Skip to content

chore(deps): update dependency jdx/mise to v2026.9.3 - #2436

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mise
Open

chore(deps): update dependency jdx/mise to v2026.9.3#2436
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/mise

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
jdx/mise uses-with minor v2026.8.11 → v2026.9.3

Release Notes

jdx/mise (jdx/mise)

v2026.9.3

Compare Source

v2026.9.2: : Packslip Backend, SSH Relay, and Reimagined Install Progress

Compare Source

This is a large release headlined by the new stable packslip: backend for installing tools from a vendor's own signed release manifest, a read-only GitHub SSH relay for remote onboarding, redesigned install progress for both terminals and CI logs, and a rebuilt dotfiles-tracking model for bootstrap. It also carries dozens of fixes across shims, tasks, brew, Go, npm, and the schema, plus two security fixes.

Highlights
  • The packslip: backend is now generally available: install tools directly from a project's cryptographically signed release manifest, with signer pinning, trusted stampers, host-requirement checks, shell completions, and agent skills all driven from the same signed source.
  • Install output was reimagined end to end. Interactive terminals get a live region with a fractional install-wide bar and permanent completion lines, while CI logs, pipes, and AI-agent terminals get a compact append-only reporter instead of thousands of scrolling rows.
  • Bootstrap grows a read-only GitHub SSH relay and --from-git onboarding, an AUR package manager, and a rebuilt dotfiles-history model that tracks files through ordinary Git commits synchronized with an origin.
Added

  • packslip: New packslip: backend installs tools from a vendor-published, signed release manifest (a sigstore bundle) that names every artifact with its digest, platform, format, and executables. The tool name is a pin, like a known_hosts entry: packslip:github.com/owner/repo accepts only a packslip signed by that repository's release workflow, and signature, log entry, statement, digest, and size are all verified before anything is unpacked. Custom hosts and monorepo tools are supported. The backend is no longer experimental. (#​12778, #​12811 by @​jdx)

    [tools]
"packslip:github.com/oxc-project/oxc/oxlint" = "latest"

  • packslip: Signer pinning remembers, per project, the signer that signed the first accepted release in a pins.toml file (like SSH's known_hosts) and records the signer in mise.lock, so a later release signed by anyone else, or one that weakens provenance, is refused. mise packslip pins lists what is pinned and mise packslip forget <project> accepts an announced key rotation. (#​12783 by @​jdx)

  • packslip: New packslip.stampers setting lets you require that a trusted host has stamped a version before mise offers or installs it (a scanning service, a mirror, or eventually the registry), with a per-tool trust = "vendor" override. (#​12782 by @​jdx)

  • packslip: Declared host requirements (OS/glibc minimums, shared libraries, required commands) are checked before download; confirmed failures refuse the install, gaps mise cannot verify warn only, and ignore_requirements = true overrides hard failures. latest also resolves from verified vendor recommendations. (#​12804, #​12805 by @​jdx)

  • packslip: A tool's packslip can ship shell completions and agent skills. mise completion <shell> --tool <name> prints (or --install writes a version-aware stub for) completions for whichever version is active in the current directory, and mise skills ls / mise skills sync link a tool's Agent Skills into .claude/skills at the pinned version. Completions are also loaded automatically in activated shells. (#​12779, #​12780, #​12848 by @​jdx)

  • install: Redesigned install progress. Interactive terminals now show a live region with an install-wide fractional bar, per-tool phase/elapsed/artifact rows, dependency-wait rows ("waiting for node@​24.20.0"), and permanent completion lines written into scrollback. prune, uninstall, and upgrade removals reuse the same session, so pruning hundreds of versions no longer floods the screen. (#​12906 by @​jdx)

  • install: CI logs, pipes, and AI-agent terminals (CLAUDECODE/AI_AGENT) get a compact append-only reporter: one permanent line per finished tool plus a periodic snapshot of the bar, active phases, transfer rates, and queue count, instead of hundreds of scrolling status rows. Resolver hosts and retry progress are surfaced too. (#​12902, #​12907 by @​jdx)

  • ssh: New mise ssh runs ordinary OpenSSH sessions with optional session-scoped, read-only GitHub access, and mise bootstrap remote --from-git onboards a remote host from a Git repo. The initiating machine keeps the credential and brokers authorized clone/fetch and REST reads over an SSH Unix-socket forward; no token is installed on the target. (#​12830 by @​jdx)

    mise ssh devbox --github-relay-read-only --github-relay-repo jdx/dotfiles

  • bootstrap: mise bootstrap --from-git <GIT_URL> clones a repository-backed global config into $MISE_CONFIG_DIR so its config.toml, conf.d/, and tasks apply on the first bootstrap and stay active afterward. (#​12715 by @​jdx)

