chore(deps): update dependency jdx/mise to v2026.8.15

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
jdx/mise	uses-with	patch	v2026.8.11 → v2026.8.15

---

Release Notes

jdx/mise (jdx/mise)

v2026.8.15: : Dotfiles diff and capture, scoped config updates, and per-tool postinstall hooks

Compare Source

This release expands the dotfiles/bootstrap workflow with previews, bulk capture, git-tracked manifests, and profile reconciliation, adds scoped config collection updates and per-tool postinstall hooks, and rounds it out with a large batch of fixes across tasks, schema validation, Windows, lockfiles, and shims.

Highlights

• Dotfiles management grows a full preview-and-capture workflow: mise bootstrap dotfiles diff, bulk add --changed, git-tracked directory manifests, and automatic reconciliation when a profile switches a target's source.
• mise config set learns idempotent list updates (--append/--remove) and explicit --global/--system targeting, and mise use gains per-tool --postinstall hooks.
• Safer upgrades: replaced tool versions now linger for a grace period instead of being deleted immediately, so a bad upgrade is easier to recover from.

Added

• dotfiles: New mise bootstrap dotfiles diff previews exactly what apply would change without writing anything, printing unified content patches for copy, template, and inline entries and structural summaries for symlinks and directories. Optional target filters use the same selection semantics as apply. (#​12511 by @​jdx)

• dotfiles: mise bootstrap dotfiles add --changed captures every drifted copy-mode target back into its source in one command, without naming each path. Directory copies, symlinks, templates, and inline content are skipped, and untrusted configs are blocked. (#​12512 by @​jdx)

• dotfiles: Directory copy and symlink-each entries can now set manifest = "git" to manage only paths returned by git ls-files, so a dotfiles repo that gitignores everything and force-adds selected paths no longer traverses (or links) ignored home-directory content. Links are removed when a file drops out of the index. (#​12523 by @​jdx)

• dotfiles: symlink-each apply now reconciles stale links when a profile change (for example toggling MISE_ENV between home and work) points a target at a different source. Only links still pointing at the previously recorded source are removed; unmanaged paths and paths desired by another active source are left alone, and dry-run previews the removals. (#​12524 by @​jdx)

• bootstrap: mise bootstrap --from <git-url> clones a setup/dotfiles repo (into $MISE_DATA_DIR/bootstrap-repo by default, or --from-dir), then runs bootstrap from that checkout. Existing checkouts are reused when the origin matches, --update fast-forwards them, and --dry-run only prints the planned git clone/git pull. (#​12525 by @​jdx)

• use: mise use --postinstall <COMMAND> attaches a per-tool post-install hook that runs only when that tool is installed or reinstalled. Repeat the flag before each tool to give each its own hook. (#​12609 by @​jdx)

  mise use --postinstall "mbx setup --defaults" mr-boxington

• config: mise config set gains --append and --remove for list-like keys (append without duplicates, remove matching entries, promote scalars to arrays as needed) while preserving TOML comments and formatting, plus explicit --global/--system targeting for config get/set. Tool postinstall hooks now also receive MISE_CONFIG_FILE, MISE_GLOBAL_CONFIG_FILE, MISE_CONFIG_ROOT, and MISE_PROJECT_ROOT. (#​12603 by @​jdx)

• config: Templates can now reference config_source, the absolute path of the config file the template lives in (not resolved through symlinks). This lets a shared config symlinked into conf.d add its own real directory to PATH, for example {{ config_source | canonicalize | dirname }}/bin. Available in mise.toml, .tool-versions, [env] directives, and [settings.age]. (#​12454 by @​Marukome0743)

• task: task_source_files(only_changed=true) returns only the sources written since the task last succeeded, so linters and formatters can run against just what changed. A failed run keeps its files outstanding until the task passes. (#​12470 by @​Marukome0743)

• outdated: mise outdated --json now includes a release_url field pointing at the release page for the offered version (from the versions host, aqua, GitHub/GitLab, or the rust core plugin). The key is omitted rather than null when no page is available. (#​12494 by @​Marukome0743)

