[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
amannn/action-semantic-pull-request	action	patch	v6.1.1 → v6.1.2
jdx/mise		minor	v2026.10.19 → v2026.11.8

---

Release Notes

amannn/action-semantic-pull-request

v6.1.2

Compare Source

Bug Fixes

• Release accumulated dependency updates (closes #​321) (fc7da0c)

jdx/mise

v2026.11.8: : Bootstrap settings plugins, block edits in bootstrap files, and argv in command wrappers

Compare Source

This release extends mise bootstrap with experimental settings plugins, system-wide plugin directories, block edits for system files, and repositories and hooks in mise bootstrap plan. macOS preferences move to [bootstrap.settings.macos]. Command wrappers can now read the user's arguments, and a new setting keeps private GitHub repos off mise-versions. It also fixes problems in lockfiles, hook-env performance, tasks and backends.

Added

Bootstrap

• Bootstrap settings plugins (experimental). A plugin can now apply one program's or desktop's settings from a [bootstrap.settings.<plugin>] section. The plugin reads and writes values, and mise compares them and writes only the keys that differ. A new settings bootstrap part runs after tools and package plugins. It works with --only settings and --skip settings, and the new mise bootstrap settings status and mise bootstrap settings apply [--dry-run] commands manage it directly. If a section's plugin is missing or can't run on this OS, mise skips the section and lists it as a follow-up. Settings plugins need experimental = true and are not yet included in mise bootstrap status or plan. #​15621 (@​jdx)

  [bootstrap.settings.omarchy.appearance]
  blur = true
  blur_strength = 4

• System plugin directories. A distro or admin can install bootstrap package manager plugins once for every user on the machine. After the user's own plugins directory, mise searches /usr/share/mise/plugins and then $MISE_SYSTEM_DATA_DIR/plugins (default /usr/local/share/mise/plugins). MISE_SYSTEM_PLUGINS_DIRS replaces this list. These plugins need no [bootstrap.plugins] entry. A user plugin with the same name overrides a system plugin. mise uses a system plugin only if root or the current user owns it and its group and other users can't write to it. System plugin directories are ignored on Windows. mise plugins ls labels these plugins (system), and mise plugins update and uninstall skip them. #​15620 (@​jdx)

• Block edits in [bootstrap.files]. An entry can now manage a marked block inside a file mise doesn't own, such as /etc/hosts, without replacing the rest of the file. mise uses sudo only when the current user can't make the change. If the file is missing, mise creates it with just the block. block can't be combined with source, content, replace, remove_empty or state = "absent", and you have to remove a block by hand for now. #​15650 (@​jdx, @​aacebedo)

  [bootstrap.files."/etc/hosts"]
  id = "dev"
  block = """
  127.0.0.1 dev.local
  127.0.0.1 api.local
  """

• Repositories and hooks in mise bootstrap plan. Repositories show as create, update or unchanged. A repository with local changes or conflicts shows as unknown, and --detailed-exitcode fails on it. Hooks appear with a new run action and a hook_phase field. They don't count as changes for --detailed-exitcode. The JSON summary gains a run count. Repository credentials are left out of the output. #​15653 (@​jdx, @​azohra)

Tools, tasks and dotfiles

• argv in command wrapper templates. A wrapper's args and env templates can now use argv, the list of arguments the user passed after the command name. The user's arguments are still forwarded unchanged after the wrapper's own args. command can't use argv. #​15655 (@​jdx, @​andersonkrs)

  [wrappers.rails]
  command = "fnox"
  args = ["--profile={{ 'test' if argv[0] == 'test' else 'development' }}", "exec", "--", "rails"]

• versions_host_exclude setting. This setting takes case-insensitive owner/repo glob patterns. mise looks up matching github: repos directly on GitHub instead of sending their names to mise-versions, and every other tool keeps using mise-versions. You can also set it with MISE_VERSIONS_HOST_EXCLUDE as a comma-separated list. #​15666 (@​jdx)