  • bootstrap: New aur: package manager installs from the Arch User Repository via yay (preferred) or paru, with foreign-package status detection so repo packages with colliding names cannot satisfy an AUR request. Bootstrap can also declare packages as absent to remove them, and now reports which root declarations were selected. (#​12718, #​12716, #​12770 by @​jdx)

  • bootstrap: Rebuilt dotfiles tracking. Files enrolled with mode = "track" stay in place while mise commits changes to a separate bare Git store with checkpoints, rollback/undo, and optional origin synchronization, including encryption of shared files before storage. (#​12918 by @​jdx)

  • activate: New activate_shims = false (MISE_ACTIVATE_SHIMS=false) keeps tool shim directories off PATH during activation and hooks without changing your auto-install or lazy-tool settings. Command wrappers such as mr-boxington's cargo keep working. (#​12926 by @​jdx)

  • core: Rust tools accept mr_boxington = true and mise use gains a repeatable --tool-option KEY=VALUE flag, so setting up the Cargo wrapper is a single command. (#​12908 by @​jdx)

    mise use --tool-option mr_boxington=true rust mr-boxington

  • ruby: mise now reads Bundler's ruby file: ".ruby-version" form from a Gemfile (resolving the path next to the Gemfile), so projects that pin Ruby through a sibling file resolve correctly. (#​12914 by @​jdx)

  • self-update: New global-only self_update.repository and self_update.api_url settings let organizations point manual updates, out-of-date hints, and automatic updates at a curated GitHub or GitHub Enterprise release mirror. Project config cannot redirect updates, and artifacts still pass the embedded-signature check. (#​12735 by @​jdx)

  • backend: install_env is now applied when resolving and downloading tools, not just at build time. (#​12777 by @​rabadin)

  • brew: mise can now evaluate ordinary third-party taps. (#​12774 by @​jdx)

Fixed
Security
  • http: URL replacements no longer forward authorization headers or URL credentials when an HTTPS origin is rewritten to HTTP; such credential-carrying downgrades are refused, and errors omit URLs so embedded credentials cannot leak through diagnostics. (#​12879 by @​jdx)
  • self-update: Self-update now requires secure release sources. (#​12737 by @​jdx)
New Contributors

Full Changelog: jdx/mise@v2026.9.1...v2026.9.2

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.9.1: : Bootstrap firewall limiting, scoped locked mode, and lazy tools in tasks

Compare Source

This release expands bootstrap system setup with firewall rate limiting and more systemd directives, adds a scoped locked mode for mixing distribution and user tool policies, and fixes lazy tools so they install when invoked from tasks and mise x.

Added

  • bootstrap: New action = "limit" for incoming TCP firewall rules rate-limits connections per source. It maps to UFW's native limiting and bounded per-source IPv4/IPv6 nftables meters; firewalld fails closed since it cannot express safe per-source limiting. Limit rules are treated as preserving SSH access by the lockout guard. (#​12669 by @​jdx)

  • bootstrap: Bootstrap systemd units now support requires (Requires=), repeatable environment_file (EnvironmentFile=), nice, and umask, with validation for nice ranges (-20 to 19) and octal umasks. Note that requires does not imply ordering; use after for that. (#​12683 by @​jdx)

  • config: New global-only locked_scopes setting (also MISE_LOCKED_SCOPES) lets you scope locked mode to specific config sources, so a distribution can ship rolling or lazy tools through /etc/mise/config.toml without forcing users to maintain a system lockfile. Defaults to all three scopes to preserve existing behavior. (#​12667 by @​jdx)

    [settings]
locked_scopes = ["project", "global"]

