[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
jdx/mise	uses-with	minor	v2026.10.24 → v2026.11.5

---

Release Notes

jdx/mise

v2026.11.5: : mise dot files shows what is tracked in a directory

Compare Source

This release adds mise dot files to show which files in a directory are tracked, and a status.show_env_ignore setting to hide variables from the status line. It also lets dot commands accept relative paths, stops warning when you save dotfiles by hand, and fixes downloads that failed because ~/.netrc held a stale login.

Added

• mise dot files. Lists the files and subdirectories in a directory and shows the state of each one, so you no longer have to work out how [dotfiles] entries, their exclude/include lists and [history] exclude apply. The possible states are:

  • tracked: saved to history. The row shows the entry that covers it and whether it autosaves.
  • excluded: covered by an entry, but a rule leaves it out. The row names the rule.
  • omitted: selected, but capture skips it, for example a file that looks like a credential.
  • untracked: no entry covers it.
  • partial: a directory that isn't tracked itself but contains tracked files.
  • local: a path kept in local-only history (mode = "track-local").

  PATH defaults to the current directory and can be a relative path or a single file. -r/--recursive lists every file below the directory, --tracked and --untracked filter the rows, and --json prints one object per row. The command uses the same exclusion check as mise dot save, so the two always agree. #​15456 (@​jdx, @​farangkao)

  $ mise dot files ~/.config
  untracked  cache/
  partial    foot/   1 file tracked below
  tracked    hypr/   1 file · ~/.config/hypr (track, autosave)
  untracked  mise/

• status.show_env_ignore. With status.show_env on, mise lists every variable it sets each time you enter a directory, including variables that never change. This new setting takes variable names or shell globs to leave out of that line. You can also set it with MISE_STATUS_MESSAGE_SHOW_ENV_IGNORE as a comma-separated list. Changes to config files and paths are still shown. mise warns about malformed patterns and ignores them. #​15454 (@​jdx)

  [settings.status]
  show_env = true
  show_env_ignore = ["GO*", "DENO_INSTALL_ROOT"]

  With this config, mise +DENO_INSTALL_ROOT +GOBIN +GOROOT +LUA_INIT becomes mise +LUA_INIT.

Fixed

• Relative paths in mise dot commands. mise dot track config.toml used to fail with target must be absolute or start with ~/. track, untrack, add and edit now resolve relative paths from the current directory the way a shell does, including .. after a symlinked directory. A path inside your home directory is saved in its ~/ form. Exclude and include rules are still relative globs. #​15455 (@​jdx, @​farangkao)
• No warning when saving dotfiles by hand. If you haven't set up the history-watch service, mise dot track now prints an info message about saving with mise dot save instead of a warning, so --quiet hides it. mise dot status now lists automatic capture as manual, without a warning or a suggested next step. mise still warns if the watcher is set up but not running, or if captures fail. #​15455 (@​jdx, @​farangkao)
• 401 errors caused by stale ~/.netrc credentials. Some downloads failed with 401 Unauthorized even though the server would serve the file without logging in. For example, mise install glab failed against gitlab.com when ~/.netrc held a login that gitlab.com no longer accepted. If the only credentials came from netrc and the server returns 401, mise now retries once without them. Later retries of the same download also leave them out. Requests that carry their own Authorization header (such as forge tokens) and requests redirected to another host are not retried this way. #​15451 (@​jdx)

Full Changelog: jdx/mise@v2026.11.4...v2026.11.5

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.4: : zip:: includes for config and tasks

Compare Source

Config and task includes can now load from zip:: archives over HTTP(S). This release also fixes shim tab completion, [tool_alias] handling in enable_tools/disable_tools and mise prune, mise dot sync conflicts, and ufw firewall rule matching in mise bootstrap.