  [settings]
  versions_host_exclude = ["my-org/*", "other-org/internal-cli"]

• Root package.json scripts in npm and Bun workspaces. A root package.json with a name is now a project in the experimental workspace task graph for every package manager, not only pnpm and Yarn. Its scripts run as <manager> run <script> --. With --affected, a change to a root lockfile now marks every Node workspace project as affected. #​15616 (@​jdx)

• Warning before overwriting edited dotfile copies. If you edited a copy target after mise last wrote it, mise dot apply now warns before overwriting it. --dry-run and the confirmation list mark the file (edited since mise last wrote it). mise doesn't check targets it has no record of writing, or directory copies outside a dotfile group. #​15600 (@​jdx, @​nahoj)

Changed

• Clean environment for brew source builds. When mise bootstrap packages apply builds a brew formula from source, it now starts from a clean environment, as brew does. Only a short list of variables is kept, including HOME, locale, proxy and CA certificate variables, SSH_AUTH_SOCK and HOMEBREW_*. Variables such as GOROOT, CC, CFLAGS and PYTHONPATH no longer leak into the build and break it. A CC or CFLAGS exported in your shell no longer affects these builds. #​15613 (@​jdx)
• Checks before mise bootstrap remote archives the source. It now refuses to send $HOME or /, which would include ~/.ssh and other credentials. It stops when the source is larger than 512 MiB or 100,000 files after excludes and lists the largest entries. It also prints archiving <dir> while it works. Pass --yes to skip these checks. #​15607 (@​jdx)
• mise lock <tool> errors on unknown tools. It now fails when a tool argument doesn't match any tool configured in the project. Before, it exited 0 and wrote nothing, and with a partial match it ignored the unknown names. #​15649 (@​jdx)
• gem: tools reuse Ruby's bundled gems. mise now installs gem: tools by setting GEM_HOME instead of passing --install-dir. This lets the gems bundled with Ruby satisfy dependencies, so, for example, gem:ceedling installs on Windows without MSYS2. Gems you installed globally can now also satisfy dependencies. #​15644 (@​jdx)
• Archived asdf: backends removed from the registry. 90 asdf: backends whose plugin repositories are archived or gone were removed from the registry. This fixes oc@latest, among others. Each affected tool still has at least one other backend, so shorthands such as mise use oc resolve as before. #​15642 (@​jdx)

Deprecated

• macOS preferences under [bootstrap.macos]. The dock, finder, keyboard, trackpad, defaults, defaults_entries and login_items tables now belong under [bootstrap.settings.macos]. mise reads both spellings, and the new one wins when a key is set in both places. Older mise versions ignore the new spelling, so keep the old one until every machine runs this version. mise won't warn about the old spelling until 2027.5.0. [bootstrap.macos.launchd.agents] stays where it is. #​15622 (@​jdx)

  # before
  [bootstrap.macos.dock]
  autohide = true
  
  # after
  [bootstrap.settings.macos.dock]
  autohide = true

Fixed

Lockfiles and installs

• On private GitLab, GitHub and Forgejo releases, mise lock now sends the forge token when it fetches the release's checksum file, such as SHA256SUMS. Before, it fell back to downloading and hashing every archive. On private releases, mise install now also checks downloads against the published checksum. #​15637 (@​jdx, @​rickeyski)
• mise install --locked now rejects a vfox download whose checksum differs from the one in mise.lock. Only sha256 and sha512 are supported. #​15648 (@​jdx)
• mise lock now records artifact bundle URLs and checksums for spm: tools on every requested platform. Before, regenerating mise.lock on one machine dropped the entries for other platforms. #​15646 (@​jdx, @​zunda-pixel)
• If the project's python is a plain release such as 3.12 and isn't installed, mise lock now resolves pypi: dependency graphs with that version instead of the first Python on PATH. If resolution fails, mise keeps the existing lock entry instead of removing it. #​15657 (@​jdx)
• mise uninstall now removes the dangling alias links and the empty tool folder after uninstalling the last version. #​15605 (@​jdx)
• On Windows, http: tools that use shared_extraction and download a raw file now hard link it instead of keeping a second copy. #​15647 (@​jdx)
• With MISE_OFFLINE=1, mise now runs an installed pipx: tool from a GitHub git URL whose repo has no releases. #​15602 (@​jdx)
• mise hook-env no longer reports an npm tool installed from a tarball URL at latest as missing. #​15643 (@​jdx)
• Node's npm wrapper now works when called through a symlink in another directory. #​15664 (@​jdx)
• mise bootstrap no longer leaves a lock file in each formula's Homebrew Cellar rack, which kept uninstalled formulae in brew list. Leftover lock files are removed on the next install. #​15597 (@​jdx, @​SimenB)