Fixed

  • task: Lazy tools (lazy = true) now install when their command is invoked from a mise run task or mise x, matching the behavior of an activated shell. mise inserts the shim farms after real tool paths for lazy toolsets and reconciles missing bootstrap shims for hand-edited declarations, so tasks no longer fail with command: not found. (#​12687 by @​jdx)
  • env: Environment variables configured for removal (false values and unset directives) are now consistently unset across mise exec, tasks, mise env, hook-env, deps, and tool stubs, so inherited or secret variables are no longer leaked back into child processes. (#​12664 by @​jdx)
  • shim: mise reshim can now safely target shared executable directories like ~/.local/bin or /usr/local/bin. It identifies mise-owned shims and only replaces or prunes those, leaving unmanaged files and symlinks in place, and --force rebuilds mise-owned shims rather than wiping the whole directory. (#​12675 by @​jdx)
  • brew-cask: Cask binaries that reference their surrounding extracted payload now keep that payload beside the staged binary, so tools like codex that exec helpers or read manifests from their own tree continue working after temporary install files are cleaned up. (#​12686 by @​azohra)
  • upgrade: Fixed recursive deferred tool pruning that could hang new terminals when prompt hooks triggered a full tracked-config scan. Deferred cleanup now takes a non-blocking lock and is skipped for shell-integration and --no-config commands. (#​12676 by @​jdx)
  • install: Install failures caused by a missing marker file now name the affected file and operation instead of reporting a bare OS error. (#​12624 by @​JamBalaya56562)
  • install: mise install --dry-run for an s3 tool that only declares a URL for another platform now reports the missing platform and available options instead of falsely claiming it would install. (#​12641 by @​hktitof)

Changed

  • registry: Registry command (shim) names are now inferred from the preferred Aqua package at build time, removing redundant bins declarations from hundreds of registry entries. Explicit bins are kept only where mise intentionally exposes a different command set, and mise registry --json exposes the inferred names. (#​12668 by @​jdx)

New Contributors

Full Changelog: jdx/mise@v2026.9.0...v2026.9.1

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.9.0: : Lazy Tool Shims

Compare Source

This release introduces lazy tool shims, which install a tool automatically the first time one of its commands is invoked, plus an opt-in Erlang precompiled OS override and a fix for nested mise calls during postinstall hooks.

Added

  • tools: Declare a tool as lazy in [tools] with lazy = true and mise generates bootstrap shims into its normal user/system shim farms. The provider is installed only when one of its commands is first called, then executes immediately; subsequent calls run the real binary without another mise dispatch. Registry tools derive their command names from registry bins, while explicit or non-registry backends declare them with lazy_bins. A bare mise install skips lazy declarations; use mise install --include-lazy to provision them all. New global path settings (shims_dir/MISE_SHIMS_DIR, system_installs_dir/MISE_SYSTEM_INSTALLS_DIR, system_shims_dir/MISE_SYSTEM_SHIMS_DIR) and mise reshim --system support system-scoped and collocated layouts. (#​12594 by @​jdx)

    [tools]
node = { version = "24", lazy = true }
"github:example/acme" = { version = "1.2.3", lazy = true, lazy_bins = ["acme", "acmectl"] }

  • erlang: New erlang.precompiled_os setting (and MISE_ERLANG_PRECOMPILED_OS) opts into a specific Bob Ubuntu build target—including Ubuntu 26.04—on compatible glibc distributions. Automatic target detection is unchanged, and lockfiles now preserve the selected OS for reproducible builds. Note the portability constraints around shared-library SONAMEs documented with the setting. (#​12637 by @​jdx)

Fixed

  • install: Postinstall hooks now activate the exact tool version being installed, so nested mise invocations (such as mise which or mise ls) resolve that version instead of an older discoverable one—or losing the tool entirely when it was declared through a custom config path with mise use --path. (#​12635 by @​jdx)

Registry

New Contributors

Full Changelog: jdx/mise@v2026.8.16...v2026.9.0

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.16: : Command wrappers and Windows shell fixes

Compare Source

This release adds configurable command wrappers for intercepting ordinary commands, alongside a batch of shell and PATH fixes that make Windows activation more reliable and clearer upgrade and error messaging.

Added

  • shims: New [wrappers] config lets you intercept an ordinary command name with a different command, arguments, and environment. Wrappers take precedence over mise-managed tools, and mise strips its dispatch directories before delegating so the underlying tool still resolves from mise or the system. Works with normal activation, activate --shims, and mise exec; managed wrapper shims are refreshed by mise reshim. (#​12617 by @​jdx)

    [tools]
mr-boxington = "1.1.0"

[wrappers.cargo]
command = "mbx"
env = { MBX_CARGO_SHIM_MODE = "1" }

Fixed

  • elvish: mise env and mise activate --shims now emit valid Elvish quoting instead of bash's. This fixes several corruptions that mostly surfaced on Windows: stray quotes and the wrong PATH separator in activate --shims, apostrophes and ! arriving with backslashes, and \n sequences in paths like C:\nodejs being turned into newlines. (#​12584 by @​JamBalaya56562)

