chore(deps): update dependency jdx/mise to v2026.5.5 by renovate[bot] · Pull Request #87 · opopops/docker

renovate · 2026-03-31T12:36:23Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
jdx/mise	minor	`2026.3.17` → `2026.5.5`

Release Notes

jdx/mise (jdx/mise)

`v2026.5.5`: : Inactive upgrades, Windows bash and bunx fixes

Compare Source

A grab-bag release: a new --inactive flag for catching installed-but-unconfigured tools, several Windows fixes around bunx and the bash task shell, and correctness fixes for the npm shim, aqua bin-path resolution, and dotnet prereleases.

Added

(outdated/upgrade) New --inactive flag on mise outdated and mise upgrade that includes installed-but-inactive tools — versions you have installed but that aren't referenced by the current config (#9640) by @roele. Useful for cleaning up or upgrading old tool installs:
```
# show every installed tool that has a newer version, even if it's not in mise.toml
mise outdated --inactive

# upgrade an installed-but-inactive tool to its current latest
mise upgrade tiny --inactive
```
When a tool has no config source, --inactive resolves against the backend's latest version rather than the pinned installed version.

Fixed

(node) The generated npm shim now invokes <this-install>/bin/node directly instead of node from PATH. Previously, running one Node install's npm while a different Node version was active could let npm derive its global prefix from the other install, sending default packages to the wrong place (#9749) by @jdx.
(bun, Windows) mise install bun on Windows now creates a bunx entry alongside bun.exe, matching what the upstream PowerShell installer does. mise tries a bunx.exe -> bun.exe hardlink first (bun switches to bunx mode based on argv[0]) and falls back to a bunx.cmd shim. reshim picks it up automatically, so bunx <pkg> finally works under mise-managed bun on Windows (#9732) by @JamBalaya56562.
(task, Windows) When a task uses shell = "bash -c" and mise is invoked from PowerShell, C:\Windows\System32\bash.exe (the WSL launcher) used to win the PATH search, silently running the task body inside a WSL Linux user-space where mise-managed Windows tools aren't visible. mise now resolves bash in this order: MISE_BASH_PATH, common Git Bash install locations (C:\Program Files\Git\bin\bash.exe, the x86 variant, %LOCALAPPDATA%\Programs\Git\bin\bash.exe), the existing PATH search, and finally an explicit reject of the WSL launcher with a warning (#9750) by @JamBalaya56562. sh/zsh/fish/ksh/dash and non-Windows builds are unaffected.
(aqua) Aqua list_bin_paths() correctly handles packages whose actual git tags add an extra v after a version prefix (e.g. tool-v1.2.3 for canonical 1.2.3), without putting remote resolution back on the bin-path hot path that was reverted in #5574. Install passes the already-resolved tag/version directly into file-link creation instead of recomputing it (#9759) by @risu729.
(dotnet) The dotnet backend now uses the shared prerelease = true tool option used by aqua/github, fetches the NuGet prerelease superset, and skips the latest fast paths when prereleases are enabled. The global prereleases setting and the deprecated dotnet.package_flags = ["prerelease"] continue to work (#9720) by @risu729:
```
MISE_EXPERIMENTAL=1 mise ls-remote 'dotnet:GitVersion.Tool[prerelease=true]'
```

Registry

Added scalafmt (github:scalameta/scalafmt) — the official Scala formatter (#9757) by @pokir.
Removed flarectl: upstream cloudflare/cloudflare-go no longer ships release binaries (the existing registry test was already commented out) (#9756) by @risu729.
Removed 49 registry shorthands with zero recorded users (bbr, brig, btrace, carp, clarinet, cli53, concourse, conduit, copper, credhub, datree, djinni, dome, draft, dtm, envcli, esy, glen, grain, inlets, kcctl, ki, kp, krab, kube-credential-cache, kubefedctl, kubefirst, kubemqctl, kwt, lab, lane, levant, melt, opsgenie-lamp, pachctl, psc-package, purerl, redo, rke, sinker, soracom, starboard, sver, terradozer, titan, uaa-cli, wasm4, wren-cli, zbctl) (#9725) by @jdx. Tools added in 2026 were skipped, and any of these can still be installed with explicit backend syntax (e.g. mise use aqua:cloudfoundry/uaa-cli).

Documentation

(secrets) Document that direct age encryption requires experimental mode, that age decryption is strict by default, and that age.strict=false skips undecryptable values and keeps resolving the environment (#9737) by @risu729.
(tasks) Add a bash shebang to the conditional-dependencies example (#9747) by @JamBalaya56562.
Backend tool option docs: document S3 support for size, strip_components, bin, and rename_exe; add no_app to GitLab and Forgejo; clarify that GitHub-family api_url covers release lookup and private/self-hosted API downloads, not just version listing (#9738) by @risu729.

New Contributors

@pokir made their first contribution in #9757

Full Changelog: jdx/mise@v2026.5.4...v2026.5.5

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.5.4`: : Java on Alpine, faster pwsh exits

Compare Source

A small release that smooths out Java installs on Alpine, makes pwsh shell activation noticeably snappier, and cleans up ibmcloud's $PATH footprint.

Added

(java) Automatic musl detection on Alpine Linux (#9688) by @roele. Java versions on Alpine no longer require an explicit -musl feature suffix — mise-java now exposes an alpine-linux OS containing the musl builds, and mise selects it automatically when running on a musl libc. So this:
```
mise use java@corretto-25
```
picks the Alpine/musl Corretto build on Alpine, and -musl-suffixed versions (e.g. corretto-musl-25) continue to resolve for backwards compatibility.