Changed

• upgrade: mise upgrade no longer deletes the replaced install immediately. When upgrade.auto_prune is on, the old version stays on disk and is scheduled for removal after upgrade.prune_after (default 24h), cleaned up opportunistically on later runs. --prune still removes immediately and --no-prune keeps the old tree with no scheduled cleanup. mise ls surfaces deferred removals. (#​12593 by @​jdx)

Fixed

• env,tasks: .env files written as UTF-16 (the default from Windows PowerShell 5.1's > and Out-File) are now decoded and loaded instead of being silently dropped, and a UTF-16 task file now gets a clear hint to save it as UTF-8. (#​12507 by @​JamBalaya56562)
• install: mise install --dry-run no longer claims it would install a tool that cannot actually be installed on this platform. (#​12568 by @​JamBalaya56562)
• exec: mise exec now reports clearly when a requested tool is not available on the current platform. (#​12547 by @​JamBalaya56562)
• config: Request-specific tool options are preserved rather than dropped during config merges. (#​12060 by @​risu729)
• config: A bare tool_alias value is now resolved through the registry. (#​12506 by @​Marukome0743)
• config: Minimum-release-age exclusions from multiple configs are merged instead of overwritten. (#​12460 by @​jdx)
• lockfile: Version ties are broken correctly when a legacy lockfile answers latest, and links belonging to other backends are ignored. (#​12583, #​12605 by @​Marukome0743, @​jdx)
• monorepo: Idiomatic version files are resolved from the task's own config root. (#​12565 by @​kaii-zen)
• task: Several ordering fixes so injected and dependency tasks keep their intended slots, tasks that link back into themselves are skipped, and taskkill output is suppressed on Windows. (#​12450, #​12466, #​12482, #​12510, #​12563 by @​Marukome0743, @​jrandolf, @​JamBalaya56562, @​sortA0329)
• shims/generate: Arguments are now delivered intact for file-mode shims and Windows launchers, and mise generate explains when a --mise-bin path has no Windows launcher. Non-executable system fallbacks are skipped. (#​12502, #​12463, #​12496, #​12545 by @​JamBalaya56562, @​jdx)
• http: Raw binaries are copied on Windows where a junction cannot name a file, and a download that fails because the path is too long now explains itself. (#​12465, #​12550 by @​Marukome0743, @​JamBalaya56562)
• link/file: Links whose target no longer exists can now be shown and removed. (#​12468, #​12469 by @​JamBalaya56562)
• trust: The ignore list is now read by what its entries point at, matching how trust links are stored. (#​12428 by @​JamBalaya56562)
• watch: The terminal is restored when the watched process is signalled. (#​12451 by @​Marukome0743)
• activate: The pwsh deactivation preamble no longer pollutes $Error. (#​12483 by @​JamBalaya56562)
• backend: Rolling updates behind a versions host are now detected. (#​12440 by @​jdx)
• github: Stale cached attestations are retried. (#​12495 by @​jdx)
• ls-remote: Recorded listing errors now cause a failure instead of returning stale/empty results. (#​12551 by @​jdx)
• npm: Dangling aube-backed tool installs are repaired. (#​12570 by @​jdx)
• bootstrap: Brew cask dependencies are preserved during prune. (#​12461 by @​jdx)
• azure: The CLI now includes pip for extension support. (#​12555 by @​esteve)
• registry: Windows/arm64 can fall back to x64 backends, as aqua already does. (#​12560 by @​JamBalaya56562)
• doctor: The self-update leftover check is gated so it does not fire for installs that manage updates elsewhere. (#​12438 by @​salim-b)
• schema: Several JSON schema corrections so registry, plugin, tool-option, and settings definitions match what the build consumers actually accept. (#​12514, #​12515, #​12520, #​12522, #​12527 by @​risu729)

Performance

• brew: Homebrew bootstrap bottles are now downloaded concurrently (bounded by MISE_JOBS), while pouring, source builds, and prefix linking stay in dependency order. (#​12604 by @​jdx)

Registry

New tools: pkgx, onefetch, syncthing, ols, spin-framework, cursor-agent, 7zip, mosh, pastel, broot, exiftool, spotify-player, yt-dlp-nightly, and cliamp. magika and sbt now install from their GitHub releases, and pre-commit uses the pipx backend on Windows. Various dependency and OS-limit cleanups were also applied. (#​12272, #​12437, #​12448, #​12484, #​12485, #​12478, #​12486, #​12532, #​12535, #​12533, #​12538, #​12539, #​12542, #​12581, #​12553, #​12567, #​12549)

