[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
jdx/mise	uses-with	patch	v2026.10.14 → v2026.10.24

---

Release Notes

jdx/mise

v2026.10.24: : Container daemons, append-position PATH entries, and extra CA certificates

Compare Source

Experimental daemons can now run container images with Docker or Podman, and named preset ports can get their own port per worktree. This release also adds position = "append" for env._.path, an extra_ca_certs setting for TLS-inspecting proxies, and a registry_index option for locking pypi: tools. It fixes several lockfile, PyPI, Homebrew and task issues.

Added

• Container images as daemons (experimental). A custom daemon with an image key runs through docker run or podman run. It supports ports, readiness checks, depends, the proxy and mise daemons logs, just like other daemons. Every port is published on 127.0.0.1 only. Containers are named per project and worktree, so two checkouts never clash, and a stale container left behind by a killed run is removed before the next start. runtime = "auto" (the default) uses docker if it is on PATH, otherwise podman. You can set MISE_CONTAINER_RUNTIME to use any Docker-compatible CLI. data_mount bind-mounts a per-checkout data directory, and ready_cmd can use {{ runtime }}, {{ container }} and port placeholders. Limitations: mise does not pull or build images or start the Docker/Podman service, only TCP ports are supported, and starting a container daemon on Windows fails. #​15182 (@​jdx)

  [daemons.cockroach]
  image = "cockroachdb/cockroach:v25.1.0"
  command = ["start-single-node", "--insecure"]
  port = { auto = true, base = 26257 }
  ports.http = { container = 8080, auto = true, base = 27000 }
  data_mount = "/cockroach/cockroach-data"
  ready_cmd = "{{ runtime }} exec {{ container }} cockroach sql --insecure -e 'select 1'"

• Per-worktree named ports for daemon presets. Named preset ports such as http_port on cockroachdb or monitor_port on nats now accept { auto = true, base, stride }, just like the primary port. Each linked worktree adds its slot to the port's own base. Before, these ports were either fixed or offset from the preset default. When base is omitted, it defaults to the preset's port. Integer overrides still work as before. mise now reports a load error if an auto named port collides with another daemon's port in the same project. #​15181 (@​jdx)

  [daemons.cockroach]
  preset = "cockroachdb"
  version = "26"
  port = { auto = true, base = 26258 }
  ports.http_port = { auto = true, base = 27000 }

• position = "append" for env._.path. Appended entries go after tool paths and before the inherited PATH. This lets directories like ~/bin or ~/.cargo/bin stop shadowing tools that mise installs. The default is still "prepend". #​15158 (@​jdx, @​Mossop)

  [env]
  _.path = [
    "bin",
    { path = ["~/bin", "~/.cargo/bin"], position = "append" },
  ]

• extra_ca_certs setting. extra_ca_certs (MISE_EXTRA_CA_CERTS) points to a PEM bundle that mise trusts in addition to its usual roots, on every platform. Use it when you're behind a traffic-inspecting proxy such as Socket Firewall. It covers mise's own HTTP requests: downloads, version lookups, GitHub API calls, attestation checks and vfox plugins. Programs that mise runs, such as git and uv, keep using their own certificate settings. You can set it only in the environment or in global config. The path must be absolute or start with ~/. If the bundle is unusable, mise warns and keeps its usual roots. #​15171 (@​jdx, @​abjectnotfound)

  MISE_EXTRA_CA_CERTS=/etc/ssl/proxy-ca.pem mise install

• registry_index for pypi: tools. Set registry_index = "priority" to search a per-tool registry_url before PyPI when locking. This works for registries that host only your own packages, such as Gitea/Forgejo, pypiserver or a static index. The tool always comes from the registry, and only packages the registry doesn't have fall back to PyPI. The default, "default", keeps the current behavior: the registry replaces PyPI. #​15157 (@​jdx)

  [tools]
  "pypi:black" = { version = "25.9.0", registry_url = "<your-registry>/api/packages/org/pypi/simple/{}/", registry_index = "priority" }

• secret() in merge = "missing" dotfile entries. Tera templates in these entries can now call secret(). mise asks only for the secrets of keys missing from the target, so you can add a key to a private config later without entering the existing ones again. mise dot status and mise dot diff never read or prompt for a secret. Enforced merge = true entries still can't use secret(). #​15168 (@​jdx, @​thernstig)

• Danger Swift libraries. The danger-swift registry entry now uses Danger's official installer, so libDanger and the Swift modules are installed with the executable. You still need to install Node and Danger JS separately. #​15120 (@​Mostafa-Ashraf97)

