Update `gh attestation` attestation bundle fetching logic by malancas · Pull Request #10185 · cli/cli

malancas · 2025-01-06T15:31:07Z

Update the logic that fetches attestation bundles to use the bundle URL if provided in the GitHub API response.

cc #9850

Signed-off-by: Meredith Lancaster <malancas@github.com>

…-url

Signed-off-by: Meredith Lancaster <malancas@github.com>

…-url

Signed-off-by: Meredith Lancaster <malancas@github.com>

…hub.com:malancas/cli into fetch-artifact-attestation-bundles-with-sas-url

Signed-off-by: Meredith Lancaster <malancas@github.com>

…-url

Signed-off-by: Meredith Lancaster <malancas@github.com>

…hub.com:malancas/cli into fetch-artifact-attestation-bundles-with-sas-url

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas · 2025-01-07T18:48:34Z

pkg/cmd/attestation/api/client.go

+var getAttestationRetryInterval = time.Millisecond * 200
+
+// githubApiClient makes REST calls to the GitHub API
+type githubApiClient interface {


Since the client that implements this interface should only be used for making requests against the GitHub API, I'm renaming this interface to more explicitly reference the GitHub API.

malancas · 2025-01-07T18:49:01Z

pkg/cmd/attestation/api/client.go

 }

+// httpClient makes HTTP calls to all non-GitHub API endpoints
+type httpClient interface {


Because the bundle URL we use to fetch the bundle is not part of the GitHub API, we need to use regular HTTP client.

malancas · 2025-01-07T18:49:54Z

pkg/cmd/attestation/api/client.go

 }

-// Allow injecting backoff interval in tests.
-var getAttestationRetryInterval = time.Millisecond * 200


I moved this to the top of the file alongside other variables and consts.

malancas · 2025-01-07T18:54:57Z

pkg/cmd/attestation/api/client.go

-		logger: l,
+		githubAPI:  api.NewClientFromHTTP(hc),
+		host:       strings.TrimSuffix(host, "/"),
+		httpClient: hc,


We use the same http.Client provided by the Factory object when the subcommand is invoked to make requests with bundle URLs.

malancas · 2025-01-07T18:58:07Z

pkg/cmd/attestation/api/client.go

 func (c *LiveClient) GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error) {
 	url := c.BuildRepoAndDigestURL(repo, digest)
-	return c.getAttestations(url, repo, digest, limit)
+	attestations, err := c.getAttestations(url, repo, digest, limit)


The getAttestations method currently returns the api.Attestation type even though we really only care about the *bundle.Bundle type returned as a field within the Attestation type. I think we should consider updating this method to return *bundle.Bundle instead in a follow up PR.

pkg/cmd/attestation/api/client.go

phillmv · 2025-01-07T20:26:45Z

pkg/cmd/attestation/api/client.go

+		})
+	}
+
+	if err := g.Wait(); err != nil {


For my own edification: if any of these go funcs errors out, then we bail on everything.

phillmv

Looks good! Honestly just minor naming tweaks / moving code around a bit.

pkg/cmd/attestation/api/client.go

pkg/cmd/attestation/api/client_test.go

Signed-off-by: Meredith Lancaster <malancas@github.com>

Co-authored-by: Phill MV <phillmv@github.com>

pkg/cmd/attestation/api/client.go

Signed-off-by: Meredith Lancaster <malancas@github.com>

williammartin · 2025-01-08T12:19:35Z

@malancas it looks like you requested my review specifically on this, and that all the changes are inside the attestations package. Before I spend time on it, is there something specific you want me to pay attention to, or just generally have a look at it because it's a large change? I'd never seen snappy before!

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas · 2025-01-08T15:48:47Z

@malancas it looks like you requested my review specifically on this, and that all the changes are inside the attestations package. Before I spend time on it, is there something specific you want me to pay attention to, or just generally have a look at it because it's a large change? I'd never seen snappy before!

@williammartin I think you were automatically added as a reviewer because I added the github.com/golang/snappy dependency to go.mod. To give you a quick summary, the gh attestation code that requests attestations from the GitHub API will now try to fetch the attestation bundle from a URL provided in the returned attestation object. The fetched bundles are compressed with Snappy, so gh attestation now uses Snappy to decompress them.

williammartin · 2025-01-08T16:04:32Z

Oh yeh I see it was because of the team. No problem.

phillmv

This seems fine. I left a couple comments but for the purposes of this PR let's handle it in a follow up.

To wit:

maybe getAttestations returns bundles directly? (meh)
maybe merge GetByOwner and GetByRepo
maybe add a retry to GetBundle

pkg/cmd/attestation/api/client.go

phillmv · 2025-01-10T20:45:54Z

pkg/cmd/attestation/api/client.go

+func (c *LiveClient) GetBundle(url string) (*bundle.Bundle, error) {
+	c.logger.VerbosePrintf("Fetching attestation bundle with bundle URL\n\n")
+
+	resp, err := c.httpClient.Get(url)


I don't know why this didn't occur to me to say this three days ago but – if we're opening N connections to fetch N bundles then we have N new opportunities for random flaky connections to trash the whole operation.

Does this have a retry baked in? Does it make sense for us to retry 2-3 times?

No, but it should be easy to add one in a follow up.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.65.0` -> `v2.66.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.66.1`](https://github.com/cli/cli/releases/tag/v2.66.1): GitHub CLI 2.66.1 [Compare Source](cli/cli@v2.66.0...v2.66.1) #### Hotfix: `gh pr view` fails with provided URL This addresses a regression in `gh pr view` was reported in [#10352](cli/cli#10352). This regression was due to a change in `v2.66.0` that no longer allowed `gh pr` subcommands to execute properly outside of a git repo. #### What's Changed - Hotfix: `gh pr view` fails with provided URL by [@jtmcg](https://github.com/jtmcg) in cli/cli#10354 **Full Changelog**: cli/cli@v2.66.0...v2.66.1 ### [`v2.66.0`](https://github.com/cli/cli/releases/tag/v2.66.0): GitHub CLI 2.66.0 [Compare Source](cli/cli@v2.65.0...v2.66.0) #### `gh pr view` and `gh pr status` now respect common triangular workflow configurations Previously, `gh pr view` and `gh pr status` would fail for pull request's (MR) open in triangular workflows. This was due to `gh` being unable to identify the MR's corresponding remote and branch refs on GitHub. Now, `gh pr view` and `gh pr status` should successfully identify the MR's refs when the following common git configurations are used: - [`branch.<branchName>.pushremote`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-branchltnamegtpushRemote) is set - [`remote.pushDefault`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-remotepushDefault) is set Branch specific configuration, the former, supersedes repo specific configuration, the latter. Additionally, if the [`@{push}` revision syntax](https://git-scm.com/docs/gitrevisions#Documentation/gitrevisions.txt-emltbranchnamegtpushemegemmasterpushemempushem) for git resolves for a branch, `gh pr view` and `gh pr status` should work regardless of additional config settings. For more information, see - cli/cli#9363 - cli/cli#9364 - cli/cli#9365 - cli/cli#9374 #### `gh secret list`, `gh secret set`, and `gh secret delete` now require repository selection when multiple `git` remotes are present Previously, `gh secret list`, `gh secret set`, and `gh secret delete` would determine which remote to target for interacting with GitHub Actions secrets. Remotes marked as default using `gh repo set-default` or through other `gh` commands had higher priority when figuring out which repository to interact with. This could have unexpected outcomes when using `gh secret` commands with forked repositories as the upstream repository would generally be selected. Now, `gh secret` commands require users to disambiguate which repository should be the target if multiple remotes are present and the `-R, --repo` flag is not provided. For more information, see cli/cli#4688 #### Extension update notices now notify once every 24 hours per extension and can be disabled Previously, the GitHub CLI would notify users about newer versions every time an extension was executed. This did not match GitHub CLI notices, which only notified users once every 24 hours and could be disabled through an environment variable. Now, extension update notices will behave similar to GitHub CLI notices. To disable extension update notices, set the `GH_NO_EXTENSION_UPDATE_NOTIFIER` environment variable. For more information, see cli/cli#9925 #### What's Changed ##### ✨ Features - Draft for discussing testing around extension update checking behavior by [@andyfeller](https://github.com/andyfeller) in cli/cli#9985 - Make extension update check non-blocking by [@andyfeller](https://github.com/andyfeller) in cli/cli#10239 - Ensure extension update notices only notify once within 24 hours, provide ability to disable all extension update notices by [@andyfeller](https://github.com/andyfeller) in cli/cli#9934 - feat: make the extension upgrade fancier by [@nobe4](https://github.com/nobe4) in cli/cli#10194 - fix: padded display by [@nobe4](https://github.com/nobe4) in cli/cli#10216 - Update `gh attestation` attestation bundle fetching logic by [@malancas](https://github.com/malancas) in cli/cli#10185 - Require repo disambiguation for secret commands by [@williammartin](https://github.com/williammartin) in cli/cli#10209 - show error message for rerun workflow older than a month ago by [@iamrajhans](https://github.com/iamrajhans) in cli/cli#10227 - Update `gh attestation verify` table output by [@malancas](https://github.com/malancas) in cli/cli#10104 - Enable MSI building for Windows arm64 by [@dennisameling](https://github.com/dennisameling) in cli/cli#10297 - feat: Add support for creating autolink references by [@hoffm](https://github.com/hoffm) in cli/cli#10180 - Find MRs using `@{push}` by [@Frederick888](https://github.com/Frederick888) in cli/cli#9208 - feat: Add support for viewing autolink references by [@hoffm](https://github.com/hoffm) in cli/cli#10324 - Update `gh attestation` bundle fetching logic by [@malancas](https://github.com/malancas) in cli/cli#10339 ##### 🐛 Fixes - gh gist delete: prompt for gist id by [@danochoa](https://github.com/danochoa) in cli/cli#10154 - Better handling for waiting for codespaces to become ready by [@cmbrose](https://github.com/cmbrose) in cli/cli#10198 - Fix: `gh gist view` and `gh gist edit` prompts with no TTY by [@mateusmarquezini](https://github.com/mateusmarquezini) in cli/cli#10048 - Remove naked return values from `ReadBranchConfig` and `prSelectorForCurrentBranch` by [@jtmcg](https://github.com/jtmcg) in cli/cli#10197 - Add job to deployment workflow to validate the tag name for a given release by [@jtmcg](https://github.com/jtmcg) in cli/cli#10121 - \[gh run list] Stop progress indicator on failure from `--workflow` flag by [@iamazeem](https://github.com/iamazeem) in cli/cli#10323 - Update deployment.yml by [@andyfeller](https://github.com/andyfeller) in cli/cli#10340 ##### 📚 Docs & Chores - Add affected version heading to bug report issue form by [@BagToad](https://github.com/BagToad) in cli/cli#10269 - chore: fix some comments by [@petercover](https://github.com/petercover) in cli/cli#10296 - Update triage.md to reflect FR experiment outcome by [@jtmcg](https://github.com/jtmcg) in cli/cli#10196 - Clear up --with-token fine grained PAT usage by [@williammartin](https://github.com/williammartin) in cli/cli#10186 - Correct help documentation around template use in `gh issue create` by [@andyfeller](https://github.com/andyfeller) in cli/cli#10208 - chore: fix some function names in comment by [@zhuhaicity](https://github.com/zhuhaicity) in cli/cli#10225 - Tiny typo fix by [@robmorgan](https://github.com/robmorgan) in cli/cli#10265 - add install instructions for Manjaro Linux by [@AMS21](https://github.com/AMS21) in cli/cli#10236 - Update test to be compatible with latest Glamour v0.8.0 by [@ottok](https://github.com/ottok) in cli/cli#10151 - Add more `gh attestation verify` integration tests by [@malancas](https://github.com/malancas) in cli/cli#10102 #####