Fixed

(registry) ibmcloud now uses symlink_bins, so only the ibmcloud binary is placed on $PATH instead of the entire install directory. This prevents the bundled install binary from shadowing /usr/bin/install (#9685) by @dnwe.

Performance

(pwsh) Activation no longer spawns a fresh pwsh -NoProfile -Command exit $status (or powershell on PS 5) after every hook just to propagate mise's exit code — it now assigns $global:LASTEXITCODE = $status directly. On a typical machine that's ~270ms (pwsh) or ~185ms (powershell) shaved off every prompt (#9723) by @vemoo.

Changed

(schema) xtasks/render/schema.ts no longer overwrites $defs.task_template and the trailing $defs.task.oneOf branch on every mise run render:schema; those shapes already live in schema/mise.json, with lightweight guard checks remaining (#9680) by @risu729.

Aqua Registry Updates

New packages:

DataDog/managed-kubernetes-auditing-toolkit
oracle.com/sqlcl

Updated packages:

Full Changelog: jdx/mise@v2026.5.3...v2026.5.4

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.5.3`: : Aqua latest from GitHub releases

Compare Source

A small patch release that fixes how the aqua backend resolves latest for tools backed by GitHub releases.

Fixed

(aqua) Resolve latest via GitHub's latest-release endpoint instead of walking the chronological tag list, so mise use <tool>@latest and similar requests pick the upstream "latest" release rather than the newest tag. Packages using version_source = github_tag continue to use the existing tag-based fallback, and before_date / minimum_release_age settings still bypass the fast path. Tag-to-version normalization (version prefixes, leading v, asset checks) is now shared across remote listing, install lookup, and latest resolution (#9277) by @risu729.

Full Changelog: jdx/mise@v2026.5.2...v2026.5.3

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.5.2`: : Stable monorepo task roots, fail-fast parallel tasks, and curated lockfiles

Compare Source

Added

(aqua) Support registry libc variants (gnu vs musl) when resolving package overrides on Linux, including cross-platform lock targets like linux-x64-musl (#9652) by @jdx.
(aqua) Honor aqua registry files[].link and files[].hard entries, creating relative symlink (or hard link) aliases next to extracted binaries so tools that inspect $0/argv[0] (e.g. granted/assumego, newer pnpm) launch correctly (#9610) by @risu729.
(bin-paths) New mise bin-paths --bin-names flag prints executable names from active bin directories, and --json now emits structured entries with name, path, and symlink (#9617) by @risu729.
(task) Added MISE_MONOREPO_ROOT env var pointing at the directory of the config with experimental_monorepo_root = true (#9657) by @jdx.
(registry) Added code-review-graph via pipx:code-review-graph (#9673) by @chautruonglong.

Fixed

(task) Parallel mise run --jobs N siblings now terminate promptly when one task fails, via per-task process groups and killpg, with a 10s pipe-drain timeout (#9655) by @jdx.
(task) MISE_PROJECT_ROOT for monorepo subproject tasks is now stable regardless of invocation cwd (#9657) by @jdx.
(install) Don't force a remote-versions cache refresh in prefer_offline mode; fixes a v2026.5.0 regression with shim auto-install of prefix: requests (#9627) by @jdx.
(lockfile) Auto-lock during mise install now respects user-curated lockfiles — removed platforms stay removed (#9621) by @jdx.
(lock) mise lock from a nested project scopes targets to the active project root and stops churning parent lockfiles; --global is now exclusive (#9319) by @risu729.
(deps) Fall through to source-hash freshness when a provider returns no outputs, so bundle install, pip install, go mod download, poetry install, and uv sync stop rerunning on every invocation (#9622) by @jdx.
(backend) Inline tool option overrides (e.g. tool[asset_pattern=...]) are now applied consistently across all backends, with backend alias [...] options as a distinct overlay layer (#9306) by @risu729.
(backend) Skip the mise-versions host when locally overridden tool options affect remote version listing (#9568) by @risu729.
(backend) Reject bare package-backend names like cargo and gem as implicit cargo:cargo/gem:gem tools (#9608) by @risu729.
(aqua) Preserve configured file extensions (e.g. .bat scripts) on Windows; avoid doubling version_prefix (#9611) by @risu729.
(github) Chmod only the explicitly configured bin target instead of every archive file (#9609) by @risu729.
(pipx) Filter yanked PyPI releases from fuzzy/latest resolution while keeping exact pinned installs available (#9607) by @risu729.
(pipx) Declare python as a backend dependency so pipx.pyz resolves to mise-managed Python (#9678) by @jdx.
(trust) Run enter hooks after mise trust newly trusts a config for the current directory (#9634) by @risu729.
(ui) Stop clearing the screen for confirmation prompts like mise prune (#9619) by @jdx.
Use /bin/cp on macOS for mise sync so it doesn't break when GNU cp from Homebrew shadows it on PATH (#9656) by @pdehlke.
(schema) Update refs to $defs in mise-registry-tool.json (#9671) by @risu729.

Changed

(registry) Removed registry-level depends from generated registry tools and added test.tools for tools whose dependencies are only needed by mise test-tool (#9571) by @risu729.
(config) Registry backend options now accept full TOML values (booleans, integers, arrays, tables) instead of strings only (#9584) by @risu729.