  • fish: mise env -s fish now splits PATH on the host's separator and recognizes the Path spelling on Windows, so semicolon-separated Windows paths are no longer severed at each drive letter. Empty PATH segments are dropped rather than adding the current directory. (#​12582 by @​JamBalaya56562)

  • http: The "No URL for platform" error now lists every platform key a tool actually declares in mise.toml, including typos and unrecognized names, instead of falling back to a misleading "requires 'url' option" message with an empty available list. (#​12580 by @​JamBalaya56562)

  • upgrade: When tools are current for their configured version ranges but newer releases exist beyond those ranges, mise upgrade no longer prints "All tools are up to date". It now lists the affected tools with their current and available versions plus the config source, and points to mise upgrade --bump. (#​12613 by @​jdx)

    Newer versions are available but do not match the configured version ranges:
  node 26.7.0 → 26.8.1 (~/.config/mise/config.toml)
Run `mise upgrade --bump` to update the configuration and upgrade.

  • task: Double-dash task arguments are now preserved with double_dash="preserve". The first -- separator was previously consumed by the outer CLI parser and lost before reaching the task. (#​12628 by @​jdx)

  • npm: Embedded Aube npm installs are now isolated as a standalone one-package workspace, so a pnpm-workspace.yaml above MISE_DATA_DIR can no longer redirect the install into the outer workspace or mutate it. This mainly affects GitLab CI layouts where the data dir lives under CI_PROJECT_DIR. (#​12630 by @​jdx)

  • bootstrap: Repository status checks now honor the global --jobs limit, so mise bootstrap status, apply, and update run these read-only git checks with bounded concurrency. (#​12629 by @​jdx)

Changed

  • registry: acli, mimirtool, and specstory are no longer restricted to Linux and macOS and can now be installed and run on Windows. (#​12627 by @​JamBalaya56562)
  • registry: llama.cpp resolution now includes prereleases, since upstream began flagging its rolling bNNNN builds as GitHub prereleases. The existing minimum-release-age and b version prefix behavior is unchanged. (#​12614 by @​jdx)

Full Changelog: jdx/mise@v2026.8.15...v2026.8.16

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.15: : Dotfiles diff and capture, scoped config updates, and per-tool postinstall hooks

Compare Source

This release expands the dotfiles/bootstrap workflow with previews, bulk capture, git-tracked manifests, and profile reconciliation, adds scoped config collection updates and per-tool postinstall hooks, and rounds it out with a large batch of fixes across tasks, schema validation, Windows, lockfiles, and shims.

Highlights

  • Dotfiles management grows a full preview-and-capture workflow: mise bootstrap dotfiles diff, bulk add --changed, git-tracked directory manifests, and automatic reconciliation when a profile switches a target's source.
  • mise config set learns idempotent list updates (--append/--remove) and explicit --global/--system targeting, and mise use gains per-tool --postinstall hooks.
  • Safer upgrades: replaced tool versions now linger for a grace period instead of being deleted immediately, so a bad upgrade is easier to recover from.

Added

  • dotfiles: New mise bootstrap dotfiles diff previews exactly what apply would change without writing anything, printing unified content patches for copy, template, and inline entries and structural summaries for symlinks and directories. Optional target filters use the same selection semantics as apply. (#​12511 by @​jdx)

  • dotfiles: mise bootstrap dotfiles add --changed captures every drifted copy-mode target back into its source in one command, without naming each path. Directory copies, symlinks, templates, and inline content are skipped, and untrusted configs are blocked. (#​12512 by @​jdx)

  • dotfiles: Directory copy and symlink-each entries can now set manifest = "git" to manage only paths returned by git ls-files, so a dotfiles repo that gitignores everything and force-adds selected paths no longer traverses (or links) ignored home-directory content. Links are removed when a file drops out of the index. (#​12523 by @​jdx)

  • dotfiles: symlink-each apply now reconciles stale links when a profile change (for example toggling MISE_ENV between home and work) points a target at a different source. Only links still pointing at the previously recorded source are removed; unmanaged paths and paths desired by another active source are left alone, and dry-run previews the removals. (#​12524 by @​jdx)

  • bootstrap: mise bootstrap --from <git-url> clones a setup/dotfiles repo (into $MISE_DATA_DIR/bootstrap-repo by default, or --from-dir), then runs bootstrap from that checkout. Existing checkouts are reused when the origin matches, --update fast-forwards them, and --dry-run only prints the planned git clone/git pull. (#​12525 by @​jdx)

