mise v2026.8.13

This release adds a few configuration and task features and delivers a large batch of fixes across completions, tools, lockfiles, tasks, config parsing, and shell integration. It also restores dynamic shell completions that regressed after the recent CLI parser change.

Added

• task: New task_config.excludes lets file-task discovery skip config-root-relative paths, directories, and glob patterns, so accidental TOML files (like a pyproject.toml inside a task directory) or entire subtrees are no longer treated as tasks. The closest config that sets excludes replaces inherited values, and an empty list clears the cascade. Relative task.disable_paths now resolve from the declaring config file. (#12366 by @jdx)

  [task_config]
  excludes = ["scripts/vendor", "**/*.generated.toml"]
  

• config: Project configuration can now be split into visible mise/conf.d/*.toml fragments, mirroring the existing .mise/conf.d and .config/mise/conf.d support but without a hidden dot-directory. Fragments merge alphabetically, mise/config.toml still wins over fragments, and environment-specific and .local variants (for example mise/conf.d/tools.development.toml) follow the usual env config rules. (#12395 by @jdx)

• bootstrap: Added --skip-dirty to mise bootstrap, mise bootstrap repos apply, and mise bootstrap repos update to warn and skip repos with local changes so the remaining repos still update. Origin mismatches and non-git targets still fail closed as before. (#12364 by @jdx)

Fixed

• completion: Restored dynamic shell completions that broke after the switch to usage-rs. Task names, task-specific flags, task value choices, and run= completers work again in fish and zsh, while native file/path completion still falls back correctly. (#12376, #12379 by @jdx)
• env: Command-prefix and runtime environment overrides (for example VAR=override mise run ...) are no longer wiped when reconstructing the pre-mise environment in an activated shell; mise-managed values are only rolled back when the live value still matches what mise recorded. (#12390 by @jdx)
• env: A leading UTF-8 byte-order mark in an env file is now stripped before parsing. (#12320 by @JamBalaya56562)
• backend: Fixed a regression where an offline latest request failed for a tool installed only with mise install --system; the effective install directory is now recovered so system/shared-only installs satisfy latest. (#12406 by @jdx)
• github: When a lockfile records a checksum but no provenance, mise no longer probes the GitHub releases API at install time. This avoids hard install failures under rate limiting in high-concurrency CI, since the lockfile checksum already guarantees artifact integrity. The lockfile checksum now also takes priority over release-metadata digests. (#12377 by @effati)
• brew: Cask installs now recursively extract single nested archives (matching Homebrew's extract_nestedly, for example a zip containing only a DMG), and bare cask .pkg downloads are staged correctly. (#12373, #12371 by @jdx)
• pipx: Non-GitHub Git latest requests now resolve to the remote default branch HEAD and are treated as a rolling channel, so outdated and upgrade detect branch movement. An unavailable configured executable is now rejected instead of failing later. (#12407, #12416 by @jdx)
• lockfile: Each new version is now attributed to its own request source, so in monorepo or parent/child layouts that request the same tool at different versions, every lockfile receives its own entry instead of the first request's lockfile getting them all. Monorepo root requests are also included in lockfile maintenance. (#12381, #12382 by @pikeas)
• task: Several ordering and output fixes: keep-order buffers are flushed instead of discarded, injected tasks are anchored at their parent's keep-order slot, #MISE header keys that need quoting are no longer dropped, and negative template argument bounds are rejected. Sandbox errors now name which paths do not exist yet. (#12370, #12397, #12415, #12421, #12309)
• config: Clearer parse errors, each reported once: TOML and settings parse failures name the offending file a single time (through the logger), and a message now explains what a backslash does when a config fails to parse. Picker descriptions are truncated safely. (#12329, #12327, #12330 by @JamBalaya56562; #12422 by @jdx)
• generate: Generated files are now each named in output, and a task stub is named after the task rather than its file. (#12333, #12341 by @JamBalaya56562)
• trust: A path that does not exist is now refused rather than trusting its parent. (#12372 by @JamBalaya56562)
• prune: Tracked configs that cannot be a config file are now removed. (#12380 by @Marukome0743)
• self-update: A failure updating plugins no longer fails the whole command. (#12363 by @JamBalaya56562)
• cli: On Windows, mise now defaults to an editor that exists and names the editor that failed to launch. (#12375 by @JamBalaya56562)
• nushell: __MISE_SESSION is now unset on deactivate. (#12361 by @NgoQuocViet2001)
• elvish: The prepended PATH entry is now separated correctly from the existing PATH. (#12362 by @NgoQuocViet2001)
• ui: Tables no longer pad the last column past its content. (#12334 by @JamBalaya56562)

Documentation

• security: Updated the description of paranoid mode behavior. (#12394 by @jdx)

Registry

• Added mr-boxington, ori, hey-cli, playwright, and ghui, and switched claude-code to aqua on Windows. (#12384, #12388, #12387, #12385, #12386, #12399)

Full Changelog: https://github.com/jdx/mise/compare/v2026.8.12...v2026.8.13

💚 Sponsor mise

mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.