Config and environment

• A project's [tool_alias] now overrides a global alias with the same name, for both backends and version aliases. #​15615 (@​jdx)
• minimum_release_age_excludes now accepts [tool_alias] names and exempts the backend the alias points to, whichever name the tool is requested by. #​15638 (@​jdx)
• In the interactive config editor, "Load .env" now writes _.file instead of the deprecated [env.mise] table. #​15640 (@​jdx)
• The hook-env fast path no longer runs fully when unrelated files appear or disappear in ancestor directories. For example, zsh's share_history lock file caused a full run at every prompt. New config files and lockfiles are still picked up. #​15667 (@​jdx)
• On WSL, mise activate and mise hook-env no longer resolve /mnt/<drive> PATH entries. This removes hundreds of milliseconds per prompt when the Windows PATH is appended. #​15665 (@​jdx)
• mise doctor no longer warns about the backend that a packageManager checksum in package.json forces for yarn, npm, pnpm or bun. #​15604 (@​jdx)
• On macOS, task sandbox paths that start with ./, such as allow_read = ["./"], now allow access as intended. #​15599 (@​jdx)

Tasks and completions

• Lua file tasks now recognize --MISE and --USAGE header comments. #​15659 (@​jdx, @​rikonor)
• In a monorepo, shell completion now offers bare root task names, such as test, in addition to :test and //:test. #​15598 (@​jdx)
• After :::, completion now offers task names and then the flags of the next task, not more arguments for the previous one. #​15614 (@​jdx)
• mise cache task '<pattern>' now reads the task cache once instead of once per matching task. With large caches this cuts the time from minutes to seconds. #​15671 (@​jdx)

Documentation

• The docs now explain that global_config_file doesn't hide ~/.config/mise from projects under your home directory. #​15639 (@​jdx)

Full Changelog: jdx/mise@v2026.11.7...v2026.11.8

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.7: : Shorter shim errors, task run history in JSON, and dotfiles safety fixes

Compare Source

When no config selects a shim's tool, the shim now fails with a one-line error, and a new opt-in setting can run the latest installed version instead. mise tasks info --json and mise tasks ls --json now include each task's run history, and vfox plugins that download nothing can install in locked mode. This release also fixes problems in bootstrap packages, dotfiles, tasks, mise exec and config rewrites.

Added

• Shorter shim errors and shims.fallback_to_installed. When no config selects a shim's tool, the error is now one line that names the latest installed version and two ways to use it. Add --verbose to list every installed version. #​15525 (@​jdx)

  mise ERROR No version is set for shim: rg. Run `mise use -g ripgrep@14.1.1` to set a default, or `mise x ripgrep@14.1.1 -- rg` to run it once.
  