Fixed

• Lockfiles
  • mise upgrade now updates every lock entry of a tool that is declared in more than one config file, such as config.toml and a conf.d fragment. Before, the old entry stayed in the lockfile and mise outdated kept offering the same upgrade. #​15164 (@​jdx, @​eliebleton-manomano)
  • http: tools with a file:// URL and no checksum install and lock again under the default lockfile_mode = "generate". mise now hashes the local file directly. #​15180 (@​jdx, @​hcrosse)
  • mise install no longer exits 1 when a git task include can't be loaded, for example a private repository in CI. It warns and leaves the lockfile unchanged. An explicit mise lock still fails. #​15166 (@​jdx)
• PyPI / pipx
  • mise lock now locks a pypi: tool's dependency graph with the selected Python, even when that Python isn't on PATH. If a per-tool python isn't installed yet, uv may download it for resolution only, unless offline is set. #​15153 (@​jdx)
  • Tools from registries that publish no upload times can now have their dependency graph locked when minimum_release_age is set. Dependencies still respect the cutoff. #​15159 (@​jdx)
  • Repos that lock the same tool and dependencies on different days now share one install instead of each creating its own copy. Each affected tool gets one new install the first time you install it after upgrading. #​15179 (@​jdx, @​tecnobrat)
• Homebrew
  • Source builds of tap formulae whose post_install uses Homebrew's MachO no longer fail. These steps are skipped with a warning. #​15152 (@​jdx)
  • install_symlink with a relative source, such as bin.install_symlink "foo" => "bar", now resolves against the target directory, as Homebrew does, instead of failing with different prefix. #​15173 (@​waynehoover)
  • Cask postflight hooks that use staged_path can now access the binary payload. This fixes installs such as brew-cask:dynatrace-oss/tap/dtctl. #​14837 (@​azohra)
• Tasks
  • A remote file task (one whose file is an HTTP URL) with its own env no longer fails with exit 127 when it runs as a sub-task or dependency. #​15178 (@​jdx)
  • mise now accepts comments in turbo.json, which is parsed as JSONC, and in global.json, which still rejects trailing commas. Before, a commented turbo.json printed a warning on every run and its task suggestions were dropped, and a commented global.json broke dotnet version detection. #​15141 (@​jdx)
• mise prune no longer removes tool versions that tasks still need when those tasks come from task_config.includes files, default task directories, or executable scripts with #MISE tools=.... #​15156 (@​jdx)
• latest for gem: tools no longer resolves to a RubyGems prerelease such as 4.1.0.beta3. To get prereleases, request one explicitly or set MISE_PRERELEASES=1. #​15143 (@​dennmart)
• When the active version doesn't provide a shim's executable, the error now names that version and the config that set it, and lists the installed versions that do provide it. Before, mise said "No version is set" and suggested switching versions with mise use -g. #​15165 (@​jdx, @​mzagaja)
• mise upgrade and mise outdated no longer say "All tools are up to date" when a version lookup fails. They now list the tools they could not check. #​15171 (@​jdx, @​abjectnotfound)

Changed

• Homebrew formulae are now resolved from the bulk formula.json index, with caching for tap metadata and cask evaluations. In one large setup, warm mise bootstrap packages upgrade --dry-run dropped from about 7.7s to 3.7s, and status from about 4.0s to 1.5s. The first run on a machine downloads the index once. #​15183 (@​waynehoover)

Deprecated

• lockfile_mode = "merge" is deprecated in favor of the default generate mode. Nothing changes yet. mise will start warning in 2027.4.0, and the mode will be removed in 2027.10.0. To migrate, delete the lockfile_mode = "merge" line (or unset MISE_LOCKFILE_MODE=merge). #​15184 (@​jdx)

Documentation

• The dotfiles docs now show how to use profile variants to apply an entry only when several environments are active. #​15154 (@​jdx, @​miroslavkrysl)

New Contributors

• @​nurazon59 made their first contribution in #​15167
• @​Mostafa-Ashraf97 made their first contribution in #​15120
• @​dennmart made their first contribution in #​15143

Full Changelog: jdx/mise@v2026.10.23...v2026.10.24

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.23: : Dotfile groups can apply edits, INI merges, and fnox-stored dotfiles

Compare Source

Dotfile groups can now carry block, line and merge edits, merge entries work on INI files, and mode = "fnox" deploys files kept encrypted in fnox. mise secrets also no longer lets a project grant itself keys from your personal fnox config. The rest of the release adds compact-index version listing for gem sources such as GitHub Packages, plus fixes for uninstall, lockfiles, command wrappers, Windows and MSYS2.