Added

• zip:: includes for config and tasks. Before, include and task_config.includes accepted local paths, git:: and oci:: sources. They now also accept a zip archive served over HTTP or HTTPS. mise downloads and unpacks the archive, then loads it the same way as an oci:: artifact. For task_config.includes it loads executable file tasks and .toml task files. For include it loads the mise.toml at the archive root. Zip entries don't reliably carry file permissions, so mise makes non-TOML files that start with a shebang executable. #​15439 (@​jdx)

  • Only HTTP and HTTPS URLs are accepted. Any other scheme fails with an error.
  • Task includes are still experimental, like the other remote sources.
  • A URL doesn't pin specific contents. mise refreshes a zip config include the way it refreshes a branch (fetch_remote_versions_cache), and paranoid mode rejects zip config includes.

  # replace <URL> with the archive's HTTP(S) URL
  include = ["zip::<URL of platform-config.zip>"]
  
  [task_config]
  includes = ["zip::<URL of shared-tasks-1.0.0.zip>"]

Fixed

• Tab completion through shims. Completing a command for a tool run through a mise shim (such as aube or pitchfork) showed mise's own subcommands instead of the tool's. mise now answers completion requests only when it is invoked as mise. Under a shim name, the request goes to the real tool. mise also skips version resolution, auto-install and auto-update while answering these requests. #​15429 (@​jdx)
• Tool aliases in enable_tools and disable_tools. If a tool was declared by its full backend ID, filtering by its [tool_alias] name did the wrong thing. MISE_ENABLE_TOOLS=myjq excluded the tool instead of selecting it, and MISE_DISABLE_TOOLS=myjq had no effect. An alias now matches the same tool as its full ID in both filters, including aliases with inline options. An explicit enable list still overrides disable_tools. If you disable an aliased python, _.python.venv is turned off too. Based on a fix by @​zeitlinger. #​15437 (@​jdx)
• mise prune and project tool aliases. When run from another directory, mise prune resolved a tracked project's [tools] entries against the current directory's config. Tools named through the project's own [tool_alias] caused "not found in mise tool registry" warnings, and mise couldn't tell whether those installs were still in use. These entries now resolve through the project's aliases, as well as the aliases in its parent and global configs. #​15438 (@​jdx)
• mise dot sync with exclusions added on two machines. When two machines each added their own mise dot exclude globs, sync failed with "enrollment conflict in exclusions". mise now merges the lists in this order: the shared base, then this machine's additions, then the other machine's. The same applies to an enrolled path's own exclude and include lists. A removal or a !glob added on both sides is still a conflict, because glob order matters. The error message now says how to recover. #​15449 (@​jdx)
• ufw rules with a source or destination CIDR. A [[bootstrap.linux.firewall.rules]] entry with a source or destination CIDR and no port never converged. mise read 10.42.0.0/16 as a port and a protocol, so mise bootstrap plan --detailed-exitcode kept reporting the rule. Firewall commands also now run with LC_ALL=C, so inspection no longer fails under non-English locales such as de_DE.UTF-8. #​15450 (@​jdx)
• Fedora 45 COPR builds. Releases are now built for Fedora 45 (x86_64 and aarch64) in the jdxcode/mise COPR repo. Before, Fedora 45 users were stuck on 2026.8.5. #​15441 (@​jdx)

Documentation

• The shell setup docs now say that fish 4.9.3 loads mise completions on its own, so you can skip mise completion fish --install there. #​15442 (@​jdx)

Full Changelog: jdx/mise@v2026.11.3...v2026.11.4

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.3: : Task history, saved task logs, and source-based --affected outside monorepos

Compare Source

This release adds three task features: mise tasks history shows how long past runs took, the opt-in task.logs setting saves each task's last output, and mise run --affected now works in any project by matching changed files against each task's sources. It also fixes problems with upgrade --bump, GitHub asset detection, locked lockfiles, Windows npm installs, prune and hung asdf plugins.

Added

• mise run --affected outside a monorepo. Before, --affected worked only at a monorepo root and failed anywhere else. Outside a monorepo it now runs only the matching tasks affected by changed files. A task is affected when a changed file matches its sources, or when the config file or file script that defines it changed. Matching uses the same rules as the up-to-date check, including ! exclusions and paths relative to the task's directory.