  The new shims.fallback_to_installed setting (MISE_SHIMS_FALLBACK_TO_INSTALLED, default false) makes the shim run that latest installed version instead of failing. It only applies to tools that no config mentions. If a configured version is missing, the shim still fails instead of running a different version. Windows .exe shims keep the error.

  mise settings shims.fallback_to_installed=true

• Task run history in JSON output. mise tasks info <task> --json and each entry of mise tasks ls --json now include a history field. It has the same summary as mise tasks history --summary --json: number of runs and failures, median duration, and the last run's duration, status and start time. The field is null for a task with no recorded runs. Text output hasn't changed. #​15522 (@​jdx)

• Locked installs for vfox plugins that download nothing. Some tool plugins download nothing, such as mise-xcode, which selects an Xcode already on the system. These plugins can now set downloads = false in metadata.lua. mise install --locked then installs them without a lockfile URL, and mise lock records only the version. If such a plugin's PreInstall returns a url anyway, the install fails with an error. #​15586 (@​jdx, @​michalpopek)

  PLUGIN = {
    name = "xcode",
    version = "0.1.0",
    downloads = false,
  }

Changed

• Less noise for coding agents. When mise detects a coding agent (for example CLAUDECODE=1 or AI_AGENT), it no longer prints the new-version notice, the mise self-update instructions, or hint messages. mise version --json and the warnings in mise doctor still report a newer version. Set AI_AGENT=0 to see the notices again. #​15523 (@​jdx)

Fixed

Config and upgrades

• mise upgrade --bump and mise use no longer write a registry entry's default options into mise.toml. For example, jactionlint = "2.4.0" no longer turns into { version = "2.5.0", workflow = "release.yaml" }. Options already written in the file are kept. #​15519 (@​jdx, @​jylenhof)
• When mise rewrites a tool entry, boolean and numeric options stay unquoted, so uvx = true no longer becomes uvx = "true". #​15517 (@​jdx)
• If a packageManager field pins pnpm with a checksum, mise now runs pnpm's install script. pnpm 12 can then use its native binary instead of warning that it is running through Node.js. The checksum is still verified. #​15563 (@​jdx)
• mise doctor now warns when a package.json that mise reads as a version file can't be parsed, for example because of a trailing comma. Before, mise ignored the versions in that file without saying why. #​15567 (@​jdx, @​crntnvdl)

Install, lock and exec

• A plain mise install or mise lock now installs missing [plugins] entries first. Idiomatic version files declared by those plugins, such as .xcode-version, are then read on the first run. Before, mise reported "all tools are installed" and a second run was needed. #​15585 (@​jdx, @​michalpopek)
• A non-root mise install no longer fails with "failed to rebuild runtime symlinks" when the user's global config picks a different version than the administrator's system config. mise now leaves the global link in a read-only shared install directory as it is. #​15526 (@​jdx, @​marcodb-servescale)
• mise lock now sends the forge token when it downloads a release asset to compute its checksum. This fixes 401 Unauthorized errors for private or self-managed GitLab, GitHub, GitHub Enterprise and Forgejo releases that publish no digest. #​15556 (@​jdx)
• With mise x -- <cmd>, directories from env._.path now come before tool bin directories even when the caller's PATH already contains them. A project's pinned npm is no longer skipped in favor of Node's bundled one. #​15564 (@​jdx)
• On Windows, mise x and shims no longer keep the caller's stdout pipe open while a detached child process runs. Before, PowerShell captures waited until that process exited, which affected tools like the Nx daemon. #​15583 (@​jdx)

Tasks and daemons

• A task can now use a task template defined in its own project's mise.toml when you run it from a sibling project in a monorepo, for example with mise run //foo:foo_task from bar/. #​15568 (@​jdx)
• mise run <task> -h now asks the task's usage spec whether -h means help. Tasks that set disable_help, declare their own -h flag, or accept -h as a flag value now receive it as an argument. Other tasks still show help. #​15573 (@​jdx)
• File tasks in a subdirectory of the task directory, such as mise-tasks/sub/nested, now resolve {{config_root}} and relative _.file paths in their env against the project root, not the subdirectory. #​15557 (@​jdx)
• mise run --quiet and --silent now hide the startup log lines of daemons that a task starts. #​15588 (@​jdx, @​artemklevtsov)
• If a named daemon port (ports.<name>) collides with a daemon in another checkout, the error now names that daemon and checkout. Before, it named whichever process held the port. mise also warns when a worktree's slot moves one automatic port onto a port the primary checkout uses for another. #​15561 (@​jdx, @​ponko2)