Added

• Edits inside dotfile groups. A [dotfile_groups.<name>.entries] table can now hold block, line and merge edits alongside whole-file entries. These edits apply only on machines that select the group in [bootstrap] dotfile_groups. Before, edits had to live under [dotfiles], which applies on every machine. Edit entries use the <path>/<id> key form, and a relative source starts at the group root. The edited file must be inside the group's target. Deselecting a group leaves the content its edits already wrote. #​15131 (@​jdx, @​thernstig)

  [dotfile_groups.common]
  root = "common"
  mode = "copy"
  
  [dotfile_groups.common.entries]
  "~/.config/mise/conf.d/private.local.toml/defaults" = { source = "../templates/private.toml", merge = "missing", permissions = "0600" }

• Dotfile merges into INI files. A merge entry can now set keys in INI files such as pip.conf, tox.ini and setup.cfg. Changed keys are replaced in place, new keys go into their section, and missing sections are added at the end of the file. Comments, other keys, indentation, CRLF line endings and a BOM are all kept. Targets ending in .ini are detected automatically. For any other file name, set format = "ini". Parsing follows Python's configparser, and a target that doesn't parse is reported and left unchanged. This change also fixes merges in any format whose target is a symlink to its own source: if the source fails to parse, mise now keeps the link instead of replacing it with a copy. #​15135 (@​jdx, @​Mossop)

  [dotfiles]
  "~/.config/pip/pip.conf/shared" = { source = "pip/shared.conf", merge = true, format = "ini" }

• mode = "fnox" for dotfiles containing secrets. This entry writes the file that fnox stores for the target path, so files like ~/.npmrc or ~/.kube/config stay out of your dotfiles repository. It requires fnox 1.44.0 or newer on PATH. Files are written with mode 0600 unless permissions says otherwise. mise dot edit runs fnox edit --file. mise dot diff never prints the content, and dry runs never call fnox. mise dot unapply removes the target only while it still matches what fnox stores, unless you pass --force. mise oci build skips these entries. One limitation: mise dot rollback journals the previous plaintext in the local state directory. Only UTF-8 text files are supported. #​15134 (@​jdx, @​owpac)

  fnox set --file ~/.npmrc

  [dotfiles]
  "~/.npmrc" = { mode = "fnox" }

• Gem sources without the JSON versions API. If a gem source returns 404 for api/v1/versions/<gem>.json, mise now lists versions from the source's compact index (info/<gem>), the same file Bundler uses. As a result, latest, version prefixes, mise outdated and mise upgrade work for gems from GitHub Packages (rubygems.pkg.github.com/<org>) and similar registries. GitHub Packages doesn't publish release dates, so minimum_release_age can't filter its versions. A 401 from GitHub Packages now comes with a hint about the read:packages token scope. #​15122 (@​waynehoover)

Fixed

• mise uninstall ruby 3.4.1 no longer removes ruby@3.4.12 when 3.4.1 isn't installed. A version now matches only when it equals the query or continues it after ., - or +, the same way mise matches versions elsewhere. #​15116 (@​jdx, @​Aqualon)
• mise ls now shows lazy tools that haven't been installed as a dimmed (lazy) instead of a red (missing). A bare mise upgrade no longer lists them among the tools it resolves. mise ls --json still reports "installed": false, and mise ls --missing still includes them. #​15114 (@​jdx)
• Installing a packageManager entry with a checksum (for example pnpm@11.7.0+sha512...) no longer forces every later install of that tool onto the npm backend. Installs that an earlier version already pinned recover on their next install. #​15124 (@​jdx, @​foobear)
• A command run through a [wrappers] entry now still goes through other wrappers. For example, node run from a wrapped pnpm now gets the node wrapper's args and env. A wrapper is skipped only for its own nested calls, and that skip is tracked in __MISE_ACTIVE_WRAPPERS. #​15126 (@​jdx)
• Locked installs inside a dotfiles checkout that is linked into your global config, such as ~/.config/mise/conf.d/dotfiles -> ~/dotfiles, no longer fail with "No lockfile URL found". The checkout's mise.lock is now trusted as global config. A project mise.toml that symlinks to your global config still can't vouch for the project's lockfile. #​15130 (@​jdx, @​soodoh)
• When ~/.config/mise is a symlink into a dotfiles repository, mise lock --global writes npm and Python sidecars to locks/ again instead of .mise/locks/. Existing pointers are rewritten on the next lock. You can delete the old .mise/locks/ directory by hand. #​15125 (@​jdx)
• When a backend (cargo, go, gem, pipx, ...) runs a program that isn't on PATH, the error now names it, for example `cargo` not found. Before, it only said "No such file or directory". #​15119 (@​jdx, @​Mossop)
• Under MSYS2, Git Bash and Cygwin, mise activate for bash, zsh and fish now exports MANPATH in POSIX form, so man can use it. Empty entries are kept so man still uses its default paths. #​15117 (@​jdx, @​PTechoueyres-mic)
• On Windows, mise self-update retries for about 6 seconds when antivirus briefly locks mise.exe. If replacing the binary fails after the old one has been moved aside, mise copies the new binary into place, so the install directory is never left without mise.exe. #​15138 (@​jdx)