  • Tasks with no sources, and tasks whose sources use {{usage.*}}, run whenever anything changed. When nothing changed, nothing runs.
  • Global tasks are left out. Dependencies of a selected task still run, subject to the up-to-date check.
  • The existing --affected-base, --affected-head, --affected-committed, --affected-uncommitted and --affected-untracked options decide which changes count. --affected-explain prints why each task was selected or skipped, and --affected-json reports the reasons (changed-source, task-config, task-file, no-sources, argument-sources).
  • Monorepo project selection is unchanged.

  #​15407 (@​jdx)

  [tasks."test:unit"]
  run = "cargo test"
  sources = ["src/**"]
  
  [tasks."test:docs"]
  run = "markdownlint docs"
  sources = ["docs/**"]

  mise run --affected --affected-explain 'test:*'

• mise tasks history. mise now records when each task run started, how long it took, its redacted arguments, its exit code and its status (ok, failed, cached, skipped or cancelled). mise tasks history [TASK] lists past runs. --summary shows each task's run count, failure count, median duration of successful runs, and last duration and status. --json prints the records as JSON. Recording is on by default and keeps the last 20 runs per task. You can change the limit with task.history_limit, or turn recording off with task.history = false. Dry runs and tasks that only have depends are not recorded, and a recording error never fails a run. #​15408 (@​jdx)

  $ mise tasks history --summary
  hello      3  0  89.0ms  88.0ms  ok
  test:unit  3  0  -       1.0ms   skipped

• Saved task output with mise tasks log. When the new task.logs setting (or MISE_TASK_LOGS=1) is on, mise keeps the full output of each task's last run. mise tasks log NAME prints it, and --path prints where the file is. This gets back output that the replacing, timed, silent and summary styles hide or shorten. When a task fails under one of those styles, mise prints a full output: <path> line. Logs are stored in $MISE_STATE_DIR/task-logs/ with owner-only permissions and are redacted the same way as terminal output. Each log keeps the newest 4 MiB. Output that mise doesn't pipe is not logged: raw and interactive tasks, and the default interleave mode when it has nothing to redact. The setting is off by default. #​15409 (@​jdx)

  [settings]
  task.logs = true

  The same PR changes every piped output style: lines longer than 1 MiB now arrive in pieces, so mise no longer holds a whole long line in memory. The pieces are split so that secrets and URL credentials are still fully redacted.

Fixed

• mise upgrade --bump no longer rewrites a two-part prefix such as { prefix = "1.23" } to the unresolvable prefix:prefix:1.1. It now bumps to the correct version, for example prefix:1.26. #​15426 (@​jdx, @​kjanat)
• When choosing a release asset automatically, the github: backend now skips Python wheels (.whl) and Ruby gems (.gem), as it already does for .deb and .rpm. Before, a manylinux wheel could be picked over the native binary. An explicit asset_pattern can still select these files. If an asset_pattern looks like a regular expression and matches nothing, the GitHub, GitLab and Forgejo error now explains that asset_pattern is a glob and suggests matching_regex. #​15423 (@​jdx)
• With tool_config.locked = true and lockfile_mode = "generate", installing or running one tool no longer writes another tool's unrecorded version into mise.lock. Before, this let the next run accept a pin nobody had reviewed. The lockfile now stays unchanged, and only mise lock records new versions. #​15428 (@​jdx, @​mikomiel)
• On Windows, npm: tools installed with aube are now reinstalled when a cache restore turned their dependency links into file symlinks. Before, mise install reported "already installed" while Node failed with ERR_MODULE_NOT_FOUND. #​15425 (@​jdx, @​Diapolo10)
• When run from outside a project, mise prune and mise upgrade no longer delete installs of task tools that the project names through its [tool_alias]. The "not found in mise tool registry" warning for these tools is also gone. #​15427 (@​jdx)
• fetch_remote_versions_timeout now stops an asdf plugin's bin/list-all that hangs. mise kills the script's process group and fails with timed out after ... and a hint about the setting. Before, mise waited until the script exited and held the version lock the whole time. ruby-install --update now follows the same timeout. bin/list-all now runs with stdin closed, so a script that reads stdin gets EOF. #​15424 (@​jdx, @​karngyan)

Full Changelog: jdx/mise@v2026.11.2...v2026.11.3

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.2: : Task tags, summary output, JSON run reports, and mise run --at

Compare Source

This release adds four mise run features that help CI scripts and coding agents: tags for selecting tasks, a summary output style that only shows failures, a JSON run report, and --at for running tasks at another git revision. It also fixes problems with safe-mode lockfiles, symlink-each dotfiles, shims and shell completion.