Bootstrap packages

• mise now runs snap list with English messages, so mise bootstrap no longer tries to reinstall snaps that are already installed when the system language isn't English. #​15518 (@​jdx, @​nahoj)
• Casks that generate completions through a wrapper command, such as ngrok, now install. mise expands $HOMEBREW_PREFIX in the wrapper's arguments. #​15562 (@​jdx)
• Casks whose installer creates its own Caskroom directory, such as miniconda, no longer fail with "multiple Caskroom versions". mise now counts only directories that Homebrew has a metadata record for. Before, this error stopped bootstrap for every package. #​15560 (@​jdx)
• Third-party tap formulae that use require_relative, such as brew:gromgit/fuse/sshfs-mac, can now be evaluated and built from source. mise loads them from a checkout of the tap at its pinned commit. Only GitHub taps are supported. #​15572 (@​jdx)

Dotfiles and skills

• Without a terminal and without --yes, mise dot apply now refuses to overwrite copy targets that were edited locally and aren't saved in history. Before, it replaced them without asking, and mise dot undo couldn't restore them. The error points to mise dot diff and --yes. #​15565 (@​jdx, @​nahoj)
• When you apply a directory copy, files that already match their source are no longer rewritten. Their modification times stay the same, and only the [history.reload] commands for files that changed run. #​15558 (@​jdx)
• Dotfiles history no longer gets stuck after a very large mise dot apply. A long commit message used to exceed the OS argument limit. Machines that are already stuck finish the pending operation on their next save. #​15575 (@​jdx)
• A leading ~ in skills.dir or MISE_SKILLS_DIR now expands to the home directory. Before, mise created a directory literally named ~. #​15559 (@​jdx)

Documentation

• A new "Coding agents" docs page explains how to put a project's tools and [env] on an agent's PATH. It includes a one-line Claude Code SessionStart hook that runs mise hook-env and notes on Codex and git worktrees. #​15521 (@​jdx)

Full Changelog: jdx/mise@v2026.11.6...v2026.11.7

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.6: : Pick several tasks with mise run --multi, and use unprefixed bootstrap packages

Compare Source

mise run --multi lets you pick several tasks from a checklist. [bootstrap.packages] keys without a manager: prefix now install through one available package manager, and the npm backend can install from an HTTPS tarball URL. Custom daemons can name several ports, and launchd agents can set resource limits. This release also changes the default prompt theme to base16 and fixes problems with tasks, mise env --dotenv, and installs.

Added

• mise run --multi. Opens the task picker as a checklist. Press Space to check a task, / to filter, and Enter to run the checked tasks. They run as if you had joined them with :::, so they run in parallel unless one depends on another, and -j and the other mise run options still apply. Add --all to list tasks from every project in a monorepo. --multi needs an interactive terminal and can't be combined with a task name, --affected or --tag. #​15503 (@​jdx)

  mise run --multi
  mise run --multi --all

• Unprefixed [bootstrap.packages] keys. A key without a manager: prefix now installs through exactly one manager, so the same config works across distributions and operating systems. mise uses the first manager that is available and allowed by system_packages.managers. The default order is apt, dnf, pacman, zypper, apk, brew, winget, scoop, choco. #​15506 (@​jdx, @​thernstig)

  • The new system_packages.prefer setting (MISE_SYSTEM_PACKAGES_PREFER) replaces that order, and only the managers it lists are considered.
  • Use the new names option when a package has a different name under some managers.
  • mise picks the manager only by which managers are available, not by what their repositories contain. If the install fails, mise reports an error and does not try another manager.
  • If no manager can install a key, mise warns and skips it. mise bootstrap packages status lists it as skipped.
  • Prefixed keys such as "apt:git" work as before.