Changed

• mise dot status and mise dot sync no longer start one git process per tracked file. In one test with about 860 tracked files, a warm mise dot status dropped from about 7s to 1.4s. Output is unchanged. #​15127 (@​waynehoover)
• The README has been rewritten. It now shows a full mise.toml example up front, an updated quickstart, a table of everyday commands, and a section on mise bootstrap. #​15136 (@​jdx)

Security

• Projects can no longer grant themselves your personal fnox keys. A key defined in fnox's global config, or in a fnox.toml in or above $HOME, now counts as yours rather than the project's. If a task's secrets list or a {{ secrets.NAME }} reference names such a key, the task fails before any secret is resolved. The error names the file that defines the key. --secrets-all leaves these keys out, while mise run --secrets NAME and mise x --secrets NAME still pass them because you named them yourself. mise secrets ls and mise tasks validate report these grants as problems of kind personal. To give a key to the project, define it in the project's fnox.toml. This needs a fnox release that reports where each key is defined. With older fnox, behavior is unchanged. mise secrets is still experimental. #​15133 (@​jdx)

Full Changelog: jdx/mise@v2026.10.22...v2026.10.23

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.22: : Project-scoped uninstall, JSONC dotfile merges, and node@lts moves to Node.js 26

Compare Source

You can now uninstall only the tools the current project requests, and new --no-global and --project flags replace the two different meanings --local had. Dotfiles can merge into JSONC files like VS Code's settings.json and can seed a file once without overwriting later edits. node@lts now resolves to Node.js 26. The rest of the release adds an ipv4_only setting, JSON output for mise vars, and fixes for Windows, lockfiles, pruning and GitHub release listing.

Added

• mise uninstall --project and mise ls --project. mise uninstall --project removes the installed versions requested by the nearest project's config files: mise.toml, mise.local.toml, conf.d fragments, .tool-versions and idiomatic version files in that directory. Config in parent directories and global config is not included. It lists each version with the file that requests it and asks before removing anything. --yes skips the prompt, and --dry-run only shows the list. mise ls --project lists the same scope. Installs are shared between projects, so another project using the same version will need to reinstall it. #​15079, #​15081 (@​jdx, @​httpete-broadcom)

  $ cd ~/work/app            # ~/work/mise.toml also exists
  $ mise ls --no-global      # app's config and ~/work's, not the global config
  $ mise ls --project        # app's config only
  $ mise uninstall --project # removes the versions app's config names, after asking

• --no-global on ls, outdated, upgrade and tasks ls. It selects tools or tasks from all non-global config, including parent directories, and does what --local did on these commands. #​15081 (@​jdx)

• Dotfile merges into JSONC files. A merge entry can now edit files that contain comments and trailing commas, such as VS Code's settings.json. It keeps the file's comments, indentation and any keys the source doesn't set. .jsonc targets are detected automatically. For other files, set the new format key (json, jsonc, toml or yaml). A .json target without format is still parsed as strict JSON. Merge sources that fail to parse now report the file path and the parse error. #​15077 (@​jdx, @​TimonLukas)

  [dotfiles]
  "~/.config/Code/User/settings.json/shared" = { source = "vscode/shared.json", merge = true, format = "jsonc" }

• create_if_missing for dotfiles. copy, template and inline content entries with create_if_missing = true write the target only when nothing exists there. After that, local edits are left alone and do not count as drift in mise dot status or mise dot diff. If you delete the target, the next apply creates it again. This works for files that are filled in on each machine, such as local tokens. #​15080 (@​jdx, @​thernstig)

  [dotfiles]
  "~/.config/mise/conf.d/private.local.toml" = { source = "templates/private.toml", mode = "copy", permissions = "0600", create_if_missing = true }

