Update dependency jdx/mise to v2026.9.1

[renovate]

This PR contains the following updates:

Package	Update	Change
jdx/mise	minor	v2026.8.14 → v2026.9.1

---

Release Notes

jdx/mise (jdx/mise)

v2026.9.1: : Bootstrap firewall limiting, scoped locked mode, and lazy tools in tasks

Compare Source

This release expands bootstrap system setup with firewall rate limiting and more systemd directives, adds a scoped locked mode for mixing distribution and user tool policies, and fixes lazy tools so they install when invoked from tasks and mise x.

Added

• bootstrap: New action = "limit" for incoming TCP firewall rules rate-limits connections per source. It maps to UFW's native limiting and bounded per-source IPv4/IPv6 nftables meters; firewalld fails closed since it cannot express safe per-source limiting. Limit rules are treated as preserving SSH access by the lockout guard. (#​12669 by @​jdx)

• bootstrap: Bootstrap systemd units now support requires (Requires=), repeatable environment_file (EnvironmentFile=), nice, and umask, with validation for nice ranges (-20 to 19) and octal umasks. Note that requires does not imply ordering; use after for that. (#​12683 by @​jdx)

• config: New global-only locked_scopes setting (also MISE_LOCKED_SCOPES) lets you scope locked mode to specific config sources, so a distribution can ship rolling or lazy tools through /etc/mise/config.toml without forcing users to maintain a system lockfile. Defaults to all three scopes to preserve existing behavior. (#​12667 by @​jdx)

  [settings]
  locked_scopes = ["project", "global"]

Fixed

• task: Lazy tools (lazy = true) now install when their command is invoked from a mise run task or mise x, matching the behavior of an activated shell. mise inserts the shim farms after real tool paths for lazy toolsets and reconciles missing bootstrap shims for hand-edited declarations, so tasks no longer fail with command: not found. (#​12687 by @​jdx)
• env: Environment variables configured for removal (false values and unset directives) are now consistently unset across mise exec, tasks, mise env, hook-env, deps, and tool stubs, so inherited or secret variables are no longer leaked back into child processes. (#​12664 by @​jdx)
• shim: mise reshim can now safely target shared executable directories like ~/.local/bin or /usr/local/bin. It identifies mise-owned shims and only replaces or prunes those, leaving unmanaged files and symlinks in place, and --force rebuilds mise-owned shims rather than wiping the whole directory. (#​12675 by @​jdx)
• brew-cask: Cask binaries that reference their surrounding extracted payload now keep that payload beside the staged binary, so tools like codex that exec helpers or read manifests from their own tree continue working after temporary install files are cleaned up. (#​12686 by @​azohra)
• upgrade: Fixed recursive deferred tool pruning that could hang new terminals when prompt hooks triggered a full tracked-config scan. Deferred cleanup now takes a non-blocking lock and is skipped for shell-integration and --no-config commands. (#​12676 by @​jdx)
• install: Install failures caused by a missing marker file now name the affected file and operation instead of reporting a bare OS error. (#​12624 by @​JamBalaya56562)
• install: mise install --dry-run for an s3 tool that only declares a URL for another platform now reports the missing platform and available options instead of falsely claiming it would install. (#​12641 by @​hktitof)

Changed

• registry: Registry command (shim) names are now inferred from the preferred Aqua package at build time, removing redundant bins declarations from hundreds of registry entries. Explicit bins are kept only where mise intentionally exposes a different command set, and mise registry --json exposes the inferred names. (#​12668 by @​jdx)

New Contributors

• @​azohra made their first contribution in #​12686
• @​hktitof made their first contribution in #​12641

Full Changelog: jdx/mise@v2026.9.0...v2026.9.1

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.9.0: : Lazy Tool Shims

Compare Source

This release introduces lazy tool shims, which install a tool automatically the first time one of its commands is invoked, plus an opt-in Erlang precompiled OS override and a fix for nested mise calls during postinstall hooks.

Added

• tools: Declare a tool as lazy in [tools] with lazy = true and mise generates bootstrap shims into its normal user/system shim farms. The provider is installed only when one of its commands is first called, then executes immediately; subsequent calls run the real binary without another mise dispatch. Registry tools derive their command names from registry bins, while explicit or non-registry backends declare them with lazy_bins. A bare mise install skips lazy declarations; use mise install --include-lazy to provision them all. New global path settings (shims_dir/MISE_SHIMS_DIR, system_installs_dir/MISE_SYSTEM_INSTALLS_DIR, system_shims_dir/MISE_SYSTEM_SHIMS_DIR) and mise reshim --system support system-scoped and collocated layouts. (#​12594 by @​jdx)

  [tools]
  node = { version = "24", lazy = true }
  "github:example/acme" = { version = "1.2.3", lazy = true, lazy_bins = ["acme", "acmectl"] }