Added

• Task tags. You can label tasks with tags, then run every task that has a tag with mise run --tag. A tag can be a string or a list. File tasks set them with #MISE tags=[...], and templates add their tags to the tasks that extend them. You can repeat --tag, and a task matches if it has any of the given tags. Dependencies run whatever their tags are. If you also give a pattern, such as mise run --tag slow 'test:*', mise runs only the matching tasks that have the tag. mise tasks ls --tag filters the task list, and tasks ls --json, tasks info and the MCP task list now include tags. #​15406 (@​jdx)

  [tasks."lint:docs"]
  run = "markdownlint docs"
  tags = ["lint", "docs"]
  
  [tasks."test:e2e"]
  run = "./e2e/run"
  tags = ["test", "slow"]

  mise run --tag lint
  mise tasks ls --tag slow

• summary task output style. mise holds each task's output until the task ends. A task that passed prints one line, such as [unit] passed in 4.2s. A task that failed prints everything it wrote. Tasks that mise stopped print [name] cancelled. This style is opt-in: use --output summary, MISE_TASK_OUTPUT=summary, task.output, or a task's output. mise keeps up to 64 KiB of output per task and drops the oldest output past that. A long-running task such as a dev server prints nothing until it exits, so give those tasks output = "interleave". #​15403 (@​jdx)

  $ mise run --output summary test
  [lint] $ cargo clippy -- -D warnings
  [lint] error: unused variable: `x`
  [unit] passed in 4.2s
  [lint] ERROR task failed

• JSON run reports. mise run --report-file <PATH>, or MISE_TASK_REPORT_FILE, writes a JSON report when the run ends. This happens whether the run passes, fails, is interrupted or hits --timeout.

  • The report has the run's status (passed, failed, cancelled or timed_out) and every scheduled task, dependencies included.
  • Each task has its status (passed, failed, cancelled, skipped, cached or not_run), exit code, duration and timestamps.
  • Task arguments are redacted the same way as in terminal output.
  • The flag can't be combined with --dry-run. Tasks don't inherit the variable, so a nested mise run can't overwrite the outer report.

  #​15405 (@​jdx)

• mise run --at REV. Runs tasks at another git revision without touching your checkout. mise checks the revision out into a temporary detached worktree, runs the task with that revision's own config and tasks, then removes the worktree. It also removes it after a failure, a timeout or Ctrl-C. --at-setup CMD prepares the worktree first, for example by installing dependencies.

  • Submodules are initialized.
  • Tasks and the setup command get MISE_RUN_AT_SOURCE (your checkout) and MISE_RUN_AT_REV (the commit).
  • Config at that revision gets your main checkout's trust, and you can't bypass this with a prompt or --yes.
  • Paranoid mode always refuses a config at that revision.

  #​15410 (@​jdx)