• permissions on dotfile merge entries. The mode is applied only when the merge creates the file. Files that already exist keep their mode. Merge entries for the same file must not set different modes. #​15087 (@​jdx, @​thernstig)

• ipv4_only setting. Set ipv4_only = true (or MISE_IPV4_ONLY=1) for networks where a host fails over IPv6, for example dl.google.com returning 404 or Sigstore TUF fetches failing. This applies to mise's own HTTP connections: downloads, version lookups, GitHub API calls, attestation verification and vfox plugins. External programs such as git, npm and the npm: backend's package manager still use the system resolver. The default is false. #​15057 (@​jdx, @​Alby02)

• mise vars --json and --json-extended. Prints vars as JSON. --json-extended also includes the file each value comes from. Redacted values stay [redacted]. #​15069 (@​jdx, @​artemklevtsov)

• mise shell --unset --all. Removes every MISE_<TOOL>_VERSION override from the current shell in one command, including ones you exported by hand. #​15088 (@​jdx, @​wfouche)

• Bootstrap hook descriptions. A hook table can set description, and mise bootstrap prints it instead of the hook's script. Without a description, mise prints $ followed by the command's first line, cut to the terminal width. --verbose and --dry-run still print the full script. #​15106 (@​jdx, @​owpac)

  [bootstrap.hooks.final]
  description = "Remove the root copy of pam_reattach if Homebrew removed the module"
  run = "..."

• Debian packages from the mise APT repository now include Bash, Zsh and Fish completions. #​15074 (@​gilesw)

• Registry: added an aqua backend for oxfmt. #​15092 (@​scop)

Changed

• node@lts now resolves to Node.js 26, which entered Active LTS on 2026-10-28. It used to resolve to 24. lts/lithium (also lts-lithium) selects the 26.x line. Aliases for older lines, such as lts/krypton, are unchanged. To stay on Node.js 24, pin node@24 or node@lts/krypton. #​15105 (@​jdx)
• Setting system_packages.elevate_with = "" now means "never elevate": package manager commands run as the current user. This helps on hosts without root, such as Termux. Before, an empty value fell back to sudo, run0 or doas. If the setting is unset, mise still picks an elevator from PATH. #​15049 (@​jdx, @​iliqiliev)

Deprecated

• --local on ls, outdated, upgrade and tasks ls is deprecated in favor of --no-global. It still works and prints no warning for now. Warnings start in 2027.1.0, and the flag is removed in 2027.7.0. settings --local and lock --local are not affected. #​15081 (@​jdx)

Fixed

• On Windows, background tool updates started from the shell prompt no longer open a visible console window for each tool. #​15038 (@​yusoofsh)
• mise prune and automatic upgrade pruning used to keep every version of a tool while a process started through a runtime link such as installs/claude/latest was running. They now keep only the version that process is running, so long-running sessions no longer stop old versions from being cleaned up. #​15113 (@​jdx)
• mise install pipx:<tool> no longer fails with missing lockfile entry when lockfile_platforms lists only the current platform. #​15091 (@​jdx, @​drewbitt)
• When api.github.com times out (5xx) listing releases for repositories with many assets per release, such as github:be5invis/Iosevka, mise now retries with smaller pages of 30 and then 10 releases instead of failing. #​15078 (@​jdx)
• mise version --json no longer reports a latest older than the running version, which happened with fresh or nightly builds because of minimum_release_age. #​15068 (@​jdx)
• mise backends switch no longer fails with No such file or directory when the locks/ directory next to it exists but is empty. Rollback after a failed switch also restores sidecar directories more reliably. #​15060 (@​zeitlinger)
• Packages from a custom aqua registry whose names are not in owner/repo form no longer print invalid aqua tool repeatedly. A name that no registry defines still fails with package not found. #​15048 (@​jdx, @​trothwell)
• A version file that links to a sibling version file, such as .nvmrc -> .node-version, no longer prints a not reading warning. Links to other files are still not read and still warn. #​15058 (@​jdx, @​owpac)
• Packslip versions held back by minimum_release_age or --before are now logged at debug level instead of printing one warning per version. #​15056 (@​jdx, @​owpac)
• Gem wrapper scripts now quote GEM_HOME and the executable path, so gems work when the install directory contains spaces or shell metacharacters. #​15055 (@​jdx)
• Remote git sources (HTTPS and SSH) now reject a ref that is empty, is HEAD, or starts with -. This stops option injection into git, and these sources now follow the same rules as plain git repo sources. #​14832 (@​Huge)

