fix: fall back to GITHUB_TOKEN for github.com by subdigital · Pull Request #7667 · jdx/mise

subdigital · 2026-01-14T17:26:56Z

When downloading from github.com (not api.github.com), fall back to GITHUB_TOKEN/MISE_GITHUB_TOKEN if MISE_GITHUB_ENTERPRISE_TOKEN is not set.

Scenario: Installing a package from an internal github repo

$ MISE_GITHUB_TOKEN=... mise install github:my-org/my-repo --verbose

The tag & release info would be fetched properly, but the download of the artifact happens on github.com so the code expected an enterprise token and that wasn't set.

Without this the download results in an HTML page that fails with "Invalid gzip header"

Note

Fixes token selection for GitHub requests outside the API host.

Updates get_headers in src/github.rs to fall back to GITHUB_TOKEN when the host is not api.github.com (previously only used MISE_GITHUB_ENTERPRISE_TOKEN)
Allows authenticated release asset downloads from github.com when only GITHUB_TOKEN/MISE_GITHUB_TOKEN is set, preventing failed downloads

^{Written by Cursor Bugbot for commit 1d22093. This will update automatically on new commits. Configure here.}

When downloading from github.com (not api.github.com), fall back to GITHUB_TOKEN/MISE_GITHUB_TOKEN if MISE_GITHUB_ENTERPRISE_TOKEN is not set. This fixes authentication for private GitHub repos when using the github backend, where downloads may go through github.com URLs that previously only used the enterprise token. Without this the download results in an HTML page that fails with "Invalid gzip header"

Copilot

Pull request overview

This PR fixes authentication when downloading GitHub release artifacts from internal repositories. When installing packages from internal GitHub repositories, the API calls go through api.github.com (authenticated with GITHUB_TOKEN), but artifact downloads happen on github.com (non-API domain), which previously required MISE_GITHUB_ENTERPRISE_TOKEN even for public GitHub.

Changes:

Added fallback from MISE_GITHUB_ENTERPRISE_TOKEN to GITHUB_TOKEN for non-api.github.com URLs in the authentication header logic

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jdx · 2026-01-14T17:29:47Z

bugbot run

cursor

✅ Bugbot reviewed your changes and found no bugs!

subdigital · 2026-01-14T17:51:03Z

@jdx I think I submitted this too soon. It got me past the download error, but then left me with an invalid checksum error:

  MISE_GITHUB_TOKEN=$GITHUB_ACCESS_TOKEN target/debug/mise install github:my-org/scriv@0.1.0 --verbose
DEBUG ARGS: target/debug/mise install github:my-org/scriv@0.1.0 --verbose
DEBUG config: ~/dev/mise/mise.toml
DEBUG config: ~/.config/mise/config.toml
DEBUG install_some_versions: github: my-org/scriv@0.1.0
INFO  github: my-org/scriv@0.1.0    install
DEBUG GET https://api.github.com/repos/my-org/scriv/releases/tags/v0.1.0
DEBUG Loaded netrc from /Users/bsch31/.netrc
DEBUG starting new connection: https://api.github.com/
DEBUG connecting to 140.82.113.5:443
DEBUG connected to 140.82.113.5:443
DEBUG GET https://api.github.com/repos/my-org/scriv/releases/tags/v0.1.0 200 OK
DEBUG pooling idle connection for ("https", api.github.com)
DEBUG using GitHub API digest for checksum verification
DEBUG HEAD https://github.com/my-org/scriv/releases/download/v0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz
DEBUG starting new connection: https://github.com/
DEBUG connecting to 140.82.114.3:443                                                                                      DEBUG connected to 140.82.114.3:443
DEBUG pooling idle connection for ("https", github.com)
DEBUG reuse idle connection for ("https", github.com)
DEBUG pooling idle connection for ("https", github.com)
DEBUG HEAD https://github.com/my-org/scriv/releases/download/v0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz 200 OK
INFO  github: my-org/scriv@0.1.0    download scriv-v0.1.0-Darwin-arm64.tar.gz
DEBUG GET Downloading https://github.com/my-org/scriv/releases/download/v0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz to ~/.local/share/mise/downloads/github-my-org-scriv/0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz
DEBUG GET https://github.com/my-org/scriv/releases/download/v0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz
DEBUG reuse idle connection for ("https", github.com)
DEBUG pooling idle connection for ("https", github.com)
DEBUG reuse idle connection for ("https", github.com)
DEBUG GET https://github.com/my-org/scriv/releases/download/v0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz 200 OK
DEBUG pooling idle connection for ("https", github.com)
INFO  github: my-org/scriv@0.1.0    checksum scriv-v0.1.0-Darwin-arm64.tar.gz
Error:
   0: Failed to install github: my-org/scriv@0.1.0: Checksum mismatch for file ~/.local/share/mise/downloads/github-my-org -scriv/0.1.0/scriv-v0.1.0-Darwin-arm64.tar.gz:
      Expected: sha256:93ed5bc2ff02495811d1f83ef683209118c29af21a5061149d36c1172e676451                                         Actual:   sha256:2ed55c59e798208ad5fcb2afa691c7c4f547a10d6f4840e04631bf9c380fdaaa
                                                                                                                          Location:
   src/toolset/toolset_install.rs:135
Version:
   2026.1.2-DEBUG macos-arm64 (2026-01-14)

Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.

The actual issue now is that the download link on github.com doesn't support bearer tokens, so my fix doesn't actually work. Would you be okay with me changing the download part to use the api (and thus the same token will work)? this is a bigger change than expected.

jdx · 2026-01-14T17:55:44Z

@subdigital Thanks for the detailed analysis in your comment - you're correct that the fix doesn't fully address the issue.

The root problem is that the URL selection logic in src/backend/github.rs:420-442 uses a HEAD request to decide between the direct URL (github.com/...) and the API URL (api.github.com/...):

true => match HTTP.head(asset.url.clone()).await {
    Ok(_) => asset.url.clone(),      // Uses direct URL if HEAD succeeds
    Err(_) => asset.url_api.clone(), // Falls back to API URL only on error
},

For private repos on standard GitHub:

The HEAD request to the direct URL succeeds (returns 200)
So the code chooses the direct URL
But github.com direct download URLs don't support Bearer token auth - they're CDN-style redirects that ignore the Authorization header
The download returns HTML/garbage instead of the actual file
Checksum mismatch

The fix should be in the URL selection logic, not in get_headers(). When GITHUB_TOKEN is set and we're downloading from standard GitHub, we should prefer the API URL which properly supports Bearer auth:

true => {
    if env::GITHUB_TOKEN.is_some() {
        // Prefer API URL when authenticated since github.com 
        // direct URLs don't support Bearer token auth
        asset.url_api.clone()
    } else {
        match HTTP.head(asset.url.clone()).await {
            Ok(_) => asset.url.clone(),
            Err(_) => asset.url_api.clone(),
        }
    }
}

This comment was AI-generated by Claude Code

Follow up to #7667 This change now checks the returned content type, if it was html then falls back to using the github api to figure out the asset url. Tested locally and it does indeed work :)  --- > [!NOTE] > Improves reliability when downloading release assets from GitHub/enterprise instances. > > - In `backend/github.rs` download flow, `HEAD` response now checks `Content-Type`; if `text/html` (likely login), use `asset.url_api` instead of the browser URL. > - In `github::get_headers`, non-`api.github.com` requests now use `MISE_GITHUB_ENTERPRISE_TOKEN` or fall back to `GITHUB_TOKEN` for auth; retains octet-stream `accept` for asset downloads. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit aadb750. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