  mise run --at main test
  mise run --at HEAD~1 --at-setup "npm ci" test

Fixed

• Lockfiles and safe mode
  • MISE_SAFE=1 MISE_LOCKED=1 mise install works again for node, python and go when mise.lock has their checksums. It used to fail with "No lockfile URL found". These tools now work out their own download URL and check it against the locked checksum. If safe mode is the reason a URL is missing, the error now says so. #​15392 (@​jdx)
  • npm: tools locked through aube now install in safe mode and in untrusted projects. mise keeps the lockfile's dependency graph if it only fetches from the registry using integrity hashes. Graphs that name tarball URLs, git sources or local paths are still dropped. #​15401 (@​jdx)
  • mise lock java@temurin-27 no longer rewrites java = "temurin-26" to the broken temurin-temurin. It now writes temurin-27, with the same precision as the original request. Switching vendor at the same version, as in java@zulu-26, is saved too. #​15386 (@​jdx)
  • When mise lock tool@3.0.1 changes tool = "2" to tool = "3" in the config, the lockfile entry now records "3", the request the config holds, instead of "3.0.1". Before, later lookups for that request couldn't find the entry. #​15404 (@​jdx)
• Dotfiles and bootstrap
  • mise bootstrap now writes mise's own config files first and plans the rest of the dotfiles from the result, as mise dot apply already did. If a dotfile entry deploys a conf.d file, the entries in that file now apply in the same run, not the next one. --dry-run previews them as well. #​15387 (@​jdx, @​webkaz)
  • A symlink-each entry no longer writes through a directory symlink you made inside its target. That symlink is now reported as a conflict that needs --force. unapply also no longer deletes a directory symlink as if it were an empty folder. #​15399 (@​jdx)
  • On the first apply, a symlink-each source that contains a dangling symlink no longer loses its link right after creating it. #​15395 (@​jdx)
  • mise dot unapply --group and mise dot apply --prune now delete a group's leftover symlink-each state records once none of its links remain. #​15390 (@​jdx)
  • On a second machine whose local history holds no files, mise dot origin set now adopts the origin's history. It used to fail with "local and origin histories are unrelated". If origin set refuses to connect, it no longer writes [history.origin]. #​15394 (@​jdx)
  • History snapshots no longer start a git process for each encrypted tracked file. This speeds up mise bootstrap and the dotfile history commands when you have many encrypted files. #​15393 (@​jdx)
• Shims
  • On macOS, when a due tool_update.global_auto check ran from a shim, the tool was launched with mise's internal arguments (jq: Unknown option --id). mise now runs the update itself. #​15389 (@​jdx)
  • When the installed version ships other executables but not the one you called, as after mprocs was renamed to dekit, the shim and mise which errors no longer suggest a reinstall that can't help. They now show the error mprocs@0.10.3 does not provide mprocs (it provides: dekit), or name another installed version that does provide it. #​15388 (@​jdx)
• Completion
  • In mise x -- <cmd> <Tab>, every word after the command now completes file names, as it would in a plain shell. The same applies to mise dot capture --, mise bootstrap repos exec -- and mise ssh. #​15396 (@​jdx, @​Yasushi)
  • When a task has the same name as a built-in command, such as upgrade, completing mise up now shows the built-in command's description. mise run <TAB> still shows the task. #​15385 (@​jdx)
• Installs and config
  • Go tool installs now retry go install after temporary network errors from the module proxy or checksum database, using the http_retries setting. When the retries run out, mise shows the network error, not a misleading unknown revision. #​15384 (@​jdx)
  • On Windows, aqua raw downloads whose URL ends in .exe now keep the extension when the recipe sets complete_windows_ext: false. Before, aqua:SonarSource/sonarqube-cli installed sonar instead of sonar.exe. #​15412 (@​jdx)
  • mise no longer crashes with PermissionDenied if it can't resolve a config path. This happened on Windows inside workspace sandboxes. A config trusted outside the sandbox may show as untrusted inside it; MISE_TRUSTED_CONFIG_PATHS works around that. #​15383 (@​jdx)
  • With skills.auto_sync, a tool that only your global config declares no longer has its agent skills linked into every project as well. Global tools are linked only under your home directory. mise skills sync without --dir or --global follows the same rule. Links that are already in project directories stay until you run mise skills sync --prune. #​15391 (@​jdx)

Changed

• Registry: temporal now installs the Temporal CLI from aqua:temporalio/cli, which includes temporal server start-dev. Before, it installed the server bundle. If you need the server bundle, use mise use aqua:temporalio/temporal. #​15373 (@​jdx)
• Registry: odin on Windows now gets an odin shim. Before, only the bundled linker tools were shimmed. #​15400 (@​jdx)

Documentation

• The site search can now find individual keys on the mise.toml reference page, such as doctor.checks. #​15375 (@​jdx)

Full Changelog: jdx/mise@v2026.11.1...v2026.11.2

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.1: : npm provenance verified by default, with repository pins in mise.lock

Compare Source

npm: tools now have their Sigstore provenance verified by default. The first install records the repository that built the package in mise.lock, and later installs must come from that same repository. This release also adds named environment sets in miserc.toml and fixes a range of lockfile, install and shell issues. See Breaking Changes before you upgrade: some installs that worked before can now fail, and new lockfiles use format version 4.