Documentation

• The secrets docs now note that reads through the fnox daemon require fnox 1.43.0. #​15115 (@​jdx)

New Contributors

• @​yusoofsh made their first contribution in #​15038
• @​gilesw made their first contribution in #​15074

Full Changelog: jdx/mise@v2026.10.21...v2026.10.22

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.21: : Easier dotfiles setup from a checkout or Stow packages, plus prune --force for casks

Compare Source

You can now keep mise's global config inside your dotfiles checkout, and deploy Stow-style packages without writing a table for each one. Dotfiles also get new protections for template entries, and mise bootstrap packages prune can force-remove casks it cannot prove are unchanged. The rest of the release fixes bugs in monorepos, lockfiles and pypi locking.

Added

• Bootstrap from a dotfiles checkout with --config-dir. mise bootstrap --from accepts --config-dir <path>. It links mise's config directory (~/.config/mise, or wherever XDG_CONFIG_HOME/MISE_CONFIG_DIR point) to that path inside the checkout, then bootstraps from it. config.toml, config.<env>.toml, conf.d/ and miserc.toml in the repository all act as global config from the first run. After that, git -C ~/.dotfiles pull && mise bootstrap is enough, and mise use -g and mise dot add write into the checkout.

  mise bootstrap --from <dotfiles-git-url> --from-dir ~/.dotfiles --config-dir .config/mise

  The path must stay inside the checkout. The existing config directory must be missing, empty, or already that link; mise refuses anything else and leaves it alone. --dry-run creates no link. The docs now recommend mise dot track ~/.config/mise, which tracks the whole config directory rather than only config.toml. Files ending in .local.toml stay on each machine. #​15025 (@​jdx, @​lhs-12, @​Mossop)

• Stow packages need no [dotfile_groups] tables. If a name in [bootstrap] dotfile_groups has no matching table but is a directory under dotfiles.root, mise treats it as a group with the default settings: that directory is deployed into ~ file by file. A table with the same name still overrides the defaults. mise dot add --group, mise dot unapply --group and orphan reporting work for these groups too. #​15025 (@​jdx, @​lhs-12, @​Mossop)

  [bootstrap]
  dotfile_groups = ["kitty", "nvim", "zsh"]

• mise bootstrap packages prune --manager brew-cask --force. This removes mise-installed casks that prune skips because it cannot prove they are unchanged, such as self-updating apps, casks with install steps, and casks installed before mise recorded prune metadata. Without --force, prune now lists which casks --force would remove. A forced prune removes only what the receipt recorded and only while it is still where mise put it. It still skips casks Homebrew owns, casks without a mise receipt, interrupted installs and shared targets. Use --dry-run to preview. #​14985 (@​jacobbednarz)

• mise dot apply warns before overwriting an edited template target. If you edited a rendered template target by hand since mise last wrote it, apply now warns that the edit will be overwritten and names the source to move it into. apply still overwrites the file, so unattended runs are not blocked. #​15020 (@​jdx, @​owpac)

• Registry: tuios (aqua:Gaurav-Gosain/tuios). #​14990 (@​Gaurav-Gosain)

