# mise changelog

> mise release notes.

- Vendor: mise
- Category: Languages & Runtimes
- Official site: https://mise.jdx.dev/
- Tracked by: What's New (https://whatsnew.fyi/product/mise)
- Harvested from: GitHub (jdx/mise)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v2026.8.2 — v2026.8.2: Declarative System Bootstrap

- Date: 2026-08-05
- Version: v2026.8.2
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.8.2
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.8.2

This release turns `mise bootstrap` into a full declarative host-provisioning system: alongside packages, mise can now converge privileged files, Linux users and groups, systemd services, Docker Compose projects, and firewall rules — all with plan/apply/status workflows, secret handling, and the ability to run over SSH against remote hosts. It also makes Ruby's `ruby.compile=false` a strict precompiled-only mode and lands a batch of install and lockfile fixes.

##### Highlights
- `mise bootstrap` gains a Terraform-style declarative model. A new `mise bootstrap plan` previews changes with table or JSON output and detailed exit codes, and each resource type has its own `apply`/`status` commands that converge only when something actually differs.
- Bootstrap can now provision far more than tools and packages: privileged files and directories, Linux accounts, systemd services, Compose projects, and host firewall rules, with dependency ordering, fail-closed safety checks, and secret inputs sourced from environment variables (never stored in config).
- The same bootstrap project can be applied to remote machines over SSH via `mise bootstrap remote`, including automatic detection of the target's OS/arch/libc and signature-verified download of the matching mise binary.

##### Added
- **bootstrap:** declarative resource plans. `mise bootstrap plan` previews what bootstrap would change before applying, with table or `--json` output and optional `--detailed-exitcode` (0 = no changes, 2 = changes, 1 = error). Resources have stable identities, dependency graphs, and validation for duplicates, missing dependencies, and cycles. ([#11669](https://github.com/jdx/mise/pull/11669) by @jdx)
- **bootstrap:** manage privileged files and directories via `[bootstrap.files]` and `[bootstrap.directories]`, with content (inline or from a source), ownership, mode, and explicit `present`/`absent` state. Writes are atomic, removal is opt-in (and requires `recursive = true` for non-empty directories), and privileged work runs through hidden helpers that never expose file content in argv or logs. ([#11674](https://github.com/jdx/mise/pull/11674) by @jdx)
- **bootstrap:** secret inputs for managed files. `[bootstrap.secrets]` references sensitive values through environment variables so nothing is stored in config, and managed files with `template = true` can render them via `{{ secret(name="...") }}`. `mise bootstrap secrets status` reports availability without revealing values, and `--prompt-secrets` prompts securely for anything missing. ([#11680](https://github.com/jdx/mise/pull/11680) by @jdx)
- **bootstrap:** manage Linux users and groups via `[bootstrap.users]` and `[bootstrap.groups]`, with create/update/remove, supplementary groups, home handling, and explicit `state = "absent"`. Accounts converge before the files that reference them, and UID/GID collisions fail closed. ([#11681](https://github.com/jdx/mise/pull/11681) by @jdx)
- **bootstrap:** manage Linux systemd services via `[bootstrap.services]` for running/stopped, enabled/disabled, and masked state. Managed files and directories can set `notify` to trigger `reload`, `restart`, or `reload_or_restart` handlers, but only after a real file change. ([#11688](https://github.com/jdx/mise/pull/11688) by @jdx)
- **bootstrap:** manage Docker Compose projects via `[bootstrap.compose]` for running, stopped, and absent states, with pull/build/recreate/wait policies, one-shot services, orphan/volume/image removal, and explicit dependencies. Convergence compares live container runtime and health to the rendered Compose model (Compose v2 only). ([#11689](https://github.com/jdx/mise/pull/11689) by @jdx)
- **bootstrap:** manage Linux host firewall rules via `[bootstrap.linux.firewall]` with nftables, firewalld, and UFW backends (`backend = "auto"`). Includes SSH-lockout protection (default-deny requires a covering allow rule or `allow_lockout = true`), drift detection, and preservation of undeclared rules unless

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.8.2]_

### v2026.8.1 — v2026.8.1: Task Cache Goes Remote, Affected Tasks, and Config Ergonomics

- Date: 2026-08-03
- Version: v2026.8.1
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.8.1
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.8.1

This release rounds out mise's experimental task artifact cache with size/age limits, inspection tooling, and a full local-plus-remote cache backend (including authenticated CI caching), adds experimental `mise run --affected` for monorepos, and lands a batch of config, upgrade, and install fixes.

##### Highlights
- The experimental task output cache now supports remote sharing: a composite store reads locally first, promotes remote hits, and mirrors writes, with authenticated requests backed by token files or GitHub Actions OIDC. Cache entries can be inspected, cleared per-task, and bounded by size and age.
- Experimental `mise run --affected` runs only the tasks in monorepo projects touched by your Git changes, using workspace dependency graphs, global task inputs, and provider lockfile attribution to decide what is affected.
- The config-writing flags are now more forgiving: `--file` and `--path` are interchangeable across the commands that write config, so you no longer have to remember which name each subcommand expects.