New Contributors

• @​sortA0329 made their first contribution in #​12563
• @​seuros made their first contribution in #​12519
• @​pb3975 made their first contribution in #​12478
• @​ThorstenHans made their first contribution in #​12485

Full Changelog: jdx/mise@v2026.8.14...v2026.8.15

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.14: : npm/aube install fixes and cleaner temp/prune handling

Compare Source

This is a small release focused on bug fixes for npm (aube-backed) installs, HTTP cache cleanup, and Windows config pruning.

Fixed

• npm: Aube-backed npm installs no longer drop a synthetic .npmrc into the per-tool install directory. Install-scoped settings such as minimumReleaseAge, trustPolicyExclude, allowedUnpopularPackages, and (for CLI installs) globalDir/globalBinDir now go into .config/aube/config.toml as typed TOML, while allowBuilds stays in package.json. Inline-table trust_policy_excludes / allow_low_downloads in mise.toml still round-trip correctly. (#​12425 by @​jdx)
• npm: mise now intercepts the private __node-gyp-bootstrap trampoline that embedded aube's lazy node-gyp shim re-execs. Previously naked-run rewriting turned it into mise run __node-gyp-bootstrap … and failed with "no tasks defined", breaking allow_builds installs whose lifecycle scripts call node-gyp (for example gemini-cli via node-pty). (#​12429 by @​jdx)
• http: A failed extraction (truncated download, unreadable archive, full disk, or Ctrl-C mid-extraction) no longer leaves a permanent hash-named temp directory behind in http-tarballs. All failure paths now clean up the temp directory. (#​12420 by @​Marukome0743)
• prune: mise prune --configs on Windows now removes trusted config links whose target no longer exists. Because Windows stores these links as plain files holding the target path, the previous existence check never fired; the link's target is now resolved before deciding whether to prune. (#​12418 by @​JamBalaya56562)

Full Changelog: jdx/mise@v2026.8.13...v2026.8.14

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.13: : Task exclusions, visible conf.d fragments, and a broad round of fixes

Compare Source

This release adds a few configuration and task features and delivers a large batch of fixes across completions, tools, lockfiles, tasks, config parsing, and shell integration. It also restores dynamic shell completions that regressed after the recent CLI parser change.

Added

• task: New task_config.excludes lets file-task discovery skip config-root-relative paths, directories, and glob patterns, so accidental TOML files (like a pyproject.toml inside a task directory) or entire subtrees are no longer treated as tasks. The closest config that sets excludes replaces inherited values, and an empty list clears the cascade. Relative task.disable_paths now resolve from the declaring config file. (#​12366 by @​jdx)

  [task_config]
  excludes = ["scripts/vendor", "**/*.generated.toml"]

• config: Project configuration can now be split into visible mise/conf.d/*.toml fragments, mirroring the existing .mise/conf.d and .config/mise/conf.d support but without a hidden dot-directory. Fragments merge alphabetically, mise/config.toml still wins over fragments, and environment-specific and .local variants (for example mise/conf.d/tools.development.toml) follow the usual env config rules. (#​12395 by @​jdx)

• bootstrap: Added --skip-dirty to mise bootstrap, mise bootstrap repos apply, and mise bootstrap repos update to warn and skip repos with local changes so the remaining repos still update. Origin mismatches and non-git targets still fail closed as before. (#​12364 by @​jdx)