Fixed

• Dotfiles
  • mise dot add on a mode = "template" entry now refuses by default. Before, it copied the rendered file over the template source, which deleted the template code and could write secrets pulled in with exec() into your repository in clear text. If you really want to capture the rendered file, pass --force. #​15019 (@​jdx, @​owpac)
  • Switching from Stow no longer destroys source files. When Stow had linked a whole directory into the source, symlink-each apply failed, and the suggested --force replaced each source file with a link to itself. Apply now replaces the folded link with a real directory of links, without needing --force. #​15025 (@​jdx, @​lhs-12, @​Mossop)
  • mise bootstrap --adopt --dry-run now previews the whole config directory, including conf.d/, config.<env>.toml and this machine's miserc.local.toml. Before, it only previewed config.toml. #​15025 (@​jdx, @​lhs-12, @​Mossop)
• Config and monorepos
  • With monorepo.config_roots = [".", "child"], a child with no tool overrides lost the tools it inherits from the root config and fell back to global versions. This broke mise install --monorepo --locked. Each declared root now loads its full config hierarchy. #​15023 (@​jdx, @​swizzlr)
  • Running mise run //app:task from the monorepo root with MISE_LOCKED=1 now looks up idiomatic version files such as app/.node-version in app/mise.lock, not the root lockfile. #​15021 (@​jdx)
  • When .nvmrc is a symlink to .node-version, the .node-version file is read again. mise still skips .nvmrc with a warning, but that skip no longer hides .node-version. Before, the directory resolved no Node version (regression in 2026.10.19). #​15006 (@​jdx, @​jjb)
• Lockfiles
  • mise lock now re-resolves platform entries whose URL points to a different release than the locked version. This happens, for example, after Renovate bumps the version in mise.lock. Before, mise lock left the old URL and checksum, and mise install --locked then refused the lockfile. #​15010 (@​jdx)
  • A mise lock sweep with no tool arguments no longer aborts when a pypi:/pipx: tool sets uvx_args or pipx_args. That tool gets a warning and a version-only lock entry. Naming the tool explicitly still errors. #​15030 (@​jdx)
  • For pypi: tools, mise lock now checks that the resolved uv dependency graph can actually be installed with uv sync --frozen --no-build. If it can't, for example because a dependency has no wheel for the interpreter, mise warns and keeps a version-only entry. Before, mise wrote a graph that the next mise install failed on. #​15031 (@​jdx)
• Other
  • mise doctor no longer lists uninstalled lazy = true tools as problems. The toolset list marks them (lazy), and --json adds "lazy": true. #​15024 (@​jdx)
  • packslip: installs on shared CI runners no longer fail when raw.githubusercontent.com returns a 429. mise now asks mise-versions whether a repository publishes a release list, and falls back to GitHub when the mirror is unavailable, use_versions_host is off, or a url_replacements rule applies. #​15032 (@​jdx)
  • SmolVM (smol-machines/smolvm) installs through aqua again. mise now rewrites the absolute symlinks in its guest root filesystem as relative links inside the install directory. Links that escape the install directory are still rejected. #​15015 (@​jdx)

New Contributors

• @​Gaurav-Gosain made their first contribution in #​14990

Full Changelog: jdx/mise@v2026.10.20...v2026.10.21

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.20: : Chocolatey packages, systemd user units, and version_regex for release tags

Compare Source

Bootstrap can now install Windows packages with Chocolatey, manage systemd user units that a package already ships, and register launchd launch events. Release-based backends can filter tags with version_regex, and mise completion supports Nushell. The rest of the release fixes lockfile, OCI, dotfiles, shim and Windows bugs.

Added

• Chocolatey package manager for bootstrap. You can declare choco: packages in [bootstrap.packages] next to winget and scoop. Chocolatey installs packages machine-wide, which covers tools like Docker Engine and the Visual Studio build tools. It only works on Windows when choco is on PATH, and choco: entries are skipped on other platforms. status works without elevation, but apply and upgrade need an elevated terminal. Mise treats reboot-required exit codes (1641, 3010) as success and prints a warning. state = "absent", import and prune are not supported yet. #​14978 (@​jdx)

  [bootstrap.packages]
  "choco:git" = "latest"
  "choco:visualstudio2022buildtools" = "117.12.0"

• Manage existing systemd user units from [bootstrap.services]. On Linux, an entry with scope = "user" and no command or builtin now manages a unit that already exists, such as one installed by a package. Mise runs systemctl --user against that unit and does not write a dev.mise.* unit. state, enabled and masked work the same way as for system services. Options that define a service, such as command, environment or restart, are rejected for these entries. Before, this configuration was always an error. Now, if you leave out command by mistake, mise reports a missing unit. #​14980 (@​jdx)

  [bootstrap.services.gnome-keyring-daemon]
  scope = "user"
  state = "running"
  enabled = true

• launchd launch events. macOS LaunchAgents defined in bootstrap can now set LaunchEvents, for example to react when a USB device is added or removed. #​14992 (@​deecewan)

• Let Homebrew manage casks that mise installs. With homebrew_metadata = true under [bootstrap.brew], mise writes Homebrew's cask metadata after it installs a brew-cask package. brew upgrade, brew outdated and brew doctor then recognize the cask, and from then on mise leaves it to Homebrew. This is off by default. #​14929 (@​jdx, @​owpac)

• version_regex tool option for github, gitlab and forgejo backends. Only release tags that match the regex are listed, resolved or installed. This helps with repositories that publish releases that aren't versions of the tool. If you also set version_prefix, a tag must start with the prefix and match the regex. An invalid pattern is reported as an error. The registry also adds blaze, which uses this option. #​14984 (@​jdx)

  [tools]
  "github:indexable-inc/blaze" = { version = "latest", prerelease = true, version_regex = '^(v\d+\.\d+\.\d+|nightly)$' }