##### Added
- **task:** experimental `mise run --affected` selects and runs only the tasks in projects affected by Git changes, combining the workspace dependency graph, `global_inputs`, and provider lockfile diffs. Base and head revisions can be overridden with `--affected-base`/`--affected-head` or `MISE_AFFECTED_*`. Includes JSON output and an `--explain` breakdown of why each task was selected. ([#11590](https://github.com/jdx/mise/pull/11590), [#11587](https://github.com/jdx/mise/pull/11587), [#11589](https://github.com/jdx/mise/pull/11589), [#11591](https://github.com/jdx/mise/pull/11591), [#11593](https://github.com/jdx/mise/pull/11593) by @jdx)

  ```bash
  mise run --affected test
  mise run --affected --affected-base main test
  ```
- **task:** remote task cache. A composite store layers local and remote backends, reading local first and promoting remote hits, then committing locally before mirroring writes so a remote failure never loses a local hit. Requests are hardened, verified, streamed, and support read/write access modes. ([#11622](https://github.com/jdx/mise/pull/11622), [#11623](https://github.com/jdx/mise/pull/11623), [#11624](https://github.com/jdx/mise/pull/11624), [#11626](https://github.com/jdx/mise/pull/11626), [#11627](https://github.com/jdx/mise/pull/11627) by @jdx)
- **task:** authenticated remote cache. Credentials resolve in fixed precedence: an explicit bearer token, a global-only token file (`MISE_TASK_CACHE_REMOTE_TOKEN_FILE`), then GitHub Actions OIDC when `MISE_TASK_CACHE_REMOTE_OIDC_AUDIENCE` is set. HTTPS is enforced except for loopback development endpoints. ([#11625](https://github.com/jdx/mise/pull/11625), [#11653](https://github.com/jdx/mise/pull/11653) by @jdx)
- **task:** `task.cache_max_size` and `task.cache_max_age` settings cap the task output cache independently of the global prune age, evicting least-recently-accessed entries after writes and rejecting expired entries on restore. ([#11610](https://github.com/jdx/mise/pull/11610) by @jdx)
- **task:** inspect and selectively clear the cache with `mise cache task <task>` (table or `--json`, reporting stored size, restorable bytes, saved time, last access, and outputs) and `mise cache clear --task <task>`, which removes only that task's entries without touching your working-tree outputs. ([#11604](https://github.com/jdx/mise/pull/11604) by @jdx)
- **task:** `mise run --task-cache-explain <task>` prints a structural breakdown of what feeds a task's cache key (input categories, counts, env/var names and presence, platform) without emitting secret-derived hashes, and works under `--dry-run`. Companion changes report cache miss reasons, cache statistics, resolved cache paths, and add JSON explanation output. ([#11595](https://github.com/jdx/mise/pull/11595), [#11597](https://github.com/jdx/mise/pull/11597), [#11599](https://github.com/jdx/mise/pull/11599), [#11600](https://github.com/jdx/mise/pull/11600), [#11601

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.8.1]_

### v2026.8.0 — v2026.8.0: 15% faster shims, multi-language workspaces, and precompiled Ruby

- Date: 2026-08-01
- Version: v2026.8.0
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.8.0
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.8.0

This release makes mise noticeably faster on Linux x64: shims have 15% lower latency, while config-aware commands are 8–11% faster in local release-to-release benchmarks. It also significantly expands the experimental monorepo task workflow with dependency inference across Cargo, uv (Python), Go, and Node workspaces, and makes precompiled Ruby binaries the default.

##### ⚡ Performance: up to 15% lower latency

Official checksum-verified Linux x64 GNU binaries were compared on an AMD Ryzen 9 7950X3D using an isolated offline fixture with warm filesystem caches (20 warmups and 200 measured runs per command):

| Workload | v2026.7.18 | v2026.8.0 | Lower latency |
| --- | ---: | ---: | ---: |
| Node shim dispatch | 6.990 ms | 5.929 ms | **15.2%** |
| `tasks ls` | 7.353 ms | 6.574 ms | **10.6%** |
| `env -s bash` | 7.942 ms | 7.187 ms | **9.5%** |
| `current` | 7.667 ms | 6.961 ms | **9.2%** |
| `settings` | 5.823 ms | 5.331 ms | **8.5%** |
| `--help` | 5.036 ms | 4.731 ms | **6.1%** |
| `version` | 5.108 ms | 4.884 ms | **4.4%** |
| `registry` | 7.457 ms | 7.181 ms | **3.7%** |

Release downloads are smaller as well:

| Linux x64 artifact | Size change |
| --- | ---: |
| `.tar.xz` | **11.1% smaller** |
| `.tar.gz` | **5.9% smaller** |
| `.tar.zst` | **5.0% smaller** |
| Allocated ELF sections | **0.6% smaller** |

The raw executable file is 2.5% larger because of the BOLT file layout, despite its smaller allocated sections and compressed artifacts. Shim dispatch was measured in two reversed-order 300-run rounds. These are whole-release results against v2026.7.18, so they include all changes between the releases rather than isolating BOLT alone.

