Update dependency jdx/mise to v2026.8.10

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise	uses-with	patch	2026.8.8 → 2026.8.10	v2026.8.12 (+1)

---

Release Notes

jdx/mise (jdx/mise)

v2026.8.10: : Remote bootstrap environments and asset-matching fixes

Compare Source

This release lets remote bootstrap pick which config environments run on each target, fixes several tool-installation edge cases (archive naming, Windows ZIP preference, renamed aqua packages, Homebrew cask metadata), and hardens pacman package detection and Windows self-update cleanup.

Added

• bootstrap: Remote bootstrap can now select which mise.<env>.toml layers load on each SSH target without inheriting the orchestrator's full environment. Set a default with [bootstrap.remote].mise_env, override per host in your inventory, or pass --remote-env (repeatable or comma-separated) on the command line. (#​12182 by @​jdx)

  [bootstrap.remote]
  mise_env = ["production"]

• bootstrap: Independent config roots can now contribute symlink-each trees that share the same target directory, as long as their leaf paths are disjoint. Overlapping leaves and file/directory collisions still fail before any changes, reporting both declaring config origins. (#​12190 by @​jdx)

• doctor: mise doctor now detects leftover Windows self-update helper files (__relocated__ / __selfdelete__ copies in TEMP) and reports their count and total size, noting that a subsequent mise self-update removes them. (#​12205 by @​JamBalaya56562)

Fixed

• system (pacman): Arch packages satisfied by an installed provider through Provides are no longer reported as missing. mise now uses pacman -T to distinguish genuinely missing packages, recovers the provider's version for status, and skips provider-satisfied aliases during targeted upgrades so pacman does not try to replace the provider. (#​12183 by @​jdx)
• registry (aqua): Twelve aqua: backends (including d2, typstyle, gitui, gradle, ktlint, kubeseal, and velero) now point at their renamed, canonical package ids, so they install even in networks where api.github.com is unreachable. A regression test prevents this drift from returning. (#​12186 by @​kkom)
• registry (azure-cli): On Windows x64, azure-cli now installs from the official bundled-Python ZIP release instead of PyPI, fixing az failing with 'python' is not recognized or No module named 'azure'. Linux and macOS continue to use the existing pipx install. (#​12161 by @​JamBalaya56562)
• brew: Homebrew cask metadata now deserializes when the API sends "auto_updates": null, treating it as the default false. This was breaking metadata fetches for the majority of current casks. (#​12192 by @​jdx)
• backend: Restored the strict preference for Windows ZIP archives over all tarball formats (tar.zst > tar.xz > other), which a prior change had accidentally reduced to a tiebreak. (#​12200 by @​risu729)
• backend: Shorthand archive extensions like .tbz and .tbz2 are now normalized correctly when matching preferred asset names and stem-only checksums, including mixed-case suffixes. This prevents assets from losing the preferred-name bonus and selecting the wrong archive. (#​12199 by @​risu729)
• sync: External-provider link reconciliation no longer removes links owned by another source or races with concurrent installs. Managed installs, runtime aliases, and links from unselected providers are preserved, and stale dangling links are correctly replaced with the winning provider's install. (#​11682 by @​risu729)
• self-update: On Windows, stale helper copies in TEMP are now swept before the TEMP-length check, so cleanup still runs on the long-TEMP machines that need it most. (#​12205 by @​JamBalaya56562)

Performance

• cache: Foreground blob lookups during rustc cache restores are now batched into a single blob-pack request when the remote supports it, instead of one request per digest, with response metadata validated and a safe fallback to individual blob GETs. (#​12191, #​12193 by @​jdx)

Documentation

• Fixed mobile table rendering and banner overlays on the docs site. (#​12184 by @​jdx)
• Clarified the registry-addition popularity bar and used neutral config-file wording in trust help. (#​12208, #​12210 by @​jdx, @​risu729)

New Contributors

• @​kkom made their first contribution in #​12186

Full Changelog: jdx/mise@v2026.8.9...v2026.8.10

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.8.9: : Composable Bootstrap, Environment-Aware conf.d, and Faster Startup

Compare Source

This release expands declarative bootstrap into a composable, multi-root system; adds environment-specific conf.d fragments and glob-based ignored config paths; smooths out shell activation so runtime overrides stick; and delivers major startup performance gains for vfox-backed setups. It also includes several security hardening fixes worth noting.