  [bootstrap.packages]
  git = "latest"
  openssl = { names = { apt = "libssl-dev", dnf = "openssl-devel" } }

• npm tools from HTTPS tarball URLs. The npm backend can now install a package from a tarball URL, such as a pkg.pr.new preview build. Use npm: followed by the full URL as the tool name, for example mise use 'npm:<tarball URL>'. The version is a prefix of the tarball's SHA-256, so latest means whatever the URL serves now, and mise up updates the tool when that content changes. #​15461 (@​jdx, @​kjanat)

  • Only HTTPS URLs work, and the checksum option isn't supported.
  • If the tarball depends on other URL packages, list them in allow_exotic_deps.
  • mise.lock records the version but not a dependency graph.

• Named ports on custom daemons. run and task daemons can now declare several ports in a ports table, as presets and containers already can. Before, mise passed these entries to pitchfork, which ignored them. Each port is exported as <DAEMON>_<NAME>_PORT. A fixed number is used as written. An auto port needs its own base, and each linked worktree gets a different port. Named ports are checked for collisions with other ports. #​15504 (@​jdx, @​ponko2)

  [daemons.stack]
  run = "docker compose up"
  ports.app = { auto = true, base = 8080 }
  ports.db = { auto = true, base = 5432 }
  ports.admin = 9000

• Resource limits for launchd agents. [bootstrap.macos.launchd.agents] entries accept soft_resource_limits and hard_resource_limits. You can now raise launchd's default limit of 256 open files without wrapping the program in a ulimit shell command. The keys are launchd's nine limits in snake case, such as number_of_files and number_of_processes. An empty table, or a soft limit above the hard limit, is an error. Based on @​disintegrator's implementation. #​15509 (@​jdx)

  [bootstrap.macos.launchd.agents.proxy]
  program = "~/.local/bin/proxy"
  soft_resource_limits = { number_of_files = 10240 }
  hard_resource_limits = { number_of_files = 65536 }

• history.lock_wait. Sets how long mise dot commands that change history wait when another history operation is running. Set it in config or with MISE_HISTORY_LOCK_WAIT. The default is 30s, 0 fails immediately, and any value above 1h is treated as 1h. mise dot watch and mise dot recover never wait. #​15498 (@​jdx, @​zachbornheimer)

• Progress in mise upgrade. After installing, mise upgrade checks every tracked config before removing old versions. This step now shows a checking tracked configs progress line, so the command no longer looks stuck. The check is also faster with many tracked configs: with about 930 configs, the same check in mise prune --dry-run dropped from about 12s to 2-4s. #​15489, #​15512 (@​jdx)

Changed

• Default prompt theme is now base16. Interactive prompts, such as the mise run task picker, were hard to read on light terminals that don't set COLORFGBG. The base16 theme now uses the terminal's named colors, and unselected options and help text use the terminal's normal text color. On dark terminals, prompts now look different by default. To keep the previous look, set color_theme = "charm" or color_theme = "auto". #​15494, #​15524 (@​jdx, @​AdrianDC)