##### Highlights
- Workspace inference now spans four ecosystems. `mise tasks graph` discovers projects and internal dependency edges from Cargo, uv, Go, and Node workspace metadata without needing the underlying toolchain installed, and `--explain` attributes every project, edge, and task field to its source.
- Precompiled Ruby binaries are now the default, cutting install times for most users while keeping source builds available on demand.

##### Added
- **task:** Cargo workspaces are now inferred for the task graph. mise parses root and member `Cargo.toml` files (no `cargo` binary required) to build `cargo:<package>` projects and internal edges from normal, dev, build, target-specific, renamed, and inherited `workspace = true` path dependencies, with provenance surfaced in graph output. ([#11554](https://github.com/jdx/mise/pull/11554) by @jdx)
- **task:** uv (Python) workspaces are inferred from `pyproject.toml`. When `[tool.uv.workspace]` is present, member globs and exclusions define `uv:<package>` projects and edges come from `[tool.uv.sources]` `workspace = true` / local `path` entries across main, optional, dependency-group, and legacy dev dependencies — again without invoking `uv` or Python. ([#11556](https://github.com/jdx/mise/pull/11556) by @jdx)
- **task:** Go workspaces are discovered from `go.work` `use` directives and each module's `go.mod`, registering stable `go:<module-path>` projects without running the `go` binary. Dependency ordering is supplied explicitly via `[monorepo.projects]` overrides. ([#11559](https://github.com/jdx/mise/pull/11559) by @jdx)
- **task:** workspace providers can now contribute task suggestions. The Node provider imports supported `inputs`, `outputs`, `cache`, and `dependsOn` metadata from matching `turbo.json` entries for inferred package scripts, tracking `turbo.json` as a task definition source. Unsupported Turbo expressions are left unset. ([#11543](https://github.com/jdx/mise/pull/11543) by @jdx)
- **task:** `mise tasks graph --explain` shows provider and metadata-source provenance for every inferred project, dependency edge, task, and provider-suggested field, and `--json` now serializes the same attribution. Config overrides are labeled as `configuration` rather than misattributed to inference. ([#11547](https://github.com/jdx/mise/pul

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.8.0]_

### v2026.7.18 — v2026.7.18: Monorepo task ergonomics and a broad round of fixes

- Date: 2026-07-30
- Version: v2026.7.18
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.18
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.18

This release refines mise's experimental monorepo task workflow with relative dependency paths and a compact dependency tree view, and lands a wide batch of fixes across Cargo installs, plugins, PATH handling, Windows program resolution, Aqua locks, GitLab pagination, and more.

##### Added
- **task:** `mise tasks deps` gains a `--compact` flag that expands each shared dependency subtree only once and marks later references as `(already shown)`, keeping every incoming edge visible while avoiding the recursive blow-up that wildcard-heavy monorepo graphs produced. Default output is unchanged unless you pass the flag. ([#11502](https://github.com/jdx/mise/pull/11502) by @jdx)

  ```bash
  mise tasks deps --compact
  ```
- **task:** monorepo task dependencies now support `./`-prefixed relative paths, resolved from the declaring task's own monorepo location, so one aggregate declaration works unchanged at the root, in nested apps, and in leaves without hard-coded absolute paths. Trailing `...` patterns now include the base project itself in addition to its descendants. ([#11503](https://github.com/jdx/mise/pull/11503) by @jdx)

  ```toml
  [tasks.test]
  depends = [{ task = "./...:groups:tests:*", optional = true }]
  ```

##### Fixed
- **cargo:** installs now record the effective install options (`features`, `default-features`, `bin`, `crate`, `locked`) and reinstall automatically when any of them change, so changing feature flags or the selected binary no longer silently reuses the wrong artifact. Incompatible shared/system installs are shadowed in your primary install directory instead of being modified. ([#11480](https://github.com/jdx/mise/pull/11480) by @Marukome0743)
- **plugins:** `[plugins]` entries can now point at local filesystem paths (absolute, `~/`, or explicit `./`/`../` relative to the config root). Local asdf, vfox, vfox-backend, and package plugins are installed as symlinks so source edits take effect immediately, while Git URLs, refs, archives, and `file://` sources keep their existing behavior. ([#11487](https://github.com/jdx/mise/pull/11487) by @Marukome0743)
- **plugins:** batch `plugins install`, `plugins install --all`, and `plugins update` now finish every plugin even when one fails, preserving successful changes and reporting all failures together (in deterministic order) with a failing exit status. ([#11490](https://github.com/jdx/mise/pull/11490) by @Marukome0743)
- **env:** computed environments (`mise env`, `mise x` child PATHs, `mise doctor`) now collapse exact duplicate PATH entries first-wins, fixing the runaway `_.path` accumulation that appeared in nested shells and IDE terminals that inherit an activated PATH without mise's state vars. The live shell PATH is intentionally left untouched. ([#11491](https://github.com/jdx/mise/pull/11491) by @JamBalaya56562)
- **install:** installing a tool no longer touches your loaded config files, so editors stop reporting spurious "file changed on disk" warnings. hook-env still detects installs and PATH changes via the mise data directory. ([#11495](https://github.com/jdx/mise/pull/11495) by @Marukome0743)
- **prune:** `mise prune --tools` no longer discards references from untrusted idiomatic version files and plain `.tool-versions`, preventing removal of versions still in use by other projects. ([#11501](https://github.com/jdx/mise/pull/11501) by @jdx)
- **monorepo:** `idiomatic_version_file_enable_tools` set in a config root's own `[settings]` is now honored by monorepo-wide commands like `mise ls --monorepo` and `mise install --monorepo`, instead of only being applied when mise runs from inside that root. ([#11463](https://github.com/jdx/mise/pull/11463) by @kaii-zen)
- **asdf:** `bin/list-all` and `bin/latest-stable` scripts now receive your resolved mise `[env]` values, removals, and `_.path` additions, so plugins that need a credential or helper on PATH can list versions. Caches are partitioned per environment so results are never reused across differi

