feat(conda): add dependency locking for reproducible installations by jdx · Pull Request #7708 · jdx/mise

jdx · 2026-01-17T14:51:54Z

Summary

Resolves #7700

Adds support for locking conda package dependencies in the lockfile, enabling reproducible installations.

Previously: Only the main package URL and checksum were stored; dependencies were resolved dynamically on each install, which could vary over time on anaconda.org.

Now: All resolved dependencies are stored in a shared [conda-packages] section in the lockfile, keyed by basename (which includes version+build). Tools reference these packages via conda_deps in their platform info.

Changes

Add conda-packages section to lockfile for shared dependency storage
Add conda_deps field to PlatformInfo for per-tool dependency references
Add CondaPackageInfo struct for storing package URL and checksum
Update conda backend to:
- Use locked deps when available (from lockfile)
- Fall back to dynamic resolution otherwise
- Store resolved deps in both tool's PlatformInfo and shared section
Add resolve_conda_packages() trait method for mise lock support
Update mise lock command to also resolve and store conda packages

Example Lockfile

[conda-packages."macos-arm64"]
"ncurses-6.4-h7ea286d_0" = { url = "https://conda.anaconda.org/.../ncurses-6.4-h7ea286d_0.conda", checksum = "sha256:abc..." }
"readline-8.2-h92ec313_1" = { url = "https://conda.anaconda.org/.../readline-8.2-h92ec313_1.conda", checksum = "sha256:def..." }

[[tools.bash]]
version = "5.2.37"
backend = "conda:bash"
"platforms.macos-arm64" = { url = "...", checksum = "...", conda_deps = ["readline-8.2-h92ec313_1", "ncurses-6.4-h7ea286d_0"] }

[[tools.jq]]
version = "1.7.1"
backend = "conda:jq"
"platforms.macos-arm64" = { url = "...", checksum = "...", conda_deps = ["ncurses-6.4-h7ea286d_0"] }

Note: Tools sharing the same dependency version (like ncurses above) share the same entry in conda-packages.

Test plan

Unit tests pass (400 tests)
Lint passes
Manual test: mise use conda:jq@1.7.1 && mise lock should generate lockfile with conda-packages section
Manual test: Delete install, reinstall should use locked deps

🤖 Generated with Claude Code

Note

Adds reproducible conda installs by locking dependency artifacts and referencing them from tools.

Lockfile: new shared [conda-packages] (platform -> basename -> {url, checksum}) and per-platform PlatformInfo.conda_deps; full (de)serialization, merge, save/read logic, and unit tests
Conda backend: uses locked deps when present, otherwise resolves dynamically; stores dep basenames in tool PlatformInfo and writes package entries to lockfile; adds resolve_conda_packages() for mise lock; adjusts extraction to use basenames
CLI (mise lock): resolves per-platform conda packages for conda tools and writes them to the shared section alongside platform info
Plumbing: ToolVersion now carries resolved conda_packages; other backends updated to populate PlatformInfo { conda_deps: None }

^{Written by Cursor Bugbot for commit cdebe86. This will update automatically on new commits. Configure here.}

Resolves #7700 Add support for locking conda package dependencies in the lockfile, enabling reproducible installations. Previously, only the main package URL and checksum were stored; dependencies were resolved dynamically on each install, which could vary over time. Changes: - Add `conda-packages` section to lockfile for shared dependency storage - Add `conda_deps` field to `PlatformInfo` for per-tool dependency refs - Update conda backend to use locked deps when available, fall back to dynamic resolution otherwise - Add `resolve_conda_packages()` trait method for `mise lock` support - Store resolved dependencies keyed by basename (includes version+build) to support different versions of the same package across tools Example lockfile format: ```toml [conda-packages."macos-arm64"] "ncurses-6.4-h7ea286d_0" = { url = "...", checksum = "sha256:..." } [[tools.jq]] version = "1.7.1" "platforms.macos-arm64" = { conda_deps = ["ncurses-6.4-h7ea286d_0"] } ``` Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Copilot

Pull request overview

This PR adds dependency locking for conda packages to ensure reproducible installations. Previously, only the main package URL and checksum were stored, with dependencies resolved dynamically on each install. Now, all resolved dependencies are stored in a shared [conda-packages] section in the lockfile, allowing tools to reference them via conda_deps in their platform info.