@jdx

### 🚀 Features - **(s3)** add S3 backend for private artifact storage by @jdx in [#7668](#7668) - **(upgrade)** use installed_tool completer for mise upgrade by @jdx in [#7670](#7670) - **(upgrade)** add --exclude flag to mise upgrade command by @jdx in [#7669](#7669) - add no hooks and no env flags by @aacebedo in [#7560](#7560) ### 🐛 Bug Fixes - **(backend)** allow upgrading vfox backend tools with symlinked installations by @TyceHerrman in [#7012](#7012) - **(backend)** reject architecture mismatches in asset selection by @jdx in [#7672](#7672) - **(backend)** canonicalize symlink target before installs check by @jdx in [#7671](#7671) - **(self-update)** skip update when already at latest version by @jdx in [#7666](#7666) - fall back to GITHUB_TOKEN for github.com by @subdigital in [#7667](#7667) - GitHub token fallback by @subdigital in [#7673](#7673) - inherit tasks from parent configs in monorepos by @chadxz in [#7643](#7643) ### 📚 Documentation - **(contributing)** update registry examples by @scop in [#7660](#7660) - **(contributing)** update registry PR title rule by @scop in [#7663](#7663) - remove 404 link from contributing by @opswole in [#7692](#7692) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to 11f659e by @renovate[bot] in [#7685](#7685) - update ghcr.io/jdx/mise:copr docker digest to 3adaea4 by @renovate[bot] in [#7686](#7686) - update ghcr.io/jdx/mise:deb docker digest to 8bbca53 by @renovate[bot] in [#7687](#7687) - update ghcr.io/jdx/mise:rpm docker digest to de81415 by @renovate[bot] in [#7688](#7688) - update mcr.microsoft.com/devcontainers/rust:1 docker digest to 282e805 by @renovate[bot] in [#7690](#7690) - update rust docker digest to bed2d7f by @renovate[bot] in [#7691](#7691) ### 📦 Registry - add oh-my-posh by @scop in [#7659](#7659) - add bibtex-tidy (npm:bibtex-tidy) by @3w36zj6 in [#7677](#7677) - remove misconfigured bin_path option from kscript by @risu729 in [#7693](#7693) ### New Contributors - @opswole made their first contribution in [#7692](#7692) - @subdigital made their first contribution in [#7673](#7673) - @aacebedo made their first contribution in [#7560](#7560) ## 📦 Aqua Registry Updates #### New Packages (5) - [`BeaconBay/ck`](https://github.com/BeaconBay/ck) - [`d-kuro/gwq`](https://github.com/d-kuro/gwq) - [`kubernetes/cloud-provider-gcp/gke-gcloud-auth-plugin`](https://github.com/kubernetes/cloud-provider-gcp/gke-gcloud-auth-plugin) - [`smithy-lang/smithy`](https://github.com/smithy-lang/smithy) - [`tassiovirginio/try-rs`](https://github.com/tassiovirginio/try-rs) #### Updated Packages (1) - [`dprint/dprint`](https://github.com/dprint/dprint)