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.18]_

### v2026.7.17 — v2026.7.17: Monorepo Task Inference and Root Defaults

- Date: 2026-07-30
- Version: v2026.7.17
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.17
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.17

This release builds out mise's experimental monorepo task story: Node workspaces now infer project dependency graphs, import package scripts as first-class tasks, and can share configuration through root task defaults and upstream (`^task`) dependencies. It also adds per-tool control over idiomatic version files, a smoother dotfiles workflow, and a batch of fixes across shell activation, hook-env, Homebrew casks, Aqua, and Python uv environments.

##### Highlights
- Node monorepo workspaces gain end-to-end task support: inferred project dependency edges, imported `package.json` scripts as `node:<package>#<script>` tasks, root task defaults shared by task name, and experimental `^task` upstream dependencies for "build upstream projects first" ordering.
- New `optional = true` task dependencies run when they match and are silently skipped when they don't, and idiomatic version files can now be disabled per tool so `.nvmrc` and `package.json` no longer fight over your Node version.
- A round of environment and shell fixes stops hook-env from reloading every prompt after unrelated file writes, keeps the fish `cd` hook working during compound commands, and fixes zsh activation under `POSIX_IDENTIFIERS`.

##### Added
- **task:** Node workspace packages now expose their `package.json` scripts as mise tasks without needing a `mise.toml` in every package. Scripts get stable IDs like `node:@scope/app#build` plus monorepo path aliases such as `//packages/app:build`, run in their package root through the detected package manager (npm/pnpm/Yarn/Bun) with raw argument passthrough, and explicit tasks take precedence while keeping both names linked. ([#11466](https://github.com/jdx/mise/pull/11466) by @jdx)
- **task:** Node workspaces now infer project dependency edges by matching declared internal package names (`dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`) to other discovered packages, surfaced through `mise tasks graph`. This is the graph that powers dependency-aware ordering. ([#11435](https://github.com/jdx/mise/pull/11435) by @jdx)
- **task:** experimental root task defaults via `[monorepo.task_defaults.<name>]` in the root `mise.toml`, applied by task name to both inferred and explicit workspace tasks. Task-local config and `extends` templates still win. ([#11473](https://github.com/jdx/mise/pull/11473) by @jdx)

  ```toml
  [monorepo.task_defaults.build]
  sources = ["src/**", "package.json"]
  outputs = ["dist/**"]
  cache = { enabled = true }

  [monorepo.task_defaults.test]
  env = { NODE_ENV = "test" }
  ```
- **task:** experimental `^task` upstream dependency syntax so a task can require the same task in every upstream workspace project before it runs, expanding through the project graph (including transitive upstreams) and skipping projects that lack the task. Supported in `depends` only. ([#11476](https://github.com/jdx/mise/pull/11476) by @jdx)

  ```toml
  [monorepo.task_defaults.build]
  depends = ["^build"]
  ```
- **task:** optional dependencies via `optional = true` on structured task dependencies. Optional deps run all matches when present and are silently omitted when nothing matches, while invalid selectors still error. Works across `depends`, `depends_post`, and `wait_for`. ([#11471](https://github.com/jdx/mise/pull/11471) by @jdx)
- **config:** `idiomatic_version_file_disable_files` lets you disable individual idiomatic version files per tool using `tool:filename` pairs, so you can keep `.nvmrc` selecting Node while ignoring `package.json` `devEngines`, with pnpm still reading `package.json`. ([#11470](https://github.com/jdx/mise/pull/11470) by @jdx)

  ```sh
  mise settings add idiomatic_version_file_disable_files node:package.json
  ```
- **dotfiles:** `mise bootstrap dotfiles add` now applies captured entries by default (use `--no-apply` for capture-only workflows), moves real paths into the dotfiles source before linking, normalizes and sorts `[dotfiles]` entries, and reports conf

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.17]_

### v2026.7.16 — v2026.7.16: Task Workspaces, MCP Command Effects, and Dotfiles Cleanup

- Date: 2026-07-29
- Version: v2026.7.16
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.16
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.16

This release expands the experimental task output cache with per-run controls, a configurable cache directory, and command-derived cache inputs, and lays the groundwork for monorepo-aware task workspaces starting with Node discovery. It also teaches `mise mcp` to expose each command's read/write/destructive effect to agents, consolidates dotfiles management under `mise bootstrap`, and lands a broad batch of fixes across brew, npm, tasks, config rewriting, and OCI pushes.