Changes:

Added lockfile support for conda package dependencies through a new [conda-packages] section and conda_deps field in PlatformInfo
Updated conda backend to use locked dependencies when available and fall back to dynamic resolution otherwise
Extended mise lock command to resolve and store conda packages for all backends

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/lockfile.rs	Added `CondaPackageInfo` struct, `conda_packages` field to `Lockfile`, and `conda_deps` field to `PlatformInfo` with serialization/deserialization logic
src/backend/conda.rs	Updated installation and locking logic to use locked dependencies when available and store resolved packages in lockfile format
src/backend/mod.rs	Added `resolve_conda_packages` trait method with default empty implementation
src/cli/lock.rs	Updated lock command to resolve and store conda packages alongside platform info
src/toolset/tool_version.rs	Added `conda_packages` field to `ToolVersion` for tracking resolved packages during installation
src/plugins/core/*.rs	Added `conda_deps: None` to `PlatformInfo` construction in non-conda backends
src/backend/github.rs	Added `conda_deps: None` to `PlatformInfo` construction
src/backend/aqua.rs	Added `conda_deps: None` to `PlatformInfo` construction

Comments suppressed due to low confidence (1)

src/lockfile.rs:1

The type annotation : &String is redundant and unnecessary since the compiler can infer the type from pkg_info.checksum.as_ref(). Remove the explicit type annotation for cleaner code.

use crate::config::{Config, Settings};

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-17T14:52:45Z

src/backend/conda.rs

+/// Extract basename from URL
+/// "https://conda.anaconda.org/.../ncurses-6.4-h7ea286d_0.conda" -> "ncurses-6.4-h7ea286d_0.conda"


This function should have a doc comment explaining its purpose and providing an example, especially since it's a utility function that extracts the filename portion from a conda package URL.

Suggested change

/// Extract basename from URL

/// "https://conda.anaconda.org/.../ncurses-6.4-h7ea286d_0.conda" -> "ncurses-6.4-h7ea286d_0.conda"

/// Extract the filename (basename) portion from a conda package URL.

///

/// For example, given:

/// `"https://conda.anaconda.org/conda-forge/linux-64/ncurses-6.4-h7ea286d_0.conda"`

/// this returns:

/// `"ncurses-6.4-h7ea286d_0.conda"`.

Copilot · 2026-01-17T14:52:46Z

src/backend/conda.rs

+/// Strip conda extension from basename
+/// "ncurses-6.4-h7ea286d_0.conda" -> "ncurses-6.4-h7ea286d_0"
+fn strip_conda_extension(basename: &str) -> &str {
+    basename
+        .strip_suffix(".conda")
+        .or_else(|| basename.strip_suffix(".tar.bz2"))
+        .unwrap_or(basename)
+}


The doc comment shows only the .conda extension example, but the function also handles .tar.bz2. Add an example for the .tar.bz2 case to fully document the function's behavior.

Move conda-specific logic into the conda backend: - Move CondaPackageInfo struct from lockfile.rs to conda.rs - Re-export from lockfile.rs for serialization compatibility - Remove generic resolve_conda_packages from Backend trait - Update lock.rs to check for conda backend type and call conda-specific method directly This keeps the conda dependency locking logic encapsulated within the conda backend rather than spreading it across the codebase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/backend/conda.rs

github-actions · 2026-01-17T15:16:27Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.1.3 x -- echo`	20.3 ± 0.6	19.1	23.1	1.00
`mise x -- echo`	20.6 ± 0.9	19.2	27.6	1.01 ± 0.06

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.1.3 env`	19.7 ± 0.6	18.6	23.6	1.00
`mise env`	19.9 ± 0.7	18.6	25.7	1.01 ± 0.05

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.1.3 hook-env`	20.2 ± 0.6	18.9	23.5	1.00
`mise hook-env`	20.3 ± 0.8	18.8	23.5	1.00 ± 0.05

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.1.3 ls`	18.3 ± 0.5	17.3	20.3	1.00
`mise ls`	18.6 ± 0.7	17.4	22.1	1.02 ± 0.05

`xtasks/test/perf`

Command	mise-2026.1.3	mise	Variance
install (cached)	114ms	114ms	+0%
ls (cached)	69ms	71ms	-2%
bin-paths (cached)	72ms	73ms	-1%
task-ls (cached)	280ms	⚠️ 733ms	-61%

⚠️ Warning: task-ls cached performance variance is -61%

Remove get_conda_packages and conda_packages_mut methods that were unused outside of tests. Tests now access conda_packages field directly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/lockfile.rs

- Make resolve_conda_packages return Result to propagate errors instead of silently returning empty maps. This prevents conda_deps references pointing to packages that don't exist in the conda-packages section. - Fix stale conda_deps merge: always use new value since None means "no dependencies" rather than "not computed" Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-01-17T16:06:53Z

src/backend/conda.rs

+                        None
+                    } else {
+                        Some(conda_deps)
+                    },


Empty conda deps treated as unlocked dependencies

Medium Severity

In resolve_lock_info, when a conda package has no dependencies, conda_deps is set to None instead of Some(vec![]). During installation, the code interprets None as "not locked" and falls back to dynamic resolution. This defeats dependency locking for packages with no dependencies — if such a package later gains dependencies, they would be installed unexpectedly, breaking reproducibility.

@jdx

### 🚀 Features - **(conda)** add dependency locking for reproducible installations by @jdx in [#7708](#7708) - **(http)** add JSON filter syntax for version extraction by @jdx in [#7707](#7707) - **(http)** add version_expr support and Tera templating by @jdx in [#7723](#7723) - **(task)** add [monorepo].config_roots for explicit config root listing by @jdx in [#7705](#7705) - **(task)** support env vars in task dependencies by @jdx in [#7724](#7724) ### 🐛 Bug Fixes - **(conda)** fix hardcoded library paths in conda packages by @jdx in [#7713](#7713) - **(env)** avoid venv/go backend deadlock during env resolution by @stk0vrfl0w in [#7696](#7696) - **(python)** sort CPython versions at end of ls-remote output by @jdx in [#7721](#7721) - **(task)** resolve remote task files before display and validation commands by @yannrouillard in [#7681](#7681) - **(task)** support monorepo paths in `mise tasks deps` by @chadxz in [#7699](#7699) - **(task)** resolve all monorepo path hints in deps by @chadxz in [#7698](#7698) ### 📚 Documentation - remove outdated roadmap page by @jdx in [#7726](#7726) ### ⚡ Performance - **(task)** fix task-ls cached performance regression by @jdx in [#7716](#7716) ### 📦️ Dependency Updates - replace dependency @tsconfig/node22 with @tsconfig/node24 by @renovate[bot] in [#7618](#7618) ### 📦 Registry - add aqua backend for smithy by @jdx in [#7661](#7661) - remove low-usage asdf plugins by @jdx in [#7701](#7701) - disable mirrord test by @jdx in [#7703](#7703) - use vfox-dotnet as default backend by @jdx in [#7704](#7704) - use vfox-lua as default lua backend by @jdx in [#7706](#7706) - add vfox backend for redis by @jdx in [#7709](#7709) - use vfox-postgres as default postgres backend by @jdx in [#7710](#7710) - use github backend for kotlin by @jdx in [#7711](#7711) - add vfox backend for leiningen by @jdx in [#7714](#7714) - use pipx backend for meson by @jdx in [#7712](#7712) - use github backend for crystal by @jdx in [#7715](#7715) - use conda backend for sqlite by @jdx in [#7718](#7718) - use conda backend for make by @jdx in [#7719](#7719) - swift-package-list use github backend by @jdx in [#7720](#7720) ### Chore - increase macos release build timeout to 90 minutes by @jdx in [#7725](#7725) ### New Contributors - @yannrouillard made their first contribution in [#7681](#7681) - @stk0vrfl0w made their first contribution in [#7696](#7696) ## 📦 Aqua Registry Updates #### New Packages (4) - [`chevdor/tera-cli`](https://github.com/chevdor/tera-cli) - [`goforj/wire`](https://github.com/goforj/wire) - [`gravitational/teleport`](https://github.com/gravitational/teleport) - [`jackchuka/mdschema`](https://github.com/jackchuka/mdschema) #### Updated Packages (2) - [`ollama/ollama`](https://github.com/ollama/ollama) - [`twpayne/chezmoi`](https://github.com/twpayne/chezmoi)

@jdx

## [2026.1.5](https://github.com/jdx/mise/compare/v2026.1.4..v2026.1.5) - 2026-01-19 ### 🚀 Features - **(complete)** add PowerShell completion support by @jdx in [#7746](jdx/mise#7746) - **(release)** add LLM-generated prose summary to release notes by @jdx in [#7737](jdx/mise#7737) - **(vfox)** add semver Lua module for version sorting by @jdx in [#7739](jdx/mise#7739) - **(vfox)** add rolling release support with checksum tracking by @jdx in [#7757](jdx/mise#7757) - dry filetask parsing and validation by @makp0 in [#7738](jdx/mise#7738) ### 🐛 Bug Fixes - **(completions)** bump usage-cli to 2.13.1 for PowerShell support by @jdx in [#7756](jdx/mise#7756) - schema missing env required string variant by @vadimpiven in [#7734](jdx/mise#7734) - validate unknown fields in filetask headers by @makp0 in [#7733](jdx/mise#7733) - disable schemacrawler test by @jdx in [#7743](jdx/mise#7743) - replace double forward slash with single slash in get_task_lists by @collinstevens in [#7744](jdx/mise#7744) - require LLM for release notes and include aqua section by @jdx in [#7745](jdx/mise#7745) - preserve {{ version }} in tool options during config load by @jdx in [#7755](jdx/mise#7755) ### 📚 Documentation - add documentation URL structure guidance to CLAUDE.md by @jdx in [#7740](jdx/mise#7740) - add pitchfork promotion by @jdx in [#7747](jdx/mise#7747) ### 📦️ Dependency Updates - relax version constraints and update dependencies by @jdx in [#7736](jdx/mise#7736) - lock file maintenance by @renovate[bot] in [#7749](jdx/mise#7749) ### Chore - bump xx to 2.3.1 by @jdx in [#7753](jdx/mise#7753) ### New Contributors - @collinstevens made their first contribution in [#7744](jdx/mise#7744) - @makp0 made their first contribution in [#7738](jdx/mise#7738) - @vadimpiven made their first contribution in [#7734](jdx/mise#7734) ## [2026.1.4](https://github.com/jdx/mise/compare/v2026.1.3..v2026.1.4) - 2026-01-17 ### 🚀 Features - **(conda)** add dependency locking for reproducible installations by @jdx in [#7708](jdx/mise#7708) - **(http)** add JSON filter syntax for version extraction by @jdx in [#7707](jdx/mise#7707) - **(http)** add version_expr support and Tera templating by @jdx in [#7723](jdx/mise#7723) - **(task)** add [monorepo].config_roots for explicit config root listing by @jdx in [#7705](jdx/mise#7705) - **(task)** support env vars in task dependencies by @jdx in [#7724](jdx/mise#7724) ### 🐛 Bug Fixes - **(conda)** fix hardcoded library paths in conda packages by @jdx in [#7713](jdx/mise#7713) - **(env)** avoid venv/go backend deadlock during env resolution by @stk0vrfl0w in [#7696](jdx/mise#7696) - **(locked)** exempt tool stubs from lockfile requirements by @jdx in [#7729](jdx/mise#7729) - **(python)** sort CPython versions at end of ls-remote output by @jdx in [#7721](jdx/mise#7721) - **(task)** resolve remote task files before display and validation commands by @yannrouillard in [#7681](jdx/mise#7681) - **(task)** support monorepo paths in `mise tasks deps` by @chadxz in [#7699](jdx/mise#7699) - **(task)** resolve all monorepo path hints in deps by @chadxz in [#7698](jdx/mise#7698) ### 📚 Documentation - remove outdated roadmap page by @jdx in [#7726](jdx/mise#7726) ### ⚡ Performance - **(task)** fix task-ls cached performance regression by @jdx in [#7716](jdx/mise#7716) ### 📦️ Dependency Updates - replace dependency @tsconfig/node22 with @tsconfig/node24 by @renovate[bot] in [#7618](jdx/mise#7618) ### 📦 Registry - add aqua backend for smithy by @jdx in [#7661](jdx/mise#7661) - remove low-usage asdf plugins by @jdx in [#7701](jdx/mise#7701) - disable mirrord test by @jdx in [#7703](jdx/mise#7703) - use vfox-dotnet as default backend by @jdx in [#7704](jdx/mise#7704) - use vfox-lua as default lua backend by @jdx in [#7706](jdx/mise#7706) - add vfox backend for redis by @jdx in [#7709](jdx/mise#7709) - use vfox-postgres as default postgres backend by @jdx in [#7710](jdx/mise#7710) - use github backend for kotlin by @jdx in [#7711](jdx/mise#7711) - add vfox backend for leiningen by @jdx in [#7714](jdx/mise#7714) - use pipx backend for meson by @jdx in [#7712](jdx/mise#7712) - use github backend for crystal by @jdx in [#7715](jdx/mise#7715) - use conda backend for sqlite by @jdx in [#7718](jdx/mise#7718) - use conda backend for make by @jdx in [#7719](jdx/mise#7719) - swift-package-list use github backend by @jdx in [#7720](jdx/mise#7720) ### Chore - increase macos release build timeout to 90 minutes by @jdx in [#7725](jdx/mise#7725) ### New Contributors - @yannrouillard made their first contribution in [#7681](jdx/mise#7681) - @stk0vrfl0w made their first contribution in [#7696](jdx/mise#7696) ## [2026.1.3](https://github.com/jdx/mise/compare/v2026.1.2..v2026.1.3) - 2026-01-16 ### 🚀 Features - **(s3)** add S3 backend for private artifact storage by @jdx in [#7668](jdx/mise#7668) - **(upgrade)** use installed_tool completer for mise upgrade by @jdx in [#7670](jdx/mise#7670) - **(upgrade)** add --exclude flag to mise upgrade command by @jdx in [#7669](jdx/mise#7669) - add no hooks and no env flags by @aacebedo in [#7560](jdx/mise#7560) ### 🐛 Bug Fixes - **(backend)** allow upgrading vfox backend tools with symlinked installations by @TyceHerrman in [#7012](jdx/mise#7012) - **(backend)** reject architecture mismatches in asset selection by @jdx in [#7672](jdx/mise#7672) - **(backend)** canonicalize symlink target before installs check by @jdx in [#7671](jdx/mise#7671) - **(npm)** avoid circular dependency when npm is in dependencies by @AprilNEA in [#7644](jdx/mise#7644) - **(self-update)** skip update when already at latest version by @jdx in [#7666](jdx/mise#7666) - fall back to GITHUB_TOKEN for github.com by @subdigital in [#7667](jdx/mise#7667) - GitHub token fallback by @subdigital in [#7673](jdx/mise#7673) - inherit tasks from parent configs in monorepos by @chadxz in [#7643](jdx/mise#7643) ### 📚 Documentation - **(contributing)** update registry examples by @scop in [#7660](jdx/mise#7660) - **(contributing)** update registry PR title rule by @scop in [#7663](jdx/mise#7663) - remove 404 link from contributing by @opswole in [#7692](jdx/mise#7692) - clarify that backend plugins should sort the version list by @ofalvai in [#7680](jdx/mise#7680) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to 11f659e by @renovate[bot] in [#7685](jdx/mise#7685) - update ghcr.io/jdx/mise:copr docker digest to 3adaea4 by @renovate[bot] in [#7686](jdx/mise#7686) - update ghcr.io/jdx/mise:deb docker digest to 8bbca53 by @renovate[bot] in [#7687](jdx/mise#7687) - update ghcr.io/jdx/mise:rpm docker digest to de81415 by @renovate[bot] in [#7688](jdx/mise#7688) - update mcr.microsoft.com/devcontainers/rust:1 docker digest to 282e805 by @renovate[bot] in [#7690](jdx/mise#7690) - update rust docker digest to bed2d7f by @renovate[bot] in [#7691](jdx/mise#7691) ### 📦 Registry - add oh-my-posh by @scop in [#7659](jdx/mise#7659) - add bibtex-tidy (npm:bibtex-tidy) by @3w36zj6 in [#7677](jdx/mise#7677) - remove misconfigured bin_path option from kscript by @risu729 in [#7693](jdx/mise#7693) ### New Contributors - @AprilNEA made their first contribution in [#7644](jdx/mise#7644) - @opswole made their first contribution in [#7692](jdx/mise#7692) - @subdigital made their first contribution in [#7673](jdx/mise#7673) - @aacebedo made their first contribution in [#7560](jdx/mise#7560)

@jdx

## [2026.1.5](https://github.com/jdx/mise/compare/v2026.1.4..v2026.1.5) - 2026-01-19 ### 🚀 Features - **(complete)** add PowerShell completion support by @jdx in [#7746](jdx/mise#7746) - **(release)** add LLM-generated prose summary to release notes by @jdx in [#7737](jdx/mise#7737) - **(vfox)** add semver Lua module for version sorting by @jdx in [#7739](jdx/mise#7739) - **(vfox)** add rolling release support with checksum tracking by @jdx in [#7757](jdx/mise#7757) - dry filetask parsing and validation by @makp0 in [#7738](jdx/mise#7738) ### 🐛 Bug Fixes - **(completions)** bump usage-cli to 2.13.1 for PowerShell support by @jdx in [#7756](jdx/mise#7756) - schema missing env required string variant by @vadimpiven in [#7734](jdx/mise#7734) - validate unknown fields in filetask headers by @makp0 in [#7733](jdx/mise#7733) - disable schemacrawler test by @jdx in [#7743](jdx/mise#7743) - replace double forward slash with single slash in get_task_lists by @collinstevens in [#7744](jdx/mise#7744) - require LLM for release notes and include aqua section by @jdx in [#7745](jdx/mise#7745) - preserve {{ version }} in tool options during config load by @jdx in [#7755](jdx/mise#7755) ### 📚 Documentation - add documentation URL structure guidance to CLAUDE.md by @jdx in [#7740](jdx/mise#7740) - add pitchfork promotion by @jdx in [#7747](jdx/mise#7747) ### 📦️ Dependency Updates - relax version constraints and update dependencies by @jdx in [#7736](jdx/mise#7736) - lock file maintenance by @renovate[bot] in [#7749](jdx/mise#7749) ### Chore - bump xx to 2.3.1 by @jdx in [#7753](jdx/mise#7753) ### New Contributors - @collinstevens made their first contribution in [#7744](jdx/mise#7744) - @makp0 made their first contribution in [#7738](jdx/mise#7738) - @vadimpiven made their first contribution in [#7734](jdx/mise#7734) ## [2026.1.4](https://github.com/jdx/mise/compare/v2026.1.3..v2026.1.4) - 2026-01-17 ### 🚀 Features - **(conda)** add dependency locking for reproducible installations by @jdx in [#7708](jdx/mise#7708) - **(http)** add JSON filter syntax for version extraction by @jdx in [#7707](jdx/mise#7707) - **(http)** add version_expr support and Tera templating by @jdx in [#7723](jdx/mise#7723) - **(task)** add [monorepo].config_roots for explicit config root listing by @jdx in [#7705](jdx/mise#7705) - **(task)** support env vars in task dependencies by @jdx in [#7724](jdx/mise#7724) ### 🐛 Bug Fixes - **(conda)** fix hardcoded library paths in conda packages by @jdx in [#7713](jdx/mise#7713) - **(env)** avoid venv/go backend deadlock during env resolution by @stk0vrfl0w in [#7696](jdx/mise#7696) - **(locked)** exempt tool stubs from lockfile requirements by @jdx in [#7729](jdx/mise#7729) - **(python)** sort CPython versions at end of ls-remote output by @jdx in [#7721](jdx/mise#7721) - **(task)** resolve remote task files before display and validation commands by @yannrouillard in [#7681](jdx/mise#7681) - **(task)** support monorepo paths in `mise tasks deps` by @chadxz in [#7699](jdx/mise#7699) - **(task)** resolve all monorepo path hints in deps by @chadxz in [#7698](jdx/mise#7698) ### 📚 Documentation - remove outdated roadmap page by @jdx in [#7726](jdx/mise#7726) ### ⚡ Performance - **(task)** fix task-ls cached performance regression by @jdx in [#7716](jdx/mise#7716) ### 📦️ Dependency Updates - replace dependency @tsconfig/node22 with @tsconfig/node24 by @renovate[bot] in [#7618](jdx/mise#7618) ### 📦 Registry - add aqua backend for smithy by @jdx in [#7661](jdx/mise#7661) - remove low-usage asdf plugins by @jdx in [#7701](jdx/mise#7701) - disable mirrord test by @jdx in [#7703](jdx/mise#7703) - use vfox-dotnet as default backend by @jdx in [#7704](jdx/mise#7704) - use vfox-lua as default lua backend by @jdx in [#7706](jdx/mise#7706) - add vfox backend for redis by @jdx in [#7709](jdx/mise#7709) - use vfox-postgres as default postgres backend by @jdx in [#7710](jdx/mise#7710) - use github backend for kotlin by @jdx in [#7711](jdx/mise#7711) - add vfox backend for leiningen by @jdx in [#7714](jdx/mise#7714) - use pipx backend for meson by @jdx in [#7712](jdx/mise#7712) - use github backend for crystal by @jdx in [#7715](jdx/mise#7715) - use conda backend for sqlite by @jdx in [#7718](jdx/mise#7718) - use conda backend for make by @jdx in [#7719](jdx/mise#7719) - swift-package-list use github backend by @jdx in [#7720](jdx/mise#7720) ### Chore - increase macos release build timeout to 90 minutes by @jdx in [#7725](jdx/mise#7725) ### New Contributors - @yannrouillard made their first contribution in [#7681](jdx/mise#7681) - @stk0vrfl0w made their first contribution in [#7696](jdx/mise#7696) ## [2026.1.3](https://github.com/jdx/mise/compare/v2026.1.2..v2026.1.3) - 2026-01-16 ### 🚀 Features - **(s3)** add S3 backend for private artifact storage by @jdx in [#7668](jdx/mise#7668) - **(upgrade)** use installed_tool completer for mise upgrade by @jdx in [#7670](jdx/mise#7670) - **(upgrade)** add --exclude flag to mise upgrade command by @jdx in [#7669](jdx/mise#7669) - add no hooks and no env flags by @aacebedo in [#7560](jdx/mise#7560) ### 🐛 Bug Fixes - **(backend)** allow upgrading vfox backend tools with symlinked installations by @TyceHerrman in [#7012](jdx/mise#7012) - **(backend)** reject architecture mismatches in asset selection by @jdx in [#7672](jdx/mise#7672) - **(backend)** canonicalize symlink target before installs check by @jdx in [#7671](jdx/mise#7671) - **(npm)** avoid circular dependency when npm is in dependencies by @AprilNEA in [#7644](jdx/mise#7644) - **(self-update)** skip update when already at latest version by @jdx in [#7666](jdx/mise#7666) - fall back to GITHUB_TOKEN for github.com by @subdigital in [#7667](jdx/mise#7667) - GitHub token fallback by @subdigital in [#7673](jdx/mise#7673) - inherit tasks from parent configs in monorepos by @chadxz in [#7643](jdx/mise#7643) ### 📚 Documentation - **(contributing)** update registry examples by @scop in [#7660](jdx/mise#7660) - **(contributing)** update registry PR title rule by @scop in [#7663](jdx/mise#7663) - remove 404 link from contributing by @opswole in [#7692](jdx/mise#7692) - clarify that backend plugins should sort the version list by @ofalvai in [#7680](jdx/mise#7680) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to 11f659e by @renovate[bot] in [#7685](jdx/mise#7685) - update ghcr.io/jdx/mise:copr docker digest to 3adaea4 by @renovate[bot] in [#7686](jdx/mise#7686) - update ghcr.io/jdx/mise:deb docker digest to 8bbca53 by @renovate[bot] in [#7687](jdx/mise#7687) - update ghcr.io/jdx/mise:rpm docker digest to de81415 by @renovate[bot] in [#7688](jdx/mise#7688) - update mcr.microsoft.com/devcontainers/rust:1 docker digest to 282e805 by @renovate[bot] in [#7690](jdx/mise#7690) - update rust docker digest to bed2d7f by @renovate[bot] in [#7691](jdx/mise#7691) ### 📦 Registry - add oh-my-posh by @scop in [#7659](jdx/mise#7659) - add bibtex-tidy (npm:bibtex-tidy) by @3w36zj6 in [#7677](jdx/mise#7677) - remove misconfigured bin_path option from kscript by @risu729 in [#7693](jdx/mise#7693) ### New Contributors - @AprilNEA made their first contribution in [#7644](jdx/mise#7644) - @opswole made their first contribution in [#7692](jdx/mise#7692) - @subdigital made their first contribution in [#7673](jdx/mise#7673) - @aacebedo made their first contribution in [#7560](jdx/mise#7560)