Fixed

• completion: Restored dynamic shell completions that broke after the switch to usage-rs. Task names, task-specific flags, task value choices, and run= completers work again in fish and zsh, while native file/path completion still falls back correctly. (#​12376, #​12379 by @​jdx)
• env: Command-prefix and runtime environment overrides (for example VAR=override mise run ...) are no longer wiped when reconstructing the pre-mise environment in an activated shell; mise-managed values are only rolled back when the live value still matches what mise recorded. (#​12390 by @​jdx)
• env: A leading UTF-8 byte-order mark in an env file is now stripped before parsing. (#​12320 by @​JamBalaya56562)
• backend: Fixed a regression where an offline latest request failed for a tool installed only with mise install --system; the effective install directory is now recovered so system/shared-only installs satisfy latest. (#​12406 by @​jdx)
• github: When a lockfile records a checksum but no provenance, mise no longer probes the GitHub releases API at install time. This avoids hard install failures under rate limiting in high-concurrency CI, since the lockfile checksum already guarantees artifact integrity. The lockfile checksum now also takes priority over release-metadata digests. (#​12377 by @​effati)
• brew: Cask installs now recursively extract single nested archives (matching Homebrew's extract_nestedly, for example a zip containing only a DMG), and bare cask .pkg downloads are staged correctly. (#​12373, #​12371 by @​jdx)
• pipx: Non-GitHub Git latest requests now resolve to the remote default branch HEAD and are treated as a rolling channel, so outdated and upgrade detect branch movement. An unavailable configured executable is now rejected instead of failing later. (#​12407, #​12416 by @​jdx)
• lockfile: Each new version is now attributed to its own request source, so in monorepo or parent/child layouts that request the same tool at different versions, every lockfile receives its own entry instead of the first request's lockfile getting them all. Monorepo root requests are also included in lockfile maintenance. (#​12381, #​12382 by @​pikeas)
• task: Several ordering and output fixes: keep-order buffers are flushed instead of discarded, injected tasks are anchored at their parent's keep-order slot, #MISE header keys that need quoting are no longer dropped, and negative template argument bounds are rejected. Sandbox errors now name which paths do not exist yet. (#​12370, #​12397, #​12415, #​12421, #​12309)
• config: Clearer parse errors, each reported once: TOML and settings parse failures name the offending file a single time (through the logger), and a message now explains what a backslash does when a config fails to parse. Picker descriptions are truncated safely. (#​12329, #​12327, #​12330 by @​JamBalaya56562; #​12422 by @​jdx)
• generate: Generated files are now each named in output, and a task stub is named after the task rather than its file. (#​12333, #​12341 by @​JamBalaya56562)
• trust: A path that does not exist is now refused rather than trusting its parent. (#​12372 by @​JamBalaya56562)
• prune: Tracked configs that cannot be a config file are now removed. (#​12380 by @​Marukome0743)
• self-update: A failure updating plugins no longer fails the whole command. (#​12363 by @​JamBalaya56562)
• cli: On Windows, mise now defaults to an editor that exists and names the editor that failed to launch. (#​12375 by @​JamBalaya56562)
• nushell: __MISE_SESSION is now unset on deactivate. (#​12361 by @​NgoQuocViet2001)
• elvish: The prepended PATH entry is now separated correctly from the existing PATH. (#​12362 by @​NgoQuocViet2001)
• ui: Tables no longer pad the last column past its content. (#​12334 by @​JamBalaya56562)

Documentation

• security: Updated the description of paranoid mode behavior. (#​12394 by @​jdx)

Registry

• Added mr-boxington, ori, hey-cli, playwright, and ghui, and switched claude-code to aqua on Windows. (#​12384, #​12388, #​12387, #​12385, #​12386, #​12399)

Full Changelog: jdx/mise@v2026.8.12...v2026.8.13

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.12: : Cleaner diagnostics and a raft of task, config, and tool fixes

Compare Source

This release adds package uninstall support to the plugin bootstrap flow and fixes a broad set of task, config, tool, and diagnostic edge cases. Many changes turn silent failures and cryptic errors into actionable messages, so it is largely a robustness and quality-of-life release.

Added

• bootstrap: Package-plugin managers now support pruning via an optional PackageUninstall hook, so mise bootstrap packages prune --manager <plugin> is no longer Homebrew-only. mise records ownership only for packages that go from missing to installed during an install, and prune removes only owned packages that are absent from the current config and trusted tracked configs. Pre-existing and manually installed packages are never claimed, dry-run never invokes the hook, and the keep-set is reloaded after confirmation so newly declared packages cannot be removed without another prompt. (#​12332 by @​jdx)