##### Highlights
- The experimental task output cache gains per-run controls (`--task-cache` / `MISE_TASK_CACHE`), a configurable `task.cache_dir`, and `cache.command_inputs` so cache keys can fold in runtime state like compiler versions.
- New experimental workspace project graph model with Node monorepo discovery (npm, pnpm, Yarn, Bun) via Aube, the foundation for monorepo-aware affected-project and task inference.
- `mise mcp` can now tell agents what a command does: the new `list_commands` tool returns each command's read/write/destructive effect so agents can reason about safety before running anything.

##### Added
- **task:** per-run cache controls via `--task-cache <mode>` and `MISE_TASK_CACHE`, supporting `read-write` (default), `read-only`, `write-only`, `off`, and `local-only`. Read-only lets untrusted CI jobs consume existing results without publishing misses, write-only warms the cache without consuming entries, and `off` gives a clean diagnostic path while preserving normal `sources` freshness. Honored by `mise run` and bootstrap/naked task entry points. ([#11396](https://github.com/jdx/mise/pull/11396) by @jdx)
- **task:** experimental `task.cache_dir` setting and `MISE_TASK_CACHE_DIR` to place task output artifacts on dedicated volumes or project-specific locations without relocating mise's entire cache. `mise cache clear` and `mise cache prune` cover the custom location. ([#11399](https://github.com/jdx/mise/pull/11399) by @jdx)
- **task:** experimental `cache.command_inputs` so cacheable tasks invalidate on command-derived state (like `node --version` or a generated config fingerprint) that isn't captured by source files. Each command runs in the task directory with the resolved tool environment, and its text plus stdout/stderr hashes fold into the cache key. ([#11381](https://github.com/jdx/mise/pull/11381) by @jdx)

  ```toml
  [tasks.build]
  run = "..."
  sources = ["src/**/*.rs"]
  outputs = ["dist/app"]
  cache = { enabled = true, command_inputs = ["rustc --version"] }
  ```
- **task:** experimental workspace project graph model and provider interface, the ecosystem-neutral foundation for Node, Cargo, uv, and Go monorepo discovery, plus Node workspace discovery for npm, pnpm, Yarn, and Bun monorepos powered by Aube's shared manifest parsing and workspace-confined scanning. ([#11400](https://github.com/jdx/mise/pull/11400), [#11418](https://github.com/jdx/mise/pull/11418), [#11420](https://github.com/jdx/mise/pull/11420), [#11422](https://github.com/jdx/mise/pull/11422), [#11424](https://github.com/jdx/mise/pull/11424), [#11427](https://github.com/jdx/mise/pull/11427), [#11430](https://github.com/jdx/mise/pull/11430), [#11445](https://github.com/jdx/mise/pull/11445) by @jdx)
- **mcp:** new `list_commands` tool exposing mise's command tree with each command's declared effect (`read`, `write`, `destructive`, or unclassified), help text, and hidden status, so agents can see what a command does before invoking it. An optional `include_hidden` controls visibility, and unclassified is explicitly treated as unknown rather than safe. ([#11389](https://github.com/jdx/mise/pull/11389) by @jdx)
- **cargo:** `cargo.binstall_native` graduates from experimental and can now discover conventionally named GitHub release artifacts from a crate's linked repository when `package.metadata.binstall` is absent, so more precompiled binaries install without crate-specific configuration. It also works under the default `locked = true` path. ([#11433](https://git

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.16]_

### v2026.7.15 — v2026.7.15: Experimental Task Output Caching

- Date: 2026-07-27
- Version: v2026.7.15
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.15
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.15

This release lands the first version of experimental local task output caching, letting eligible tasks restore their declared outputs and replay their logs without rerunning. It also adds structured registry idiomatic-version-file parsing, a standalone Aube installer mode, and a broad batch of task, Homebrew, shell, and Windows path fixes.

##### Highlights
- Experimental local task artifact caching restores task outputs (and replays their logs) across deletions, checkouts, and unchanged CI runs, with cache keys derived from source contents, task config, tools, and environment. It works for tasks that produce files, tasks with no filesystem outputs, and multi-task graphs, and stays opt-in and conservative on any failure.
- Registry-backed tools can now parse idiomatic version files (like `dagger.json`, `Taskfile.yml`, `.chezmoiversion`, and 8 more) in-process, with no plugin or shell execution.