Documentation

(node) Added tips for enabling node idiomatic version files (#9675) by @fu050409.

New Contributors

@chautruonglong made their first contribution in #9673
@pdehlke made their first contribution in #9656

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.5.1`: : Aqua cosign and a reshim rescue

Compare Source

A small follow-up to v2026.5.0 that lands top-level cosign verification for the aqua backend, fixes a mise reshim failure caused by stale latest install directories, and tightens schema validation.

Added

(backend) The aqua backend now honors top-level cosign metadata when verifying packages, covering both checksum and artifact flows and reusing the existing native sigstore path. Lockfiles record top-level cosign provenance, with new e2e and lockfile regression coverage (#9111) by @risu729.
(registry) Added wasm-tools via aqua:bytecodealliance/wasm-tools for working with the WebAssembly Component Model (#9596) by @2xdevv.

Fixed

(shim) mise reshim no longer aborts with failed to rebuild shims: no versions found for <tool> when an install directory literally named latest (or any other non-resolvable name) is left on disk. Toolset::list_installed_versions already reads concrete version directory names, so it now constructs ToolVersion directly instead of calling .resolve() (no network), and per-tool ToolRequest::new failures are warned-and-skipped instead of aborting the entire rebuild (#9599) by @jdx. Repro:
```
mkdir -p ~/.mise/installs/buck2/latest/bin
touch ~/.mise/installs/buck2/latest/bin/buck2
mise reshim   # previously failed; now succeeds
```
(schema) All files under schema/ are now validated against draft/2020-12 in strict mode. Hand-written schemas and the BoolOrString renderer in schema.ts use oneOf instead of union type arrays so AJV's strictTypes no longer rejects them; the bogus --strict-schema flag is replaced with --strict-types=true --strict-tuples=true (#9594) by @risu729.
(registry) elixir-ls re-enables symlink_bins so the move to the aqua backend stops exposing internal binaries that aren't meant to be called directly (#9592) by @AlternateRT.

Changed

(registry) rebar now installs from the GitHub backend (erlang/rebar3) since rebar3 is just an escript; the asdf plugin fallback is removed. Versions before rebar 3 are no longer supported, and the installed executable remains rebar3 to match upstream docs (#9576) by @risu729.
(registry) bashly drops the asdf:mise-plugins/mise-bashly fallback and the redundant explicit ruby dependency, since the gem backend already pulls in Ruby (#9578) by @risu729.
(release) Restored the "Sponsor mise" block on every successful GitHub release. It had been accidentally scoped to the communique-failure fallback in #9395, so normal releases since v2026.4.22 lost it (#9580) by @jdx.

Documentation

(dev-tools) Clarified that vfox metadata depends runs install hooks for the listed dependency tools (#9573) by @risu729.
(plugins) Removed outdated registry submission guidance from the plugins docs (#9577) by @risu729.

Aqua Registry Updates

New packages:

Updated:

pnpm/pnpm

Full Changelog: jdx/mise@v2026.5.0...v2026.5.1

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.5.0`: : Conda graduates, smarter prereleases, and Windows POSIX tasks

Compare Source

Added

(conda) Graduated the conda backend out of experimental (#9544) by @jdx.
(deps) Added dart and flutter deps providers backed by pubspec.yaml / pubspec.lock (#9505) by @tjarvstrand.
(task) sources entries can now be prefixed with ! to exclude paths, and a new sources_exclude field is supported; exclusions apply to freshness checks, task_source_files, and mise watch (#9496) by @jlarmstrongiv.
(vfox) Added stat to the Lua file module so plugins can read file metadata (#9497) by @esteve.
(registry) Added neo4j (#9525), rustfs (#9530), expert (#9498), systemctl-tui (#9521), codon (#9538), yr (#9542), betterleaks (#9541), git-filter-repo (#9550), umoci (#9555), google-java-format (#9488), an aqua backend for elixir-ls (#9557), and enabled shellcheck on Windows (#9487).

Fixed

(backend) Stamp prerelease metadata via regex for backends that don't expose it upstream (#9500) by @jdx.
(backend) Treat -nightly, -canary, -experimental, -insider, -edge as prereleases (#9523) by @jdx.
(backend) Scope PEP 440 prerelease detection to Python backends (#9558) by @jdx.
(backend) Honor dotnet.package_flags = "prerelease" and --prerelease for dotnet (#9551) by @jdx.
(backend) Suppress repeated No versions found warnings for backends that support unresolved latest (#9548) by @jdx.
(install) Don't warn for configured tools when version is passed via CLI (#9522) by @jdx.
(install) Refresh latest before installing missing tools (#9545) by @jdx.
(install) Don't cache nonexistent install paths (#9553) by @jdx.
(lockfile) Don't propagate ad-hoc CLI overrides into the project lockfile (#9562) by @jdx.
(plugin) Detect plugin types after cloning (#9540) by @risu729.
(task) Convert PATH to MSYS Unix form when spawning POSIX shells on Windows (#9547) by @JamBalaya56562.
(cargo) Apply install_env during cargo install (#9502) by @c22.
(github) Skip attestations on non-default api_url (#9486) by @jdx.
(github) Retry IP allow list errors without auth (#9506) by @risu729.
(http) Update versions host tracking endpoint (#9527) by @jdx.
(release) Pass --no-git-checks to aube publish (#9483) by @jdx.
(copr) Drop epel-9 chroots since rust >= 1.91 is unavailable (#9484) by @jdx.