@jdx

## [2026.1.5](https://github.com/jdx/mise/compare/v2026.1.4..v2026.1.5) - 2026-01-19 ### 🚀 Features - **(complete)** add PowerShell completion support by @jdx in [#7746](jdx/mise#7746) - **(release)** add LLM-generated prose summary to release notes by @jdx in [#7737](jdx/mise#7737) - **(vfox)** add semver Lua module for version sorting by @jdx in [#7739](jdx/mise#7739) - **(vfox)** add rolling release support with checksum tracking by @jdx in [#7757](jdx/mise#7757) - dry filetask parsing and validation by @makp0 in [#7738](jdx/mise#7738) ### 🐛 Bug Fixes - **(completions)** bump usage-cli to 2.13.1 for PowerShell support by @jdx in [#7756](jdx/mise#7756) - schema missing env required string variant by @vadimpiven in [#7734](jdx/mise#7734) - validate unknown fields in filetask headers by @makp0 in [#7733](jdx/mise#7733) - disable schemacrawler test by @jdx in [#7743](jdx/mise#7743) - replace double forward slash with single slash in get_task_lists by @collinstevens in [#7744](jdx/mise#7744) - require LLM for release notes and include aqua section by @jdx in [#7745](jdx/mise#7745) - preserve {{ version }} in tool options during config load by @jdx in [#7755](jdx/mise#7755) ### 📚 Documentation - add documentation URL structure guidance to CLAUDE.md by @jdx in [#7740](jdx/mise#7740) - add pitchfork promotion by @jdx in [#7747](jdx/mise#7747) ### 📦️ Dependency Updates - relax version constraints and update dependencies by @jdx in [#7736](jdx/mise#7736) - lock file maintenance by @renovate[bot] in [#7749](jdx/mise#7749) ### Chore - bump xx to 2.3.1 by @jdx in [#7753](jdx/mise#7753) ### New Contributors - @collinstevens made their first contribution in [#7744](jdx/mise#7744) - @makp0 made their first contribution in [#7738](jdx/mise#7738) - @vadimpiven made their first contribution in [#7734](jdx/mise#7734) ## [2026.1.4](https://github.com/jdx/mise/compare/v2026.1.3..v2026.1.4) - 2026-01-17 ### 🚀 Features - **(conda)** add dependency locking for reproducible installations by @jdx in [#7708](jdx/mise#7708) - **(http)** add JSON filter syntax for version extraction by @jdx in [#7707](jdx/mise#7707) - **(http)** add version_expr support and Tera templating by @jdx in [#7723](jdx/mise#7723) - **(task)** add [monorepo].config_roots for explicit config root listing by @jdx in [#7705](jdx/mise#7705) - **(task)** support env vars in task dependencies by @jdx in [#7724](jdx/mise#7724) ### 🐛 Bug Fixes - **(conda)** fix hardcoded library paths in conda packages by @jdx in [#7713](jdx/mise#7713) - **(env)** avoid venv/go backend deadlock during env resolution by @stk0vrfl0w in [#7696](jdx/mise#7696) - **(locked)** exempt tool stubs from lockfile requirements by @jdx in [#7729](jdx/mise#7729) - **(python)** sort CPython versions at end of ls-remote output by @jdx in [#7721](jdx/mise#7721) - **(task)** resolve remote task files before display and validation commands by @yannrouillard in [#7681](jdx/mise#7681) - **(task)** support monorepo paths in `mise tasks deps` by @chadxz in [#7699](jdx/mise#7699) - **(task)** resolve all monorepo path hints in deps by @chadxz in [#7698](jdx/mise#7698) ### 📚 Documentation - remove outdated roadmap page by @jdx in [#7726](jdx/mise#7726) ### ⚡ Performance - **(task)** fix task-ls cached performance regression by @jdx in [#7716](jdx/mise#7716) ### 📦️ Dependency Updates - replace dependency @tsconfig/node22 with @tsconfig/node24 by @renovate[bot] in [#7618](jdx/mise#7618) ### 📦 Registry - add aqua backend for smithy by @jdx in [#7661](jdx/mise#7661) - remove low-usage asdf plugins by @jdx in [#7701](jdx/mise#7701) - disable mirrord test by @jdx in [#7703](jdx/mise#7703) - use vfox-dotnet as default backend by @jdx in [#7704](jdx/mise#7704) - use vfox-lua as default lua backend by @jdx in [#7706](jdx/mise#7706) - add vfox backend for redis by @jdx in [#7709](jdx/mise#7709) - use vfox-postgres as default postgres backend by @jdx in [#7710](jdx/mise#7710) - use github backend for kotlin by @jdx in [#7711](jdx/mise#7711) - add vfox backend for leiningen by @jdx in [#7714](jdx/mise#7714) - use pipx backend for meson by @jdx in [#7712](jdx/mise#7712) - use github backend for crystal by @jdx in [#7715](jdx/mise#7715) - use conda backend for sqlite by @jdx in [#7718](jdx/mise#7718) - use conda backend for make by @jdx in [#7719](jdx/mise#7719) - swift-package-list use github backend by @jdx in [#7720](jdx/mise#7720) ### Chore - increase macos release build timeout to 90 minutes by @jdx in [#7725](jdx/mise#7725) ### New Contributors - @yannrouillard made their first contribution in [#7681](jdx/mise#7681) - @stk0vrfl0w made their first contribution in [#7696](jdx/mise#7696) ## [2026.1.3](https://github.com/jdx/mise/compare/v2026.1.2..v2026.1.3) - 2026-01-16 ### 🚀 Features - **(s3)** add S3 backend for private artifact storage by @jdx in [#7668](jdx/mise#7668) - **(upgrade)** use installed_tool completer for mise upgrade by @jdx in [#7670](jdx/mise#7670) - **(upgrade)** add --exclude flag to mise upgrade command by @jdx in [#7669](jdx/mise#7669) - add no hooks and no env flags by @aacebedo in [#7560](jdx/mise#7560) ### 🐛 Bug Fixes - **(backend)** allow upgrading vfox backend tools with symlinked installations by @TyceHerrman in [#7012](jdx/mise#7012) - **(backend)** reject architecture mismatches in asset selection by @jdx in [#7672](jdx/mise#7672) - **(backend)** canonicalize symlink target before installs check by @jdx in [#7671](jdx/mise#7671) - **(npm)** avoid circular dependency when npm is in dependencies by @AprilNEA in [#7644](jdx/mise#7644) - **(self-update)** skip update when already at latest version by @jdx in [#7666](jdx/mise#7666) - fall back to GITHUB_TOKEN for github.com by @subdigital in [#7667](jdx/mise#7667) - GitHub token fallback by @subdigital in [#7673](jdx/mise#7673) - inherit tasks from parent configs in monorepos by @chadxz in [#7643](jdx/mise#7643) ### 📚 Documentation - **(contributing)** update registry examples by @scop in [#7660](jdx/mise#7660) - **(contributing)** update registry PR title rule by @scop in [#7663](jdx/mise#7663) - remove 404 link from contributing by @opswole in [#7692](jdx/mise#7692) - clarify that backend plugins should sort the version list by @ofalvai in [#7680](jdx/mise#7680) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to 11f659e by @renovate[bot] in [#7685](jdx/mise#7685) - update ghcr.io/jdx/mise:copr docker digest to 3adaea4 by @renovate[bot] in [#7686](jdx/mise#7686) - update ghcr.io/jdx/mise:deb docker digest to 8bbca53 by @renovate[bot] in [#7687](jdx/mise#7687) - update ghcr.io/jdx/mise:rpm docker digest to de81415 by @renovate[bot] in [#7688](jdx/mise#7688) - update mcr.microsoft.com/devcontainers/rust:1 docker digest to 282e805 by @renovate[bot] in [#7690](jdx/mise#7690) - update rust docker digest to bed2d7f by @renovate[bot] in [#7691](jdx/mise#7691) ### 📦 Registry - add oh-my-posh by @scop in [#7659](jdx/mise#7659) - add bibtex-tidy (npm:bibtex-tidy) by @3w36zj6 in [#7677](jdx/mise#7677) - remove misconfigured bin_path option from kscript by @risu729 in [#7693](jdx/mise#7693) ### New Contributors - @AprilNEA made their first contribution in [#7644](jdx/mise#7644) - @opswole made their first contribution in [#7692](jdx/mise#7692) - @subdigital made their first contribution in [#7673](jdx/mise#7673) - @aacebedo made their first contribution in [#7560](jdx/mise#7560)