##### Added
- **task:** experimental, opt-in local artifact caching. Tasks with `sources` and explicit `outputs` can restore their outputs from a content-addressed cache instead of rerunning, and successful stdout/stderr are replayed through whatever output mode the current run uses. Cache keys combine source contents, task configuration and arguments, declared and allowlisted ambient environment, resolved tools, OS, and architecture. Cache failures degrade to misses or warnings rather than failing a task. ([#11328](https://github.com/jdx/mise/pull/11328), [#11347](https://github.com/jdx/mise/pull/11347) by @jdx)

  ```toml
  [tasks.build]
  run = "..."
  sources = ["src/**/*.rs"]
  outputs = ["dist/app"]
  cache = { enabled = true, env = ["CI"] }
  ```
- **task:** dependency artifact keys now fold into a task's cache key, so downstream tasks reuse cached outputs when their dependencies resolve to the same artifacts, and an upstream input change correctly invalidates downstream results. ([#11340](https://github.com/jdx/mise/pull/11340) by @jdx)
- **task:** result-only caching via `outputs = []` for checks like lint, test, and typecheck that produce no files. Their successful result and replayable logs are cached without writing an archive. ([#11351](https://github.com/jdx/mise/pull/11351) by @jdx)
- **task:** reusable and global cache inputs. Define named `[task_config.input_groups]` referenced from `sources` as `@group:<name>`, and `task_config.global_inputs` to apply config-rooted patterns to every task in scope, so shared lockfiles and toolchain files no longer need repeating per task. ([#11356](https://github.com/jdx/mise/pull/11356) by @jdx)
- **task:** `task_config.global_env` for scoped environment inputs that participate in cache keys, plus `pass_through_env` / `task_config.global_pass_through_env` to keep selected ambient variables (like tokens) available under `deny_env` without affecting cache keys. ([#11363](https://github.com/jdx/mise/pull/11363) by @jdx)
- **task:** `outputs` now support ordered `!` exclusions and re-inclusions (mirroring `sources`), with `\!` escaping. Excluded paths are omitted from freshness hashes and cache archives, and existing excluded files are preserved on restore. ([#11367](https://github.com/jdx/mise/pull/11367) by @jdx)
- **task:** `task_config.shell` sets a project-scoped default shell for tasks, with task-local and template `shell` still taking precedence. This gives users a safe migration path after the 2026.7.14 change that ignored project-level default shell-arg settings. ([#11354](https://github.com/jdx/mise/pull/11354) by @jdx)
- **config:** registry `idiomatic_files` entries can now define structured `version_regex`, `version_json_path`, and `version_expr` parsers, adding in-process idiomatic version-file parsing for 11 tools including Dagger, Task, chezmoi, CMake, Earthly, golangci-lint, GoReleaser, Lefthook, Pixi, pre-commit, and Ruff. Parsing runs without executing plugin or shell code, and remains opt-in per tool. ([#11341](https://github.com/jdx/mise/pull/11341) by @jdx)

  ```sh

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.15]_

### v2026.7.14 — v2026.7.14: Multi-asset GitHub installs, safer defaults, and Windows pip

- Date: 2026-07-26
- Version: v2026.7.14
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.14
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.14

This release adds overlay installs for GitHub-based tools, closes a config-trust security gap around default shell arguments, and lands a wide batch of correctness fixes across tasks, lockfiles, npm, Swift, brew casks, and Windows Python.

##### Added
- **github:** the GitHub/GitLab/Forgejo release backend now accepts `additional_asset_patterns`, so a single install can overlay multiple release archives from the same tag into one installation directory. Each supplemental artifact is locked and verified (checksums and provenance) on its own, and `--locked` fails if the recorded set no longer matches. This models release layouts like Ollama's optional ROCm archive without making a large payload unconditional. ([#11272](https://github.com/jdx/mise/pull/11272) by @jdx)