Added

• npm provenance repository pins. When provenance verification is on, mise install records the GitHub or GitLab repository that an npm: package's provenance names. Later installs of that version fail if the provenance comes from a different repository, or if the package stops publishing provenance. This protects against a release published from somewhere else, for example after a maintainer account is compromised. The pin is written by mise install, not mise lock. #​15338 (@​jdx)

  [[tools."npm:@sigstore/bundle"]]
  version = "3.1.0"
  backend = "npm:@sigstore/bundle"
  provenance = { repository = "github.com/sigstore/sigstore-js" }

• gitlab.com CI provenance for npm. npm provenance built on gitlab.com CI/CD now verifies the same way GitHub Actions provenance does, including projects in subgroups. Before, these packages failed with verified attestation names no source repository. Self-hosted GitLab is not supported. #​15335 (@​jdx)

• Named environment sets. A shared miserc.toml can now define [env_sets]. You can then select a set by name in env, MISE_ENV or -E, and mise expands it to the environments it lists. Sets expand one level only, keep their listed order, and drop duplicate entries. A project .miserc.toml cannot redefine a set from the system or global miserc.toml. The new mise bootstrap --save-env writes the environments given with -E or MISE_ENV to miserc.local.toml, so later mise bootstrap --update runs select the same ones. #​15327 (@​jdx, @​owpac)

  # miserc.toml
  [env_sets]
  server = ["server", "ssh", "pac"]
  workstation = ["workstation", "ssh", "pac", "raycast"]

  mise bootstrap --from <url> -E workstation --save-env

• Download progress for vfox plugins. When a vfox plugin's PreInstall returns a url, the install line now shows the amount downloaded, the total size and the speed. Before, it showed only the elapsed time. #​15323 (@​jdx, @​carlosemart)

Fixed

• Lockfiles
  • Fixed mise install --locked failing with node@lts is not in the lockfile after an alias such as lts moved to a new version, in lockfiles with no lockfile_version line (format 0). If the tool has exactly one matching entry, mise uses it as the pin. mise lock --upgrade now keeps that pin and binds it to the alias, where before it re-resolved the alias and dropped the old entry. #​15301 (@​jdx, @​simonbuchan)
  • mise install in a project no longer rewrites ~/.config/mise/mise.lock unless it installs a global tool. A global tool that a project also declares is now relocked under the backend its own lockfile records. This fixes lockfile generation would change the recorded signer errors from mise lock --global and mise upgrade --global. #​15348 (@​jdx, @​drewbitt)
  • mise lock no longer warns on every run that the node checksum files from unofficial-builds.nodejs.org (used for the musl targets) are unsigned. Signature failures on nodejs.org or a node.mirror_url still fail as before. mise install with the default lockfile_mode = "generate" also stops drawing extra progress rows for lockfile entries it prepares in the background. #​15346 (@​jdx)
• Zig: zig installs now download from the URL pinned in mise.lock without fetching index.json, and still check the minisign signature. When the index can't be read, mise now builds the correct archive name for 0.14.1 and later (zig-{arch}-{os}-…, .zip on Windows) instead of failing with a 404, and it shows the index error. #​15351 (@​jdx, @​sargunv)
• Rust: with RUSTUP_DIST_SERVER set, mise no longer queries GitHub to list Rust versions. latest resolves to the mirror's stable release, and an exact version is checked against the mirror's channel manifest. Version discovery through a mirror is limited to the current stable release. #​15326 (@​jdx)
• latest with non-numeric releases: when a tool's newest release was still inside minimum_release_age and its releases don't start with a digit (for example Odin's dev-YYYY-MM), latest could fall back to a years-old numbered release. mise now picks the newest release the cutoff allows. #​15360 (@​jdx, @​i-api)
• aqua on Android: aqua-backed tools now install on Android (Termux). mise treats the host as Linux, selects static musl builds, and refuses binaries that need a loader bionic doesn't provide. The aqua backend also now honors the os and arch settings when checking a package's supported platforms. #​15347 (@​i-api)
• pnpm: with npm.package_manager = "pnpm" and pnpm 11 or later, npm: tools now stay inside their install directory instead of linking into pnpm's global virtual store. Before, restoring only MISE_DATA_DIR from a CI cache left tools that failed with Cannot find module. #​15330 (@​jdx)
• Read-only filesystems: mise x, mise run and wrapper shims no longer fail on a read-only filesystem when [wrappers] is configured and every wrapper shim already exists. #​15300 (@​jdx, @​liskin)
• PowerShell prompt status: with mise activate pwsh, the prompt that mise wraps, such as starship's, can see $? again, so it shows when a native command failed. #​15315 (@​meop)
• mise upgrade no longer prints an out-of-range note for a version that another entry for the same tool already uses, such as python = ["3.15", "3.14"]. #​15359 (@​jdx)
• mise no longer warns unknown config file type on every run for a remembered file that no config type recognizes anymore, such as a main.tf after you narrow idiomatic_version_file_enable_tools. #​15333 (@​jdx)