• Nushell completions. mise completion nu (or nushell) now works, including --install. #​14999 (@​jdx, @​briankchan)

  mise completion nu > ~/.config/nushell/completions/mise.nu

• Templates in settings.dotfiles.root. For example, root = "{{ mise_config_dir }}/home" now resolves to a real path. Before, the template text was used as a literal path. A relative result resolves against the config root. #​14969 (@​jdx, @​ponko2)

• jactionlint in the registry now prefers the packslip backend, then aqua, then github. #​14947 (@​sahidvelji)

Changed

• system_packages.elevate_with is now a global-only setting. This setting names the program mise runs instead of sudo. Now only global config or MISE_SYSTEM_PACKAGES_ELEVATE_WITH can set it. If a project's mise.toml sets it, mise ignores the value and prints the usual warning. #​14972 (@​jdx)
• mise self-update no longer replaces a mise that WinGet installed, because updating it in place breaks WinGet's management of the package. Instead, mise tells you to run winget upgrade jdx.mise. --force and MISE_SELF_UPDATE_AVAILABLE=true still override this. #​14977 (@​jdx)
• If a project config sets write_targets.*, mise now warns that the value is ignored only when a write would have used it (mise use --global, mise dot add, ...). The warning names the file that mise writes to instead. The bootstrap docs also have a new section on keeping global config in a dotfiles repository. #​14973 (@​jdx)

Fixed

• Lockfiles
  • mise lock can now add tools that are missing from the lockfile when tool_config.locked = true. Before, it failed with an error telling you to run mise lock. This affected Renovate bumps, for example. #​15003 (@​jdx, @​staticaland)
  • mise lock no longer resolves a tool, or warns about it, for platforms that the tool's os option excludes. #​14959 (@​jdx)
  • When the global config directory is a symlink, npm sidecars now stay in one location. Before, they switched between locks/ and .mise/locks/ depending on the working directory. #​14961 (@​jdx)
  • When mise lock or auto-locking downloads a vfox artifact, it now sends the headers from the plugin's PreInstall hook. Before, private artifact repositories returned a 401. The headers go only to the plugin's origin and are never written to mise.lock. #​15002 (@​jdx, @​carlosemart)
  • For a stale backend lock entry in the global lockfile, the warning now suggests mise backends switch --global <tool>. Before, the suggested command didn't work. #​14976 (@​jdx, @​jc00ke)
• Bootstrap
  • mise bootstrap --from now finds git when it was just installed outside the startup PATH, such as Homebrew in /opt/homebrew/bin on a fresh Mac. #​14919 (@​pmmmwh)
  • [bootstrap.compose] services that use network_mode: service:X, ipc, pid or volumes_from no longer always report update. #​14958 (@​jdx, @​thurstonsand)
  • Cask apps are now staged in a hidden directory, so launchers such as Raycast no longer list them under a Name.mise-tmp-<hash> name. #​15001 (@​jdx, @​kyong0612)
• OCI images
  • Tools whose backend comes from [tool_alias] are now written to the image config under their resolved backend, so they still resolve inside the container. #​14971 (@​jdx, @​artemklevtsov)
  • System package layers keep absolute symlink targets unchanged, and mise no longer prints false "dangling" warnings for links such as /etc/alternatives/*. #​14968 (@​jdx)
• Dotfiles
  • mise dot status now shows the path of the local history repository, and mise dot track explains when it writes a tracking entry next to an existing copy/symlink/template entry. The docs now cover moving from a symlinked dotfiles repository to tracking. #​14979 (@​jdx)
  • A relative mise dot add --source path now resolves from the current directory. #​14983 (@​jdx, @​sahidvelji)
  • On Windows, mise now retries git write-tree when Windows refuses to write a loose object. #​15000 (@​jdx)
• Shims and shell
  • A concurrent reshim no longer briefly removes the shared command-wrappers directory. Before, a process that ran a wrapper during that window could fail with ENOENT. #​14931 (@​HackingGate)
  • A stale or undecodable __MISE_SESSION no longer makes mise hook-env print cannot install provided ErrorHook at every prompt. #​14963 (@​jdx)
  • On Windows, hook-env no longer re-checks the health of large npm: tool trees on every prompt. The result is cached until the install changes. #​14960 (@​jdx)
• Other
  • When decrypting sops, mise no longer finds its own sops shim on PATH and recurses back into itself. It skips mise shims and keeps looking for a real sops binary. #​14801 (@​shuaiyafei)
  • Tera filters on version in tool option templates now work, for example {{ version | replace(from='-x', to='') }} in an http URL. If an expression mixes `

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.