  ```toml
  [tools."github:ollama/ollama"]
  version = "latest"
  additional_asset_patterns = ["ollama-linux-amd64-rocm.tgz"]
  ```
- **npm:** new `allow_low_downloads` tool option lets an embedded aube install bypass the weekly-download popularity gate for the requested package only, so curated tools like `bibtex-tidy` and `purty` install again without `npm.shell_out`. Transitive dependencies still hit the gate. ([#11305](https://github.com/jdx/mise/pull/11305) by @jdx)
- **env:** structured env files (`env._.file` loading JSON/YAML/TOML) support an explicit `expand = true` option for shell-style variable expansion, including references to earlier values. See Fixed below for the default-behavior change. ([#11269](https://github.com/jdx/mise/pull/11269) by @jdx)

##### Fixed
- **env:** values loaded from JSON/YAML/TOML env files are literal by default again, fixing a regression where every value was shell-expanded when `env_shell_expand` was on. That corrupted literals such as bcrypt-style `$6$salt$hash` and could pull in matching process-environment values. Opt back into expansion with `expand = true`. ([#11269](https://github.com/jdx/mise/pull/11269) by @jdx)
- **python:** `pip` is now usable on fresh Windows installs. mise synthesizes `pip.cmd`/`pip3.cmd` wrappers, adds the install's `Scripts` directory to PATH so pip-installed console scripts resolve, and fixes default-package installation on Windows. ([#11278](https://github.com/jdx/mise/pull/11278) by @JamBalaya56562)
- **github:** `.exe` release assets are now preferred on Windows, so tools that ship both an extensionless and `.exe` binary no longer install the non-runnable one and fail with "cannot find binary path". ([#11257](https://github.com/jdx/mise/pull/11257) by @gologames)
- **github:** a rejected GitHub token (401) now produces an actionable error that names the token source (gh CLI, `github_tokens.toml`, OAuth, env var, etc.) and includes GitHub's response and a remediation hint, instead of a bare `401 Unauthorized`. ([#11236](https://github.com/jdx/mise/pull/11236) by @Marukome0743)
- **backend:** an archive containing a single binary with an OS/arch suffix (e.g. `gdscript-formatter-macos-aarch64`) is now renamed to its clean name on PATH, matching the existing behavior for single-file downloads. ([#11232](https://github.com/jdx/mise/pull/11232) by @Marukome0743)
- **brew:** brew-cask installs handle more real-world casks — completion stanzas and `system_command` in lifecycle blocks are supported, and artifact links into root-owned directories like `/usr/local/bin` now elevate through mise's sudo policy instead of failing with permission errors. Fixes installing `docker-desktop`. ([#11273](https://github.com/jdx/mise/pull/11273) by @jdx)
- **lockfile:** `prefix:` tool requests now honor the locked version on `mise install` instead of silently re-resolving to the newest match. Constrained upgrades via `mise upgrade`/`mise lock --bump` still work. ([#11255](https://github.com/jdx/mise/pull/11255) by @JamBalaya56562)
- **aqua:** cross-platform lockfiles for aqua HTTP packages preserve a reachable `v`-prefixed URL, fixing 404s where an entry locked to another platform's unprefixed URL. ([#11267](http

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.14]_

### v2026.7.13 — v2026.7.13: Multi-binary renaming, cask completions, and go.mod support

- Date: 2026-07-24
- Version: v2026.7.13
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.13
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.13

This release expands archive backends to rename multiple binaries from a single release, adds Homebrew cask shell completions and `go.mod` version-file support, and fixes a broad batch of task, install, lockfile, and language-plugin correctness issues.

##### Added
- **backend:** `rename_exe` now accepts a table mapping source patterns to target names, so an archive that ships several executables can expose all of them cleanly on PATH instead of only one. The existing string form is unchanged. ([#11231](https://github.com/jdx/mise/pull/11231) by @jdx)

  ```toml
  [tools."github:DanielGavin/ols"]
  version = "latest"
  rename_exe = { "ols-*" = "ols", "odinfmt-*" = "odinfmt" }
  ```
- **brew:** brew-cask now installs shell completions (declared `bash_completion`/`fish_completion`/`zsh_completion` files and `generate_completions_from_executable` for bash, zsh, fish, and pwsh) instead of skipping them, tracking them in cask receipts and installed-state checks. ([#11198](https://github.com/jdx/mise/pull/11198) by @jdx)
- **go:** `go.mod` can now be used as an idiomatic version file. A `toolchain goX.Y.Z` directive resolves as an exact pin, while a `go X.Y` minimum resolves to the latest matching patch. It is opt-in and unchanged unless enabled per-tool. ([#11213](https://github.com/jdx/mise/pull/11213) by @JamBalaya56562)