Changed

(registry) Deny inline backend options in registry tool entries (#9565) by @risu729.
(registry) Update entry for checkmake (#9504) by @eread.

Deprecated

shorthands_file setting / MISE_SHORTHANDS_FILE is deprecated; warning starts in 2026.6.0, removal planned for 2026.12.0. Use [plugins] instead (#9534) by @risu729.

Documentation

Document ghtkn as a GitHub credential_command (#9546) by @jdx.
Clarify registry backend acceptance policy (#9543, 7bbeebe) by @jdx.
Update mise watch docs to pitchfork.en.dev (#9536) by @risu729.
Use bash in exec example for variable echoing (#9567) by @kuboon.

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

`v2026.4.28`: : Remote tasks pinned by commit SHA

Compare Source

A small patch release: remote tasks pinned to a commit SHA no longer panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes again.

Fixed

(task) Remote tasks referenced by commit SHA (a git:: source with ?ref=<40-char hex>) no longer crash mise with we map by name only and have no object-id in refspec from gix (#9473) by @jdx. gix-refspec parses any 40- or 64-char hex string as an ObjectId refspec, but gix::clone::fetch::util::find_custom_refname only handles name-based matches and expect()s on the result, so passing a bare SHA to prepare_clone.with_ref_name() triggered a hard process panic on every cache miss. Git::clone now detects SHA-shaped refs via a looks_like_sha heuristic, skips both the with_ref_name() and git clone -b paths (neither accepts bare SHAs), drops --depth 1 since shallow clones may not contain the requested object, and checks out the SHA after the clone via the existing CLI-backed update. Named branches and tags continue to use the existing fast paths. Closes #9472.
(copr) The copr-publish workflow no longer pins a stale ghcr.io/jdx/mise:copr image digest, and docker.yml now rebuilds the :copr image whenever packaging/copr/Dockerfile changes on main (#9451) by @bestagi. Previously the workflow kept hitting ModuleNotFoundError: No module named 'rich' even after #9421 switched copr-cli to dnf install, because the hardcoded digest still pointed at the old pip-installed image.

New Contributors

@bestagi made their first contribution in #9451

Full Changelog: jdx/mise@v2026.4.27...v2026.4.28

`v2026.4.27`: : npm install args, smarter watch, and a macOS shim recursion fix

Compare Source

A focused release: more control over how npm-backed tools get installed, smarter mise watch that follows task dependencies, and a fix for a nasty macOS shim recursion that could lock up a shell during mise up --bump.

Added

(backend) New npm_args, pnpm_args, bun_args, and aube_args tool options on the npm backend (#9109) by @risu729. Each one is forwarded to the matching package manager when it's the active settings.npm.package_manager, mirroring the pipx backend's style. The args are also recorded in the lockfile and at install time:
```
[tools]
"npm:npm" = { version = "latest", aube_args = "--reporter append-only" }
"npm:tiny" = { version = "latest", pnpm_args = "--loglevel=warn" }
```
(env) External vfox environment plugins now get ctx.config_root in their MiseEnv / MisePath hooks (#9465) by @hisaac. This matches what built-in directives like _.file already see, so plugins (e.g. mise-xcode) can resolve user-supplied relative paths against the project root regardless of the shell's cwd. watch_files returned from a plugin are now also absolutized against config_root instead of current_dir().
(task) mise watch now follows the task graph and watches the sources of each chosen task's dependencies as well as its own (#9437) by @43081j. Pass --skip-deps (or set skip_deps) to restore the previous "task sources only" behavior. Explicit --glob overrides still win.
(release) scripts/gen-aqua-changelog.sh now diffs the previous tag's registry.yaml against the current one and emits New Packages / Updated Packages sections in the release PR, instead of dumping the aqua-registry release tags rolled into the release (#9471) by @jdx. This restores the pre-#9043 behavior for the merged-registry world.

Fixed

(backend) When _list_remote_versions returned an empty list (invalid module path, throttling, etc.) the empty result was cached as if it were authoritative, poisoning both the on-disk cache file and the in-memory OnceCell for up to an hour (#9444) by @c22. The cache is now cleared in both places when the list comes back empty, so the next call re-fetches.
(shims) Fixed an infinite shim recursion on macOS reported in #9462 where mise up --bump against npm packages would loop mise -> npm shim -> mise -> npm shim -> ... and sometimes crash the session (#9468) by @jdx. The trigger was a case-mismatched $HOME in PATH (/Users/Olfway/... vs. /Users/olfway/...) — the shims-stripping in Backend::dependency_env compared byte-equal, so on case-insensitive APFS/HFS+ volumes it was a no-op and npm re-resolved to the mise shim. A new file::paths_eq does case-insensitive compares on macOS/Windows and byte-equal on Linux, and is now used everywhere mise asks "is this PATH entry the shims directory?" — including path_env_without_shims, which_no_shims, PathEnv partitioning, cli::exec program resolution, and the doctor's shims_on_path check (which had been silently reporting no for affected users).
(task) Under deny_env = true on Linux, every env var was being stripped from the child process — including the PATH / HOME / USER / SHELL / TERM / LANG that filter_env and the docs say should pass through (#9467) by @jdx, fixing #9466. apply_sandbox() was calling Command::env_clear() after the task executor populated explicit envs via .envs(filtered_env), wiping both. The Linux branch now snapshots the explicit envs before clearing and re-applies them; macOS already did this. A new path_test task in e2e/sandbox/test_sandbox_task guards against regressions.