Fixed

• config: Version-declaring files that begin with a UTF-8 byte-order mark now parse correctly. Previously a leading BOM (as written by Notepad or PowerShell's Out-File -Encoding utf8) could make .tool-versions, .node-version, package.json packageManager, registry-scraped files like Earthfile, and .sdkmanrc entries silently vanish or resolve to a corrupt version. Cached idiomatic parses written by an older mise are re-parsed so the fix takes effect on upgrade. (#​12325 by @​JamBalaya56562)
• config: Saving from mise edit (and the interactive TUI) now preserves comments — leading, trailing, and section comments are captured on parse and written back on save, instead of being stripped. (#​12319 by @​Marukome0743)
• config: An idiomatic file such as package.json that was tracked while enabled and later disabled no longer triggers a spurious "cannot update idiomatic version file" warning on read-only operations like mise ls --all-sources. The tracking entry is retained so re-enabling the tool reactivates it. (#​12194 by @​xqm32)
• cli: A cd target that cannot be entered (for example via MISE_CD pointing at a missing directory, or a directory the process cannot chdir into) is now reported with the path and OS reason instead of panicking. (#​12314 by @​JamBalaya56562)
• task: A task whose child process is killed by SIGINT (Ctrl-C reaching only the child) is now treated as an interruption, exiting 130 without failing sibling tasks, instead of reporting a spurious failure. Signalled processes now render as killed by SIGINT/killed by SIGTERM rather than "no exit status". (#​12323 by @​Marukome0743)
• task: Value-taking usage flags without a default (for example --file <file>) now stay string-typed during template rendering, so path filters like dirname work on them. Switch flags still default to booleans and count flags to integers. (#​12355 by @​jdx)
• tasks: On Windows, task files skipped because they have no known extension or shebang now explain why and give platform-appropriate guidance, instead of producing no output or a misleading "Are you in a project directory?" message. Outdated chmod +x advice is gone from Windows messages. (#​12324 by @​JamBalaya56562)
• tool-stub: Non-cached tool-stub execution now keeps the toolset's env_with_path rather than rebuilding PATH from a pristine environment, restoring project _.path directories and fixing discovery of sibling stubs. The stub-selected tool version is no longer shadowed by an outer task's install directories. (#​12322 by @​tmkx)
• watch: mise watch --clear=reset --restart no longer leaves the terminal without echo after Ctrl-C. The controlling terminal (preferring /dev/tty) is now saved and restored from a drop guard, so it recovers on normal return, errors, and cancellation, including when stdin is redirected or a second terminal is in use. (#​12328 by @​Marukome0743)
• go: go install no longer inherits a GOROOT that mise exported for a different Go, which caused compile: version ... does not match go tool version ... failures when another go was first on PATH. An explicitly configured install_env GOROOT is still honored. (#​12342 by @​Marukome0743)
• doctor: mise doctor now flags a tool whose install directory exists but is empty (for example after an interrupted download), marking it (empty) and suggesting mise install --force, instead of silently treating it as installed. (#​12321 by @​Marukome0743)
• env: When an age SSH identity cannot be used (passphrase-protected, encrypted, hardware-backed, or an unsupported key type), decryption failures now explain which identity could not be read and why, instead of the misleading "No matching keys found". (#​12339 by @​Marukome0743)
• env: The warning for an unexpanded $VAR now names the key or directive that referenced the missing variable and the config file it lives in, making it possible to find the offending line in a large [env] block. (#​12316 by @​Marukome0743)
• brew-cask: Casks already owned by Homebrew are now recognized as installed (read-only) rather than reported missing and then blocked by the ownership guard, making declarative bootstrap idempotent for Homebrew-managed casks. mise leaves such installations untouched across status, apply, use, upgrade, and prune. (#​12346 by @​donbeave)
• registry: oc (OpenShift client) now installs from channel aliases such as oc = "stable" by resolving the unversioned artifact name within the channel directory, fixing a 404. (#​12326 by @​Marukome0743)

Documentation

• tasks: PowerShell task guidance now points extensionless tasks at MISE_TASK_DIR for locating sibling files, which works consistently across Linux, macOS, and Windows without renaming the task. (#​12313 by @​JamBalaya56562)

New Contributors

• @​tmkx made their first contribution in #​12322

Full Changelog: jdx/mise@v2026.8.11...v2026.8.12

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.