  ```sh
  mise settings add idiomatic_version_file_enable_tools go
  ```
- **task:** PowerShell task shells (`pwsh`/`powershell`) now run with `-NoProfile` by default, matching how mise spawns POSIX shells, so a profile that mutates `PATH` (such as a mise activation snippet) can no longer shadow a task's own tools and cause confusing "cannot find binary path" errors. Opt out with the new `windows_powershell_no_profile` setting (`MISE_WINDOWS_POWERSHELL_NO_PROFILE=false`). ([#11199](https://github.com/jdx/mise/pull/11199) by @jdx)

##### Fixed
- **env:** `_.path`/`_.file`/`_.source` directives within a single `[env]._` block are now resolved in written order, so a `_.path` can reference a variable exported by a `_.source` written before it. ([#11163](https://github.com/jdx/mise/pull/11163) by @JamBalaya56562)
- **install:** failed installs no longer print a contradictory "installed but not activated" hint before the real error. ([#11227](https://github.com/jdx/mise/pull/11227) by @jdx)
- **install:** logical state mutations during install are now serialized to avoid races. ([#11207](https://github.com/jdx/mise/pull/11207) by @risu729)
- **lockfile:** upgrading a locked `github:` tool to a newer version that is already installed on disk no longer triggers a false supply-chain "provenance regression" error. ([#11230](https://github.com/jdx/mise/pull/11230) by @jdx)
- **npm:** aube install failures now surface the full cause chain instead of an opaque "failed to resolve dependencies" message, with mise-native remediation guidance (`trust_policy_excludes` or `npm.shell_out`) for trust-downgrade errors. ([#11226](https://github.com/jdx/mise/pull/11226) by @jdx)
- **task:** inline task definitions now follow a consistent first-wins precedence model across local, `conf.d`, and monorepo configs, so lower-precedence metadata no longer leaks into script tasks and the winning config's context is preserved. ([#11103](https://github.com/jdx/mise/pull/11103) by @risu729)
- **task:** source freshness now tracks files correctly for workspace-rooted `sources` patterns used in nested subproject tasks, so edits inside a subproject trigger a rerun. ([#11202](https://github.com/jdx/mise/pull/11202) by @rabadin)
- **brew:** cask upgrades handle structured `preflight_steps`/`postflight_steps` for move/remove operations, and cleanup-only `zap` `pkgutil` IDs are no longer treated as install receipts (which could leave pkg cask status permanently missing). ([#11197](https://github.com/jdx/mise/pull/11197) by @jdx)
- **brew:** cask upgrades no longer fail when removing a protected app backup (e.g. docker-desktop) hits "Permission denied",

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.13]_

### v2026.7.12 — v2026.7.12: Safe mode, node-free npm, and a built-in OCI push client

- Date: 2026-07-23
- Version: v2026.7.12
- Original notes: https://github.com/jdx/mise/releases/tag/v2026.7.12
- Permalink: https://whatsnew.fyi/product/mise/releases/v2026.7.12

This release centers on running mise safely against untrusted config, shipping node-free `npm:` version resolution and installs, and replacing external tools (skopeo/crane, gpg) with built-in, dependency-free implementations. Along the way it fixes a `prefer_offline` timeout regression, several config/env correctness issues, and platform-specific problems on Windows and macOS.

##### Highlights
- New `MISE_SAFE=1` mode turns mise into an inert config reader so automation (CI, Renovate) can run `mise lock --bump` against untrusted branches without trust prompts or arbitrary code execution.
- The `npm:` backend no longer needs node or npm installed to resolve or install packages — version metadata is fetched over HTTP and installs run in-process via the embedded aube package manager.
- `mise oci push` gained a full built-in registry client: no more skopeo/crane, with blob dedup, chunked uploads, retries, cross-repo mounts, layer reuse from prior images, and multi-arch image indexes.

##### Added
- **Safe mode:** a new global-only `safe` setting (`MISE_SAFE=1`) makes mise refuse or ignore anything that would let project config execute code or inject environment. Blocked (with errors): template `exec()`/`read_file()`, `_.source`, hooks, tasks, asdf plugin scripts, and plugin installs. Ignored: project `[env]`, `_.path`, `_.file`, `[shell_alias]`, and `[settings]`. HTTP-based version resolution, lockfile refresh/bump, and already-installed/embedded plugins keep working. Because a config loaded this way is inert, safe mode also skips the trust requirement. ([#11146](https://github.com/jdx/mise/pull/11146), [#11151](https://github.com/jdx/mise/pull/11151) by @jdx)

  ```sh
  MISE_SAFE=1 mise lock --bump --dry-run --json   # detect updates with zero code execution, no trust needed
  ```
- **`mise lock --bump`:** advance fuzzy lockfile selectors (`latest`, `lts`, prefixes like `"20"`) to the newest matching remote versions without installing anything and without touching `mise.toml`. Exact pins stay put. Pairs with `--json` and `--dry-run` for a CI job that opens lockfile-only PRs. ([#11145](https://github.com/jdx/mise/pull/11145) by @jdx)

  ```console
  $ mise lock --bump --dry-run --json
  [{ "name": "node", "backend": "core:node", "old_versions": ["22.14.0"], "new_versions": ["22.15.0"] }]
  ```
- **Node-free `npm:` backend:** `mise ls-remote npm:*` and `latest` resolution now query the npm registry directly over HTTP, and installs run in-process through the embedded aube package manager. node is only needed to *run* installed tools (and their lifecycle scripts), not to install them. User `~/.npmrc`, scoped registries, auth, and `minimum_release_age` are honored. A new `npm.shell_out` setting (`MISE_NPM_SHELL_OUT`) routes both metadata and installs through the npm CLI for setups relying on npm-only config like `cafile` or client certs. ([#11147](https://github.com/jdx/mise/pull/11147), [#11149](https://github.com/jdx/mise/pull/11149) by @jdx)
- **Built-in OCI registry client:** `mise oci push` no longer requires skopeo or crane. It uses an in-tree OCI Distribution client that uploads only blobs the registry is missing, resolves credentials the way docker/podman do (`docker login`/`podman login` is all the setup needed), and answers registry auth challenges so private base-image pulls via `--from` also work. `mise oci run --engine docker` now streams the image into `docker load` instead of needing skopeo. The `--tool` flag was removed. ([#11132](https://github.com/jdx/mise/pull/11132) by @jdx)
- **OCI push robustness:** large layers upload in 64 MiB chunks, transient failures retry with mise's standard backoff, base layers are mounted cross-repo (`?mount=`) when they already live on the destination registry (zero bytes transferred), and pushes/pulls now show byte progress. A new `oci.insecure_registries` setting opts non-loopback registries into plain HTTP. ([#11141](https://github.com/jdx/mise/pull/11141) by @jdx)
- **OCI layer reu

_[Truncated at 4000 characters — full notes: https://github.com/jdx/mise/releases/tag/v2026.7.12]_