: creating an unrelated file in a config-search ancestor directory no longer forces env._.source and full config reloads to re-run on every prompt indefinitely. Forced fast-path runs now always refresh the session. (#​11458 by @​Marukome0743)
• activate: the fish directory-change hook now stays active while commands run, so each cd in a compound command applies the matching mise environment immediately, matching Bash and Zsh behavior. (#​11478 by @​Marukome0743)
• activate: zsh activation now works with POSIX_IDENTIFIERS enabled; MISE_* changes are captured correctly instead of hitting a bad math expression error. (#​11467 by @​jdx)
• brew: Homebrew casks using the new command_wrapper artifacts and structured run lifecycle

✂ Note

PR body was truncated to here.