Highlights

• Bootstrap can now compose declarative resources (dotfiles, files, directories, services, and Compose projects) from multiple independent config roots, with provenance tracking and clear conflict diagnostics.
• Startup is dramatically faster on machines with vfox plugins: idiomatic file detection is now gated on opt-in, and vfox plugin metadata is cached on disk, cutting common invocations from hundreds of milliseconds to single digits.
• Security hardening: forge tokens no longer leak to third-party hosts, and safe mode now blocks tool-level install hooks.

Added

• bootstrap: Compose declarative resources from multiple independent config roots via [bootstrap].config_roots. Selected roots contribute [dotfiles], [bootstrap.files], [bootstrap.directories], [bootstrap.services], and [bootstrap.compose] without gaining precedence from list or glob order; identical declarations are deduplicated and conflicting declarations fail with both origins reported. (#​12105, #​12132 by @​jdx)

  [bootstrap]
  config_roots = ["bundles/*"]

• bootstrap: Declaration provenance is now retained and exposed for dotfiles and managed files/directories. mise bootstrap plan, bootstrap status, and mise dotfiles status include origin details (declaring config, config root, environment, resolved source) in JSON, and human-readable tables gain a Config column. (#​12100 by @​jdx)

• bootstrap: Homebrew-compatible support for self-updating and adopted casks in [bootstrap.packages]. Casks declaring auto_updates: true are left to update themselves, and existing app bundles can be adopted globally with [bootstrap.brew].adopt = true or per cask with adopt = true. (#​12074 by @​ascarter)

• bootstrap: Remote bootstrap gains symlink materialization controls. Use --copy-link <PATH> (repeatable) to dereference selected source-relative symlinks or --copy-links to recursively dereference all archived symlinks; both are also configurable in [bootstrap.remote] and per-host. Default behavior is unchanged (links stay links). (#​12121 by @​jdx)

• config: Environment-specific conf.d fragments. Files like .mise/conf.d/*.{env}.toml (and .local variants) load only when that config environment is active, applying to project, global, and system conf.d directories. (#​12151 by @​jdx)

• config: ignored_config_paths now supports relative entries and glob patterns (including recursive **). Entries in .miserc.toml resolve against the declaring file, while MISE_IGNORED_CONFIG_PATHS resolves against the invocation directory — making it easy to exclude vendored repos portably. (#​12169 by @​jdx)

• config: mise run, naked mise <task>, mise install, mise exec, and mise watch now implicitly trust and persist the active config in normal mode, avoiding a redundant prompt. Automatic hook-env/inspection commands still require explicit trust, and paranoid and safe modes are unchanged. (#​12107 by @​jdx)

• system: Plugins can declare an ordered list of candidate package names per package manager in systemDependencies, so the same capability can be expressed across distro renames (for example apt = { "libaio1t64", "libaio1" }). mise resolves the first available candidate. (#​12149 by @​jdx)

• vfox: Traditional vfox plugins can now read configured [tools] options from ctx.options in PreInstall and PostInstall hooks, with scalars as strings and arrays/tables as structured Lua values. Existing hook environment variables continue to work. (#​12174 by @​jdx)