  • use: mise use --postinstall <COMMAND> attaches a per-tool post-install hook that runs only when that tool is installed or reinstalled. Repeat the flag before each tool to give each its own hook. (#​12609 by @​jdx)

    mise use --postinstall "mbx setup --defaults" mr-boxington

  • config: mise config set gains --append and --remove for list-like keys (append without duplicates, remove matching entries, promote scalars to arrays as needed) while preserving TOML comments and formatting, plus explicit --global/--system targeting for config get/set. Tool postinstall hooks now also receive MISE_CONFIG_FILE, MISE_GLOBAL_CONFIG_FILE, MISE_CONFIG_ROOT, and MISE_PROJECT_ROOT. (#​12603 by @​jdx)

  • config: Templates can now reference config_source, the absolute path of the config file the template lives in (not resolved through symlinks). This lets a shared config symlinked into conf.d add its own real directory to PATH, for example {{ config_source | canonicalize | dirname }}/bin. Available in mise.toml, .tool-versions, [env] directives, and [settings.age]. (#​12454 by @​Marukome0743)

  • task: task_source_files(only_changed=true) returns only the sources written since the task last succeeded, so linters and formatters can run against just what changed. A failed run keeps its files outstanding until the task passes. (#​12470 by @​Marukome0743)

  • outdated: mise outdated --json now includes a release_url field pointing at the release page for the offered version (from the versions host, aqua, GitHub/GitLab, or the rust core plugin). The key is omitted rather than null when no page is available. (#​12494 by @​Marukome0743)

Changed

  • upgrade: mise upgrade no longer deletes the replaced install immediately. When upgrade.auto_prune is on, the old version stays on disk and is scheduled for removal after upgrade.prune_after (default 24h), cleaned up opportunistically on later runs. --prune still removes immediately and --no-prune keeps the old tree with no scheduled cleanup. mise ls surfaces deferred removals. (#​12593 by @​jdx)

Fixed

Performance

  • brew: Homebrew bootstrap bottles are now downloaded concurrently (bounded by MISE_JOBS), while pouring, source builds, and prefix linking stay in dependency order. (#​12604 by @​jdx)

Registry

New tools: pkgx, onefetch, syncthing, ols, spin-framework, cursor-agent, 7zip, mosh, pastel, broot, exiftool, spotify-player, yt-dlp-nightly, and cliamp. magika and sbt now install from their GitHub releases, and pre-commit uses the pipx backend on Windows. Various dependency and OS-limit cleanups were also applied. (#​12272, #​12437, #​12448, #​12484, #​12485, #​12478, #​12486, #​12532, #​12535, #​12533, #​12538, #​12539, #​12542, #​12581, #​12553, #​12567, #​12549)

New Contributors

Full Changelog: jdx/mise@v2026.8.14...v2026.8.15

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.14: : npm/aube install fixes and cleaner temp/prune handling

Compare Source

This is a small release focused on bug fixes for npm (aube-backed) installs, HTTP cache cleanup, and Windows config pruning.

Fixed
  • npm: Aube-backed npm installs no longer drop a synthetic .npmrc into the per-tool install directory. Install-scoped settings such as minimumReleaseAge, trustPolicyExclude, allowedUnpopularPackages, and (for CLI installs) globalDir/globalBinDir now go into .config/aube/config.toml as typed TOML, while allowBuilds stays in package.json. Inline-table trust_policy_excludes / allow_low_downloads in mise.toml still round-trip correctly. (#​12425 by @​jdx)
  • npm: mise now intercepts the private __node-gyp-bootstrap trampoline that embedded aube's lazy node-gyp shim re-execs. Previously naked-run rewriting turned it into mise run __node-gyp-bootstrap … and failed with "no tasks defined", breaking allow_builds installs whose lifecycle scripts call node-gyp (for example gemini-cli via node-pty). (#​12429 by @​jdx)
  • http: A failed extraction (truncated download, unreadable archive, full disk, or Ctrl-C mid-extraction) no longer leaves a permanent hash-named temp directory behind in http-tarballs. All failure paths now clean up the temp directory. (#​12420 by @​Marukome0743)
  • prune: mise prune --configs on Windows now removes trusted config links whose target no longer exists. Because Windows stores these links as plain files holding the target path, the previous existence check never fired; the link's target is now resolved before deciding whether to prune. (#​12418 by @​JamBalaya56562)

Full Changelog: jdx/mise@v2026.8.13...v2026.8.14

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.13: : Task exclusions, visible conf.d fragments, and a broad round of fixes

Compare Source

This release adds a few configuration and task features and delivers a large batch of fixes across completions, tools, lockfiles, tasks, config parsing, and shell integration. It also restores dynamic shell completions that regressed after the recent CLI parser change.