• erlang: New erlang.precompiled_os setting (and MISE_ERLANG_PRECOMPILED_OS) opts into a specific Bob Ubuntu build target—including Ubuntu 26.04—on compatible glibc distributions. Automatic target detection is unchanged, and lockfiles now preserve the selected OS for reproducible builds. Note the portability constraints around shared-library SONAMEs documented with the setting. (#​12637 by @​jdx)

Fixed

• install: Postinstall hooks now activate the exact tool version being installed, so nested mise invocations (such as mise which or mise ls) resolve that version instead of an older discoverable one—or losing the tool entirely when it was declared through a custom config path with mise use --path. (#​12635 by @​jdx)

Registry

• Added engram (#​12480 by @​AndryOre)
• Added gentle-ai (aqua:Gentleman-Programming/gentle-ai) (#​12444 by @​AndryOre)

New Contributors

• @​AndryOre made their first contribution in #​12444

Full Changelog: jdx/mise@v2026.8.16...v2026.9.0

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.16

Compare Source

v2026.8.15: : Dotfiles diff and capture, scoped config updates, and per-tool postinstall hooks

Compare Source

This release expands the dotfiles/bootstrap workflow with previews, bulk capture, git-tracked manifests, and profile reconciliation, adds scoped config collection updates and per-tool postinstall hooks, and rounds it out with a large batch of fixes across tasks, schema validation, Windows, lockfiles, and shims.

Highlights

• Dotfiles management grows a full preview-and-capture workflow: mise bootstrap dotfiles diff, bulk add --changed, git-tracked directory manifests, and automatic reconciliation when a profile switches a target's source.
• mise config set learns idempotent list updates (--append/--remove) and explicit --global/--system targeting, and mise use gains per-tool --postinstall hooks.
• Safer upgrades: replaced tool versions now linger for a grace period instead of being deleted immediately, so a bad upgrade is easier to recover from.

Added

• dotfiles: New mise bootstrap dotfiles diff previews exactly what apply would change without writing anything, printing unified content patches for copy, template, and inline entries and structural summaries for symlinks and directories. Optional target filters use the same selection semantics as apply. (#​12511 by @​jdx)

• dotfiles: mise bootstrap dotfiles add --changed captures every drifted copy-mode target back into its source in one command, without naming each path. Directory copies, symlinks, templates, and inline content are skipped, and untrusted configs are blocked. (#​12512 by @​jdx)

• dotfiles: Directory copy and symlink-each entries can now set manifest = "git" to manage only paths returned by git ls-files, so a dotfiles repo that gitignores everything and force-adds selected paths no longer traverses (or links) ignored home-directory content. Links are removed when a file drops out of the index. (#​12523 by @​jdx)

• dotfiles: symlink-each apply now reconciles stale links when a profile change (for example toggling MISE_ENV between home and work) points a target at a different source. Only links still pointing at the previously recorded source are removed; unmanaged paths and paths desired by another active source are left alone, and dry-run previews the removals. (#​12524 by @​jdx)

• bootstrap: mise bootstrap --from <git-url> clones a setup/dotfiles repo (into $MISE_DATA_DIR/bootstrap-repo by default, or --from-dir), then runs bootstrap from that checkout. Existing checkouts are reused when the origin matches, --update fast-forwards them, and --dry-run only prints the planned git clone/git pull. (#​12525 by @​jdx)

• use: mise use --postinstall <COMMAND> attaches a per-tool post-install hook that runs only when that tool is installed or reinstalled. Repeat the flag before each tool to give each its own hook. (#​12609 by @​jdx)

  mise use --postinstall "mbx setup --defaults" mr-boxington

• config: mise config set gains --append and --remove for list-like keys (append without duplicates, remove matching entries, promote scalars to arrays as needed) while preserving TOML comments and formatting, plus explicit --global/--system targeting for config get/set. Tool postinstall hooks now also receive MISE_CONFIG_FILE, MISE_GLOBAL_CONFIG_FILE, MISE_CONFIG_ROOT, and MISE_PROJECT_ROOT. (#​12603 by @​jdx)

• config: Templates can now reference config_source, the absolute path of the config file the template lives in (not resolved through symlinks). This lets a shared config symlinked into conf.d add its own real directory to PATH, for example {{ config_source | canonicalize | dirname }}/bin. Available in mise.toml, .tool-versions, [env] directives, and [settings.age]. (#​12454 by @​Marukome0743)

• task: task_source_files(only_changed=true) returns only the sources written since the task last succeeded, so linters and formatters can run against just what changed. A failed run keeps its files outstanding until the task passes. (#​12470 by @​Marukome0743)

• outdated: mise outdated --json now includes a release_url field pointing at the release page for the offered version (from the versions host, aqua, GitHub/GitLab, or the rust core plugin). The key is omitted rather than null when no page is available. (#​12494 by @​Marukome0743)