Dependencies - Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by [@dependabot](https://github.com/dependabot) in cli/cli#10215 - Bump github.com/sigstore/protobuf-specs from 0.3.2 to 0.3.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10214 - Bump github.com/gabriel-vasile/mimetype from 1.4.7 to 1.4.8 by [@dependabot](https://github.com/dependabot) in cli/cli#10184 - Bump google.golang.org/protobuf from 1.36.2 to 1.36.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10250 - Bump golangci-linter and address failures to prepare for Go 1.24 strictness by [@mikelolasagasti](https://github.com/mikelolasagasti) in cli/cli#10279 - Bump github.com/google/go-containerregistry from 0.20.2 to 0.20.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10257 - Bump actions/attest-build-provenance from 2.1.0 to 2.2.0 by [@dependabot](https://github.com/dependabot) in cli/cli#10300 - Bump google.golang.org/protobuf from 1.36.3 to 1.36.4 by [@dependabot](https://github.com/dependabot) in cli/cli#10306 - Upgrade sigstore-go to v0.7.0: fixes [#10114](cli/cli#10114) formatting issue by [@codysoyland](https://github.com/codysoyland) in cli/cli#10309 - Bump github.com/in-toto/attestation from 1.1.0 to 1.1.1 by [@dependabot](https://github.com/dependabot) in cli/cli#10319 #### New Contributors Big thank you to our many new *and* longtime contributors making this release happen!! ❤️ ✨ - [@zhuhaicity](https://github.com/zhuhaicity) made their first contribution in cli/cli#10225 - [@danochoa](https://github.com/danochoa) made their first contribution in cli/cli#10154 - [@robmorgan](https://github.com/robmorgan) made their first contribution in cli/cli#10265 - [@iamrajhans](https://github.com/iamrajhans) made their first contribution in cli/cli#10227 - [@AMS21](https://github.com/AMS21) made their first contribution in cli/cli#10236 - [@petercover](https://github.com/petercover) made their first contribution in cli/cli#10296 - [@ottok](https://github.com/ottok) made their first contribution in cli/cli#10151 - [@dennisameling](https://github.com/dennisameling) made their first contribution in cli/cli#10297 - [@iamazeem](https://github.com/iamazeem) made their first contribution in cli/cli#10323 - [@Frederick888](https://github.com/Frederick888) made their first contribution in cli/cli#9208 **Full Changelog**: cli/cli@v2.65.0...v2.66.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.2.7` → `v2026.2.13` | --- ### Release Notes <details> <summary>jdx/mise (mise)</summary> ### [`v2026.2.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.13): : Fix GitHub attestation verification failures [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.11...v2026.2.13) This release partially mitigates GitHub attestation verification failures that were causing tool installations to fail (e.g., `gh`, and other aqua-backed tools with attestations enabled). See [#8142](https://redirect.github.com/jdx/mise/discussions/8142) for details. ##### What happened GitHub silently changed their attestations API to externalize bundle storage to Azure Blob Storage (`tmaproduction.blob.core.windows.net`) using [Snappy compression](https://google.github.io/snappy/), rather than returning bundles inline as JSON. The `gh` CLI had already been updated to handle this ([cli/cli#10185](https://redirect.github.com/cli/cli/pull/10185)), but third-party tools like mise were not yet aware of the new format, causing `"error decoding response body"` failures. ##### What this release does Bumps `sigstore-verification` to 0.2, which splits the reqwest dependency version from mise's (0.13 vs 0.12). This avoids Cargo feature unification that was causing mise's `gzip` feature to be applied to attestation requests, interfering with the Snappy-compressed responses. **Note:** A full fix with proper Snappy decompression support and auth token scoping landed in [sigstore-verification v0.2.1](https://redirect.github.com/jdx/sigstore-verification/releases/tag/v0.2.1) ([#22](https://redirect.github.com/jdx/sigstore-verification/pull/22), [#23](https://redirect.github.com/jdx/sigstore-verification/pull/23)) — expect a follow-up mise release with that bump. If you are still hitting issues, set `settings.aqua.github_attestations = false` as a workaround. ##### Dependency Updates - **Bumped `sigstore-verification` to 0.2** ([e8897c9](https://redirect.github.com/jdx/mise/commit/e8897c9fbc873fe272495a65e5a88b04b97f3b6d)) ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`k1LoW/tcmux`](https://redirect.github.com/k1LoW/tcmux) ##### Updated Packages (1) - [`jdx/usage`](https://redirect.github.com/jdx/usage) ### [`v2026.2.11`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.11): : Templates Level Up [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.10...v2026.2.11) A small release with a nice quality-of-life improvement for tera template users and a bug fix for file watching. ##### Highlights - **Array access for multi-version tools in tera templates** — If you have multiple versions of a tool installed, you can now access them individually in tera templates via `tools.<name>[0].path`, `tools.<name>[1].path`, etc. Single-version tools continue to work as before with `tools.<name>.path`. [#8129](https://redirect.github.com/jdx/mise/pull/8129) ##### Bug Fixes - **hook-env now watches files used in tera templates** — Files referenced by template functions like `read_file()`, `hash_file()`, `file_size()`, and `last_modified()` are now properly tracked by `hook-env`. Previously, changes to these files wouldn't trigger an environment refresh until you changed directories. [#8122](https://redirect.github.com/jdx/mise/pull/8122) ##### New Tools - [mutagen](https://redirect.github.com/mutagen-io/mutagen) — thanks [@tony-sol](https://redirect.github.com/tony-sol)! [#8125](https://redirect.github.com/jdx/mise/pull/8125) - [communique](https://redirect.github.com/jdx/communique) [#8126](https://redirect.github.com/jdx/mise/pull/8126) ### [`v2026.2.10`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.10): : Shims, Stdin, and Smarter Offline [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.9...v2026.2.10) This release brings several quality-of-life features alongside a solid round of bug fixes. ##### Highlights - **Shims as PATH fallback during activation** — When `not_found_auto_install` is enabled (the default), mise now adds the shims directory to your PATH as a fallback. This fixes a subtle issue where subshells or child processes could miss uninstalled tools or pick up the wrong system version instead of the mise-managed one. Thanks [@ctaintor](https://redirect.github.com/ctaintor) for this contribution! [#8106](https://redirect.github.com/jdx/mise/pull/8106) - **`tools` variable in Tera templates** — You can now reference `{{ tools.node.version }}` and `{{ tools.node.path }}` directly in env templates and task templates (with `tools = true`), eliminating the need for `exec(command='node --version')` workarounds. [#8108](https://redirect.github.com/jdx/mise/pull/8108) — [Template docs](https://mise.jdx.dev/environments/templates.html) - **`mise set --stdin` for multiline values** — Need to set an SSH key, certificate, or other multiline value as an environment variable? `mise set --stdin MY_KEY` now reads from stdin until EOF. [#8110](https://redirect.github.com/jdx/mise/pull/8110) ##### Bug Fixes - **`MISE_OFFLINE` now works correctly** — Previously, offline mode could hang or error out instead of gracefully falling back to local data. This is now fixed, and `offline`/`prefer_offline` are proper settings configurable in `mise.toml`. [#8109](https://redirect.github.com/jdx/mise/pull/8109) - **Upgrade symlink cleanup** — Fixed an issue where `mise upgrade` could leave behind invalid symlinks when uninstalling old versions, thanks [@roele](https://redirect.github.com/roele). [#8099](https://redirect.github.com/jdx/mise/pull/8099) [#8101](https://redirect.github.com/jdx/mise/pull/8101) - **Conda dependency resolution** — Improved patchelf handling and dependency version pinning for complex conda packages on Linux. [#8087](https://redirect.github.com/jdx/mise/pull/8087) - **SLSA provenance for Docker Buildx** — Tools like `github:docker/buildx` that ship in-toto statements without sigstore signatures no longer fail verification, thanks [@gerhard](https://redirect.github.com/gerhard). [#8094](https://redirect.github.com/jdx/mise/pull/8094) - **Vfox plugin auto-installation** — Fixed a clean-setup failure where vfox-backed env modules would error with "Plugin directory not found" before the plugin was installed, thanks [@pose](https://redirect.github.com/pose). [#8035](https://redirect.github.com/jdx/mise/pull/8035) - **GitHub `latest` version prefix** — The `v` prefix is no longer incorrectly added when resolving "latest" for GitHub release backends. [#8105](https://redirect.github.com/jdx/mise/pull/8105) - **GitLab tool options** — Tool options from config are now correctly resolved for aliased GitLab tools. [#8084](https://redirect.github.com/jdx/mise/pull/8084) - **Flutter version resolution** — Fixed version resolution by using `version_expr`. [#8081](https://redirect.github.com/jdx/mise/pull/8081) - **Tuist on Linux** — Registry now includes Linux support for tuist, thanks [@fortmarek](https://redirect.github.com/fortmarek). [#8102](https://redirect.github.com/jdx/mise/pull/8102) ##### Registry - Added conda backends for mysql, ffmpeg, ghc, vim, and several other previously asdf-only tools. [#8080](https://redirect.github.com/jdx/mise/pull/8080) [#8083](https://redirect.github.com/jdx/mise/pull/8083) - Added podman-tui, thanks [@tony-sol](https://redirect.github.com/tony-sol). [#8098](https://redirect.github.com/jdx/mise/pull/8098) ##### New Contributors Welcome [@ctaintor](https://redirect.github.com/ctaintor), [@rileychh](https://redirect.github.com/rileychh), [@fortmarek](https://redirect.github.com/fortmarek), [@pose](https://redirect.github.com/pose), and [@gerhard](https://redirect.github.com/gerhard) — thanks for your first contributions! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`entireio/cli`](https://redirect.github.com/entireio/cli) - [`rmitchellscott/reManager`](https://redirect.github.com/rmitchellscott/reManager) ##### Updated Packages (1) - [`atuinsh/atuin`](https://redirect.github.com/atuinsh/atuin) ### [`v2026.2.9`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.9): : Ruby Plays Nice with Legacy Linux [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.8...v2026.2.9) This release brings a quality-of-life improvement for Ruby users on older Linux distributions, plus a couple of important bug fixes. ##### Highlights **Automatic Ruby variant selection for older glibc systems** ([#8069](https://redirect.github.com/jdx/mise/pull/8069)) If you're running Linux with glibc older than 2.35 (common on RHEL 7, Amazon Linux 2, CentOS 7, or older Debian/Ubuntu versions), mise will now automatically download the no-YJIT precompiled Ruby variant instead of failing with cryptic errors. This means precompiled Ruby "just works" on a much wider range of Linux systems without any manual configuration. Systems with glibc 2.35+ (Ubuntu 22.04+, Debian 12+, Fedora 36+) continue to get the standard YJIT-enabled builds as before. ##### Bug Fixes - **Windows shim updates with self-update** ([#8075](https://redirect.github.com/jdx/mise/pull/8075)) — `mise self-update` on Windows now properly updates `mise-shim.exe` alongside `mise.exe`. Previously, users had to manually download the shim from GitHub releases after updating. - **Fixed `cargo install mise`** ([#8077](https://redirect.github.com/jdx/mise/pull/8077)) — Bumped the `xx` dependency to 2.5 to fix an issue where Cargo was selecting an incompatible older version, causing installation failures. Thanks [@erickt](https://redirect.github.com/erickt) for the fix and welcome to mise! ##### Documentation - Ruby precompiled binaries are no longer marked as experimental ([#8073](https://redirect.github.com/jdx/mise/pull/8073)) — they're stable and ready for production use. ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`carthage-software/mago`](https://redirect.github.com/carthage-software/mago) ### [`v2026.2.8`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.8): : Hooks Get Their Act Together [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.7...v2026.2.8) This release focuses on hooks—fixing 12 community-reported issues that were making them unreliable. There are also some nice quality-of-life improvements for Node.js and Ruby users. ##### Highlights **Hooks overhaul** — A comprehensive fix for the hooks system addressing a dozen issues reported by the community. Global hooks now actually work, hook execution order is corrected (leave fires before enter), infinite loops in fish shell are fixed, and postinstall hooks can now find all installed tools. [#8058](https://redirect.github.com/jdx/mise/pull/8058) **Node version detection from package.json** — mise now reads tool versions directly from `package.json` using the `devEngines` and `packageManager` fields. This means your Node, Bun, pnpm, yarn, and npm versions can be auto-detected without a separate `.tool-versions` or `mise.toml` file. Semver ranges are simplified automatically (`>=18.0.0` → `18`). [#8059](https://redirect.github.com/jdx/mise/pull/8059) **Precompiled Ruby goes stable** — You can now use precompiled Ruby binaries by setting `ruby.compile=false` without needing `experimental=true`. This will become the default in 2026.8.0. If you haven't tried it, precompiled Ruby installs in seconds instead of minutes. [#8052](https://redirect.github.com/jdx/mise/pull/8052) ##### New Features - **`--dry-run-code` flag** — Added to `install`, `upgrade`, `prune`, `uninstall`, and `use` commands. Behaves like `--dry-run` but exits with code 1 when there's work to do, enabling patterns like `if ! mise install --dry-run-code -q; then mise install; fi` [#8063](https://redirect.github.com/jdx/mise/pull/8063) ##### Bug Fixes - **MISE\_ARCH override** — The bun and erlang plugins now respect `MISE_ARCH` at runtime, which is useful for Windows ARM64 users running x64 binaries under emulation [#8062](https://redirect.github.com/jdx/mise/pull/8062) - **key=value format** — `mise settings set`, `mise settings add`, `mise config set`, and `mise shell-alias set` now accept `key=value` as a single argument [#8053](https://redirect.github.com/jdx/mise/pull/8053) ##### Registry - Added **quicktype** (`npm:quicktype`) — thanks [@zdunecki](https://redirect.github.com/zdunecki)! [#8054](https://redirect.github.com/jdx/mise/pull/8054) ##### Dependencies - Upgraded to TOML 1.1 support via toml 0.9 and toml\_edit 0.24 [#8057](https://redirect.github.com/jdx/mise/pull/8057) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/boardgamers/clash).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.2.11` → `v2026.2.17` | `v2026.2.19` (+1) | --- ### Release Notes <details> <summary>jdx/mise (mise)</summary> ### [`v2026.2.17`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.17): : Freshly Prepared [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.16...v2026.2.17) A moderate release with a handful of bug fixes and a new feature for the `prepare` system. ##### Highlights - **Prepare: auto-touch stale outputs** — When tools like `uv sync` skip work because dependencies are already satisfied, output files don't get updated, causing mise to consider them stale on the next run. Prepare providers now automatically touch output files after a successful command, keeping staleness checks accurate. This is controlled by a new `touch_outputs` config option (defaults to true). [#8243](https://redirect.github.com/jdx/mise/pull/8243) by [@halms](https://redirect.github.com/halms) - **Settings reorganization: `task_*` → `task.*`** — Nine flat `task_*` settings have been consolidated into a nested `task.*` namespace (e.g., `task_output` → `task.output`). The old names still work with no breaking changes — deprecation warnings won't appear until `2026.8.0`. [#8239](https://redirect.github.com/jdx/mise/pull/8239) ##### Bug Fixes - **Postinstall hooks now use correct bin paths** — Per-tool postinstall hooks were hardcoding `$install_path/bin` on `PATH`, which broke backends like aqua where binaries live in non-standard subdirectories. Hooks now use each backend's actual binary paths. [#8234](https://redirect.github.com/jdx/mise/pull/8234) - **`mise use` writes to the correct config file** — When both `config.toml` and `config.local.toml` exist, `mise use` was incorrectly writing to `config.local.toml`. It now properly targets `config.toml`. [#8240](https://redirect.github.com/jdx/mise/pull/8240) - **Legacy `.mise.backend` installs no longer block auto-migration** — Legacy backend files were defaulting to `explicit_backend = true`, which prevented auto-migration to updated registry backends. They now default to non-explicit, allowing tools like `glab` to resolve correctly through the current registry. [#8245](https://redirect.github.com/jdx/mise/pull/8245) by [@jean-humann](https://redirect.github.com/jean-humann) ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`namespacelabs/foundation/nsc`](https://redirect.github.com/namespacelabs/foundation/nsc) ### [`v2026.2.16`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.16): : MCP Gets Its Hands Dirty [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.15...v2026.2.16) This release brings MCP task execution support, better Node.js flavor guidance, and a solid round of bug fixes across several backends. ##### Highlights - **MCP `run_task` tool** — You can now execute mise tasks directly through the [MCP](https://mise.jdx.dev/) interface. The new `run_task` tool runs tasks via subprocess with full stdout/stderr capture, timeout support, and hardened execution. An `install_tool` stub is also included for future expansion. [#8179](https://redirect.github.com/jdx/mise/pull/8179) by [@joaommartins](https://redirect.github.com/joaommartins) - **Node flavor suggestions** — When a Node.js version isn't found in the configured mirror, mise now suggests setting `node.flavor` to help you get to the right download faster. [#8206](https://redirect.github.com/jdx/mise/pull/8206) by [@risu729](https://redirect.github.com/risu729) - **Registry stack overflow fix** — The registry `BTreeMap` is now built directly on the heap, eliminating a stack overflow that could occur with large registries. [#8214](https://redirect.github.com/jdx/mise/pull/8214) by [@risu729](https://redirect.github.com/risu729) ##### Bug Fixes - **Java version sorting** — Shorthand Java versions (e.g., `21`, `17`) now sort correctly. [#8197](https://redirect.github.com/jdx/mise/pull/8197) by [@roele](https://redirect.github.com/roele) - **Node env var migration** — Node-related environment variables have been properly migrated to the settings system. [#8200](https://redirect.github.com/jdx/mise/pull/8200) by [@risu729](https://redirect.github.com/risu729) - **Registry overrides in shims** — Registry overrides are now correctly applied when running tools through shims. [#8199](https://redirect.github.com/jdx/mise/pull/8199) by [@risu729](https://redirect.github.com/risu729) - **Rust outdated duplication** — Fixed `mise outdated` showing Rust versions twice. [#8209](https://redirect.github.com/jdx/mise/pull/8209) by [@roele](https://redirect.github.com/roele) - **GitHub aliased backend resolution** — Version lookups no longer break for tools aliased to a different backend than the registry default. [#8221](https://redirect.github.com/jdx/mise/pull/8221) - **GitHub attestation output** — Attestation verification success is now shown in progress output. [#8230](https://redirect.github.com/jdx/mise/pull/8230) - **Cargo binstall setting migration** — `MISE_CARGO_BINSTALL_ONLY` has been migrated to the settings system. [#8202](https://redirect.github.com/jdx/mise/pull/8202) by [@risu729](https://redirect.github.com/risu729) ##### New Tools - **typst** — GitHub backend added. [#8210](https://redirect.github.com/jdx/mise/pull/8210) by [@3w36zj6](https://redirect.github.com/3w36zj6) - **cargo-dist** — Now available via aqua registry. [#8153](https://redirect.github.com/jdx/mise/pull/8153) by [@risu729](https://redirect.github.com/risu729) - **release-plz** — Now available via aqua registry. [#8150](https://redirect.github.com/jdx/mise/pull/8150) by [@risu729](https://redirect.github.com/risu729) ### [`v2026.2.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.15): : Streaming in Order [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.14...aqua-registry-v2026.2.15) This release brings a nice quality-of-life improvement to task execution along with a solid batch of bug fixes across several subsystems. ##### Highlights - **Real-time streaming for keep-order tasks** — The `keep_order` task output mode now streams the active task's output in real-time instead of buffering everything until completion. Other parallel tasks buffer quietly and flush in definition order as they finish, so you get live feedback without sacrificing deterministic output ordering. [#8164](https://redirect.github.com/jdx/mise/pull/8164) - **npm backend performance** — `npm view` is now called only once per package lookup instead of multiple times, speeding up npm-based tool resolution. Thanks [@risu729](https://redirect.github.com/risu729)! [#8181](https://redirect.github.com/jdx/mise/pull/8181) ##### Bug Fixes - **Recursive shim execution on Windows** — `mise exec` now strips the shims directory from PATH during executable lookup, preventing infinite recursion when shims call back into `mise x`. [#8189](https://redirect.github.com/jdx/mise/pull/8189) - **PATH reordering after activation** — `hook-env` now preserves any PATH reordering done after `mise activate` (e.g., by `~/.zlogin`), instead of silently reverting to the original order. [#8190](https://redirect.github.com/jdx/mise/pull/8190) - **Cross-platform lockfile resolution** — The aqua backend now correctly resolves lockfile artifacts for the target platform instead of leaking host-specific overrides into `mise lock --platform`. Thanks [@mackwic](https://redirect.github.com/mackwic)! [#8183](https://redirect.github.com/jdx/mise/pull/8183) - **Version alias lockfile lookup** — Version aliases (like `lts`) are now resolved before lockfile lookup, so locked versions are matched correctly. [#8194](https://redirect.github.com/jdx/mise/pull/8194) - **Task source freshness checks** — Freshness checks now work correctly with dynamic task directories. Thanks [@rooperuu](https://redirect.github.com/rooperuu)! [#8169](https://redirect.github.com/jdx/mise/pull/8169) - **Global tasks in monorepos** — Global tasks are now properly resolved when running from a monorepo root. [#8192](https://redirect.github.com/jdx/mise/pull/8192) - **Wildcard glob matching** — `test:*` no longer incorrectly matches the parent `test` task. [#8165](https://redirect.github.com/jdx/mise/pull/8165) - **task\_config.includes paths** — Include paths in task config are now resolved relative to the config root, not the working directory. [#8193](https://redirect.github.com/jdx/mise/pull/8193) - **Upgrade safety** — `mise upgrade` now skips untrusted tracked configs instead of failing. [#8195](https://redirect.github.com/jdx/mise/pull/8195) - **helm-diff registry entry** — Fixed the archive binary name for helm-diff. Thanks [@jean-humann](https://redirect.github.com/jean-humann)! [#8173](https://redirect.github.com/jdx/mise/pull/8173) ##### New Contributors Welcome [@jean-humann](https://redirect.github.com/jean-humann), [@mackwic](https://redirect.github.com/mackwic), and [@rooperuu](https://redirect.github.com/rooperuu)! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`BetterDiscord/cli`](https://redirect.github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://redirect.github.com/glossia.ai/cli) ### [`v2026.2.