Fixed

• Broken TOML task usage. A TOML task whose usage couldn't be loaded, such as a missing include file or a spec that didn't parse, used to break mise tasks --usage, mise generate task-docs and completion for every task. Now mise warns about that task and the others keep working. A broken task that doesn't use its spec, such as one with raw_args = true, still runs. mise tasks validate still reports the error. #​15465 (@​jdx)
• MISE_ORIGINAL_CWD with --cd. Tasks run with -C/--cd or MISE_CD now get the directory where mise was started, not the --cd target. #​15464 (@​jdx)
• Faster task freshness checks. Checking whether a task is up to date no longer reads directories that can't contain its sources or outputs. For example, sources = ["packages/*/src/**/*"] no longer reads every packages/*/node_modules, and mise skips directories excluded by !**/node_modules/**. Tasks still select the same files. #​15499 (@​jdx, @​2chanhaeng)
• mise env --dotenv output can be read back. Values are now quoted and escaped when needed, so values with #, newlines, quotes or $ stay the same when the file is loaded with _.file. Simple values stay unquoted. Tools that don't handle quotes, such as Docker --env-file, read the quotes as part of the value. #​15490 (@​jdx)
• Undefined {{ env.X }} errors. When a template referred to an undefined env field, the error listed the name of every environment variable, including secret names such as *_TOKEN. In an activated shell, mise printed this list at every prompt. The error now names only the missing field and suggests get_env(name=..., default=""). #​15510 (@​jdx)
• Nushell completion with activation. With mise activate nu, pressing Tab after mise now completes mise subcommands and arguments instead of file paths. On Nushell versions before 0.116, flags still need ^mise and the script from mise completion nu --install. #​15505 (@​jdx, @​Deano217)
• Command wrappers during installs. The cargo, npm, pipx and aube backends now run their install commands without command wrappers on PATH. For example, cargo install no longer fails when cargo is wrapped by mbx. mise exec, mise run and ordinary commands still use wrappers. #​15495 (@​jdx)
• cargo: tools with minimum_release_age. With an explicit minimum_release_age and "core:rust" = "stable", cargo: tools failed to install because mise looked for rust@stable instead of the dated Rust version it had installed. #​15460 (@​jdx)
• Date-only release ages for Rust beta and nightly. A date-only minimum_release_age, such as 2026-11-09, now includes rust@beta and rust@nightly builds from that day instead of falling back to the day before. #​15486 (@​jdx)
• packslip: releases in monorepos. In repositories that publish releases for several components, packslip: couldn't find releases listed after another component's releases. A pinned version is now looked up by its tag, and latest searches more of the release history. #​15501 (@​jdx, @​pepicrft)
• Faster GitHub fallback on 5xx errors. When a GitHub release download URL returns a 5xx error, mise now retries the check once, then switches to the API asset URL. Before, it used up all http_retries first, which could take minutes per file. #​15485 (@​jdx, @​csechuan)
• Long cache keys in the http: backend. Installs could fail with File name too long, for example Yarn 2+ from a packageManager with a Corepack checksum. Temporary directory names now stay under the filesystem's name length limit. #​15493 (@​jdx)
• Cleanup after failed installs. Installing a GitHub repo that isn't an asdf or vfox plugin no longer leaves its clone in the plugins directory. The error now suggests the github: backend. A failed install also removes its cache directory. #​15511 (@​jdx, @​gigaimage)
• Homebrew tap casks with zap :not_required. Previewing or installing these casks failed with an ArgumentError. #​15491 (@​jdx, @​cdenihan)

Full Changelog: jdx/mise@v2026.11.5...v2026.11.6

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.5: : mise dot files shows what is tracked in a directory

Compare Source

This release adds mise dot files to show which files in a directory are tracked, and a status.show_env_ignore setting to hide variables from the status line. It also lets dot commands accept relative paths, stops warning when you save dotfiles by hand, and fixes downloads that failed because ~/.netrc held a stale login.

Added

• mise dot files. Lists the files and subdirectories in a directory and shows the state of each one, so you no longer have to work out how [dotfiles] entries, their exclude/include lists and [history] exclude apply. The possible states are:

  • tracked: saved to history. The row shows the entry that covers it and whether it autosaves.
  • excluded: covered by an entry, but a rule leaves it out. The row names the rule.
  • omitted: selected, but capture skips it, for example a file that looks like a credential.
  • untracked: no entry covers it.
  • partial: a directory that isn't tracked itself but contains tracked files.
  • local: a path kept in local-only history (mode = "track-local").