@jdx

## [2026.1.5](https://github.com/jdx/mise/compare/v2026.1.4..v2026.1.5) - 2026-01-19 ### 🚀 Features - **(complete)** add PowerShell completion support by @jdx in [#7746](jdx/mise#7746) - **(release)** add LLM-generated prose summary to release notes by @jdx in [#7737](jdx/mise#7737) - **(vfox)** add semver Lua module for version sorting by @jdx in [#7739](jdx/mise#7739) - **(vfox)** add rolling release support with checksum tracking by @jdx in [#7757](jdx/mise#7757) - dry filetask parsing and validation by @makp0 in [#7738](jdx/mise#7738) ### 🐛 Bug Fixes - **(completions)** bump usage-cli to 2.13.1 for PowerShell support by @jdx in [#7756](jdx/mise#7756) - schema missing env required string variant by @vadimpiven in [#7734](jdx/mise#7734) - validate unknown fields in filetask headers by @makp0 in [#7733](jdx/mise#7733) - disable schemacrawler test by @jdx in [#7743](jdx/mise#7743) - replace double forward slash with single slash in get_task_lists by @collinstevens in [#7744](jdx/mise#7744) - require LLM for release notes and include aqua section by @jdx in [#7745](jdx/mise#7745) - preserve {{ version }} in tool options during config load by @jdx in [#7755](jdx/mise#7755) ### 📚 Documentation - add documentation URL structure guidance to CLAUDE.md by @jdx in [#7740](jdx/mise#7740) - add pitchfork promotion by @jdx in [#7747](jdx/mise#7747) ### 📦️ Dependency Updates - relax version constraints and update dependencies by @jdx in [#7736](jdx/mise#7736) - lock file maintenance by @renovate[bot] in [#7749](jdx/mise#7749) ### Chore - bump xx to 2.3.1 by @jdx in [#7753](jdx/mise#7753) ### New Contributors - @collinstevens made their first contribution in [#7744](jdx/mise#7744) - @makp0 made their first contribution in [#7738](jdx/mise#7738) - @vadimpiven made their first contribution in [#7734](jdx/mise#7734) ## [2026.1.4](https://github.com/jdx/mise/compare/v2026.1.3..v2026.1.4) - 2026-01-17 ### 🚀 Features - **(conda)** add dependency locking for reproducible installations by @jdx in [#7708](jdx/mise#7708) - **(http)** add JSON filter syntax for version extraction by @jdx in [#7707](jdx/mise#7707) - **(http)** add version_expr support and Tera templating by @jdx in [#7723](jdx/mise#7723) - **(task)** add [monorepo].config_roots for explicit config root listing by @jdx in [#7705](jdx/mise#7705) - **(task)** support env vars in task dependencies by @jdx in [#7724](jdx/mise#7724) ### 🐛 Bug Fixes - **(conda)** fix hardcoded library paths in conda packages by @jdx in [#7713](jdx/mise#7713) - **(env)** avoid venv/go backend deadlock during env resolution by @stk0vrfl0w in [#7696](jdx/mise#7696) - **(locked)** exempt tool stubs from lockfile requirements by @jdx in [#7729](jdx/mise#7729) - **(python)** sort CPython versions at end of ls-remote output by @jdx in [#7721](jdx/mise#7721) - **(task)** resolve remote task files before display and validation commands by @yannrouillard in [#7681](jdx/mise#7681) - **(task)** support monorepo paths in `mise tasks deps` by @chadxz in [#7699](jdx/mise#7699) - **(task)** resolve all monorepo path hints in deps by @chadxz in [#7698](jdx/mise#7698) ### 📚 Documentation - remove outdated roadmap page by @jdx in [#7726](jdx/mise#7726) ### ⚡ Performance - **(task)** fix task-ls cached performance regression by @jdx in [#7716](jdx/mise#7716) ### 📦️ Dependency Updates - replace dependency @tsconfig/node22 with @tsconfig/node24 by @renovate[bot] in [#7618](jdx/mise#7618) ### 📦 Registry - add aqua backend for smithy by @jdx in [#7661](jdx/mise#7661) - remove low-usage asdf plugins by @jdx in [#7701](jdx/mise#7701) - disable mirrord test by @jdx in [#7703](jdx/mise#7703) - use vfox-dotnet as default backend by @jdx in [#7704](jdx/mise#7704) - use vfox-lua as default lua backend by @jdx in [#7706](jdx/mise#7706) - add vfox backend for redis by @jdx in [#7709](jdx/mise#7709) - use vfox-postgres as default postgres backend by @jdx in [#7710](jdx/mise#7710) - use github backend for kotlin by @jdx in [#7711](jdx/mise#7711) - add vfox backend for leiningen by @jdx in [#7714](jdx/mise#7714) - use pipx backend for meson by @jdx in [#7712](jdx/mise#7712) - use github backend for crystal by @jdx in [#7715](jdx/mise#7715) - use conda backend for sqlite by @jdx in [#7718](jdx/mise#7718) - use conda backend for make by @jdx in [#7719](jdx/mise#7719) - swift-package-list use github backend by @jdx in [#7720](jdx/mise#7720) ### Chore - increase macos release build timeout to 90 minutes by @jdx in [#7725](jdx/mise#7725) ### New Contributors - @yannrouillard made their first contribution in [#7681](jdx/mise#7681) - @stk0vrfl0w made their first contribution in [#7696](jdx/mise#7696) ## [2026.1.3](https://github.com/jdx/mise/compare/v2026.1.2..v2026.1.3) - 2026-01-16 ### 🚀 Features - **(s3)** add S3 backend for private artifact storage by @jdx in [#7668](jdx/mise#7668) - **(upgrade)** use installed_tool completer for mise upgrade by @jdx in [#7670](jdx/mise#7670) - **(upgrade)** add --exclude flag to mise upgrade command by @jdx in [#7669](jdx/mise#7669) - add no hooks and no env flags by @aacebedo in [#7560](jdx/mise#7560) ### 🐛 Bug Fixes - **(backend)** allow upgrading vfox backend tools with symlinked installations by @TyceHerrman in [#7012](jdx/mise#7012) - **(backend)** reject architecture mismatches in asset selection by @jdx in [#7672](jdx/mise#7672) - **(backend)** canonicalize symlink target before installs check by @jdx in [#7671](jdx/mise#7671) - **(npm)** avoid circular dependency when npm is in dependencies by @AprilNEA in [#7644](jdx/mise#7644) - **(self-update)** skip update when already at latest version by @jdx in [#7666](jdx/mise#7666) - fall back to GITHUB_TOKEN for github.com by @subdigital in [#7667](jdx/mise#7667) - GitHub token fallback by @subdigital in [#7673](jdx/mise#7673) - inherit tasks from parent configs in monorepos by @chadxz in [#7643](jdx/mise#7643) ### 📚 Documentation - **(contributing)** update registry examples by @scop in [#7660](jdx/mise#7660) - **(contributing)** update registry PR title rule by @scop in [#7663](jdx/mise#7663) - remove 404 link from contributing by @opswole in [#7692](jdx/mise#7692) - clarify that backend plugins should sort the version list by @ofalvai in [#7680](jdx/mise#7680) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to 11f659e by @renovate[bot] in [#7685](jdx/mise#7685) - update ghcr.io/jdx/mise:copr docker digest to 3adaea4 by @renovate[bot] in [#7686](jdx/mise#7686) - update ghcr.io/jdx/mise:deb docker digest to 8bbca53 by @renovate[bot] in [#7687](jdx/mise#7687) - update ghcr.io/jdx/mise:rpm docker digest to de81415 by @renovate[bot] in [#7688](jdx/mise#7688) - update mcr.microsoft.com/devcontainers/rust:1 docker digest to 282e805 by @renovate[bot] in [#7690](jdx/mise#7690) - update rust docker digest to bed2d7f by @renovate[bot] in [#7691](jdx/mise#7691) ### 📦 Registry - add oh-my-posh by @scop in [#7659](jdx/mise#7659) - add bibtex-tidy (npm:bibtex-tidy) by @3w36zj6 in [#7677](jdx/mise#7677) - remove misconfigured bin_path option from kscript by @risu729 in [#7693](jdx/mise#7693) ### New Contributors - @AprilNEA made their first contribution in [#7644](jdx/mise#7644) - @opswole made their first contribution in [#7692](jdx/mise#7692) - @subdigital made their first contribution in [#7673](jdx/mise#7673) - @aacebedo made their first contribution in [#7560](jdx/mise#7560)