Documentation

• The install docs now recommend the PowerShell script on Windows (irm https://mise.run/powershell | iex). winget packages can lag behind a release and turn off mise self-update. #​15332 (@​jdx)

Breaking Changes

• npm provenance is verified by default. #​15341 (@​jdx) npm.provenance is now true by default. Here is what changes:

  • An npm: package whose provenance doesn't verify, or that comes from a repository other than the one pinned in mise.lock, now fails to install.
  • Packages and registries that publish no provenance install as before, unless mise.lock already pins a repository for that version.
  • Installs through another npm.package_manager, and local archives pinned only by a checksum, are installed without a check instead of failing. They still fail under the provenance category of paranoid.
  • Verification fetches Sigstore's trust roots. If your network blocks them, installs of packages that publish provenance fail until you opt out.
  • Only the tool's own package is checked, not its dependencies. Private or authenticated registries are not queried.

  To opt out:

  [settings.npm]
  provenance = false   # or MISE_NPM_PROVENANCE=0

• Lockfile format version 4. New lockfiles are written at revision 4, which older mise versions refuse to read (unsupported lockfile version 4). Make sure everyone who shares a new lockfile runs this release or later. Existing lockfiles keep their revision until you run mise lock --upgrade. At an older revision, mise leaves out the provenance pin and warns. Revision 3 lockfiles now get the usual six-month outdated warning. #​15338 (@​jdx)

New Contributors

• @​meop made their first contribution in #​15315

Full Changelog: jdx/mise@v2026.11.0...v2026.11.1

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.11.0: : Task locks for shared resources, safer lockfiles, and .agents/skills as the default skills directory

Compare Source

Tasks can now declare a lock, so runs that share a resource take turns, even across worktrees and terminals. This release also adds opt-in npm provenance verification, dotfile dependencies, and mise bootstrap --update for global config checkouts. Lockfiles get stricter: --locked now requires checksums, and safe mode no longer trusts project lockfiles. The planned removal of minimum-version reading from go.mod and CMakeLists.txt also lands here. See Breaking Changes before you upgrade.

Added

• Task lock. When several agents or terminals run tasks at the same time, they can collide on resources that exist only once on the machine, such as a shared test database, a simulator or a GPU. A task can now name the locks it needs, and a run that needs a lock someone else holds waits for it. #​15242 (@​jdx)

  • A string name is shared by every task on the machine that uses it. lock = true locks the task within its repository, and all worktrees of that repository share the lock.
  • mise takes the lock just before the first command, after dependencies, skip_if, sources and cache checks, so a skipped task never waits. A task waiting for a lock gives up its --jobs slot, so other tasks keep running. Nested mise run calls inherit their parent's locks and don't deadlock on them.
  • mise run --lock-timeout 5m, or the task.lock_timeout setting, makes a task fail after waiting that long. The error names the run holding the lock. mise tasks info and --dry-run show the locks a task takes.
  • Locks are OS file locks (flock, or LockFileEx on Windows), so they are released when the holder exits, even if it is killed. This feature is not experimental.