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.14) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.13...aqua-registry-v2026.2.14) A feature-focused release adding vfox plugin env redaction, Deno devEngines support, and a new Rust default\_host setting. ##### Highlights - **Vfox env var redaction** — Vfox plugins can now request that specific environment variables be redacted from logs and debug output by returning a `redact` field in `MiseEnvResult`. Useful for plugins that inject secrets or tokens. [#8166](https://redirect.github.com/jdx/mise/pull/8166) - **Deno devEngines.runtime support** — Mise now reads the `devEngines.runtime` field from `package.json` to auto-detect the desired Deno version, matching the same convention already supported for Node. Thanks [@risu729](https://redirect.github.com/risu729)! [#8144](https://redirect.github.com/jdx/mise/pull/8144) - **`default_host` setting for Rust** — A new `rust.default_host` setting lets you override the Rust target triple used during installation, useful for cross-compilation setups. Thanks [@aacebedo](https://redirect.github.com/aacebedo)! [#8154](https://redirect.github.com/jdx/mise/pull/8154) - **Aqua `github_content` package support** — The aqua backend now supports packages hosted via GitHub content downloads (not just releases). Thanks [@risu729](https://redirect.github.com/risu729)! [#8147](https://redirect.github.com/jdx/mise/pull/8147) ##### Bug Fixes - **`mise edit` whitespace** — TOML values edited via `mise edit` no longer retain extra formatting whitespace. [#8162](https://redirect.github.com/jdx/mise/pull/8162) - **`--locked` for python/ubi** — The `--locked` flag now works correctly with python and ubi backends. [#8163](https://redirect.github.com/jdx/mise/pull/8163) - **npm update notifier** — The npm update notifier is now suppressed during `npm install`, preventing spurious output. Thanks [@risu729](https://redirect.github.com/risu729)! [#8152](https://redirect.github.com/jdx/mise/pull/8152) - **Asset matcher vsix penalty** — `.vsix` files are now deprioritized in asset matching, preventing incorrect downloads. Thanks [@risu729](https://redirect.github.com/risu729)! [#8151](https://redirect.github.com/jdx/mise/pull/8151) - **JSON schema updates** — Added missing `task_templates`, `extends`, and `timeout` fields to the mise.json schema. Thanks [@risu729](https://redirect.github.com/risu729)! [#8145](https://redirect.github.com/jdx/mise/pull/8145) ##### New Contributors Welcome [@joaommartins](https://redirect.github.com/joaommartins)! [#8133](https://redirect.github.com/jdx/mise/pull/8133) *** > **Note:** This release has no attached binary assets. The v2026.2.14 tag was created successfully but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. The binaries for this version are functionally identical to v2026.2.15 minus the additional fixes in that release. Use v2026.2.15 instead. ### [`v2026.2.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.13): : Fix GitHub attestation verification failures [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.12...v2026.2.13) This release partially mitigates GitHub attestation verification failures that were causing tool installations to fail (e.g., `gh`, and other aqua-backed tools with attestations enabled). See [#8142](https://redirect.github.com/jdx/mise/discussions/8142) for details. ##### What happened GitHub silently changed their attestations API to externalize bundle storage to Azure Blob Storage (`tmaproduction.blob.core.windows.net`) using [Snappy compression](https://google.github.io/snappy/), rather than returning bundles inline as JSON. The `gh` CLI had already been updated to handle this ([cli/cli#10185](https://redirect.github.com/cli/cli/pull/10185)), but third-party tools like mise were not yet aware of the new format, causing `"error decoding response body"` failures. ##### What this release does Bumps `sigstore-verification` to 0.2, which splits the reqwest dependency version from mise's (0.13 vs 0.12). This avoids Cargo feature unification that was causing mise's `gzip` feature to be applied to attestation requests, interfering with the Snappy-compressed responses. **Note:** A full fix with proper Snappy decompression support and auth token scoping landed in [sigstore-verification v0.2.1](https://redirect.github.com/jdx/sigstore-verification/releases/tag/v0.2.1) ([#22](https://redirect.github.com/jdx/sigstore-verification/pull/22), [#23](https://redirect.github.com/jdx/sigstore-verification/pull/23)) — expect a follow-up mise release with that bump. If you are still hitting issues, set `settings.aqua.github_attestations = false` as a workaround. ##### Dependency Updates - **Bumped `sigstore-verification` to 0.2** ([e8897c9](https://redirect.github.com/jdx/mise/commit/e8897c9fbc873fe272495a65e5a88b04b97f3b6d)) ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`k1LoW/tcmux`](https://redirect.github.com/k1LoW/tcmux) ##### Updated Packages (1) - [`jdx/usage`](https://redirect.github.com/jdx/usage) ### [`v2026.2.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.12) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.11...v2026.2.12) A small release adding a new Java configuration option. ##### Highlights - **`java.shorthand_vendor` setting** — A new setting that lets you configure which vendor is used when specifying shorthand Java versions (e.g., `21` instead of `temurin-21`). Thanks [@roele](https://redirect.github.com/roele)! [#8134](https://redirect.github.com/jdx/mise/pull/8134) *** > **Note:** This release has no attached binary assets. The v2026.2.12 tag was created but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. Use v2026.2.13 or later instead. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.  Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com> Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [jdx/mise](https://redirect.github.com/jdx/mise) | patch | `2026.2.3` → `2026.2.20` | --- ### Release Notes <details> <summary>jdx/mise (jdx/mise)</summary> ### [`v2026.2.20`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.20): : Conda rewrite, .NET SDK core plugin, and per-task timeouts [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.19...v2026.2.20) A feature-packed release that replaces the conda backend with production-grade internals, adds a native .NET SDK plugin, and finally enforces per-task timeouts. Several lockfile and environment-handling fixes round things out. ##### Highlights - **Conda backend rewritten with rattler** -- The experimental conda backend has been completely rewritten to use the [rattler](https://redirect.github.com/conda/rattler) Rust crates (the same engine behind pixi), replacing \~1,600 lines of custom code that relied on the unsupported anaconda.org API. This brings a proper SAT-based dependency solver, correct binary prefix replacement, and repodata caching via CDN. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) - **Native .NET SDK management** -- A new core plugin for .NET SDK installs all versions side-by-side under a shared `DOTNET_ROOT`, matching .NET's native multi-version model. It uses Microsoft's official `dotnet-install` script and supports `global.json` for per-project SDK pinning. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeouts are now enforced** -- The `timeout` field on tasks (added in v2025.1.6 but never wired up) now actually kills tasks that exceed their limit. Timeouts send SIGTERM with a 5-second grace period before SIGKILL, and both per-task and global `task_timeout` settings are respected. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) ##### Added - **Core .NET SDK plugin** -- `mise use dotnet@8` now installs via a native core plugin with side-by-side version support and `global.json` detection. Configure `DOTNET_ROOT` via the new `dotnet.dotnet_root` setting. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeout enforcement** -- Tasks with a `timeout` field are now killed if they exceed the configured duration. Works with both per-task config and the global `task_timeout`/`--timeout` flag. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) ```toml [tasks.deploy] run = "npm run deploy" timeout = "5m" ``` - **VSIX archive support** -- The HTTP backend now recognizes `.vsix` files as ZIP archives and extracts them correctly, enabling tools distributed as VS Code extensions to be installed via `http:` URLs. [#8306](https://redirect.github.com/jdx/mise/pull/8306) by [@sosumappu](https://redirect.github.com/sosumappu) - **Registry: `oxfmt`** -- Added the oxfmt formatter to the tool registry. [#8316](https://redirect.github.com/jdx/mise/pull/8316) by [@taoufik07](https://redirect.github.com/taoufik07) ##### Changed - **Conda backend rewritten with rattler crates** -- Replaces custom version matching, dependency resolution, archive extraction, and binary patching with the battle-tested rattler ecosystem (`rattler_solve`, `rattler_repodata_gateway`, `rattler::install`). Binary prefix replacement now works correctly (the old code skipped binary files entirely). Since the conda backend is still experimental, this is a non-breaking change. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) ##### Fixed - **Lockfile not modified with `--locked`** -- `mise install --locked` no longer writes to `mise.lock`, matching the semantics of `cargo install --locked` and `uv pip install --locked`. [#8308](https://redirect.github.com/jdx/mise/pull/8308) by [@jdx](https://redirect.github.com/jdx) - **Orphan lockfile entries pruned** -- `mise lock` now removes stale tool entries that are no longer present in config, keeping the lockfile aligned with the current toolset. [#8265](https://redirect.github.com/jdx/mise/pull/8265) by [@mackwic](https://redirect.github.com/mackwic) - **Contradictory lockfile config caught early** -- Setting `locked=true` alongside `lockfile=false` now produces a clear error instead of silently ignoring the lock. [#8329](https://redirect.github.com/jdx/mise/pull/8329) by [@jdx](https://redirect.github.com/jdx) - **`watch_files` triggers on every change** -- The hook-env fast-path now checks `[[watch_files]]` paths, fixing a bug where only the first file change triggered the associated run command. [#8317](https://redirect.github.com/jdx/mise/pull/8317) by [@jdx](https://redirect.github.com/jdx) - **Fish alias completions cleaned up** -- Setting or unsetting shell aliases in fish now clears stale completions, preventing tab-complete from offering outdated suggestions. [#8324](https://redirect.github.com/jdx/mise/pull/8324) by [@jdx](https://redirect.github.com/jdx) - **JSON schema accepts age-encrypted env values** -- Fixed a `oneOf` ambiguity in the mise schema that rejected `[env]` entries using age encryption. [#8328](https://redirect.github.com/jdx/mise/pull/8328) by [@adamliang0](https://redirect.github.com/adamliang0) - **Regal registry updated** -- The regal tool now points to its new home at `open-policy-agent/regal`. [#8315](https://redirect.github.com/jdx/mise/pull/8315) by [@charlieegan3](https://redirect.github.com/charlieegan3) - **Conda: locked installs preserve package data** -- `conda_packages` entries are no longer silently dropped during `--locked` installs, and concurrent downloads no longer race on the same temp file. [#8335](https://redirect.github.com/jdx/mise/pull/8335) by [@jdx](https://redirect.github.com/jdx) - **Conda: solver no longer fails on Linux** -- Deduplicated repodata records before passing them to the solver, fixing "duplicate records" errors when installing tools like imagemagick. [#8337](https://redirect.github.com/jdx/mise/pull/8337) by [@jdx](https://redirect.github.com/jdx) ##### New Contributors - [@tvararu](https://redirect.github.com/tvararu) made their first contribution in [#8250](https://redirect.github.com/jdx/mise/pull/8250) - [@sosumappu](https://redirect.github.com/sosumappu) made their first contribution in [#8306](https://redirect.github.com/jdx/mise/pull/8306) - [@charlieegan3](https://redirect.github.com/charlieegan3) made their first contribution in [#8315](https://redirect.github.com/jdx/mise/pull/8315) - [@taoufik07](https://redirect.github.com/taoufik07) made their first contribution in [#8316](https://redirect.github.com/jdx/mise/pull/8316) - [@adamliang0](https://redirect.github.com/adamliang0) made their first contribution in [#8328](https://redirect.github.com/jdx/mise/pull/8328) - [@mackwic](https://redirect.github.com/mackwic) made their first contribution in [#8265](https://redirect.github.com/jdx/mise/pull/8265) **Full Changelog**: <jdx/mise@v2026.2.19...v2026.2.20> ### [`v2026.2.19`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.19): : Fixes for interactive tasks and failed install cleanup [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.18...v2026.2.19) A small patch release with two targeted bug fixes: a regression fix for interactive task execution and better cleanup after failed installs. ##### Bug Fixes - **Interactive tasks no longer hang** -- The process group isolation added in v2026.2.18 ([#8279](https://redirect.github.com/jdx/mise/pull/8279)) inadvertently broke interactive tools like Tilt that read from stdin. When a child process was moved to its own process group, the terminal wouldn't deliver keyboard input to it, causing `SIGTTIN` and a silent hang. mise now checks whether stdin is a TTY before calling `setpgid` -- interactive tasks stay in the terminal's foreground process group for proper keyboard I/O, while non-interactive tasks still get their own process group for clean signal teardown. [#8301](https://redirect.github.com/jdx/mise/pull/8301) by [@jdx](https://redirect.github.com/jdx) - **Failed installs clean up properly** -- When an install fails (e.g. a 404 for a non-existent version or a 403 from GitHub rate limiting), mise now removes the empty parent directory (e.g. `installs/tilt/`) and the stale incomplete marker from cache, instead of leaving them behind. [#8302](https://redirect.github.com/jdx/mise/pull/8302) by [@jdx](https://redirect.github.com/jdx) ##### Documentation - Fixed the ripgrep command in the getting-started guide to use the correct binary name `rg` instead of `ripgrep`. [#8299](https://redirect.github.com/jdx/mise/pull/8299) by [@nguyenvulong](https://redirect.github.com/nguyenvulong) **Full Changelog**: <jdx/mise@v2026.2.18...v2026.2.19> ### [`v2026.2.18`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.18): : Task Reliability & Developer Experience [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.17...v2026.2.18) A bug-fix-heavy release focused on task execution reliability, with a new feature for cross-platform tool locking. ##### Highlights - **Auto-lock all platforms after install** — When you install a tool, mise now automatically locks versions for all platforms (not just the current one). This means your `mise.lock` stays complete for teammates on different OSes without needing to run `mise lock` separately. [#8277](https://redirect.github.com/jdx/mise/pull/8277) - **Process group cleanup for tasks** — Task child processes are now managed via Unix process groups, so killing a task reliably takes down the entire process tree instead of leaving orphaned children. [#8279](https://redirect.github.com/jdx/mise/pull/8279) - **`depends_post` tasks run even on failure** — Post-dependency tasks (cleanup, notifications, etc.) now execute even when the parent task fails, matching the expected behavior for teardown-style hooks. [#8274](https://redirect.github.com/jdx/mise/pull/8274) ##### Bug Fixes - **Infinite shim recursion on Unix** — `mise exec` now strips its own shims from `PATH` before spawning subprocesses, preventing infinite recursion when a shimmed tool calls itself. [#8276](https://redirect.github.com/jdx/mise/pull/8276) - **`--yes` flag now works for config trust prompts** — The `--yes`/`-y` flag is now properly respected when mise prompts to trust a config file. [#8288](https://redirect.github.com/jdx/mise/pull/8288) - **`--locked --dry-run` validation order** — `mise install --locked` now validates the lock requirement before the `--dry-run` short-circuit, so you get a proper error instead of silent success. [#8290](https://redirect.github.com/jdx/mise/pull/8290) by [@altendky](https://redirect.github.com/altendky) - **JSON Schema compatibility** — Replaced `unevaluatedProperties` with `additionalProperties` in the mise JSON schema for broader validator support. [#8285](https://redirect.github.com/jdx/mise/pull/8285) - **Duplicate stderr on task failure** — Fixed tasks in replacing output mode printing error output twice on failure. [#8275](https://redirect.github.com/jdx/mise/pull/8275) - **Did-you-mean for task commands** — Mistyping a CLI subcommand now suggests similar task names. [#8286](https://redirect.github.com/jdx/mise/pull/8286) - **Monorepo prepare steps** — Prepare steps for subdirectory configs now execute from the repository root as expected. [#8291](https://redirect.github.com/jdx/mise/pull/8291) - **`mise upgrade` no longer force-reinstalls** — Previously installed versions are skipped during upgrade instead of being redundantly reinstalled. [#8282](https://redirect.github.com/jdx/mise/pull/8282) - **Terminal restore after `mise watch`** — `watchexec` no longer leaves the terminal in a broken state on exit. [#8273](https://redirect.github.com/jdx/mise/pull/8273) ##### Documentation - Clarified that `MISE_CEILING_PATHS` excludes the ceiling directory itself. [#8283](https://redirect.github.com/jdx/mise/pull/8283) ##### New Contributors - [@altendky](https://redirect.github.com/altendky) made their first contribution in [#8290](https://redirect.github.com/jdx/mise/pull/8290) ##### 📦 Aqua Registry Updates ##### New Packages (4) - [`Skarlso/crd-to-sample-yaml`](https://redirect.github.com/Skarlso/crd-to-sample-yaml) - [`kunobi-ninja/kunobi-releases`](https://redirect.github.com/kunobi-ninja/kunobi-releases) - [`swanysimon/markdownlint-rs`](https://redirect.github.com/swanysimon/markdownlint-rs) - [`tmux/tmux-builds`](https://redirect.github.com/tmux/tmux-builds) ##### Updated Packages (2) - [`firecow/gitlab-ci-local`](https://redirect.github.com/firecow/gitlab-ci-local) - [`k1LoW/runn`](https://redirect.github.com/k1LoW/runn) ### [`v2026.2.17`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.17): : Freshly Prepared [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.16...v2026.2.17) A moderate release with a handful of bug fixes and a new feature for the `prepare` system. ##### Highlights - **Prepare: auto-touch stale outputs** — When tools like `uv sync` skip work because dependencies are already satisfied, output files don't get updated, causing mise to consider them stale on the next run. Prepare providers now automatically touch output files after a successful command, keeping staleness checks accurate. This is controlled by a new `touch_outputs` config option (defaults to true). [#8243](https://redirect.github.com/jdx/mise/pull/8243) by [@halms](https://redirect.github.com/halms) - **Settings reorganization: `task_*` → `task.*`** — Nine flat `task_*` settings have been consolidated into a nested `task.*` namespace (e.g., `task_output` → `task.output`). The old names still work with no breaking changes — deprecation warnings won't appear until `2026.8.0`. [#8239](https://redirect.github.com/jdx/mise/pull/8239) ##### Bug Fixes - **Postinstall hooks now use correct bin paths** — Per-tool postinstall hooks were hardcoding `$install_path/bin` on `PATH`, which broke backends like aqua where binaries live in non-standard subdirectories. Hooks now use each backend's actual binary paths. [#8234](https://redirect.github.com/jdx/mise/pull/8234) - **`mise use` writes to the correct config file** — When both `config.toml` and `config.local.toml` exist, `mise use` was incorrectly writing to `config.local.toml`. It now properly targets `config.toml`. [#8240](https://redirect.github.com/jdx/mise/pull/8240) - **Legacy `.mise.backend` installs no longer block auto-migration** — Legacy backend files were defaulting to `explicit_backend = true`, which prevented auto-migration to updated registry backends. They now default to non-explicit, allowing tools like `glab` to resolve correctly through the current registry. [#8245](https://redirect.github.com/jdx/mise/pull/8245) by [@jean-humann](https://redirect.github.com/jean-humann) ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`namespacelabs/foundation/nsc`](https://redirect.github.com/namespacelabs/foundation/nsc) ### [`v2026.2.16`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.16): : MCP Gets Its Hands Dirty [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.15...v2026.2.16) This release brings MCP task execution support, better Node.js flavor guidance, and a solid round of bug fixes across several backends. ##### Highlights - **MCP `run_task` tool** — You can now execute mise tasks directly through the [MCP](https://mise.jdx.dev/) interface. The new `run_task` tool runs tasks via subprocess with full stdout/stderr capture, timeout support, and hardened execution. An `install_tool` stub is also included for future expansion. [#8179](https://redirect.github.com/jdx/mise/pull/8179) by [@joaommartins](https://redirect.github.com/joaommartins) - **Node flavor suggestions** — When a Node.js version isn't found in the configured mirror, mise now suggests setting `node.flavor` to help you get to the right download faster. [#8206](https://redirect.github.com/jdx/mise/pull/8206) by [@risu729](https://redirect.github.com/risu729) - **Registry stack overflow fix** — The registry `BTreeMap` is now built directly on the heap, eliminating a stack overflow that could occur with large registries. [#8214](https://redirect.github.com/jdx/mise/pull/8214) by [@risu729](https://redirect.github.com/risu729) ##### Bug Fixes - **Java version sorting** — Shorthand Java versions (e.g., `21`, `17`) now sort correctly. [#8197](https://redirect.github.com/jdx/mise/pull/8197) by [@roele](https://redirect.github.com/roele) - **Node env var migration** — Node-related environment variables have been properly migrated to the settings system. [#8200](https://redirect.github.com/jdx/mise/pull/8200) by [@risu729](https://redirect.github.com/risu729) - **Registry overrides in shims** — Registry overrides are now correctly applied when running tools through shims. [#8199](https://redirect.github.com/jdx/mise/pull/8199) by [@risu729](https://redirect.github.com/risu729) - **Rust outdated duplication** — Fixed `mise outdated` showing Rust versions twice. [#8209](https://redirect.github.com/jdx/mise/pull/8209) by [@roele](https://redirect.github.com/roele) - **GitHub aliased backend resolution** — Version lookups no longer break for tools aliased to a different backend than the registry default. [#8221](https://redirect.github.com/jdx/mise/pull/8221) - **GitHub attestation output** — Attestation verification success is now shown in progress output. [#8230](https://redirect.github.com/jdx/mise/pull/8230) - **Cargo binstall setting migration** — `MISE_CARGO_BINSTALL_ONLY` has been migrated to the settings system. [#8202](https://redirect.github.com/jdx/mise/pull/8202) by [@risu729](https://redirect.github.com/risu729) ##### New Tools - **typst** — GitHub backend added. [#8210](https://redirect.github.com/jdx/mise/pull/8210) by [@3w36zj6](https://redirect.github.com/3w36zj6) - **cargo-dist** — Now available via aqua registry. [#8153](https://redirect.github.com/jdx/mise/pull/8153) by [@risu729](https://redirect.github.com/risu729) - **release-plz** — Now available via aqua registry. [#8150](https://redirect.github.com/jdx/mise/pull/8150) by [@risu729](https://redirect.github.com/risu729) ### [`v2026.2.