Copilot AI review requested due to automatic review settings January 14, 2026 17:26

Copilot started reviewing on behalf of subdigital January 14, 2026 17:27 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

cursor bot reviewed Jan 14, 2026

View reviewed changes

jdx enabled auto-merge (squash) January 14, 2026 17:35

jdx merged commit ba26b44 into jdx:main Jan 14, 2026
41 of 42 checks passed

mise-en-dev mentioned this pull request Jan 14, 2026

chore: release 2026.1.3 #7662

Merged

subdigital mentioned this pull request Jan 14, 2026

fix: GitHub token fallback #7673

Merged

mise-en-dev mentioned this pull request Jan 16, 2026

chore: release 2026.1.4 #7697

Merged

BrewTestBot mentioned this pull request Jan 16, 2026

mise 2026.1.3 Homebrew/homebrew-core#263203

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: fall back to GITHUB_TOKEN for github.com#7667

fix: fall back to GITHUB_TOKEN for github.com#7667
jdx merged 1 commit intojdx:mainfrom
subdigital:fix/github-token-fallback

subdigital commented Jan 14, 2026 •

edited by cursor bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

jdx commented Jan 14, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

subdigital commented Jan 14, 2026

Uh oh!

jdx commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

subdigital commented Jan 14, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jdx commented Jan 14, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

subdigital commented Jan 14, 2026

Uh oh!

jdx commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

subdigital commented Jan 14, 2026 •

edited by cursor bot

Loading