New Contributors

@43081j made their first contribution in #9437
@hisaac made their first contribution in #9465

Full Changelog: jdx/mise@v2026.4.26...v2026.4.27

`v2026.4.26`

Compare Source

`v2026.4.25`: : Sharper task tooling and lockfile fixes

Compare Source

A patch release focused on smoothing rough edges in tasks (sandbox path resolution, dependency templates, a new --name-only listing) and fixing a handful of upgrade/ls-remote pitfalls.

Added

(task) New --name-only flag on mise tasks ls (and mise tasks) prints one task name per line — no headers, no padding, no description column (#9435) by @jdx. It composes with --all, --global/--local, --hidden, --sort/--sort-order, and uses a broken-pipe-tolerant writer so dropping it into fzf Just Works:
```
mise run "$(mise tasks ls --name-only --all | fzf)"
```
Conflicts with --json, --extended, and --usage.

Fixed

(task) Dependency templates can now branch on usage values inside Tera statement tags, not just output expressions, and boolean/array flags are passed through with their real types instead of stringified (#9424) by @jdx. So this finally does what it looks like:
```
[tasks.lint]
usage = 'flag "--run-post" default=#false'
depends_post = ['''
    {%- if usage.run_post -%}
        postlint:**
    {%- else -%}
        noop
    {%- endif -%}
''']
run = 'echo "lint ran"'
```
(task) Tasks that define usage with subcommands but no top-level args/flags now correctly populate usage.cmd for dependency templates, fixing a regression from #9424 where the early-return path skipped subcommand handling (#9431) by @jdx. The fix also de-duplicates make_usage_ctx between the script parser and the dep renderer so they can't drift again.
(task) Sandbox allow_read / allow_write paths declared on a task are now resolved against the task's effective working directory rather than the shell's pwd (#9428) by @jdx. Previously, dir = "../bar" plus allow_read = ["."] opened up the caller's directory while the task itself ran in bar/ and got blocked. CLI overrides like mise run --allow-read=… still resolve against shell cwd. Closes #9423.
(lockfile) mise upgrade now updates the global lockfile (~/.config/mise/mise.lock) when bumping a fuzzy version such as latest (#9442) by @jdx. The grouping pass was excluding global config files entirely, and fuzzy requests could re-resolve through the stale lockfile entry mid-update. Newly installed versions are now overlaid before lockfiles are rewritten, so a global dummy = "latest" upgrading from 1.0.0 to 2.0.0 actually pins 2.0.0.
(aqua) When list_releases_including_prereleases returned an empty list (paginated/cached edge case, throttling, or a repo that genuinely has no releases), aqua fell back to list_tags and pulled in every git tag in the repo (#9443) by @jdx. For monorepos that tag sub-crates, that meant ripgrep's grep-regex-0.1.1 and friends ended up in the shared mise-versions snapshot, so ripgrep = "latest" resolved to a tag with no matching release asset and 404'd on install. Empty release lists now propagate as empty version lists; packages that legitimately use tags as their version source still opt in via version_source = "github_tag". The remote_versions cache filename is also reverted to remote_versions.msgpack.z to avoid needlessly invalidating existing caches — VersionInfo already deserializes forward-compatibly. (Server-side mise-versions snapshots will need to be regenerated with this fix.)
(ls-remote) mise ls-remote --json no longer emits "rolling":false,"prerelease":false on every entry (#9439) by @jdx. Dummy output is now [{"version":"1.0.0"},{"version":"1.1.0"},{"version":"2.0.0"}]. Backends that legitimately set either flag (rust nightly/beta/stable, github/aqua pre-releases) still emit the field; cached entries written by older builds continue to deserialize.
(docs) The docs site no longer flickers between light/dark themes on initial load (#9427) by @vhespanha. VitePress's anti-flicker inline script is now marked data-cfasync="false" so Cloudflare's Rocket Loader stops deferring it. Fixes #9393.
(Dockerfile) copr-cli is now installed via dnf instead of pip, fixing ModuleNotFoundError: No module named 'rich' in the publish-copr workflow (#9421) by @bestagi.

New Contributors

@vhespanha made their first contribution in #9427
@bestagi made their first contribution in #9421

Full Changelog: jdx/mise@v2026.4.24...v2026.4.25

`v2026.4.24`: : Resilient downloads and global pre-release opt-in

Compare Source

A small release that hardens HTTP downloads against flaky networks and adds a global way to surface pre-release versions, plus refreshed intro messaging.