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.15): : Streaming in Order [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.14...v2026.2.15) This release brings a nice quality-of-life improvement to task execution along with a solid batch of bug fixes across several subsystems. ##### Highlights - **Real-time streaming for keep-order tasks** — The `keep_order` task output mode now streams the active task's output in real-time instead of buffering everything until completion. Other parallel tasks buffer quietly and flush in definition order as they finish, so you get live feedback without sacrificing deterministic output ordering. [#8164](https://redirect.github.com/jdx/mise/pull/8164) - **npm backend performance** — `npm view` is now called only once per package lookup instead of multiple times, speeding up npm-based tool resolution. Thanks [@risu729](https://redirect.github.com/risu729)! [#8181](https://redirect.github.com/jdx/mise/pull/8181) ##### Bug Fixes - **Recursive shim execution on Windows** — `mise exec` now strips the shims directory from PATH during executable lookup, preventing infinite recursion when shims call back into `mise x`. [#8189](https://redirect.github.com/jdx/mise/pull/8189) - **PATH reordering after activation** — `hook-env` now preserves any PATH reordering done after `mise activate` (e.g., by `~/.zlogin`), instead of silently reverting to the original order. [#8190](https://redirect.github.com/jdx/mise/pull/8190) - **Cross-platform lockfile resolution** — The aqua backend now correctly resolves lockfile artifacts for the target platform instead of leaking host-specific overrides into `mise lock --platform`. Thanks [@mackwic](https://redirect.github.com/mackwic)! [#8183](https://redirect.github.com/jdx/mise/pull/8183) - **Version alias lockfile lookup** — Version aliases (like `lts`) are now resolved before lockfile lookup, so locked versions are matched correctly. [#8194](https://redirect.github.com/jdx/mise/pull/8194) - **Task source freshness checks** — Freshness checks now work correctly with dynamic task directories. Thanks [@rooperuu](https://redirect.github.com/rooperuu)! [#8169](https://redirect.github.com/jdx/mise/pull/8169) - **Global tasks in monorepos** — Global tasks are now properly resolved when running from a monorepo root. [#8192](https://redirect.github.com/jdx/mise/pull/8192) - **Wildcard glob matching** — `test:*` no longer incorrectly matches the parent `test` task. [#8165](https://redirect.github.com/jdx/mise/pull/8165) - **task\_config.includes paths** — Include paths in task config are now resolved relative to the config root, not the working directory. [#8193](https://redirect.github.com/jdx/mise/pull/8193) - **Upgrade safety** — `mise upgrade` now skips untrusted tracked configs instead of failing. [#8195](https://redirect.github.com/jdx/mise/pull/8195) - **helm-diff registry entry** — Fixed the archive binary name for helm-diff. Thanks [@jean-humann](https://redirect.github.com/jean-humann)! [#8173](https://redirect.github.com/jdx/mise/pull/8173) ##### New Contributors Welcome [@jean-humann](https://redirect.github.com/jean-humann), [@mackwic](https://redirect.github.com/mackwic), and [@rooperuu](https://redirect.github.com/rooperuu)! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`BetterDiscord/cli`](https://redirect.github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://redirect.github.com/glossia.ai/cli) ### [`v2026.2.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.14) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.13...v2026.2.14) A feature-focused release adding vfox plugin env redaction, Deno devEngines support, and a new Rust default\_host setting. ##### Highlights - **Vfox env var redaction** — Vfox plugins can now request that specific environment variables be redacted from logs and debug output by returning a `redact` field in `MiseEnvResult`. Useful for plugins that inject secrets or tokens. [#8166](https://redirect.github.com/jdx/mise/pull/8166) - **Deno devEngines.runtime support** — Mise now reads the `devEngines.runtime` field from `package.json` to auto-detect the desired Deno version, matching the same convention already supported for Node. Thanks [@risu729](https://redirect.github.com/risu729)! [#8144](https://redirect.github.com/jdx/mise/pull/8144) - **`default_host` setting for Rust** — A new `rust.default_host` setting lets you override the Rust target triple used during installation, useful for cross-compilation setups. Thanks [@aacebedo](https://redirect.github.com/aacebedo)! [#8154](https://redirect.github.com/jdx/mise/pull/8154) - **Aqua `github_content` package support** — The aqua backend now supports packages hosted via GitHub content downloads (not just releases). Thanks [@risu729](https://redirect.github.com/risu729)! [#8147](https://redirect.github.com/jdx/mise/pull/8147) ##### Bug Fixes - **`mise edit` whitespace** — TOML values edited via `mise edit` no longer retain extra formatting whitespace. [#8162](https://redirect.github.com/jdx/mise/pull/8162) - **`--locked` for python/ubi** — The `--locked` flag now works correctly with python and ubi backends. [#8163](https://redirect.github.com/jdx/mise/pull/8163) - **npm update notifier** — The npm update notifier is now suppressed during `npm install`, preventing spurious output. Thanks [@risu729](https://redirect.github.com/risu729)! [#8152](https://redirect.github.com/jdx/mise/pull/8152) - **Asset matcher vsix penalty** — `.vsix` files are now deprioritized in asset matching, preventing incorrect downloads. Thanks [@risu729](https://redirect.github.com/risu729)! [#8151](https://redirect.github.com/jdx/mise/pull/8151) - **JSON schema updates** — Added missing `task_templates`, `extends`, and `timeout` fields to the mise.json schema. Thanks [@risu729](https://redirect.github.com/risu729)! [#8145](https://redirect.github.com/jdx/mise/pull/8145) ##### New Contributors Welcome [@joaommartins](https://redirect.github.com/joaommartins)! [#8133](https://redirect.github.com/jdx/mise/pull/8133) *** > **Note:** This release has no attached binary assets. The v2026.2.14 tag was created successfully but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. The binaries for this version are functionally identical to v2026.2.15 minus the additional fixes in that release. Use v2026.2.15 instead. ### [`v2026.2.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.13): : Fix GitHub attestation verification failures [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.12...v2026.2.13) This release partially mitigates GitHub attestation verification failures that were causing tool installations to fail (e.g., `gh`, and other aqua-backed tools with attestations enabled). See [#8142](https://redirect.github.com/jdx/mise/discussions/8142) for details. ##### What happened GitHub silently changed their attestations API to externalize bundle storage to Azure Blob Storage (`tmaproduction.blob.core.windows.net`) using [Snappy compression](https://google.github.io/snappy/), rather than returning bundles inline as JSON. The `gh` CLI had already been updated to handle this ([cli/cli#10185](https://redirect.github.com/cli/cli/pull/10185)), but third-party tools like mise were not yet aware of the new format, causing `"error decoding response body"` failures. ##### What this release does Bumps `sigstore-verification` to 0.2, which splits the reqwest dependency version from mise's (0.13 vs 0.12). This avoids Cargo feature unification that was causing mise's `gzip` feature to be applied to attestation requests, interfering with the Snappy-compressed responses. **Note:** A full fix with proper Snappy decompression support and auth token scoping landed in [sigstore-verification v0.2.1](https://redirect.github.com/jdx/sigstore-verification/releases/tag/v0.2.1) ([#22](https://redirect.github.com/jdx/sigstore-verification/pull/22), [#23](https://redirect.github.com/jdx/sigstore-verification/pull/23)) — expect a follow-up mise release with that bump. If you are still hitting issues, set `settings.aqua.github_attestations = false` as a workaround. ##### Dependency Updates - **Bumped `sigstore-verification` to 0.2** ([e8897c9](https://redirect.github.com/jdx/mise/commit/e8897c9fbc873fe272495a65e5a88b04b97f3b6d)) ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`k1LoW/tcmux`](https://redirect.github.com/k1LoW/tcmux) ##### Updated Packages (1) - [`jdx/usage`](https://redirect.github.com/jdx/usage) ### [`v2026.2.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.12) [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.11...v2026.2.12) A small release adding a new Java configuration option. ##### Highlights - **`java.shorthand_vendor` setting** — A new setting that lets you configure which vendor is used when specifying shorthand Java versions (e.g., `21` instead of `temurin-21`). Thanks [@roele](https://redirect.github.com/roele)! [#8134](https://redirect.github.com/jdx/mise/pull/8134) *** > **Note:** This release has no attached binary assets. The v2026.2.12 tag was created but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. Use v2026.2.13 or later instead. ### [`v2026.2.11`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.11): : Templates Level Up [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.10...aqua-registry-v2026.2.11) A small release with a nice quality-of-life improvement for tera template users and a bug fix for file watching. ##### Highlights - **Array access for multi-version tools in tera templates** — If you have multiple versions of a tool installed, you can now access them individually in tera templates via `tools.<name>[0].path`, `tools.<name>[1].path`, etc. Single-version tools continue to work as before with `tools.<name>.path`. [#8129](https://redirect.github.com/jdx/mise/pull/8129) ##### Bug Fixes - **hook-env now watches files used in tera templates** — Files referenced by template functions like `read_file()`, `hash_file()`, `file_size()`, and `last_modified()` are now properly tracked by `hook-env`. Previously, changes to these files wouldn't trigger an environment refresh until you changed directories. [#8122](https://redirect.github.com/jdx/mise/pull/8122) ##### New Tools - [mutagen](https://redirect.github.com/mutagen-io/mutagen) — thanks [@tony-sol](https://redirect.github.com/tony-sol)! [#8125](https://redirect.github.com/jdx/mise/pull/8125) - [communique](https://redirect.github.com/jdx/communique) [#8126](https://redirect.github.com/jdx/mise/pull/8126) ### [`v2026.2.10`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.10): : Shims, Stdin, and Smarter Offline [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.9...aqua-registry-v2026.2.10) This release brings several quality-of-life features alongside a solid round of bug fixes. ##### Highlights - **Shims as PATH fallback during activation** — When `not_found_auto_install` is enabled (the default), mise now adds the shims directory to your PATH as a fallback. This fixes a subtle issue where subshells or child processes could miss uninstalled tools or pick up the wrong system version instead of the mise-managed one. Thanks [@ctaintor](https://redirect.github.com/ctaintor) for this contribution! [#8106](https://redirect.github.com/jdx/mise/pull/8106) - **`tools` variable in Tera templates** — You can now reference `{{ tools.node.version }}` and `{{ tools.node.path }}` directly in env templates and task templates (with `tools = true`), eliminating the need for `exec(command='node --version')` workarounds. [#8108](https://redirect.github.com/jdx/mise/pull/8108) — [Template docs](https://mise.jdx.dev/environments/templates.html) - **`mise set --stdin` for multiline values** — Need to set an SSH key, certificate, or other multiline value as an environment variable? `mise set --stdin MY_KEY` now reads from stdin until EOF. [#8110](https://redirect.github.com/jdx/mise/pull/8110) ##### Bug Fixes - **`MISE_OFFLINE` now works correctly** — Previously, offline mode could hang or error out instead of gracefully falling back to local data. This is now fixed, and `offline`/`prefer_offline` are proper settings configurable in `mise.toml`. [#8109](https://redirect.github.com/jdx/mise/pull/8109) - **Upgrade symlink cleanup** — Fixed an issue where `mise upgrade` could leave behind invalid symlinks when uninstalling old versions, thanks [@roele](https://redirect.github.com/roele). [#8099](https://redirect.github.com/jdx/mise/pull/8099) [#8101](https://redirect.github.com/jdx/mise/pull/8101) - **Conda dependency resolution** — Improved patchelf handling and dependency version pinning for complex conda packages on Linux. [#8087](https://redirect.github.com/jdx/mise/pull/8087) - **SLSA provenance for Docker Buildx** — Tools like `github:docker/buildx` that ship in-toto statements without sigstore signatures no longer fail verification, thanks [@gerhard](https://redirect.github.com/gerhard). [#8094](https://redirect.github.com/jdx/mise/pull/8094) - **Vfox plugin auto-installation** — Fixed a clean-setup failure where vfox-backed env modules would error with "Plugin directory not found" before the plugin was installed, thanks [@pose](https://redirect.github.com/pose). [#8035](https://redirect.github.com/jdx/mise/pull/8035) - **GitHub `latest` version prefix** — The `v` prefix is no longer incorrectly added when resolving "latest" for GitHub release backends. [#8105](https://redirect.github.com/jdx/mise/pull/8105) - **GitLab tool options** — Tool options from config are now correctly resolved for aliased GitLab tools. [#8084](https://redirect.github.com/jdx/mise/pull/8084) - **Flutter version resolution** — Fixed version resolution by using `version_expr`. [#8081](https://redirect.github.com/jdx/mise/pull/8081) - **Tuist on Linux** — Registry now includes Linux support for tuist, thanks [@fortmarek](https://redirect.github.com/fortmarek). [#8102](https://redirect.github.com/jdx/mise/pull/8102) ##### Registry - Added conda backends for mysql, ffmpeg, ghc, vim, and several other previously asdf-only tools. [#8080](https://redirect.github.com/jdx/mise/pull/8080) [#8083](https://redirect.github.com/jdx/mise/pull/8083) - Added podman-tui, thanks [@tony-sol](https://redirect.github.com/tony-sol). [#8098](https://redirect.github.com/jdx/mise/pull/8098) ##### New Contributors Welcome [@ctaintor](https://redirect.github.com/ctaintor), [@rileychh](https://redirect.github.com/rileychh), [@fortmarek](https://redirect.github.com/fortmarek), [@pose](https://redirect.github.com/pose), and [@gerhard](https://redirect.github.com/gerhard) — thanks for your first contributions! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`entireio/cli`](https://redirect.github.com/entireio/cli) - [`rmitchellscott/reManager`](https://redirect.github.com/rmitchellscott/reManager) ##### Updated Packages (1) - [`atuinsh/atuin`](https://redirect.github.com/atuinsh/atuin) ### [`v2026.2.9`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.9): : Ruby Plays Nice with Legacy Linux [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.8...aqua-registry-v2026.2.9) This release brings a quality-of-life improvement for Ruby users on older Linux distributions, plus a couple of important bug fixes. ##### Highlights **Automatic Ruby variant selection for older glibc systems** ([#8069](https://redirect.github.com/jdx/mise/pull/8069)) If you're running Linux with glibc older than 2.35 (common on RHEL 7, Amazon Linux 2, CentOS 7, or older Debian/Ubuntu versions), mise will now automatically download the no-YJIT precompiled Ruby variant instead of failing with cryptic errors. This means precompiled Ruby "just works" on a much wider range of Linux systems without any manual configuration. Systems with glibc 2.35+ (Ubuntu 22.04+, Debian 12+, Fedora 36+) continue to get the standard YJIT-enabled builds as before. ##### Bug Fixes - **Windows shim updates with self-update** ([#8075](https://redirect.github.com/jdx/mise/pull/8075)) — `mise self-update` on Windows now properly updates `mise-shim.exe` alongside `mise.exe`. Previously, users had to manually download the shim from GitHub releases after updating. - **Fixed `cargo install mise`** ([#8077](https://redirect.github.com/jdx/mise/pull/8077)) — Bumped the `xx` dependency to 2.5 to fix an issue where Cargo was selecting an incompatible older version, causing installation failures. Thanks [@erickt](https://redirect.github.com/erickt) for the fix and welcome to mise! ##### Documentation - Ruby precompiled binaries are no longer marked as experimental ([#8073](https://redirect.github.com/jdx/mise/pull/8073)) — they're stable and ready for production use. ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`carthage-software/mago`](https://redirect.github.com/carthage-software/mago) ### [`v2026.2.8`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.8): : Hooks Get Their Act Together [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.7...aqua-registry-v2026.2.8) This release focuses on hooks—fixing 12 community-reported issues that were making them unreliable. There are also some nice quality-of-life improvements for Node.js and Ruby users. ##### Highlights **Hooks overhaul** — A comprehensive fix for the hooks system addressing a dozen issues reported by the community. Global hooks now actually work, hook execution order is corrected (leave fires before enter), infinite loops in fish shell are fixed, and postinstall hooks can now find all installed tools. [#8058](https://redirect.github.com/jdx/mise/pull/8058) **Node version detection from package.json** — mise now reads tool versions directly from `package.json` using the `devEngines` and `packageManager` fields. This means your Node, Bun, pnpm, yarn, and npm versions can be auto-detected without a separate `.tool-versions` or `mise.toml` file. Semver ranges are simplified automatically (`>=18.0.0` → `18`). [#8059](https://redirect.github.com/jdx/mise/pull/8059) **Precompiled Ruby goes stable** — You can now use precompiled Ruby binaries by setting `ruby.compile=false` without needing `experimental=true`. This will become the default in 2026.8.0. If you haven't tried it, precompiled Ruby installs in seconds instead of minutes. [#8052](https://redirect.github.com/jdx/mise/pull/8052) ##### New Features - **`--dry-run-code` flag** — Added to `install`, `upgrade`, `prune`, `uninstall`, and `use` commands. Behaves like `--dry-run` but exits with code 1 when there's work to do, enabling patterns like `if ! mise install --dry-run-code -q; then mise install; fi` [#8063](https://redirect.github.com/jdx/mise/pull/8063) ##### Bug Fixes - **MISE\_ARCH override** — The bun and erlang plugins now respect `MISE_ARCH` at runtime, which is useful for Windows ARM64 users running x64 binaries under emulation [#8062](https://redirect.github.com/jdx/mise/pull/8062) - **key=value format** — `mise settings set`, `mise settings add`, `mise config set`, and `mise shell-alias set` now accept `key=value` as a single argument [#8053](https://redirect.github.com/jdx/mise/pull/8053) ##### Registry - Added **quicktype** (`npm:quicktype`) — thanks [@zdunecki](https://redirect.github.com/zdunecki)! [#8054](https://redirect.github.com/jdx/mise/pull/8054) ##### Dependencies - Upgraded to TOML 1.1 support via toml 0.9 and toml\_edit 0.24 [#8057](https://redirect.github.com/jdx/mise/pull/8057) ### [`v2026.2.7`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.7): : Windows Gets Real [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.6...aqua-registry-v2026.2.7) This release brings a significant improvement for Windows users with native `.exe` shims, along with several bug fixes that improve the reliability of tool installation and version resolution. ##### Highlights **Native Windows Shims** ([#8045](https://redirect.github.com/jdx/mise/pull/8045)) mise now generates native `.exe` shim files instead of `.cmd` batch scripts. This resolves a whole category of frustrating issues: - No more intermittent `ENOENT` errors from `spawnSync` in node - `where.exe` now correctly finds your tools - Better compatibility with package managers like npm and bun that expect real executables - Proper control flow in batch scripts The new `"exe"` mode is now the default for `windows_shim_mode`. This follows the same pattern used by Scoop, Volta, and Chocolatey. If you need to switch back, you can set `windows_shim_mode = "file"` in your settings. Thanks to [@iki](https://redirect.github.com/iki) for helping with this. ##### Bug Fixes - **Config options preserved during CLI installs** ([#8044](https://redirect.github.com/jdx/mise/pull/8044)) - Running `mise install tool@version` with an explicit version no longer loses tool-level config options like `postinstall` from your `mise.toml`. Registry defaults (like `uvx=false` or `pipx_args`) are also preserved when using table syntax. - **Linked versions take priority over lockfiles** ([#8050](https://redirect.github.com/jdx/mise/pull/8050)) - Tools created with `mise link` now correctly override lockfile entries during version resolution. Previously, a lockfile pin would override your linked version, causing confusing "missing" warnings. - **Fixed duplicate entries in `ls --all-sources`** ([#8042](https://redirect.github.com/jdx/mise/pull/8042)) - Thanks [@roele](https://redirect.github.com/roele)! ##### Registry Updates - Switched `oxlint` to use npm backend by default ([#8038](https://redirect.github.com/jdx/mise/pull/8038)) - Thanks [@risu729](https://redirect.github.com/risu729)! - Added `orval` for OpenAPI client generation: `mise use orval` ([#8051](https://redirect.github.com/jdx/mise/pull/8051)) - Thanks [@zdunecki](https://redirect.github.com/zdunecki) for your first contribution! ### [`v2026.2.6`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.6): : Shell Expansion & Source Tracking [Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.2.5...v2026.2.6) This release brings a couple of nice quality-of-life improvements alongside several bug fixes. ##### Highlights **Shell-style variable expansion in env values** ([#8029](https://redirect.github.com/jdx/mise/pull/8029)) - You can now use shell-style variable expansion like `${VAR:-default}` and `${VAR:+alternate}` directly in your `mise.toml` environment variables. This makes it easier to set up flexible configurations without needing to drop into shell scripts. **New `--all-sources` flag for `mise ls`** ([#8019](https://redirect.github.com/jdx/mise/pull/8019)) - Thanks to [@TylerHillery](https://redirect.github.com/TylerHillery) for adding this flag, which shows all the sources where a tool version is defined. Useful for debugging why a particular version is being used when you have multiple config files. ##### Bug Fixes - **gem backend**: Fixed Windows support and resolved a newline issue in gem scripts ([#8031](https://redirect.github.com/jdx/mise/pull/8031), [#8034](https://redirect.github.com/jdx/mise/pull/8034)) - Thanks [@my1e5](https://redirect.github.com/my1e5)! - **lockfile**: Tools are now written to the lockfile matching their source config, fixing issues where lockfile entries could get misattributed ([#8012](https://redirect.github.com/jdx/mise/pull/8012)) - **mise ls**: Sources in `--all-sources` output are now sorted deterministically ([#8037](https://redirect.github.com/jdx/mise/pull/8037)) - **tasks**: File tasks now auto-install tools defined in `mise.toml`, matching the behavior of inline tasks ([#8030](https://redirect.github.com/jdx/mise/pull/8030)) ##### Security - Updated the `time` crate to 0.3.47 to address RUSTSEC-2026-0009 ([#8026](https://redirect.github.com/jdx/mise/pull/8026)) ##### New Tools - [tirith](https://redirect.github.com/sheeki03/tirith) - Thanks [@sheeki03](https://redirect.github.com/sheeki03)! - [mas](https://redirect.github.com/mas-cli/mas) (Mac App Store CLI) - Thanks [@TyceHerrman](https://redirect.github.com/TyceHerrman)! ##### New Contributors Welcome to [@sheeki03](https://redirect.github.com/sheeki03) and [@TylerHillery](https://redirect.github.com/TylerHillery) for their first contributions! ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`kubernetes-sigs/kubectl-validate`](https://redirect.github.com/kubernetes-sigs/kubectl-validate) ##### Updated Packages (6) - [`flux-iac/tofu-controller/tfctl`](https://redirect.github.com/flux-iac/tofu-controller/tfctl) - [`gogs/gogs`](https://redirect.github.com/gogs/gogs) - [`j178/prek`](https://redirect.github.com/j178/prek) - [`syncthing/syncthing`](https://redirect.github.com/syncthing/syncthing) - [`tuist/tuist`](https://redirect.github.com/tuist/tuist) - [`yaml/yamlscript`](https://redirect.github.com/yaml/yamlscript) ### [`v2026.2.5`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.5): : Lockfiles Break Free [Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.2.4...vfox-v2026.2.5) This is a small maintenance release with one user-facing improvement. ##### Bug Fixes - **Lockfiles no longer require experimental mode** - You can now use `mise.lock` files without setting `experimental = true` in your configuration. Lockfiles help ensure reproducible tool versions across your team, and this change makes them accessible to everyone by default. ([#8011](https://redirect.github.com/jdx/mise/pull/8011)) For more information on lockfiles, see the [documentation](https://mise.jdx.dev/configuration/mise-lock.html). ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`uutils/coreutils`](https://redirect.github.com/uutils/coreutils) ### [`v2026.2.4`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.4): : Taming the Environment [Compare Source](https://redirect.github.com/jdx/mise/compare/mise-interactive-config-v2026.2.3...vfox-v2026.2.4) This release focuses on fixing several edge cases in environment handling and tool management. Users working with complex environment configurations, npm package managers, and locked tool versions will find this update particularly helpful. ##### Bug Fixes - **Environment variable resolution for tool templates**: When using `env._.source` to source environment files, tool templates now correctly resolve the sourced environment variables. Previously, tool version templates that depended on sourced env vars might not have worked as expected. Thanks to [@corymhall](https://redirect.github.com/corymhall) for this fix! [#7895](https://redirect.github.com/jdx/mise/pull/7895) - **npm package manager dependencies**: When using mise to manage Node.js package managers (npm, yarn, pnpm, bun), mise now only declares the specifically configured package manager as a dependency rather than all of them. This prevents unnecessary dependency resolution issues. [#7995](https://redirect.github.com/jdx/mise/pull/7995) - **Respect `use_locked_version` during upgrades**: The `mise upgrade` command now properly respects the `use_locked_version` setting when checking tracked configs. If you have this setting enabled, upgrades will now correctly use the locked versions from your config files. [#7997](https://redirect.github.com/jdx/mise/pull/7997) - **Ignore `MISE_TOOL_VERSION` in env parsing**: Fixed an issue where the internal `MISE_TOOL_VERSION` environment variable could interfere with environment variable parsing, preventing potential conflicts in certain workflows. [#8004](https://redirect.github.com/jdx/mise/pull/8004) ##### New Contributors Welcome to [@corymhall](https://redirect.github.com/corymhall) who made their first contribution to mise! 🎉 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/hetznercloud/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.2.11` → `v2026.2.24` | --- ### Release Notes <details> <summary>jdx/mise (mise)</summary> ### [`v2026.2.24`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.24): : Hooks get Tera templates, aqua cache cleanup, and better error messages [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.23...v2026.2.24) A bug-fix release that enables Tera template rendering in hooks, eliminates a class of stale PATH bugs with aqua tools, improves error messages for unsupported registry tools, and removes the long-deprecated `python.venv_auto_create` setting. #### Fixed - **Hooks now support Tera template rendering** -- Hook scripts can now use Tera template variables like `{{tools.ripgrep.path}}`, just like tasks. Additionally, the install progress bar is now cleared before postinstall hooks run, so hook output is no longer masked by the progress UI. Preinstall hooks correctly skip `tools=true` env directives since referenced tools may not yet be installed. [#8385](https://redirect.github.com/jdx/mise/pull/8385) by [@jdx](https://redirect.github.com/jdx) - **Aqua tool PATH entries no longer go stale** -- The aqua backend's `bin_paths` disk cache (`bin_paths.msgpack.z`) has been removed entirely. This cache provided negligible performance benefit -- reading and decompressing a msgpack file is comparable to parsing the small YAML registry entry -- but was the root cause of stale PATH entries after tool installs (e.g. upgrading `uv` causing its PATH entry to vanish). The previous fix in v2026.2.23 was raceable by concurrent `mise hook-env` calls; removing the cache eliminates this class of bugs completely. [#8383](https://redirect.github.com/jdx/mise/pull/8383) by [@jdx](https://redirect.github.com/jdx) - **Better error when a registry tool has no supported backends** -- When a tool exists in the registry but all its backends are filtered out for the current platform or configuration (e.g. `imagemagick` on a platform where only `conda` and `asdf` backends are registered but disabled), the error now clearly explains the situation and lists the registered backends instead of suggesting the user meant the exact tool name they already typed. [#8388](https://redirect.github.com/jdx/mise/pull/8388) by [@jdx](https://redirect.github.com/jdx) #### Removed - **Deprecated `python.venv_auto_create` setting removed** -- The `python.venv_auto_create` and `python_venv_auto_create` settings have been fully removed. These were deprecated in favor of the `_.python.venv` configuration. If you were relying on the legacy `virtualenv` tool option to auto-create venvs, mise will now warn and print manual creation instructions instead. Migrate to the newer venv configuration: [#8384](https://redirect.github.com/jdx/mise/pull/8384) by [@jdx](https://redirect.github.com/jdx) ```toml [tools] python = { version = "3.12", _.python.venv = { path = ".venv", create = true } } ``` #### Breaking Changes - The `python.venv_auto_create` and `python_venv_auto_create` settings no longer exist. If you still have these in your configuration, they will be silently ignored. Use `_.python.venv = { path = ".venv", create = true }` in your tool configuration instead. [#8384](https://redirect.github.com/jdx/mise/pull/8384) **Full Changelog**: <jdx/mise@v2026.2.23...v2026.2.24> ### [`v2026.2.23`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.23): : Stricter lockfile enforcement and vfox backend options [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.22...v2026.2.23) This release tightens lockfile behavior in `--locked` mode, fixes a stale PATH cache issue with aqua-based tools, resolves intermittent panics with remote git tasks, and adds the ability to pass custom options to vfox backend plugins. #### Added - **Custom options for vfox backend plugins** -- Options defined in `mise.toml` tool entries are now passed through to vfox backend plugins in both `BackendInstall` and `BackendExecEnv` contexts, accessible in Lua via `ctx.options`. This enables custom plugin use cases like controlling build parameters. [#8369](https://redirect.github.com/jdx/mise/pull/8369) by [@Attempt3035](https://redirect.github.com/Attempt3035) ```toml [tools] "llvm:clang" = { version = "latest", build_cores = "22" } ``` ```lua function PLUGIN:BackendInstall(ctx) local cores = ctx.options.build_cores -- use cores in your build logic end ``` - **Registry: porter** -- Added [Porter](https://porter.sh), a CNAB bundle authoring and management tool (`github:getporter/porter`). [#8380](https://redirect.github.com/jdx/mise/pull/8380) by [@lbergnehr](https://redirect.github.com/lbergnehr) - **Registry: entire** -- Added entire CLI (`aqua:entireio/cli`). [#8378](https://redirect.github.com/jdx/mise/pull/8378) by [@TyceHerrman](https://redirect.github.com/TyceHerrman) - **Registry: topgrade** -- Added topgrade (`aqua:topgrade-rs/topgrade`), an all-in-one system upgrade tool. [#8377](https://redirect.github.com/jdx/mise/pull/8377) by [@TyceHerrman](https://redirect.github.com/TyceHerrman) #### Fixed - **`--locked` mode now strictly enforces the lockfile** -- Previously, `mise lock` could still run while `--locked` was active, `mise use tool@latest` could bypass the lockfile, and tools missing from the lockfile would silently fall through to remote resolution. Now `mise lock` refuses to run in locked mode with a clear error and hint, `mise use tool@latest` respects the lockfile when locked, and missing tools fail fast with an actionable message instead of resolving remotely. [#8362](https://redirect.github.com/jdx/mise/pull/8362) by [@jdx](https://redirect.github.com/jdx) - **Aqua tool PATH entries no longer go missing after install** -- The `list_bin_paths()` cache could be populated with stale (empty) data before extraction finished, or by a concurrent `mise hook-env` call during installation. The in-memory and on-disk `bin_paths` caches are now cleared after an aqua tool install completes so paths are recomputed from the freshly installed files. Fixes an issue where upgrading tools like `uv` caused their PATH entry to vanish. [#8374](https://redirect.github.com/jdx/mise/pull/8374) by [@jdx](https://redirect.github.com/jdx) - **Remote git task cache no longer panics or corrupts on concurrent access** -- Replaced `println!`/`eprintln!` with non-panicking `writeln!` to handle EPIPE gracefully, and added file locking with clone-to-temp-then-rename to prevent concurrent cache corruption when multiple mise processes fetch the same remote git task simultaneously. [#8375](https://redirect.github.com/jdx/mise/pull/8375) by [@vmaleze](https://redirect.github.com/vmaleze) #### New Contributors - [@Attempt3035](https://redirect.github.com/Attempt3035) made their first contribution in [#8369](https://redirect.github.com/jdx/mise/pull/8369) - [@lbergnehr](https://redirect.github.com/lbergnehr) made their first contribution in [#8380](https://redirect.github.com/jdx/mise/pull/8380) **Full Changelog**: <jdx/mise@v2026.2.22...v2026.2.23> ### [`v2026.2.22`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.22): : Outdated plugins, rename_exe fixes, and smoother installs [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.21...v2026.2.22) A small release adding a new way to check for outdated plugins, along with three bug fixes for archive installs, tool environment resolution, and cross-platform Ruby lockfiles. #### Added - **`mise plugins ls --outdated` flag** -- A new `-o`/`--outdated` flag checks remote git refs in parallel and displays only plugins where the local SHA differs from the remote. Shows a table with plugin name, URL, ref, local SHA, and remote SHA. Prints "All plugins are up to date" when everything is current. [#8360](https://redirect.github.com/jdx/mise/pull/8360) by [@jdx](https://redirect.github.com/jdx) ```sh $ mise plugins ls --outdated Plugin Url Ref Local Remote tiny https://github.com/mise-plugins/rtx-tiny.git main abc1234 def5678 ``` #### Fixed - **`rename_exe` works with archives containing a `bin/` subdirectory** -- When an archive extracts to a layout like `prefix/bin/binary`, the `rename_exe` option was silently skipped because it searched the extraction root non-recursively instead of the `bin/` subdirectory where the binary actually lives. Both the GitHub-style backend and the HTTP backend now auto-detect the `bin/` subdirectory as the search directory, matching the same logic used by `discover_bin_paths()` for PATH construction. [#8358](https://redirect.github.com/jdx/mise/pull/8358) by [@jdx](https://redirect.github.com/jdx) - **Installing cargo/npm/pipx tools no longer crashes with `tools = true` env directives** -- When `[env]` contained entries like `NODE_VERSION = { value = "{{ tools.node.version }}", tools = true }`, installing npm/cargo/pipx tools would fail with "Variable not found in context" because the referenced tools might not be installed yet. The cargo, npm, and pipx backends now skip `tools = true` env directive resolution during installation while still including tool paths in PATH. [#8356](https://redirect.github.com/jdx/mise/pull/8356) by [@jdx](https://redirect.github.com/jdx) - **Ruby lockfile resolves correct Windows checksums** -- Running `mise lock` on macOS/Linux now correctly resolves RubyInstaller2 binary URLs and checksums for Windows platform entries, instead of incorrectly using the MRI source tarball checksum. The lockfile generator now fetches the correct `.7z` asset from the `oneclick/rubyinstaller2` GitHub releases for Windows targets. [#8357](https://redirect.github.com/jdx/mise/pull/8357) by [@jdx](https://redirect.github.com/jdx) #### Changed - **Registry: terradozer switched to GitHub fork** -- The terradozer registry entry now points to `github:chenrui333/terradozer` (replacing the archived asdf plugin and unavailable aqua backend), and is restricted to Linux and macOS. [#8365](https://redirect.github.com/jdx/mise/pull/8365) by [@chenrui333](https://redirect.github.com/chenrui333) #### New Contributors - [@chenrui333](https://redirect.github.com/chenrui333) made their first contribution in [#8365](https://redirect.github.com/jdx/mise/pull/8365) **Full Changelog**: <jdx/mise@v2026.2.21...v2026.2.22> ### [`v2026.2.21`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.21): : Bug fix roundup for monorepo tasks, conda noarch, and exec PATH handling [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.20...v2026.2.21) A bug-fix release addressing several regressions and long-standing issues: monorepo task variables and glob dependencies now resolve correctly, the conda backend can install Python noarch packages, `mise x` respects virtualenv PATH ordering again, and nested task execution no longer hangs. #### Fixed - **`mise x` respects virtualenv PATH order again** -- A pre-resolution step added in v2026.2.17 ([#8276](https://redirect.github.com/jdx/mise/pull/8276)) resolved bare command names directly to mise-managed tool paths, bypassing PATH entirely. This broke `_.python.venv` and similar configs where a virtualenv binary should take precedence over the mise-managed install. The pre-resolution is removed; shim stripping in `exec_program` (also from [#8276](https://redirect.github.com/jdx/mise/issues/8276)) is sufficient to prevent recursion. [#8342](https://redirect.github.com/jdx/mise/pull/8342) by [@jdx](https://redirect.github.com/jdx) - **Conda noarch Python packages install correctly** -- Installing noarch Python packages via the conda backend (e.g. `mise use conda:ruff`) failed because the linker didn't know the Python version needed to compute `site-packages` paths. The solver's resolved Python version is now extracted and passed through to `link_package`, fixing the error. [#8349](https://redirect.github.com/jdx/mise/pull/8349) by [@wolfv](https://redirect.github.com/wolfv) - **Nested mise tasks no longer hang** -- The process group isolation (`setpgid`/`killpg`) introduced in v2026.2.18 and refined in v2026.2.19 has been fully reverted. When tools like Playwright use process-group-based kills (`kill(-pid, SIGKILL)`) to tear down a server subprocess tree, grandchild processes in a separate group (created by mise's `setpgid`) survived and held pipes open, causing indefinite hangs. mise now sends signals directly to child PIDs instead. [#8347](https://redirect.github.com/jdx/mise/pull/8347) by [@jdx](https://redirect.github.com/jdx) - **Monorepo tasks resolve `[vars]` from subdirectory configs** -- Running a monorepo task like `mise run //infra/stacks/gcp:greet` failed to pick up `[vars]` defined in subdirectory `.mise.toml` files, causing template rendering errors. Variables are now resolved from the task's full config hierarchy (including `mise.<env>.toml` overlays) and threaded through script rendering. [#8343](https://redirect.github.com/jdx/mise/pull/8343) by [@jdx](https://redirect.github.com/jdx) - **Monorepo glob dependencies trigger subdirectory prepare steps** -- When a root task depended on a monorepo glob pattern like `//...:check`, the prepare phase only collected configs from top-level tasks, missing subdirectory tasks entirely. Dependencies are now resolved before prepare runs, so transitive subdirectory tasks and their prepare providers are properly discovered. [#8353](https://redirect.github.com/jdx/mise/pull/8353) by [@jdx](https://redirect.github.com/jdx) #### New Contributors - [@wolfv](https://redirect.github.com/wolfv) made their first contribution in [#8349](https://redirect.github.com/jdx/mise/pull/8349) **Full Changelog**: <jdx/mise@v2026.2.20...v2026.2.21> ### [`v2026.2.20`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.20): : Conda rewrite, .NET SDK core plugin, and per-task timeouts [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.19...v2026.2.20) A feature-packed release that replaces the conda backend with production-grade internals, adds a native .NET SDK plugin, and finally enforces per-task timeouts. Several lockfile and environment-handling fixes round things out. #### Highlights - **Conda backend rewritten with rattler** -- The experimental conda backend has been completely rewritten to use the [rattler](https://redirect.github.com/conda/rattler) Rust crates (the same engine behind pixi), replacing \~1,600 lines of custom code that relied on the unsupported anaconda.org API. This brings a proper SAT-based dependency solver, correct binary prefix replacement, and repodata caching via CDN. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) - **Native .NET SDK management** -- A new core plugin for .NET SDK installs all versions side-by-side under a shared `DOTNET_ROOT`, matching .NET's native multi-version model. It uses Microsoft's official `dotnet-install` script and supports `global.json` for per-project SDK pinning. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeouts are now enforced** -- The `timeout` field on tasks (added in v2025.1.6 but never wired up) now actually kills tasks that exceed their limit. Timeouts send SIGTERM with a 5-second grace period before SIGKILL, and both per-task and global `task_timeout` settings are respected. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) #### Added - **Core .NET SDK plugin** -- `mise use dotnet@8` now installs via a native core plugin with side-by-side version support and `global.json` detection. Configure `DOTNET_ROOT` via the new `dotnet.dotnet_root` setting. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeout enforcement** -- Tasks with a `timeout` field are now killed if they exceed the configured duration. Works with both per-task config and the global `task_timeout`/`--timeout` flag. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) ```toml [tasks.deploy] run = "npm run deploy" timeout = "5m" ``` - **VSIX archive support** -- The HTTP backend now recognizes `.vsix` files as ZIP archives and extracts them correctly, enabling tools distributed as VS Code extensions to be installed via `http:` URLs. [#8306](https://redirect.github.com/jdx/mise/pull/8306) by [@sosumappu](https://redirect.github.com/sosumappu) - **Registry: `oxfmt`** -- Added the oxfmt formatter to the tool registry. [#8316](https://redirect.github.com/jdx/mise/pull/8316) by [@taoufik07](https://redirect.github.com/taoufik07) #### Changed - **Conda backend rewritten with rattler crates** -- Replaces custom version matching, dependency resolution, archive extraction, and binary patching with the battle-tested rattler ecosystem (`rattler_solve`, `rattler_repodata_gateway`, `rattler::install`). Binary prefix replacement now works correctly (the old code skipped binary files entirely). Since the conda backend is still experimental, this is a non-breaking change. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) #### Fixed - **Lockfile not modified with `--locked`** -- `mise install --locked` no longer writes to `mise.lock`, matching the semantics of `cargo install --locked` and `uv pip install --locked`. [#8308](https://redirect.github.com/jdx/mise/pull/8308) by [@jdx](https://redirect.github.com/jdx) - **Orphan lockfile entries pruned** -- `mise lock` now removes stale tool entries that are no longer present in config, keeping the lockfile aligned with the current toolset. [#8265](https://redirect.github.com/jdx/mise/pull/8265) by [@mackwic](https://redirect.github.com/mackwic) - **Contradictory lockfile config caught early** -- Setting `locked=true` alongside `lockfile=false` now produces a clear error instead of silently ignoring the lock. [#8329](https://redirect.github.com/jdx/mise/pull/8329) by [@jdx](https://redirect.github.com/jdx) - **`watch_files` triggers on every change** -- The hook-env fast-path now checks `[[watch_files]]` paths, fixing a bug where only the first file change triggered the associated run command. [#8317](https://redirect.github.com/jdx/mise/pull/8317) by [@jdx](https://redirect.github.com/jdx) - **Fish alias completions cleaned up** -- Setting or unsetting shell aliases in fish now clears stale completions, preventing tab-complete from offering outdated suggestions. [#8324](https://redirect.github.com/jdx/mise/pull/8324) by [@jdx](https://redirect.github.com/jdx) - **JSON schema accepts age-encrypted env values** -- Fixed a `oneOf` ambiguity in the mise schema that rejected `[env]` entries using age encryption. [#8328](https://redirect.github.com/jdx/mise/pull/8328) by [@adamliang0](https://redirect.github.com/adamliang0) - **Regal registry updated** -- The regal tool now points to its new home at `open-policy-agent/regal`. [#8315](https://redirect.github.com/jdx/mise/pull/8315) by [@charlieegan3](https://redirect.github.com/charlieegan3) - **Conda: locked installs preserve package data** -- `conda_packages` entries are no longer silently dropped during `--locked` installs, and concurrent downloads no longer race on the same temp file. [#8335](https://redirect.github.com/jdx/mise/pull/8335) by [@jdx](https://redirect.github.com/jdx) - **Conda: solver no longer fails on Linux** -- Deduplicated repodata records before passing them to the solver, fixing "duplicate records" errors when installing tools like imagemagick. [#8337](https://redirect.github.com/jdx/mise/pull/8337) by [@jdx](https://redirect.github.com/jdx) #### New Contributors - [@tvararu](https://redirect.github.com/tvararu) made their first contribution in [#8250](https://redirect.github.com/jdx/mise/pull/8250) - [@sosumappu](https://redirect.github.com/sosumappu) made their first contribution in [#8306](https://redirect.github.com/jdx/mise/pull/8306) - [@charlieegan3](https://redirect.github.com/charlieegan3) made their first contribution in [#8315](https://redirect.github.com/jdx/mise/pull/8315) - [@taoufik07](https://redirect.github.com/taoufik07) made their first contribution in [#8316](https://redirect.github.com/jdx/mise/pull/8316) - [@adamliang0](https://redirect.github.com/adamliang0) made their first contribution in [#8328](https://redirect.github.com/jdx/mise/pull/8328) - [@mackwic](https://redirect.github.com/mackwic) made their first contribution in [#8265](https://redirect.github.com/jdx/mise/pull/8265) **Full Changelog**: <jdx/mise@v2026.2.19...v2026.2.20> ### [`v2026.2.19`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.19): : Fixes for interactive tasks and failed install cleanup [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.18...v2026.2.19) A small patch release with two targeted bug fixes: a regression fix for interactive task execution and better cleanup after failed installs. ##### Bug Fixes - **Interactive tasks no longer hang** -- The process group isolation added in v2026.2.18 ([#8279](https://redirect.github.com/jdx/mise/pull/8279)) inadvertently broke interactive tools like Tilt that read from stdin. When a child process was moved to its own process group, the terminal wouldn't deliver keyboard input to it, causing `SIGTTIN` and a silent hang. mise now checks whether stdin is a TTY before calling `setpgid` -- interactive tasks stay in the terminal's foreground process group for proper keyboard I/O, while non-interactive tasks still get their own process group for clean signal teardown. [#8301](https://redirect.github.com/jdx/mise/pull/8301) by [@jdx](https://redirect.github.com/jdx) - **Failed installs clean up properly** -- When an install fails (e.g. a 404 for a non-existent version or a 403 from GitHub rate limiting), mise now removes the empty parent directory (e.g. `installs/tilt/`) and the stale incomplete marker from cache, instead of leaving them behind. [#8302](https://redirect.github.com/jdx/mise/pull/8302) by [@jdx](https://redirect.github.com/jdx) ##### Documentation - Fixed the ripgrep command in the getting-started guide to use the correct binary name `rg` instead of `ripgrep`. [#8299](https://redirect.github.com/jdx/mise/pull/8299) by [@nguyenvulong](https://redirect.github.com/nguyenvulong) **Full Changelog**: <jdx/mise@v2026.2.18...v2026.2.19> ### [`v2026.2.18`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.18): : Task Reliability & Developer Experience [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.17...v2026.2.18) A bug-fix-heavy release focused on task execution reliability, with a new feature for cross-platform tool locking. ##### Highlights - **Auto-lock all platforms after install** — When you install a tool, mise now automatically locks versions for all platforms (not just the current one). This means your `mise.lock` stays complete for teammates on different OSes without needing to run `mise lock` separately. [#8277](https://redirect.github.com/jdx/mise/pull/8277) - **Process