Fixed

• hook-env: Runtime environment overrides now persist between refreshes. Changes made with export, shell aliases, sourced scripts, or direct PATH edits are no longer reverted on every prompt, reversing the continuous enforcement introduced in 2026.8.0. (#​12094 by @​jdx)
• aqua: Prefer glibc release assets on unqualified glibc Linux targets, falling back to a musl asset only when no glibc sibling exists. Explicit libc selections stay strict. (#​12093 by @​jdx)
• python: Automatic venv creation now resolves the configured uv even when invoked through a tool override (for example mise x tiny@3), so python.uv_venv_auto no longer reports uv as missing right after mise installs it. (#​12177 by @​jdx)
• which: mise which <bin> --tool=<tool>@<version> now reports that the requested version is not installed (with an install hint) instead of the misleading "not currently active" message. (#​12106 by @​TrevorBurnham)
• shell: The pwsh command-not-found hook now branches on the command exit code and skips mise's own commands, and the environment is refreshed on auto-install when --no-hook-env omits the hook. (#​12089, #​12131, #​12117 by @​JamBalaya56562)
• bootstrap: Create missing parent directories when bootstrapping. (#​12096 by @​jdx)
• github: Match arm assets on arm64 hosts. (#​12098 by @​jdx)
• use: Scope global install hooks correctly. (#​12101 by @​jdx)
• task: Support Azure DevOps cloud SSH URLs as remote git task sources, and normalize Windows task environment paths. (#​12102 by @​cheesemans, #​12173 by @​jdx)
• system: Resolve dependency executables on Windows. (#​12178 by @​jdx)
• backend: Keep flavour queries from crossing a +, and key the remote version cache by listing tool options. (#​12118 by @​Marukome0743, #​12164 by @​JamBalaya56562)
• http: Order remote versions consistently. (#​12170 by @​jdx)
• vfox: Follow symlinks when fingerprinting plugin sources, honor systemDependencies in embedded plugins, and apply netrc credentials to HTTP requests. (#​12155, #​12152, #​12168 by @​jdx)
• Asset selection now handles non-gz tar variants. (#​12156 by @​sgammon)

Changed

• backend: Removed the remaining legacy RTX_* environment variables (including RTX_TOOL_OPTS__* and RTX_ADD_PATH) passed to asdf and vfox plugin hooks. Plugin authors should use the equivalent MISE_* variables; standard ASDF_* variables remain available to asdf plugins. (#​12172 by @​jdx)

Performance

• config: Idiomatic version file detection is now gated on idiomatic_version_file_enable_tools, so mise no longer boots a Lua VM for every vfox plugin on ordinary invocations. Common commands dropped from hundreds of milliseconds to single-digit milliseconds, and nested mise run/mise x chains improved dramatically. (#​12143 by @​jdx)
• vfox: Filesystem plugin metadata (idiomatic filenames, dependencies, system dependencies) is now cached on disk and invalidated by plugin file changes, avoiding repeated Lua execution. (#​12145 by @​jdx)
• activate: pwsh no longer runs hook-env twice per directory change. (#​12147 by @​jdx)
• cache: Batch remote blob prefetch. (#​12103 by @​jdx)

Security

• backend: GitLab and Forgejo authentication headers are now bound to the configured API origin, preventing tokens from leaking to third-party release asset hosts or cross-origin pagination URLs. (#​12167 by @​jdx)
• Safe mode (MISE_SAFE=1) now blocks tool-level postinstall hooks and install_env from running during installation. (#​12140 by @​jdx)

Registry

• Added workerd via github:cloudflare/workerd. (#​12180 by @​mikea)
• Pointed vlang at the maintained vfox:jdx/vfox-v backend so it shares versions with v, replacing an unmaintained third-party version source. (#​12153 by @​jdx)

Breaking Changes

• conf.d filenames: A conf.d fragment with an extra dot before .toml (for example node.tools.toml) is now interpreted as environment-specific. Use hyphens for unconditional multi-word fragment names (for example node-tools.toml). (#​12151)
• vlang versions: Configs pinning vlang = "2026.x"-style versions must move to a real upstream version such as 0.5.2 or a weekly.* tag, since the previous version strings did not correspond to upstream tags. (#​12153)
• *RTX_ variables:** Plugins relying on legacy RTX_* variables must switch to MISE_*. (#​12172)

New Contributors

• @​sgammon made their first contribution in #​12156
• @​ascarter made their first contribution in #​12074
• @​TrevorBurnham made their first contribution in #​12106

Full Changelog: jdx/mise@v2026.8.8...v2026.8.9

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.