Added

(ls-remote) New global prereleases setting (MISE_PRERELEASES=1) and a --prerelease flag for mise ls-remote (#9415) by @jdx. Acts as prerelease = true applied to every tool, so GitHub releases flagged prerelease: true show up in ls-remote, latest resolves against the full list, and fuzzy queries like 1.2 can match pre-release tags. Currently honored by the github: and aqua: backends; draft releases are still excluded.
```
mise ls-remote github:cli/cli --prerelease
# or, persistently:
export MISE_PRERELEASES=1
```

Fixed

(http) HTTP requests now retry transient failures with a jittered backoff schedule (~200ms / 1s / 4s / 15s, then capped at 15s) and the default http_retries is bumped from 0 to 3 (#9414) by @jdx. Retries fire on 5xx, 408, 429, and network-layer errors (connect refused, timeout, mid-stream body drops); deterministic 4xx responses like 404 fail fast without retry. Downloads wrap the full request + body so a chunk failure mid-stream restarts from byte 0 instead of failing the install. Each retry logs a warn! immediately so flaky infrastructure surfaces in real time, and the same logic now powers vfox plugin downloads (which honor MISE_HTTP_RETRIES too). Set MISE_HTTP_RETRIES=0 to opt out. The http→https fallback now only triggers on connection-level errors, not on HTTP status errors.
(release) scripts/publish-s3.sh now purges the mise.en.dev Cloudflare zone (alongside jdx.dev and mise.run) after each S3 publish (#9416) by @jdx. Because install.sh is uploaded with immutable cache-control, missing the purge could leave one zone serving the previous release's install.sh next to a new release's install.sh.minisig.

Documentation

Refreshed the project tagline and intro across the README, docs site, landing page, man page, snapcraft/RPM/DEB/npm packaging metadata, and CLI help text to "Dev tools, env vars, and tasks in one CLI" with a clearer "what is it?" pitch focused on what mise does rather than what it replaces (#9418) by @jdx.
The docs site's GitHub star count is now prefixed with a ★ glyph for clarity (#9417) by @jdx.

Full Changelog: jdx/mise@v2026.4.23...v2026.4.24

`v2026.4.23`: : Pre-releases, libc preference, and a Node musl fix

Compare Source

A patch release that adds a global libc preference and pre-release opt-in for github:/aqua: backends, alongside fixes for Node musl downloads, read-only system installs, and mise prune network hangs.

Added

(backend) Per-tool prerelease = true opt-in for the github: and aqua: backends (#9329) by @jakedgy. When set, GitHub releases flagged prerelease: true show up in mise ls-remote, latest resolves against the full list including pre-releases, and fuzzy queries like 1.2 can match pre-release tags. Default behavior is unchanged; draft releases are still excluded.
```
[tools]
"github:myorg/mytool" = { version = "latest", prerelease = true }
"aqua:owner/tool"     = { version = "latest", prerelease = true }
```
(backend) Global libc setting for selecting Linux precompiled binary variants (#9404) by @jdx. Accepts musl, glibc, or gnu and threads through Platform::current()/PlatformTarget so generic GitHub asset matching, aqua registry replacements (e.g. unknown-linux-gnu ↔ unknown-linux-musl), Bun, Python precompiled builds, Node, and vfox envType all honor the preference.
```
export MISE_LIBC=musl
```

Fixed

(install) Stop rewriting healthy runtime symlinks (#9410) by @jdx. The rebuild path was unconditionally remove_all + recreating every latest -> X.Y.Z symlink, which became a hard failure under the common Docker pattern where root populates /usr/local/share/mise/installs/ at build time and a non-root user runs mise install at runtime. Healthy symlinks now take a no-op path; the read-only system dir is no longer touched. If a write is genuinely required and can't happen, the install fails loudly instead of silently leaving a stale latest.
(node) Route musl tarball URLs to unofficial-builds.nodejs.org (#9409) by @jdx. After #9404 Node started appending -musl to filenames but kept routing through nodejs.org/dist/ (which doesn't host them), causing 404s and lockfiles where the URL had a -musl suffix while the checksum was still pinned to the glibc tarball. The tarball URL and matching SHASUMS256.txt now come from the same host, and a custom node.mirror_url still passes through unchanged. Lockfile merging is also hardened to drop stale checksum/size/url_api when URLs disagree.
(prune) Skip remote version resolution for tracked configs (#9406) by @jdx. mise prune was hitting npm, the Go proxy, and the GitHub API to resolve tracked-config tool versions, which could hang on slow or failing registries. Since prune only protects installed versions from deletion, an offline flag is now threaded through ResolveOptions for prune. mise upgrade is unchanged and still queries fresh remote data. Closes #9405.
(backend) Allow unresolved latest opt-in (#9401) by @jdx. latest now falls back to an unresolved selector only when a backend's unfiltered remote version list is empty and the backend opts in via unresolved_latest_version(). pipx opts in for git-backed requests; backends that require concrete versions continue to fail rather than create literal latest/ installs. If minimum_release_age filters all candidates out, mise still reports no matching version.
(schema) Allow array values in tool additionalProperties (#9400) by @JP-Ellis. Configs like rust = { version = "1.77", components = ["rustfmt", "clippy"] } are no longer flagged as invalid by linters such as tombi.

Registry

Use aqua for rumdl (#9397) by @scop
Add llmfit (#9412) by @jylenhof

New Contributors

@JP-Ellis made their first contribution in #9400

Full Changelog: jdx/mise@v2026.4.22...v2026.4.23

`v2026.4.22`: : Repaired latest resolution and clearer deps output

Compare Source

A focused patch release that repairs two @latest regressions, gives mise deps clearer per-provider output labels, and renames the install_before setting to minimum_release_age to match the wider ecosystem.

Highlights

@latest resolution is fixed for Go modules that only publish pseudo-versions, and stale installs/<tool>/latest/ directories are now repaired automatically.
The install_before setting has been renamed to minimum_release_age; the old name keeps working as a deprecated alias.
mise deps output is now labeled by provider (e.g. [deps.codegen]) instead of repeating the raw command.
Fedora 44 and Rawhide are now supported in the COPR build.