Added

  • task: New task_config.excludes lets file-task discovery skip config-root-relative paths, directories, and glob patterns, so accidental TOML files (like a pyproject.toml inside a task directory) or entire subtrees are no longer treated as tasks. The closest config that sets excludes replaces inherited values, and an empty list clears the cascade. Relative task.disable_paths now resolve from the declaring config file. (#​12366 by @​jdx)

    [task_config]
excludes = ["scripts/vendor", "**/*.generated.toml"]

  • config: Project configuration can now be split into visible mise/conf.d/*.toml fragments, mirroring the existing .mise/conf.d and .config/mise/conf.d support but without a hidden dot-directory. Fragments merge alphabetically, mise/config.toml still wins over fragments, and environment-specific and .local variants (for example mise/conf.d/tools.development.toml) follow the usual env config rules. (#​12395 by @​jdx)

  • bootstrap: Added --skip-dirty to mise bootstrap, mise bootstrap repos apply, and mise bootstrap repos update to warn and skip repos with local changes so the remaining repos still update. Origin mismatches and non-git targets still fail closed as before. (#​12364 by @​jdx)

Fixed
  • completion: Restored dynamic shell completions that broke after the switch to usage-rs. Task names, task-specific flags, task value choices, and run= completers work again in fish and zsh, while native file/path completion still falls back correctly. (#​12376, #​12379 by @​jdx)
  • env: Command-prefix and runtime environment overrides (for example VAR=override mise run ...) are no longer wiped when reconstructing the pre-mise environment in an activated shell; mise-managed values are only rolled back when the live value still matches what mise recorded. (#​12390 by @​jdx)
  • env: A leading UTF-8 byte-order mark in an env file is now stripped before parsing. (#​12320 by @​JamBalaya56562)
  • backend: Fixed a regression where an offline latest request failed for a tool installed only with mise install --system; the effective install directory is now recovered so system/shared-only installs satisfy latest. (#​12406 by @​jdx)
  • github: When a lockfile records a checksum but no provenance, mise no longer probes the GitHub releases API at install time. This avoids hard install failures under rate limiting in high-concurrency CI, since the lockfile checksum already guarantees artifact integrity. The lockfile checksum now also takes priority over release-metadata digests. (#​12377 by @​effati)
  • brew: Cask installs now recursively extract single nested archives (matching Homebrew's extract_nestedly, for example a zip containing only a DMG), and bare cask .pkg downloads are staged correctly. (#​12373, #​12371 by @​jdx)
  • pipx: Non-GitHub Git latest requests now resolve to the remote default branch HEAD and are treated as a rolling channel, so outdated and upgrade detect branch movement. An unavailable configured executable is now rejected instead of failing later. (#​12407, #​12416 by @​jdx)
  • lockfile: Each new version is now a

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 4am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from fstab as a code owner August 31, 2026 01:41
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@renovate
renovate Bot enabled auto-merge (squash) August 31, 2026 01:41
@renovate renovate Bot changed the title chore(deps): update dependency jdx/mise to v2026.8.15 chore(deps): update dependency jdx/mise to v2026.8.16 Aug 31, 2026
@renovate renovate Bot changed the title chore(deps): update dependency jdx/mise to v2026.8.16 chore(deps): update dependency jdx/mise to v2026.9.0 Sep 1, 2026
@renovate renovate Bot changed the title chore(deps): update dependency jdx/mise to v2026.9.0 chore(deps): update dependency jdx/mise to v2026.9.1 Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/mise branch 4 times, most recently from f676daa to de27c0f Compare September 8, 2026 03:15
@renovate renovate Bot changed the title chore(deps): update dependency jdx/mise to v2026.9.1 chore(deps): update dependency jdx/mise to v2026.9.2 Sep 8, 2026
@renovate renovate Bot changed the title chore(deps): update dependency jdx/mise to v2026.9.2 chore(deps): update dependency jdx/mise to v2026.9.3 Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fstab fstab Awaiting requested review from fstab fstab is a code owner
@dhoard dhoard Awaiting requested review from dhoard dhoard is a code owner
@zeitlinger zeitlinger Awaiting requested review from zeitlinger zeitlinger is a code owner
@jaydeluca jaydeluca Awaiting requested review from jaydeluca jaydeluca is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants