### 🐛 Bug Fixes

- **(env)** resolve sourced env for tool templates by @corymhall in
[#7895](#7895)
- **(npm)** only declare the configured package manager as a dependency
by @jdx in [#7995](#7995)
- **(upgrade)** respect use_locked_version when checking tracked configs
by @jdx in [#7997](#7997)
- ignore MISE_TOOL_VERSION in env var parsing by @jdx in
[#8004](#8004)

### New Contributors

- @corymhall made their first contribution in
[#7895](#7895)

jdx#7997)

## Summary

Fixes `mise upgrade` incorrectly keeping old versions when lockfile is
enabled.

- When checking which versions are needed by tracked configs during
upgrade, the code was always using the lockfile to resolve versions even
when `use_locked_version` was explicitly set to `false`
- This caused old versions to be incorrectly kept after upgrade because
the lockfile hadn't been updated yet
- The debug message "Keeping X because it's still needed by a tracked
config" would appear even when no tracked config actually needed the old
version

## Root Cause

In `tool_version_list.rs`, when resolving versions that aren't "latest",
the code was overriding `use_locked_version` to `true` regardless of
what the caller passed in:

```rust
// Before:
ResolveOptions {
    latest_versions: false,
    use_locked_version: true,  // Always true, ignoring caller's setting
    ..opts.clone()
}
```

## Fix

1. `get_versions_needed_by_tracked_configs` now explicitly requests
`use_locked_version: false`
2. `ToolVersionList::resolve` now respects the caller's
`use_locked_version` setting

Fixes jdx#7991

## Test plan

- [x] Added e2e test `test_lockfile_upgrade_prune` that verifies old
versions are removed after upgrade with lockfile enabled
- [x] Existing upgrade tests pass
- [x] Existing prune tests pass
- [x] Existing lockfile tests pass
- [x] Unit tests pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches version resolution used by both `mise upgrade` and `mise
prune`, which can change which tool versions are considered “needed” and
therefore uninstalled. Scope is small and covered by a new e2e
regression test, but mistakes could lead to unexpected installs/removals
when lockfiles are enabled.
> 
> **Overview**
> Fixes a lockfile-enabled upgrade regression where `mise upgrade` could
incorrectly keep old tool versions by resolving tracked config
requirements from the *previously locked* version.
> 
> `get_versions_needed_by_tracked_configs` now resolves tracked configs
with `use_locked_version: false`, and `ToolVersionList::resolve` no
longer forces `use_locked_version=true` for non-`latest` requests (it
inherits the caller’s setting).
> 
> Adds an e2e regression test
(`e2e/lockfile/test_lockfile_upgrade_prune`) asserting that upgrading a
prefix version updates the lockfile and prunes the old installed
version.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8c068fe. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

### 🐛 Bug Fixes

- **(env)** resolve sourced env for tool templates by @corymhall in
[jdx#7895](jdx#7895)
- **(npm)** only declare the configured package manager as a dependency
by @jdx in [jdx#7995](jdx#7995)
- **(upgrade)** respect use_locked_version when checking tracked configs
by @jdx in [jdx#7997](jdx#7997)
- ignore MISE_TOOL_VERSION in env var parsing by @jdx in
[jdx#8004](jdx#8004)

### New Contributors

- @corymhall made their first contribution in
[jdx#7895](jdx#7895)