Fixed

(backend) Two separate @latest issues are repaired in #9383 by @jdx:
- Go modules that enumerate zero versions now resolve @latest via go list -m -json <module>@latest, so modules that only publish pseudo-versions still install a concrete version.
- Stale real installs/<tool>/latest/ directories are now repaired generically by the runtime symlink migration. The migration reruns under a new marker and refreshes only install_state after rewriting directories, so the current process picks up the repaired layout without rebuilding the backend map (which previously broke config aliases). Numeric partial-version dirs such as installs/<tool>/25/ are left alone, and real direct-URL latest installs (e.g. UBI URL installs) are preserved when there is no concrete version to replace them with.
(task) mise deps output is now labeled with a stable [deps.<provider>] prefix on stdout/stderr (and in the progress message) instead of using the raw run command as the prefix, making repeated output from commands like pip install -r requirements.txt much easier to follow. mise deps add/remove continues to run unprefixed. (#9385) by @jdx

Changed

(config) The install_before setting and per-tool option have been renamed to minimum_release_age, matching pnpm's terminology. The old install_before name is preserved as a hidden, deprecated alias — global settings are migrated at load time, per-tool options resolve through the new key, and the JSON schema marks the old name as deprecated. Precedence is unchanged: --before > per-tool > global. (#9384) by @jdx

Added

(copr) Fedora 44 and Rawhide are now supported by the COPR build script. (#9391) by @bestagi

Documentation

The docs site nav now displays the current release version (read from Cargo.toml at build time), linking to the GitHub releases page. The build emits a warning if the version cannot be parsed instead of silently falling back. (#9388, #9389) by @jdx

Aqua Registry

Updated aqua-registry from v4.498.0 to [v4.499.0](https://redirect.github.com/a

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.3.18~~ chore(deps): update dependency jdx/mise to v2026.4.0 Apr 1, 2026

renovate Bot force-pushed the renovate/all branch from b80483b to e746981 Compare April 1, 2026 14:51

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.0~~ chore(deps): update dependency jdx/mise to v2026.4.1 Apr 2, 2026

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 7bca63d to 78cde9b Compare April 3, 2026 13:52

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.1~~ chore(deps): update dependency jdx/mise to v2026.4.3 Apr 3, 2026

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.3~~ chore(deps): update dependency jdx/mise to v2026.4.4 Apr 5, 2026

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 71dfc7c to 2c2deda Compare April 6, 2026 13:24

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.4~~ chore(deps): update dependency jdx/mise to v2026.4.5 Apr 6, 2026

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.5~~ chore(deps): update dependency jdx/mise to v2026.4.6 Apr 8, 2026

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 9807261 to 23e68ca Compare April 9, 2026 10:49

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.6~~ chore(deps): update dependency jdx/mise to v2026.4.7 Apr 9, 2026

renovate Bot force-pushed the renovate/all branch from 23e68ca to 5dbfe28 Compare April 10, 2026 14:16

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.7~~ chore(deps): update dependency jdx/mise to v2026.4.8 Apr 10, 2026

renovate Bot force-pushed the renovate/all branch from 5dbfe28 to 0b27243 Compare April 11, 2026 20:28

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.8~~ chore(deps): update dependency jdx/mise to v2026.4.9 Apr 11, 2026

renovate Bot force-pushed the renovate/all branch from 0b27243 to 4772b7b Compare April 12, 2026 13:32

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.9~~ chore(deps): update dependency jdx/mise to v2026.4.10 Apr 12, 2026

renovate Bot force-pushed the renovate/all branch from 4772b7b to 08413f6 Compare April 13, 2026 13:17

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.10~~ chore(deps): update dependency jdx/mise to v2026.4.11 Apr 13, 2026

renovate Bot force-pushed the renovate/all branch from 08413f6 to 7f4fed8 Compare April 16, 2026 10:41

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.11~~ chore(deps): update dependency jdx/mise to v2026.4.14 Apr 16, 2026

renovate Bot force-pushed the renovate/all branch from 7f4fed8 to d106507 Compare April 16, 2026 17:43

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.14~~ chore(deps): update dependency jdx/mise to v2026.4.15 Apr 16, 2026

renovate Bot force-pushed the renovate/all branch from d106507 to 0d1ebc0 Compare April 17, 2026 15:11

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.15~~ chore(deps): update dependency jdx/mise to v2026.4.16 Apr 17, 2026

renovate Bot force-pushed the renovate/all branch from 0d1ebc0 to 29746be Compare April 18, 2026 17:00

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.16~~ chore(deps): update dependency jdx/mise to v2026.4.17 Apr 18, 2026

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.19~~ chore(deps): update dependency jdx/mise to v2026.4.20 Apr 24, 2026

renovate Bot force-pushed the renovate/all branch from 5a0caea to a8ac06c Compare April 25, 2026 13:08

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.20~~ chore(deps): update dependency jdx/mise to v2026.4.21 Apr 25, 2026

renovate Bot force-pushed the renovate/all branch from a8ac06c to f953196 Compare April 25, 2026 18:35

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.21~~ chore(deps): update dependency jdx/mise to v2026.4.22 Apr 25, 2026

renovate Bot force-pushed the renovate/all branch from f953196 to 8f3ef1a Compare April 26, 2026 21:26