  PATH defaults to the current directory and can be a relative path or a single file. -r/--recursive lists every file below the directory, --tracked and --untracked filter the rows, and --json prints one object per row. The command uses the same exclusion check as mise dot save, so the two always agree. #​15456 (@​jdx, @​farangkao)

  $ mise dot files ~/.config
  untracked  cache/
  partial    foot/   1 file tracked below
  tracked    hypr/   1 file · ~/.config/hypr (track, autosave)
  untracked  mise/

• status.show_env_ignore. With status.show_env on, mise lists every variable it sets each time you enter a directory, including variables that never change. This new setting takes variable names or shell globs to leave out of that line. You can also set it with MISE_STATUS_MESSAGE_SHOW_ENV_IGNORE as a comma-separated list. Changes to config files and paths are still shown. mise warns about malformed patterns and ignores them. #​15454 (@​jdx)

  [settings.status]
  show_env = true
  show_env_ignore = ["GO*", "DENO_INSTALL_ROOT"]

  With this config, mise +DENO_INSTALL_ROOT +GOBIN +GOROOT +LUA_INIT becomes mise +LUA_INIT.

Fixed

• Relative paths in mise dot commands. mise dot track config.toml used to fail with target must be absolute or start with ~/. track, untrack, add and edit now resolve relative paths from the current directory the way a shell does, including .. after a symlinked directory. A path inside your home directory is saved in its ~/ form. Exclude and include rules are still relative globs. #​15455 (@​jdx, @​farangkao)
• No warning when saving dotfiles by hand. If you haven't set up the history-watch service, mise dot track now prints an info message about saving with mise dot save instead of a warning, so --quiet hides it. mise dot status now lists automatic capture as manual, without a warning or a suggested next step. mise still warns if the watcher is set up but not running, or if captures fail. #​15455 (@​jdx, @​farangkao)
• 401 errors caused by stale ~/.netrc credentials. Some downloads failed with 401 Unauthorized even though the server would serve the file without logging in. For example, mise install glab failed against gitlab.com when ~/.netrc held a login that gitlab.com no longer accepted. If the only credentials came from netrc and the server returns 401, mise now retries once without them. Later retries of the same download also leave them out. Requests that carry their own Authorization header (such as forge tokens) and requests redirected to another host are not retried this way. #​15451 (@​jdx)

Full Changelog: jdx/mise@v2026.11.4...v2026.11.5

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.4: : zip:: includes for config and tasks

Compare Source

Config and task includes can now load from zip:: archives over HTTP(S). This release also fixes shim tab completion, [tool_alias] handling in enable_tools/disable_tools and mise prune, mise dot sync conflicts, and ufw firewall rule matching in mise bootstrap.

Added

• zip:: includes for config and tasks. Before, include and task_config.includes accepted local paths, git:: and oci:: sources. They now also accept a zip archive served over HTTP or HTTPS. mise downloads and unpacks the archive, then loads it the same way as an oci:: artifact. For task_config.includes it loads executable file tasks and .toml task files. For include it loads the mise.toml at the archive root. Zip entries don't reliably carry file permissions, so mise makes non-TOML files that start with a shebang executable. #​15439 (@​jdx)

  • Only HTTP and HTTPS URLs are accepted. Any other scheme fails with an error.
  • Task includes are still experimental, like the other remote sources.
  • A URL doesn't pin specific contents. mise refreshes a zip config include the way it refreshes a branch (fetch_remote_versions_cache), and paranoid mode rejects zip config includes.

  # replace <URL> with the archive's HTTP(S) URL
  include = ["zip::<URL of platform-config.zip>"]
  
  [task_config]
  includes = ["zip::<URL of shared-tasks-1.0.0.zip>"]

Fixed

• Tab completion through shims. Completing a command for a tool run through a mise shim (such as aube or pitchfork) showed mise's own subcommands instead of the tool's. mise now answers completion requests only when it is invoked as mise. Under a shi

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (8f2a772) to head (0dd2d46).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #735   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          110       110           
  Lines        18547     18547           
  Branches      1587      1602   +15     
=========================================
  Hits         18547     18547           

Flag	Coverage Δ
integration	30.68% <ø> (ø)
unittest	94.95% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.