group cleanup for tasks** — Task child processes are now managed via Unix process groups, so killing a task reliably takes down the entire process tree instead of leaving orphaned children. [#8279](https://redirect.github.com/jdx/mise/pull/8279) - **`depends_post` tasks run even on failure** — Post-dependency tasks (cleanup, notifications, etc.) now execute even when the parent task fails, matching the expected behavior for teardown-style hooks. [#8274](https://redirect.github.com/jdx/mise/pull/8274) ##### Bug Fixes - **Infinite shim recursion on Unix** — `mise exec` now strips its own shims from `PATH` before spawning subprocesses, preventing infinite recursion when a shimmed tool calls itself. [#8276](https://redirect.github.com/jdx/mise/pull/8276) - **`--yes` flag now works for config trust prompts** — The `--yes`/`-y` flag is now properly respected when mise prompts to trust a config file. [#8288](https://redirect.github.com/jdx/mise/pull/8288) - **`--locked --dry-run` validation order** — `mise install --locked` now validates the lock requirement before the `--dry-run` short-circuit, so you get a proper error instead of silent success. [#8290](https://redirect.github.com/jdx/mise/pull/8290) by [@altendky](https://redirect.github.com/altendky) - **JSON Schema compatibility** — Replaced `unevaluatedProperties` with `additionalProperties` in the mise JSON schema for broader validator support. [#8285](https://redirect.github.com/jdx/mise/pull/8285) - **Duplicate stderr on task failure** — Fixed tasks in replacing output mode printing error output twice on failure. [#8275](https://redirect.github.com/jdx/mise/pull/8275) - **Did-you-mean for task commands** — Mistyping a CLI subcommand now suggests similar task names. [#8286](https://redirect.github.com/jdx/mise/pull/8286) - **Monorepo prepare steps** — Prepare steps for subdirectory configs now execute from the repository root as expected. [#8291](https://redirect.github.com/jdx/mise/pull/8291) - **`mise upgrade` no longer force-reinstalls** — Previously installed versions are skipped during upgrade instead of being redundantly reinstalled. [#8282](https://redirect.github.com/jdx/mise/pull/8282) - **Terminal restore after `mise watch`** — `watchexec` no longer leaves the terminal in a broken state on exit. [#8273](https://redirect.github.com/jdx/mise/pull/8273) ##### Documentation - Clarified that `MISE_CEILING_PATHS` excludes the ceiling directory itself. [#8283](https://redirect.github.com/jdx/mise/pull/8283) ##### New Contributors - [@altendky](https://redirect.github.com/altendky) made their first contribution in [#8290](https://redirect.github.com/jdx/mise/pull/8290) ##### 📦 Aqua Registry Updates ##### New Packages (4) - [`Skarlso/crd-to-sample-yaml`](https://redirect.github.com/Skarlso/crd-to-sample-yaml) - [`kunobi-ninja/kunobi-releases`](https://redirect.github.com/kunobi-ninja/kunobi-releases) - [`swanysimon/markdownlint-rs`](https://redirect.github.com/swanysimon/markdownlint-rs) - [`tmux/tmux-builds`](https://redirect.github.com/tmux/tmux-builds) ##### Updated Packages (2) - [`firecow/gitlab-ci-local`](https://redirect.github.com/firecow/gitlab-ci-local) - [`k1LoW/runn`](https://redirect.github.com/k1LoW/runn) ### [`v2026.2.17`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.17): : Freshly Prepared [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.16...v2026.2.17) A moderate release with a handful of bug fixes and a new feature for the `prepare` system. ##### Highlights - **Prepare: auto-touch stale outputs** — When tools like `uv sync` skip work because dependencies are already satisfied, output files don't get updated, causing mise to consider them stale on the next run. Prepare providers now automatically touch output files after a successful command, keeping staleness checks accurate. This is controlled by a new `touch_outputs` config option (defaults to true). [#8243](https://redirect.github.com/jdx/mise/pull/8243) by [@halms](https://redirect.github.com/halms) - **Settings reorganization: `task_*` → `task.*`** — Nine flat `task_*` settings have been consolidated into a nested `task.*` namespace (e.g., `task_output` → `task.output`). The old names still work with no breaking changes — deprecation warnings won't appear until `2026.8.0`. [#8239](https://redirect.github.com/jdx/mise/pull/8239) ##### Bug Fixes - **Postinstall hooks now use correct bin paths** — Per-tool postinstall hooks were hardcoding `$install_path/bin` on `PATH`, which broke backends like aqua where binaries live in non-standard subdirectories. Hooks now use each backend's actual binary paths. [#8234](https://redirect.github.com/jdx/mise/pull/8234) - **`mise use` writes to the correct config file** — When both `config.toml` and `config.local.toml` exist, `mise use` was incorrectly writing to `config.local.toml`. It now properly targets `config.toml`. [#8240](https://redirect.github.com/jdx/mise/pull/8240) - **Legacy `.mise.backend` installs no longer block auto-migration** — Legacy backend files were defaulting to `explicit_backend = true`, which prevented auto-migration to updated registry backends. They now default to non-explicit, allowing tools like `glab` to resolve correctly through the current registry. [#8245](https://redirect.github.com/jdx/mise/pull/8245) by [@jean-humann](https://redirect.github.com/jean-humann) ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`namespacelabs/foundation/nsc`](https://redirect.github.com/namespacelabs/foundation/nsc) ### [`v2026.2.16`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.16): : MCP Gets Its Hands Dirty [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.15...v2026.2.16) This release brings MCP task execution support, better Node.js flavor guidance, and a solid round of bug fixes across several backends. ##### Highlights - **MCP `run_task` tool** — You can now execute mise tasks directly through the [MCP](https://mise.jdx.dev/) interface. The new `run_task` tool runs tasks via subprocess with full stdout/stderr capture, timeout support, and hardened execution. An `install_tool` stub is also included for future expansion. [#8179](https://redirect.github.com/jdx/mise/pull/8179) by [@joaommartins](https://redirect.github.com/joaommartins) - **Node flavor suggestions** — When a Node.js version isn't found in the configured mirror, mise now suggests setting `node.flavor` to help you get to the right download faster. [#8206](https://redirect.github.com/jdx/mise/pull/8206) by [@risu729](https://redirect.github.com/risu729) - **Registry stack overflow fix** — The registry `BTreeMap` is now built directly on the heap, eliminating a stack overflow that could occur with large registries. [#8214](https://redirect.github.com/jdx/mise/pull/8214) by [@risu729](https://redirect.github.com/risu729) ##### Bug Fixes - **Java version sorting** — Shorthand Java versions (e.g., `21`, `17`) now sort correctly. [#8197](https://redirect.github.com/jdx/mise/pull/8197) by [@roele](https://redirect.github.com/roele) - **Node env var migration** — Node-related environment variables have been properly migrated to the settings system. [#8200](https://redirect.github.com/jdx/mise/pull/8200) by [@risu729](https://redirect.github.com/risu729) - **Registry overrides in shims** — Registry overrides are now correctly applied when running tools through shims. [#8199](https://redirect.github.com/jdx/mise/pull/8199) by [@risu729](https://redirect.github.com/risu729) - **Rust outdated duplication** — Fixed `mise outdated` showing Rust versions twice. [#8209](https://redirect.github.com/jdx/mise/pull/8209) by [@roele](https://redirect.github.com/roele) - **GitHub aliased backend resolution** — Version lookups no longer break for tools aliased to a different backend than the registry default. [#8221](https://redirect.github.com/jdx/mise/pull/8221) - **GitHub attestation output** — Attestation verification success is now shown in progress output. [#8230](https://redirect.github.com/jdx/mise/pull/8230) - **Cargo binstall setting migration** — `MISE_CARGO_BINSTALL_ONLY` has been migrated to the settings system. [#8202](https://redirect.github.com/jdx/mise/pull/8202) by [@risu729](https://redirect.github.com/risu729) ##### New Tools - **typst** — GitHub backend added. [#8210](https://redirect.github.com/jdx/mise/pull/8210) by [@3w36zj6](https://redirect.github.com/3w36zj6) - **cargo-dist** — Now available via aqua registry. [#8153](https://redirect.github.com/jdx/mise/pull/8153) by [@risu729](https://redirect.github.com/risu729) - **release-plz** — Now available via aqua registry. [#8150](https://redirect.github.com/jdx/mise/pull/8150) by [@risu729](https://redirect.github.com/risu729) ### [`v2026.2.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.15): : Streaming in Order [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.14...v2026.2.15) This release brings a nice quality-of-life improvement to task execution along with a solid batch of bug fixes across several subsystems. ##### Highlights - **Real-time streaming for keep-order tasks** — The `keep_order` task output mode now streams the active task's output in real-time instead of buffering everything until completion. Other parallel tasks buffer quietly and flush in definition order as they finish, so you get live feedback without sacrificing deterministic output ordering. [#8164](https://redirect.github.com/jdx/mise/pull/8164) - **npm backend performance** — `npm view` is now called only once per package lookup instead of multiple times, speeding up npm-based tool resolution. Thanks [@risu729](https://redirect.github.com/risu729)! [#8181](https://redirect.github.com/jdx/mise/pull/8181) ##### Bug Fixes - **Recursive shim execution on Windows** — `mise exec` now strips the shims directory from PATH during executable lookup, preventing infinite recursion when shims call back into `mise x`. [#8189](https://redirect.github.com/jdx/mise/pull/8189) - **PATH reordering after activation** — `hook-env` now preserves any PATH reordering done after `mise activate` (e.g., by `~/.zlogin`), instead of silently reverting to the original order. [#8190](https://redirect.github.com/jdx/mise/pull/8190) - **Cross-platform lockfile resolution** — The aqua backend now correctly resolves lockfile artifacts for the target platform instead of leaking host-specific overrides into `mise lock --platform`. Thanks [@mackwic](https://redirect.github.com/mackwic)! [#8183](https://redirect.github.com/jdx/mise/pull/8183) - **Version alias lockfile lookup** — Version aliases (like `lts`) are now resolved before lockfile lookup, so locked versions are matched correctly. [#8194](https://redirect.github.com/jdx/mise/pull/8194) - **Task source freshness checks** — Freshness checks now work correctly with dynamic task directories. Thanks [@rooperuu](https://redirect.github.com/rooperuu)! [#8169](https://redirect.github.com/jdx/mise/pull/8169) - **Global tasks in monorepos** — Global tasks are now properly resolved when running from a monorepo root. [#8192](https://redirect.github.com/jdx/mise/pull/8192) - **Wildcard glob matching** — `test:*` no longer incorrectly matches the parent `test` task. [#8165](https://redirect.github.com/jdx/mise/pull/8165) - **task\_config.includes paths** — Include paths in task config are now resolved relative to the config root, not the working directory. [#8193](https://redirect.github.com/jdx/mise/pull/8193) - **Upgrade safety** — `mise upgrade` now skips untrusted tracked configs instead of failing. [#8195](https://redirect.github.com/jdx/mise/pull/8195) - **helm-diff registry entry** — Fixed the archive binary name for helm-diff. Thanks [@jean-humann](https://redirect.github.com/jean-humann)! [#8173](https://redirect.github.com/jdx/mise/pull/8173) ##### New Contributors Welcome [@jean-humann](https://redirect.github.com/jean-humann), [@mackwic](https://redirect.github.com/mackwic), and [@rooperuu](https://redirect.github.com/rooperuu)! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`BetterDiscord/cli`](https://redirect.github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://redirect.github.com/glossia.ai/cli) ### [`v2026.2.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.14) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.13...v2026.2.14) A feature-focused release adding vfox plugin env redaction, Deno devEngines support, and a new Rust default\_host setting. ##### Highlights - **Vfox env var redaction** — Vfox plugins can now request that specific environment variables be redacted from logs and debug output by returning a `redact` field in `MiseEnvResult`. Useful for plugins that inject secrets or tokens. [#8166](https://redirect.github.com/jdx/mise/pull/8166) - **Deno devEngines.runtime support** — Mise now reads the `devEngines.runtime` field from `package.json` to auto-detect the desired Deno version, matching the same convention already supported for Node. Thanks [@risu729](https://redirect.github.com/risu729)! [#8144](https://redirect.github.com/jdx/mise/pull/8144) - **`default_host` setting for Rust** — A new `rust.default_host` setting lets you override the Rust target triple used during installation, useful for cross-compilation setups. Thanks [@aacebedo](https://redirect.github.com/aacebedo)! [#8154](https://redirect.github.com/jdx/mise/pull/8154) - **Aqua `github_content` package support** — The aqua backend now supports packages hosted via GitHub content downloads (not just releases). Thanks [@risu729](https://redirect.github.com/risu729)! [#8147](https://redirect.github.com/jdx/mise/pull/8147) ##### Bug Fixes - **`mise edit` whitespace** — TOML values edited via `mise edit` no longer retain extra formatting whitespace. [#8162](https://redirect.github.com/jdx/mise/pull/8162) - **`--locked` for python/ubi** — The `--locked` flag now works correctly with python and ubi backends. [#8163](https://redirect.github.com/jdx/mise/pull/8163) - **npm update notifier** — The npm update notifier is now suppressed during `npm install`, preventing spurious output. Thanks [@risu729](https://redirect.github.com/risu729)! [#8152](https://redirect.github.com/jdx/mise/pull/8152) - **Asset matcher vsix penalty** — `.vsix` files are now deprioritized in asset matching, preventing incorrect downloads. Thanks [@risu729](https://redirect.github.com/risu729)! [#8151](https://redirect.github.com/jdx/mise/pull/8151) - **JSON schema updates** — Added missing `task_templates`, `extends`, and `timeout` fields to the mise.json schema. Thanks [@risu729](https://redirect.github.com/risu729)! [#8145](https://redirect.github.com/jdx/mise/pull/8145) ##### New Contributors Welcome [@joaommartins](https://redirect.github.com/joaommartins)! [#8133](https://redirect.github.com/jdx/mise/pull/8133) *** > **Note:** This release has no attached binary assets. The v2026.2.14 tag was created successfully but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. The binaries for this version are functionally identical to v2026.2.15 minus the additional fixes in that release. Use v2026.2.15 instead. ### [`v2026.2.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.13): : Fix GitHub attestation verification failures [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.12...v2026.2.13) This release partially mitigates GitHub attestation verification failures that were causing tool installations to fail (e.g., `gh`, and other aqua-backed tools with attestations enabled). See [#8142](https://redirect.github.com/jdx/mise/discussions/8142) for details. ##### What happened GitHub silently changed their attestations API to externalize bundle storage to Azure Blob Storage (`tmaproduction.blob.core.windows.net`) using [Snappy compression](https://google.github.io/snappy/), rather than returning bundles inline as JSON. The `gh` CLI had already been updated to handle this ([cli/cli#10185](https://redirect.github.com/cli/cli/pull/10185)), but third-party tools like mise were not yet aware of the new format, causing `"error decoding response body"` failures. ##### What this release does Bumps `sigstore-verification` to 0.2, which splits the reqwest dependency version from mise's (0.13 vs 0.12). This avoids Cargo feature unification that was causing mise's `gzip` feature to be applied to attestation requests, interfering with the Snappy-compressed responses. **Note:** A full fix with proper Snappy decompression support and auth token scoping landed in [sigstore-verification v0.2.1](https://redirect.github.com/jdx/sigstore-verification/releases/tag/v0.2.1) ([#22](https://redirect.github.com/jdx/sigstore-verification/pull/22), [#23](https://redirect.github.com/jdx/sigstore-verification/pull/23)) — expect a follow-up mise release with that bump. If you are still hitting issues, set `settings.aqua.github_attestations = false` as a workaround. ##### Dependency Updates - **Bumped `sigstore-verification` to 0.2** ([e8897c9](https://redirect.github.com/jdx/mise/commit/e8897c9fbc873fe272495a65e5a88b04b97f3b6d)) ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`k1LoW/tcmux`](https://redirect.github.com/k1LoW/tcmux) ##### Updated Packages (1) - [`jdx/usage`](https://redirect.github.com/jdx/usage) ### [`v2026.2.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.12) [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.11...v2026.2.12) A small release adding a new Java configuration option. ##### Highlights - **`java.shorthand_vendor` setting** — A new setting that lets you configure which vendor is used when specifying shorthand Java versions (e.g., `21` instead of `temurin-21`). Thanks [@roele](https://redirect.github.com/roele)! [#8134](https://redirect.github.com/jdx/mise/pull/8134) *** > **Note:** This release has no attached binary assets. The v2026.2.12 tag was created but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. Use v2026.2.13 or later instead. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/prometheus/client_java).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [mise](https://redirect.github.com/jdx/mise) | patch | `v2026.2.11` → `v2026.2.21` | `v2026.2.24` (+2) | --- ### Release Notes <details> <summary>jdx/mise (mise)</summary> ### [`v2026.2.21`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.21): : Bug fix roundup for monorepo tasks, conda noarch, and exec PATH handling [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.20...v2026.2.21) A bug-fix release addressing several regressions and long-standing issues: monorepo task variables and glob dependencies now resolve correctly, the conda backend can install Python noarch packages, `mise x` respects virtualenv PATH ordering again, and nested task execution no longer hangs. #### Fixed - **`mise x` respects virtualenv PATH order again** -- A pre-resolution step added in v2026.2.17 ([#8276](https://redirect.github.com/jdx/mise/pull/8276)) resolved bare command names directly to mise-managed tool paths, bypassing PATH entirely. This broke `_.python.venv` and similar configs where a virtualenv binary should take precedence over the mise-managed install. The pre-resolution is removed; shim stripping in `exec_program` (also from [#8276](https://redirect.github.com/jdx/mise/issues/8276)) is sufficient to prevent recursion. [#8342](https://redirect.github.com/jdx/mise/pull/8342) by [@jdx](https://redirect.github.com/jdx) - **Conda noarch Python packages install correctly** -- Installing noarch Python packages via the conda backend (e.g. `mise use conda:ruff`) failed because the linker didn't know the Python version needed to compute `site-packages` paths. The solver's resolved Python version is now extracted and passed through to `link_package`, fixing the error. [#8349](https://redirect.github.com/jdx/mise/pull/8349) by [@wolfv](https://redirect.github.com/wolfv) - **Nested mise tasks no longer hang** -- The process group isolation (`setpgid`/`killpg`) introduced in v2026.2.18 and refined in v2026.2.19 has been fully reverted. When tools like Playwright use process-group-based kills (`kill(-pid, SIGKILL)`) to tear down a server subprocess tree, grandchild processes in a separate group (created by mise's `setpgid`) survived and held pipes open, causing indefinite hangs. mise now sends signals directly to child PIDs instead. [#8347](https://redirect.github.com/jdx/mise/pull/8347) by [@jdx](https://redirect.github.com/jdx) - **Monorepo tasks resolve `[vars]` from subdirectory configs** -- Running a monorepo task like `mise run //infra/stacks/gcp:greet` failed to pick up `[vars]` defined in subdirectory `.mise.toml` files, causing template rendering errors. Variables are now resolved from the task's full config hierarchy (including `mise.<env>.toml` overlays) and threaded through script rendering. [#8343](https://redirect.github.com/jdx/mise/pull/8343) by [@jdx](https://redirect.github.com/jdx) - **Monorepo glob dependencies trigger subdirectory prepare steps** -- When a root task depended on a monorepo glob pattern like `//...:check`, the prepare phase only collected configs from top-level tasks, missing subdirectory tasks entirely. Dependencies are now resolved before prepare runs, so transitive subdirectory tasks and their prepare providers are properly discovered. [#8353](https://redirect.github.com/jdx/mise/pull/8353) by [@jdx](https://redirect.github.com/jdx) #### New Contributors - [@wolfv](https://redirect.github.com/wolfv) made their first contribution in [#8349](https://redirect.github.com/jdx/mise/pull/8349) **Full Changelog**: <jdx/mise@v2026.2.20...v2026.2.21> ### [`v2026.2.20`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.20): : Conda rewrite, .NET SDK core plugin, and per-task timeouts [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.19...v2026.2.20) A feature-packed release that replaces the conda backend with production-grade internals, adds a native .NET SDK plugin, and finally enforces per-task timeouts. Several lockfile and environment-handling fixes round things out. #### Highlights - **Conda backend rewritten with rattler** -- The experimental conda backend has been completely rewritten to use the [rattler](https://redirect.github.com/conda/rattler) Rust crates (the same engine behind pixi), replacing \~1,600 lines of custom code that relied on the unsupported anaconda.org API. This brings a proper SAT-based dependency solver, correct binary prefix replacement, and repodata caching via CDN. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) - **Native .NET SDK management** -- A new core plugin for .NET SDK installs all versions side-by-side under a shared `DOTNET_ROOT`, matching .NET's native multi-version model. It uses Microsoft's official `dotnet-install` script and supports `global.json` for per-project SDK pinning. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeouts are now enforced** -- The `timeout` field on tasks (added in v2025.1.6 but never wired up) now actually kills tasks that exceed their limit. Timeouts send SIGTERM with a 5-second grace period before SIGKILL, and both per-task and global `task_timeout` settings are respected. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) #### Added - **Core .NET SDK plugin** -- `mise use dotnet@8` now installs via a native core plugin with side-by-side version support and `global.json` detection. Configure `DOTNET_ROOT` via the new `dotnet.dotnet_root` setting. [#8326](https://redirect.github.com/jdx/mise/pull/8326) by [@jdx](https://redirect.github.com/jdx) - **Per-task timeout enforcement** -- Tasks with a `timeout` field are now killed if they exceed the configured duration. Works with both per-task config and the global `task_timeout`/`--timeout` flag. [#8250](https://redirect.github.com/jdx/mise/pull/8250) by [@tvararu](https://redirect.github.com/tvararu) ```toml [tasks.deploy] run = "npm run deploy" timeout = "5m" ``` - **VSIX archive support** -- The HTTP backend now recognizes `.vsix` files as ZIP archives and extracts them correctly, enabling tools distributed as VS Code extensions to be installed via `http:` URLs. [#8306](https://redirect.github.com/jdx/mise/pull/8306) by [@sosumappu](https://redirect.github.com/sosumappu) - **Registry: `oxfmt`** -- Added the oxfmt formatter to the tool registry. [#8316](https://redirect.github.com/jdx/mise/pull/8316) by [@taoufik07](https://redirect.github.com/taoufik07) #### Changed - **Conda backend rewritten with rattler crates** -- Replaces custom version matching, dependency resolution, archive extraction, and binary patching with the battle-tested rattler ecosystem (`rattler_solve`, `rattler_repodata_gateway`, `rattler::install`). Binary prefix replacement now works correctly (the old code skipped binary files entirely). Since the conda backend is still experimental, this is a non-breaking change. [#8325](https://redirect.github.com/jdx/mise/pull/8325) by [@jdx](https://redirect.github.com/jdx) #### Fixed - **Lockfile not modified with `--locked`** -- `mise install --locked` no longer writes to `mise.lock`, matching the semantics of `cargo install --locked` and `uv pip install --locked`. [#8308](https://redirect.github.com/jdx/mise/pull/8308) by [@jdx](https://redirect.github.com/jdx) - **Orphan lockfile entries pruned** -- `mise lock` now removes stale tool entries that are no longer present in config, keeping the lockfile aligned with the current toolset. [#8265](https://redirect.github.com/jdx/mise/pull/8265) by [@mackwic](https://redirect.github.com/mackwic) - **Contradictory lockfile config caught early** -- Setting `locked=true` alongside `lockfile=false` now produces a clear error instead of silently ignoring the lock. [#8329](https://redirect.github.com/jdx/mise/pull/8329) by [@jdx](https://redirect.github.com/jdx) - **`watch_files` triggers on every change** -- The hook-env fast-path now checks `[[watch_files]]` paths, fixing a bug where only the first file change triggered the associated run command. [#8317](https://redirect.github.com/jdx/mise/pull/8317) by [@jdx](https://redirect.github.com/jdx) - **Fish alias completions cleaned up** -- Setting or unsetting shell aliases in fish now clears stale completions, preventing tab-complete from offering outdated suggestions. [#8324](https://redirect.github.com/jdx/mise/pull/8324) by [@jdx](https://redirect.github.com/jdx) - **JSON schema accepts age-encrypted env values** -- Fixed a `oneOf` ambiguity in the mise schema that rejected `[env]` entries using age encryption. [#8328](https://redirect.github.com/jdx/mise/pull/8328) by [@adamliang0](https://redirect.github.com/adamliang0) - **Regal registry updated** -- The regal tool now points to its new home at `open-policy-agent/regal`. [#8315](https://redirect.github.com/jdx/mise/pull/8315) by [@charlieegan3](https://redirect.github.com/charlieegan3) - **Conda: locked installs preserve package data** -- `conda_packages` entries are no longer silently dropped during `--locked` installs, and concurrent downloads no longer race on the same temp file. [#8335](https://redirect.github.com/jdx/mise/pull/8335) by [@jdx](https://redirect.github.com/jdx) - **Conda: solver no longer fails on Linux** -- Deduplicated repodata records before passing them to the solver, fixing "duplicate records" errors when installing tools like imagemagick. [#8337](https://redirect.github.com/jdx/mise/pull/8337) by [@jdx](https://redirect.github.com/jdx) #### New Contributors - [@tvararu](https://redirect.github.com/tvararu) made their first contribution in [#8250](https://redirect.github.com/jdx/mise/pull/8250) - [@sosumappu](https://redirect.github.com/sosumappu) made their first contribution in [#8306](https://redirect.github.com/jdx/mise/pull/8306) - [@charlieegan3](https://redirect.github.com/charlieegan3) made their first contribution in [#8315](https://redirect.github.com/jdx/mise/pull/8315) - [@taoufik07](https://redirect.github.com/taoufik07) made their first contribution in [#8316](https://redirect.github.com/jdx/mise/pull/8316) - [@adamliang0](https://redirect.github.com/adamliang0) made their first contribution in [#8328](https://redirect.github.com/jdx/mise/pull/8328) - [@mackwic](https://redirect.github.com/mackwic) made their first contribution in [#8265](https://redirect.github.com/jdx/mise/pull/8265) **Full Changelog**: <jdx/mise@v2026.2.19...v2026.2.20> ### [`v2026.2.19`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.19): : Fixes for interactive tasks and failed install cleanup [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.18...v2026.2.19) A small patch release with two targeted bug fixes: a regression fix for interactive task execution and better cleanup after failed installs. ##### Bug Fixes - **Interactive tasks no longer hang** -- The process group isolation added in v2026.2.18 ([#8279](https://redirect.github.com/jdx/mise/pull/8279)) inadvertently broke interactive tools like Tilt that read from stdin. When a child process was moved to its own process group, the terminal wouldn't deliver keyboard input to it, causing `SIGTTIN` and a silent hang. mise now checks whether stdin is a TTY before calling `setpgid` -- interactive tasks stay in the terminal's foreground process group for proper keyboard I/O, while non-interactive tasks still get their own process group for clean signal teardown. [#8301](https://redirect.github.com/jdx/mise/pull/8301) by [@jdx](https://redirect.github.com/jdx) - **Failed installs clean up properly** -- When an install fails (e.g. a 404 for a non-existent version or a 403 from GitHub rate limiting), mise now removes the empty parent directory (e.g. `installs/tilt/`) and the stale incomplete marker from cache, instead of leaving them behind. [#8302](https://redirect.github.com/jdx/mise/pull/8302) by [@jdx](https://redirect.github.com/jdx) ##### Documentation - Fixed the ripgrep command in the getting-started guide to use the correct binary name `rg` instead of `ripgrep`. [#8299](https://redirect.github.com/jdx/mise/pull/8299) by [@nguyenvulong](https://redirect.github.com/nguyenvulong) **Full Changelog**: <jdx/mise@v2026.2.18...v2026.2.19> ### [`v2026.2.18`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.18): : Task Reliability & Developer Experience [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.17...v2026.2.18) A bug-fix-heavy release focused on task execution reliability, with a new feature for cross-platform tool locking. ##### Highlights - **Auto-lock all platforms after install** — When you install a tool, mise now automatically locks versions for all platforms (not just the current one). This means your `mise.lock` stays complete for teammates on different OSes without needing to run `mise lock` separately. [#8277](https://redirect.github.com/jdx/mise/pull/8277) - **Process group cleanup for tasks** — Task child processes are now managed via Unix process groups, so killing a task reliably takes down the entire process tree instead of leaving orphaned children. [#8279](https://redirect.github.com/jdx/mise/pull/8279) - **`depends_post` tasks run even on failure** — Post-dependency tasks (cleanup, notifications, etc.) now execute even when the parent task fails, matching the expected behavior for teardown-style hooks. [#8274](https://redirect.github.com/jdx/mise/pull/8274) ##### Bug Fixes - **Infinite shim recursion on Unix** — `mise exec` now strips its own shims from `PATH` before spawning subprocesses, preventing infinite recursion when a shimmed tool calls itself. [#8276](https://redirect.github.com/jdx/mise/pull/8276) - **`--yes` flag now works for config trust prompts** — The `--yes`/`-y` flag is now properly respected when mise prompts to trust a config file. [#8288](https://redirect.github.com/jdx/mise/pull/8288) - **`--locked --dry-run` validation order** — `mise install --locked` now validates the lock requirement before the `--dry-run` short-circuit, so you get a proper error instead of silent success. [#8290](https://redirect.github.com/jdx/mise/pull/8290) by [@altendky](https://redirect.github.com/altendky) - **JSON Schema compatibility** — Replaced `unevaluatedProperties` with `additionalProperties` in the mise JSON schema for broader validator support. [#8285](https://redirect.github.com/jdx/mise/pull/8285) - **Duplicate stderr on task failure** — Fixed tasks in replacing output mode printing error output twice on failure. [#8275](https://redirect.github.com/jdx/mise/pull/8275) - **Did-you-mean for task commands** — Mistyping a CLI subcommand now suggests similar task names. [#8286](https://redirect.github.com/jdx/mise/pull/8286) - **Monorepo prepare steps** — Prepare steps for subdirectory configs now execute from the repository root as expected. [#8291](https://redirect.github.com/jdx/mise/pull/8291) - **`mise upgrade` no longer force-reinstalls** — Previously installed versions are skipped during upgrade instead of being redundantly reinstalled. [#8282](https://redirect.github.com/jdx/mise/pull/8282) - **Terminal restore after `mise watch`** — `watchexec` no longer leaves the terminal in a broken state on exit. [#8273](https://redirect.github.com/jdx/mise/pull/8273) ##### Documentation - Clarified that `MISE_CEILING_PATHS` excludes the ceiling directory itself. [#8283](https://redirect.github.com/jdx/mise/pull/8283) ##### New Contributors - [@altendky](https://redirect.github.com/altendky) made their first contribution in [#8290](https://redirect.github.com/jdx/mise/pull/8290) ##### 📦 Aqua Registry Updates ##### New Packages (4) - [`Skarlso/crd-to-sample-yaml`](https://redirect.github.com/Skarlso/crd-to-sample-yaml) - [`kunobi-ninja/kunobi-releases`](https://redirect.github.com/kunobi-ninja/kunobi-releases) - [`swanysimon/markdownlint-rs`](https://redirect.github.com/swanysimon/markdownlint-rs) - [`tmux/tmux-builds`](https://redirect.github.com/tmux/tmux-builds) ##### Updated Packages (2) - [`firecow/gitlab-ci-local`](https://redirect.github.com/firecow/gitlab-ci-local) - [`k1LoW/runn`](https://redirect.github.com/k1LoW/runn) ### [`v2026.2.17`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.17): : Freshly Prepared [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.16...v2026.2.17) A moderate release with a handful of bug fixes and a new feature for the `prepare` system. ##### Highlights - **Prepare: auto-touch stale outputs** — When tools like `uv sync` skip work because dependencies are already satisfied, output files don't get updated, causing mise to consider them stale on the next run. Prepare providers now automatically touch output files after a successful command, keeping staleness checks accurate. This is controlled by a new `touch_outputs` config option (defaults to true). [#8243](https://redirect.github.com/jdx/mise/pull/8243) by [@halms](https://redirect.github.com/halms) - **Settings reorganization: `task_*` → `task.*`** — Nine flat `task_*` settings have been consolidated into a nested `task.*` namespace (e.g., `task_output` → `task.output`). The old names still work with no breaking changes — deprecation warnings won't appear until `2026.8.0`. [#8239](https://redirect.github.com/jdx/mise/pull/8239) ##### Bug Fixes - **Postinstall hooks now use correct bin paths** — Per-tool postinstall hooks were hardcoding `$install_path/bin` on `PATH`, which broke backends like aqua where binaries live in non-standard subdirectories. Hooks now use each backend's actual binary paths. [#8234](https://redirect.github.com/jdx/mise/pull/8234) - **`mise use` writes to the correct config file** — When both `config.toml` and `config.local.toml` exist, `mise use` was incorrectly writing to `config.local.toml`. It now properly targets `config.toml`. [#8240](https://redirect.github.com/jdx/mise/pull/8240) - **Legacy `.mise.backend` installs no longer block auto-migration** — Legacy backend files were defaulting to `explicit_backend = true`, which prevented auto-migration to updated registry backends. They now default to non-explicit, allowing tools like `glab` to resolve correctly through the current registry. [#8245](https://redirect.github.com/jdx/mise/pull/8245) by [@jean-humann](https://redirect.github.com/jean-humann) ##### 📦 Aqua Registry Updates ##### Updated Packages (1) - [`namespacelabs/foundation/nsc`](https://redirect.github.com/namespacelabs/foundation/nsc) ### [`v2026.2.16`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.16): : MCP Gets Its Hands Dirty [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.15...v2026.2.16) This release brings MCP task execution support, better Node.js flavor guidance, and a solid round of bug fixes across several backends. ##### Highlights - **MCP `run_task` tool** — You can now execute mise tasks directly through the [MCP](https://mise.jdx.dev/) interface. The new `run_task` tool runs tasks via subprocess with full stdout/stderr capture, timeout support, and hardened execution. An `install_tool` stub is also included for future expansion. [#8179](https://redirect.github.com/jdx/mise/pull/8179) by [@joaommartins](https://redirect.github.com/joaommartins) - **Node flavor suggestions** — When a Node.js version isn't found in the configured mirror, mise now suggests setting `node.flavor` to help you get to the right download faster. [#8206](https://redirect.github.com/jdx/mise/pull/8206) by [@risu729](https://redirect.github.com/risu729) - **Registry stack overflow fix** — The registry `BTreeMap` is now built directly on the heap, eliminating a stack overflow that could occur with large registries. [#8214](https://redirect.github.com/jdx/mise/pull/8214) by [@risu729](https://redirect.github.com/risu729) ##### Bug Fixes - **Java version sorting** — Shorthand Java versions (e.g., `21`, `17`) now sort correctly. [#8197](https://redirect.github.com/jdx/mise/pull/8197) by [@roele](https://redirect.github.com/roele) - **Node env var migration** — Node-related environment variables have been properly migrated to the settings system. [#8200](https://redirect.github.com/jdx/mise/pull/8200) by [@risu729](https://redirect.github.com/risu729) - **Registry overrides in shims** — Registry overrides are now correctly applied when running tools through shims. [#8199](https://redirect.github.com/jdx/mise/pull/8199) by [@risu729](https://redirect.github.com/risu729) - **Rust outdated duplication** — Fixed `mise outdated` showing Rust versions twice. [#8209](https://redirect.github.com/jdx/mise/pull/8209) by [@roele](https://redirect.github.com/roele) - **GitHub aliased backend resolution** — Version lookups no longer break for tools aliased to a different backend than the registry default. [#8221](https://redirect.github.com/jdx/mise/pull/8221) - **GitHub attestation output** — Attestation verification success is now shown in progress output. [#8230](https://redirect.github.com/jdx/mise/pull/8230) - **Cargo binstall setting migration** — `MISE_CARGO_BINSTALL_ONLY` has been migrated to the settings system. [#8202](https://redirect.github.com/jdx/mise/pull/8202) by [@risu729](https://redirect.github.com/risu729) ##### New Tools - **typst** — GitHub backend added. [#8210](https://redirect.github.com/jdx/mise/pull/8210) by [@3w36zj6](https://redirect.github.com/3w36zj6) - **cargo-dist** — Now available via aqua registry. [#8153](https://redirect.github.com/jdx/mise/pull/8153) by [@risu729](https://redirect.github.com/risu729) - **release-plz** — Now available via aqua registry. [#8150](https://redirect.github.com/jdx/mise/pull/8150) by [@risu729](https://redirect.github.com/risu729) ### [`v2026.2.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.15): : Streaming in Order [Compare Source](https://redirect.github.com/jdx/mise/compare/aqua-registry-v2026.2.14...aqua-registry-v2026.2.15) This release brings a nice quality-of-life improvement to task execution along with a solid batch of bug fixes across several subsystems. ##### Highlights - **Real-time streaming for keep-order tasks** — The `keep_order` task output mode now streams the active task's output in real-time instead of buffering everything until completion. Other parallel tasks buffer quietly and flush in definition order as they finish, so you get live feedback without sacrificing deterministic output ordering. [#8164](https://redirect.github.com/jdx/mise/pull/8164) - **npm backend performance** — `npm view` is now called only once per package lookup instead of multiple times, speeding up npm-based tool resolution. Thanks [@risu729](https://redirect.github.com/risu729)! [#8181](https://redirect.github.com/jdx/mise/pull/8181) ##### Bug Fixes - **Recursive shim execution on Windows** — `mise exec` now strips the shims directory from PATH during executable lookup, preventing infinite recursion when shims call back into `mise x`. [#8189](https://redirect.github.com/jdx/mise/pull/8189) - **PATH reordering after activation** — `hook-env` now preserves any PATH reordering done after `mise activate` (e.g., by `~/.zlogin`), instead of silently reverting to the original order. [#8190](https://redirect.github.com/jdx/mise/pull/8190) - **Cross-platform lockfile resolution** — The aqua backend now correctly resolves lockfile artifacts for the target platform instead of leaking host-specific overrides into `mise lock --platform`. Thanks [@mackwic](https://redirect.github.com/mackwic)! [#8183](https://redirect.github.com/jdx/mise/pull/8183) - **Version alias lockfile lookup** — Version aliases (like `lts`) are now resolved before lockfile lookup, so locked versions are matched correctly. [#8194](https://redirect.github.com/jdx/mise/pull/8194) - **Task source freshness checks** — Freshness checks now work correctly with dynamic task directories. Thanks [@rooperuu](https://redirect.github.com/rooperuu)! [#8169](https://redirect.github.com/jdx/mise/pull/8169) - **Global tasks in monorepos** — Global tasks are now properly resolved when running from a monorepo root. [#8192](https://redirect.github.com/jdx/mise/pull/8192) - **Wildcard glob matching** — `test:*` no longer incorrectly matches the parent `test` task. [#8165](https://redirect.github.com/jdx/mise/pull/8165) - **task\_config.includes paths** — Include paths in task config are now resolved relative to the config root, not the working directory. [#8193](https://redirect.github.com/jdx/mise/pull/8193) - **Upgrade safety** — `mise upgrade` now skips untrusted tracked configs instead of failing. [#8195](https://redirect.github.com/jdx/mise/pull/8195) - **helm-diff registry entry** — Fixed the archive binary name for helm-diff. Thanks [@jean-humann](https://redirect.github.com/jean-humann)! [#8173](https://redirect.github.com/jdx/mise/pull/8173) ##### New Contributors Welcome [@jean-humann](https://redirect.github.com/jean-humann), [@mackwic](https://redirect.github.com/mackwic), and [@rooperuu](https://redirect.github.com/rooperuu)! ##### 📦 Aqua Registry Updates ##### New Packages (2) - [`BetterDiscord/cli`](https://redirect.github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://redirect.github.com/glossia.ai/cli) ### [`v2026.2.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.14) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.13...aqua-registry-v2026.2.14) A feature-focused release adding vfox plugin env redaction, Deno devEngines support, and a new Rust default\_host setting. ##### Highlights - **Vfox env var redaction** — Vfox plugins can now request that specific environment variables be redacted from logs and debug output by returning a `redact` field in `MiseEnvResult`. Useful for plugins that inject secrets or tokens. [#8166](https://redirect.github.com/jdx/mise/pull/8166) - **Deno devEngines.runtime support** — Mise now reads the `devEngines.runtime` field from `package.json` to auto-detect the desired Deno version, matching the same convention already supported for Node. Thanks [@risu729](https://redirect.github.com/risu729)! [#8144](https://redirect.github.com/jdx/mise/pull/8144) - **`default_host` setting for Rust** — A new `rust.default_host` setting lets you override the Rust target triple used during installation, useful for cross-compilation setups. Thanks [@aacebedo](https://redirect.github.com/aacebedo)! [#8154](https://redirect.github.com/jdx/mise/pull/8154) - **Aqua `github_content` package support** — The aqua backend now supports packages hosted via GitHub content downloads (not just releases). Thanks [@risu729](https://redirect.github.com/risu729)! [#8147](https://redirect.github.com/jdx/mise/pull/8147) ##### Bug Fixes - **`mise edit` whitespace** — TOML values edited via `mise edit` no longer retain extra formatting whitespace. [#8162](https://redirect.github.com/jdx/mise/pull/8162) - **`--locked` for python/ubi** — The `--locked` flag now works correctly with python and ubi backends. [#8163](https://redirect.github.com/jdx/mise/pull/8163) - **npm update notifier** — The npm update notifier is now suppressed during `npm install`, preventing spurious output. Thanks [@risu729](https://redirect.github.com/risu729)! [#8152](https://redirect.github.com/jdx/mise/pull/8152) - **Asset matcher vsix penalty** — `.vsix` files are now deprioritized in asset matching, preventing incorrect downloads. Thanks [@risu729](https://redirect.github.com/risu729)! [#8151](https://redirect.github.com/jdx/mise/pull/8151) - **JSON schema updates** — Added missing `task_templates`, `extends`, and `timeout` fields to the mise.json schema. Thanks [@risu729](https://redirect.github.com/risu729)! [#8145](https://redirect.github.com/jdx/mise/pull/8145) ##### New Contributors Welcome [@joaommartins](https://redirect.github.com/joaommartins)! [#8133](https://redirect.github.com/jdx/mise/pull/8133) *** > **Note:** This release has no attached binary assets. The v2026.2.14 tag was created successfully but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. The binaries for this version are functionally identical to v2026.2.15 minus the additional fixes in that release. Use v2026.2.15 instead. ### [`v2026.2.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.13): : Fix GitHub attestation verification failures [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.12...v2026.2.13) This release partially mitigates GitHub attestation verification failures that were causing tool installations to fail (e.g., `gh`, and other aqua-backed tools with attestations enabled). See [#8142](https://redirect.github.com/jdx/mise/discussions/8142) for details. ##### What happened GitHub silently changed their attestations API to externalize bundle storage to Azure Blob Storage (`tmaproduction.blob.core.windows.net`) using [Snappy compression](https://google.github.io/snappy/), rather than returning bundles inline as JSON. The `gh` CLI had already been updated to handle this ([cli/cli#10185](https://redirect.github.com/cli/cli/pull/10185)), but third-party tools like mise were not yet aware of the new format, causing `"error decoding response body"` failures. ##### What this release does Bumps `sigstore-verification` to 0.2, which splits the reqwest dependency version from mise's (0.13 vs 0.12). This avoids Cargo feature unification that was causing mise's `gzip` feature to be applied to attestation requests, interfering with the Snappy-compressed responses. **Note:** A full fix with proper Snappy decompression support and auth token scoping landed in [sigstore-verification v0.2.1](https://redirect.github.com/jdx/sigstore-verification/releases/tag/v0.2.1) ([#22](https://redirect.github.com/jdx/sigstore-verification/pull/22), [#23](https://redirect.github.com/jdx/sigstore-verification/pull/23)) — expect a follow-up mise release with that bump. If you are still hitting issues, set `settings.aqua.github_attestations = false` as a workaround. ##### Dependency Updates - **Bumped `sigstore-verification` to 0.2** ([e8897c9](https://redirect.github.com/jdx/mise/commit/e8897c9fbc873fe272495a65e5a88b04b97f3b6d)) ##### 📦 Aqua Registry Updates ##### New Packages (1) - [`k1LoW/tcmux`](https://redirect.github.com/k1LoW/tcmux) ##### Updated Packages (1) - [`jdx/usage`](https://redirect.github.com/jdx/usage) ### [`v2026.2.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.2.12) [Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.2.11...v2026.2.12) A small release adding a new Java configuration option. ##### Highlights - **`java.shorthand_vendor` setting** — A new setting that lets you configure which vendor is used when specifying shorthand Java versions (e.g., `21` instead of `temurin-21`). Thanks [@roele](https://redirect.github.com/roele)! [#8134](https://redirect.github.com/jdx/mise/pull/8134) *** > **Note:** This release has no attached binary assets. The v2026.2.12 tag was created but the GitHub Actions workflow that publishes release artifacts did not trigger for the tag push. Use v2026.2.13 or later instead. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- ## Need help? You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.  Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com> Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