  [tasks.test]
  run = "pytest"
  lock = "test-db"
  
  [tasks."e2e:ios"]
  run = "./scripts/e2e-ios.sh"
  lock = ["ios-simulator", "test-db"]

  [test] waiting for lock test-db, held by test in ~/src/shop-pr-42 (pid 4121, for 3.0s)
  

• npm provenance verification (opt-in). With npm.provenance = true, or the provenance category of paranoid, mise install verifies the Sigstore provenance an npm: tool's package publishes, against the sha512 integrity that the install locks. Packages that publish no provenance install as before. This only works with the embedded aube package manager, and only the tool's own package is checked, not its dependencies. #​15240 (@​jdx, @​kndoshn)

  [settings.npm]
  provenance = true

• Dotfile depends. A [dotfiles] entry or a [dotfile_groups] group can list the groups or entry targets it depends on. mise dot apply writes those first, in rounds. This lets an entry such as a mode = "fnox" file or a template that reads a file use files created in the same apply, so a new machine needs only one apply. mise reports an error for a cycle or an unknown name. If a round fails, mise stops and lists the entries it didn't apply. #​15277 (@​jdx, @​owpac)

  [dotfiles]
  "~/.workrc" = { mode = "fnox", depends = ["secrets"] }
  "~/.npmrc" = { mode = "fnox", depends = ["~/.ssh/encryption_ed25519"] }

• mise bootstrap --update pulls the global config checkout. Without --from or --adopt, --update fast-forwards the Git checkout that holds ~/.config/mise. This works whether the directory is linked into a checkout by --config-dir or is a checkout itself from --adopt. Bootstrap then runs again from the new commit. mise accepts only fast-forwards, so a diverged checkout stops the run. --dry-run prints the git pull --ff-only instead of running it. #​15286 (@​jdx, @​owpac)

• Skills default to .agents/skills. When skills.dir is unset, mise skills sync and skills.auto_sync use .agents/skills if it exists, or else an existing .claude/skills. If neither exists, mise creates .agents/skills and makes .claude/skills a symlink to it, so Claude Code finds the skills too. Projects that already sync into .claude/skills keep doing so. #​15278 (@​jdx, @​canac)

• mise use -g syncs skills into your home directory. With skills.auto_sync on, mise use -g links the skills of global tools into the skills directory under your home directory. mise install and mise upgrade keep those links current from any directory. mise skills sync --global now links only tools from the global and system config, not every tool active in the current directory. #​15276 (@​jdx, @​canac)

• Registry: kotlin-toolchain (JetBrains' Kotlin Toolchain, formerly Amper) #​15234 (@​ggoggam), headscale #​15282 (@​i-api), and tailscale #​15298 (@​i-api).

Fixed

Tasks

• On Windows, a multi-line run or run_windows script under cmd.exe ran only its first line and exited 0. It now runs every line, and a later exit /b fails the task. Each line still runs whatever the previous line's exit code was, and %VAR% is expanded once for the whole script. #​15238 (@​jdx)
• With jobs > 1, mise run could hang forever after a task failed while other tasks were still queued. #​15268 (@​jdx)
• Monorepo tasks run from the root, such as mise run //subproject:task, now get the variables the subproject's daemons export, such as API_PORT. An explicit [env] value for the same key still wins. #​15217 (@​jdx, @​dotellie)
• mise tasks validate no longer reports a run_windows-only task as having no command when you run it on macOS or Linux. #​15258 (@​jdx, @​ryan-pip)
• A mistyped command such as mise lsit now suggests mise list. Hidden internal commands are never

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.