Copilot AI review requested due to automatic review settings January 17, 2026 14:51

Copilot AI reviewed Jan 17, 2026

View reviewed changes

cursor bot reviewed Jan 17, 2026

View reviewed changes

src/backend/conda.rs Show resolved Hide resolved

fix: remove unused conda lockfile methods

825d0a8

Remove get_conda_packages and conda_packages_mut methods that were unused outside of tests. Tests now access conda_packages field directly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor bot reviewed Jan 17, 2026

View reviewed changes

src/lockfile.rs Outdated Show resolved Hide resolved

cursor bot reviewed Jan 17, 2026

View reviewed changes

jdx merged commit ed0addb into main Jan 17, 2026
34 checks passed

jdx deleted the feat/conda-lockfile-deps branch January 17, 2026 16:12

mise-en-dev mentioned this pull request Jan 17, 2026

chore: release 2026.1.4 #7697

Merged

mise-en-dev mentioned this pull request Jan 17, 2026

chore: release 2026.1.5 #7730

Merged

BrewTestBot mentioned this pull request Jan 18, 2026

mise 2026.1.4 Homebrew/homebrew-core#263358

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(conda): add dependency locking for reproducible installations#7708

feat(conda): add dependency locking for reproducible installations#7708
jdx merged 4 commits intomainfrom
feat/conda-lockfile-deps

jdx commented Jan 17, 2026 •

edited by cursor bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Jan 17, 2026 •

edited

Loading

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Jan 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		/// Extract basename from URL
		/// "https://conda.anaconda.org/.../ncurses-6.4-h7ea286d_0.conda" -> "ncurses-6.4-h7ea286d_0.conda"

-/// Extract basename from URL
-/// "https://conda.anaconda.org/.../ncurses-6.4-h7ea286d_0.conda" -> "ncurses-6.4-h7ea286d_0.conda"
+/// Extract the filename (basename) portion from a conda package URL.
+///
+/// For example, given:
+/// `"https://conda.anaconda.org/conda-forge/linux-64/ncurses-6.4-h7ea286d_0.conda"`
+/// this returns:
+/// `"ncurses-6.4-h7ea286d_0.conda"`.

Uh oh!

Conversation

jdx commented Jan 17, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Example Lockfile

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 17, 2026

Choose a reason for hiding this comment

Empty conda deps treated as unlocked dependencies

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jdx commented Jan 17, 2026 •

edited by cursor bot

Loading

github-actions bot commented Jan 17, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`