malancas and others added 29 commits November 6, 2024 07:57

initial pass at fetching bundles with sas urls

bfd140c

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into fetch-artifact-attestation-bundles-with-sas…

7160f7e

…-url

fetch bundles with sas url

5a6a796

Signed-off-by: Meredith Lancaster <malancas@github.com>

remove unused method

e51b4ef

Signed-off-by: Meredith Lancaster <malancas@github.com>

add httpClient field to LiveClient struct

6b95175

Signed-off-by: Meredith Lancaster <malancas@github.com>

go mod tidy

45121f6

Signed-off-by: Meredith Lancaster <malancas@github.com>

var naming

8f5d710

Signed-off-by: Meredith Lancaster <malancas@github.com>

update error messages

fb020f2

Signed-off-by: Meredith Lancaster <malancas@github.com>

add mock http client

e4431a3

Signed-off-by: Meredith Lancaster <malancas@github.com>

fix failing tests

ab4912f

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into fetch-artifact-attestation-bundles-with-sas…

706314b

…-url

provide additional logging and fallback

9051da3

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'fetch-artifact-attestation-bundles-with-sas-url' of git…

fc984c9

…hub.com:malancas/cli into fetch-artifact-attestation-bundles-with-sas-url

return fetch attestations err directly

311f2b2

Signed-off-by: Meredith Lancaster <malancas@github.com>

fetch bundles in parallel

070b67e

Signed-off-by: Meredith Lancaster <malancas@github.com>

add tests for bundle url fetch and fallback

e03a36e

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into fetch-artifact-attestation-bundles-with-sas…

b1af4b0

…-url

add test case for bundle url fetch failure

0202ca8

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'fetch-artifact-attestation-bundles-with-sas-url' of git…

fb4fc7e

…hub.com:malancas/cli into fetch-artifact-attestation-bundles-with-sas-url

add mutex for test field

6986511

Signed-off-by: Meredith Lancaster <malancas@github.com>

setup testing struct for test cases

9ecd90c

Signed-off-by: Meredith Lancaster <malancas@github.com>

add http client test constructors

e34e188

Signed-off-by: Meredith Lancaster <malancas@github.com>

use mock to assert number of http calls

ecf55c6

Signed-off-by: Meredith Lancaster <malancas@github.com>

simplify mock http client

9d88ca8

Signed-off-by: Meredith Lancaster <malancas@github.com>

more mock http client cleanup

7838e91

Signed-off-by: Meredith Lancaster <malancas@github.com>

undo name change for now

3c0280c

Signed-off-by: Meredith Lancaster <malancas@github.com>

remove spaces

37e0969

Signed-off-by: Meredith Lancaster <malancas@github.com>

undo other name change

0a602fa

Signed-off-by: Meredith Lancaster <malancas@github.com>

undo more name chanages

258c69c

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas commented Jan 7, 2025

View reviewed changes

malancas marked this pull request as ready for review January 7, 2025 19:08

malancas requested review from a team as code owners January 7, 2025 19:08

malancas requested a review from williammartin January 7, 2025 19:08

cliAutomation added the external pull request originating outside of the CLI core team label Jan 7, 2025

phillmv reviewed Jan 7, 2025

View reviewed changes

pkg/cmd/attestation/api/client.go Show resolved Hide resolved

phillmv reviewed Jan 7, 2025

View reviewed changes

malancas and others added 3 commits January 7, 2025 14:13

remove old comment

42cb254

Signed-off-by: Meredith Lancaster <malancas@github.com>

Update pkg/cmd/attestation/api/client.go

51a74ae

Co-authored-by: Phill MV <phillmv@github.com>

Update pkg/cmd/attestation/api/client.go

8d89dd9

Co-authored-by: Phill MV <phillmv@github.com>

github-advanced-security bot found potential problems Jan 7, 2025

View reviewed changes

pkg/cmd/attestation/api/client.go Fixed Show fixed Hide fixed

update tests to use new function name

33d0002

Signed-off-by: Meredith Lancaster <malancas@github.com>

add check for invalid attestation

8ad877b

Signed-off-by: Meredith Lancaster <malancas@github.com>

williammartin approved these changes Jan 8, 2025

View reviewed changes

malancas requested a review from phillmv January 8, 2025 17:58

phillmv approved these changes Jan 10, 2025

View reviewed changes

malancas merged commit 112552f into cli:trunk Jan 13, 2025

malancas deleted the fetch-artifact-attestation-bundles-with-sas-url branch January 13, 2025 17:42

malancas mentioned this pull request Jan 13, 2025

Attestation bundle fetch improvements #10233

Merged

Conversation

malancas commented Jan 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

williammartin commented Jan 8, 2025

Uh oh!

malancas commented Jan 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

williammartin commented Jan 8, 2025

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

malancas commented Jan 6, 2025 •

edited

Loading

malancas commented Jan 8, 2025 •

edited

Loading