Changed

• upgrade: mise upgrade no longer deletes the replaced install immediately. When upgrade.auto_prune is on, the old version stays on disk and is scheduled for removal after upgrade.prune_after (default 24h), cleaned up opportunistically on later runs. --prune still removes immediately and --no-prune keeps the old tree with no scheduled cleanup. mise ls surfaces deferred removals. (#​12593 by @​jdx)

Fixed

• env,tasks: .env files written as UTF-16 (the default from Windows PowerShell 5.1's > and Out-File) are now decoded and loaded instead of being silently dropped, and a UTF-16 task file now gets a clear hint to save it as UTF-8. (#​12507 by @​JamBalaya56562)
• install: mise install --dry-run no longer claims it would install a tool that cannot actually be installed on this platform. (#​12568 by @​JamBalaya56562)
• exec: mise exec now reports clearly when a requested tool is not available on the current platform. (#​12547 by @​JamBalaya56562)
• config: Request-specific tool options are preserved rather than dropped during config merges. (#​12060 by @​risu729)
• config: A bare tool_alias value is now resolved through the registry. (#​12506 by @​Marukome0743)
• config: Minimum-release-age exclusions from multiple configs are merged instead of overwritten. (#​12460 by @​jdx)
• lockfile: Version ties are broken correctly when a legacy lockfile answers latest, and links belonging to other backends are ignored. (#​12583, #​12605 by @​Marukome0743, @​jdx)
• monorepo: Idiomatic version files are resolved from the task's own config root. (#​12565 by @​kaii-zen)
• task: Several ordering fixes so injected and dependency tasks keep their intended slots, tasks that link back into themselves are skipped, and taskkill output is suppressed on Windows. (#​12450, #​12466, #​12482, #​12510, #​12563 by @​Marukome0743, @​jrandolf, @​JamBalaya56562, @​sortA0329)
• shims/generate: Arguments are now delivered intact for file-mode shims and Windows launchers, and mise generate explains when a --mise-bin path has no Windows launcher. Non-executable system fallbacks are skipped. (#​12502, #​12463, #​12496, #​12545 by @​JamBalaya56562, @​jdx)
• http: Raw binaries are copied on Windows where a junction cannot name a file, and a download that fails because the path is too long now explains itself. (#​12465, #​12550 by @​Marukome0743, @​JamBalaya56562)
• link/file: Links whose target no longer exists can now be shown and removed. (#​12468, #​12469 by @​JamBalaya56562)
• trust: The ignore list is now read by what its entries point at, matching how trust links are stored. (#​12428 by @​JamBalaya56562)
• watch: The terminal is restored when the watched process is signalled. (#​12451 by @​Marukome0743)
• activate: The pwsh deactivation preamble no longer pollutes $Error. (#​12483 by @​JamBalaya56562)
• backend: Rolling updates behind a versions host are now detected. (#​12440 by @​jdx)
• github: Stale cached attestations are retried. (#​12495 by @​jdx)
• ls-remote: Recorded listing errors now cause a failure instead of returning stale/empty results. (#​12551 by @​jdx)
• npm: Dangling aube-backed tool installs are repaired. (#​12570 by @​jdx)
• bootstrap: Brew cask dependencies are preserved during prune. (#​12461 by @​jdx)
• azure: The CLI now includes pip for extension support. (#​12555 by @​esteve)
• registry: Windows/arm64 can fall back to x64 backends, as aqua already does. (#​12560 by @​JamBalaya56562)
• doctor: The self-update leftover check is gated so it does not fire for installs that manage updates elsewhere. (#​12438 by @​salim-b)
• schema: Several JSON schema corrections so registry, plugin, tool-option, and settings definitions match what the build consumers actually accept. (#​12514, #​12515, #​12520, #​12522, #​12527 by @​risu729)

Performance

• brew: Homebrew bootstrap bottles are now downloaded concurrently (bounded by MISE_JOBS), while pouring, source builds, and prefix linking stay in dependency order. (#​12604 by @​jdx)

Registry

New tools: pkgx, onefetch, syncthing, ols, spin-framework, cursor-agent, 7zip, mosh, pastel, broot, exiftool, spotify-player, yt-dlp-nightly, and cliamp. magika and sbt now install from their GitHub releases, and pre-commit uses the pipx backend on Windows. Various dependency and OS-limit cleanups were also applied. (#​12272, #​12437, #​12448, #​12484, #​12485, #​12478, #​12486, #​12532, #​12535, #​12533, #​12538, #​12539, #​12542, #​12581, #​12553, #​12567, #​12549)

New Contributors

• @​sortA0329 made their first contribution in #​12563
• @​seuros made their first contribution in #​12519
• @​pb3975 made their first contribution in #​12478
• @​ThorstenHans made their first contribution in #​12485

Full Changelog: jdx/mise@v2026.8.14...v2026.8.15

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.