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.22~~ chore(deps): update dependency jdx/mise to v2026.4.23 Apr 26, 2026

renovate Bot force-pushed the renovate/all branch from 8f3ef1a to 647eacb Compare April 27, 2026 13:23

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.23~~ chore(deps): update dependency jdx/mise to v2026.4.24 Apr 27, 2026

renovate Bot force-pushed the renovate/all branch from 647eacb to 72020a7 Compare April 28, 2026 17:43

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.24~~ chore(deps): update dependency jdx/mise to v2026.4.25 Apr 28, 2026

renovate Bot force-pushed the renovate/all branch from 72020a7 to fd1ed23 Compare April 29, 2026 16:37

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.25~~ chore(deps): update dependency jdx/mise to v2026.4.26 Apr 29, 2026

renovate Bot force-pushed the renovate/all branch from fd1ed23 to edf5298 Compare April 29, 2026 23:24

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.26~~ chore(deps): update dependency jdx/mise to v2026.4.27 Apr 29, 2026

renovate Bot force-pushed the renovate/all branch from edf5298 to 1d8da69 Compare April 30, 2026 16:05

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.27~~ chore(deps): update dependency jdx/mise to v2026.4.28 Apr 30, 2026

renovate Bot force-pushed the renovate/all branch from 1d8da69 to 0837f8f Compare May 3, 2026 22:13

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.4.28~~ chore(deps): update dependency jdx/mise to v2026.5.0 May 3, 2026

renovate Bot force-pushed the renovate/all branch from 0837f8f to 5599c9b Compare May 5, 2026 14:44

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.5.0~~ chore(deps): update dependency jdx/mise to v2026.5.1 May 5, 2026

renovate Bot force-pushed the renovate/all branch from 5599c9b to 4c38329 Compare May 7, 2026 13:38

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.5.1~~ chore(deps): update dependency jdx/mise to v2026.5.2 May 7, 2026

renovate Bot force-pushed the renovate/all branch from 4c38329 to 951583f Compare May 8, 2026 12:59

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.5.2~~ chore(deps): update dependency jdx/mise to v2026.5.3 May 8, 2026

renovate Bot force-pushed the renovate/all branch from 951583f to 406abab Compare May 9, 2026 13:44

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.5.3~~ chore(deps): update dependency jdx/mise to v2026.5.4 May 9, 2026

chore(deps): update dependency jdx/mise to v2026.5.5

ac5e40c

renovate Bot force-pushed the renovate/all branch from 406abab to ac5e40c Compare May 10, 2026 12:44

renovate Bot changed the title ~~chore(deps): update dependency jdx/mise to v2026.5.4~~ chore(deps): update dependency jdx/mise to v2026.5.5 May 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency jdx/mise to v2026.5.5#87

chore(deps): update dependency jdx/mise to v2026.5.5#87
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all

renovate Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2026.5.5: : Inactive upgrades, Windows bash and bunx fixes

Added

Fixed

Registry

Documentation

New Contributors

💚 Sponsor mise

v2026.5.4: : Java on Alpine, faster pwsh exits

Added

Fixed

Performance

Changed

Aqua Registry Updates

💚 Sponsor mise

v2026.5.3: : Aqua latest from GitHub releases

Fixed

💚 Sponsor mise

v2026.5.2: : Stable monorepo task roots, fail-fast parallel tasks, and curated lockfiles

Added

Fixed

Changed

Documentation

New Contributors

💚 Sponsor mise

v2026.5.1: : Aqua cosign and a reshim rescue

Added

Fixed

Changed

Documentation

Aqua Registry Updates

💚 Sponsor mise

v2026.5.0: : Conda graduates, smarter prereleases, and Windows POSIX tasks

Added

Fixed

Changed

Deprecated

Documentation

💚 Sponsor mise

v2026.4.28: : Remote tasks pinned by commit SHA

Fixed

New Contributors

v2026.4.27: : npm install args, smarter watch, and a macOS shim recursion fix

Added

Fixed

New Contributors

v2026.4.26

v2026.4.25: : Sharper task tooling and lockfile fixes

Added

Fixed

New Contributors

v2026.4.24: : Resilient downloads and global pre-release opt-in

Added

Fixed

Documentation

v2026.4.23: : Pre-releases, libc preference, and a Node musl fix

Added

Fixed

Registry

New Contributors

v2026.4.22: : Repaired latest resolution and clearer deps output

Highlights

Fixed

Changed

Added

Documentation

Aqua Registry

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 31, 2026 •

edited

Loading

`v2026.5.5`: : Inactive upgrades, Windows bash and bunx fixes

`v2026.5.4`: : Java on Alpine, faster pwsh exits

`v2026.5.3`: : Aqua latest from GitHub releases

`v2026.5.2`: : Stable monorepo task roots, fail-fast parallel tasks, and curated lockfiles

`v2026.5.1`: : Aqua cosign and a reshim rescue

`v2026.5.0`: : Conda graduates, smarter prereleases, and Windows POSIX tasks

`v2026.4.28`: : Remote tasks pinned by commit SHA

`v2026.4.27`: : npm install args, smarter watch, and a macOS shim recursion fix

`v2026.4.26`

`v2026.4.25`: : Sharper task tooling and lockfile fixes

`v2026.4.24`: : Resilient downloads and global pre-release opt-in

`v2026.4.23`: : Pre-releases, libc preference, and a Node musl fix

`v2026.4.22`: : Repaired latest resolution and clearer deps output