jdx/mise v2026.10.11

v2026.10.11: Public GitHub metadata now comes from mise-versions instead of api.github.com

on GitHub

In this release, most everyday commands stop calling api.github.com. mise install, exec, shims, outdated, lock, self-update and attestation checks now read GitHub release data, tags and attestations from mise-versions, so users without a GitHub token no longer hit the 60-requests-an-hour limit. It also adds mise bootstrap --upgrade and mise env --paths, and closes a trust gap in remote task files.

Security

• Remote task files now need trust before their headers render. A mise.toml with only [tasks] loads without trust. Before this fix, if one of those tasks set file to a remote URL, mise tasks ls, mise tasks info and mise tasks validate rendered the file's #MISE headers, so a template like {{ exec(...) }} ran without a trust prompt. Remote files now follow the same rule as local task includes: if the headers contain template syntax, the config that references them must be trusted first. Remote files with plain headers still list without trust, and braces in the script body need no trust. #14416 (@JamBalaya56562, @risu729)
• Updated rustls to 0.23.46 to address a RustSec advisory. #14434

Added

• mise bootstrap --upgrade installs what is missing and then upgrades what is already installed, in a single run. In the packages phase it runs the same upgrade as mise bootstrap packages upgrade, and pins are respected. In the tools phase it runs mise upgrade without --bump, so configured version ranges hold. Both run before the matching post hooks and dependent services. --dry-run previews both steps and --skip works as before. It does not update mise itself, repositories or images, and it does not restart services. #14433

  mise self-update --yes && mise bootstrap --upgrade

• mise env --paths prints the PATH entries mise manages, one per line and in PATH order: tool bin directories, _.path entries, and inherited directories that mise moves forward, such as ~/.cargo/bin. This lets CI integrations export only mise's additions without diffing PATH. #14429

  $ mise env --paths
  /home/me/.local/share/mise/installs/node/24.11.0/bin
  /home/me/.cargo/bin

• The install script downloads pinned versions from mise.jdx.dev. curl https://mise.run | MISE_VERSION=<version> sh now tries mise.jdx.dev first and falls back to GitHub Releases if that download fails. Checksums for pinned versions still come only from GitHub's SHASUMS256.txt. If no checksum is found, the script refuses to install. MISE_INSTALL_FROM_GITHUB=1 still uses GitHub only. #14446

• Registry: gdal installs the GDAL/OGR command-line tools from conda-forge (conda:libgdal-core). #14440 (@ivan-ivkovic)

Changed

• mise-versions is now the only source for public GitHub metadata when use_versions_host is on (the default). This covers release lists, latest, git tags (aqua github_tag packages, ubi and go), artifact attestations (including aqua's predicate_type filters), and the digest in the checksum-mismatch hint. When a mise-versions request fails, mise now reports an error that names use_versions_host = false as the way out, instead of silently retrying against api.github.com. GitHub is still asked directly for repositories mise-versions doesn't list, when you have a token (the private-repository case), and in paranoid mode for attestations. The direct API is also still used with use_versions_host = false, GitHub url_replacements and custom api_urls. #14460, #14461, #14469, #14481, #14477, #14443
• Other requests also moved off the GitHub API:
  • mise x, mise exec, shims and hook-env use mise-versions when they auto-install a tool. #14458
  • mise self-update reads mise's releases from mise-versions and downloads the archive from github.com release downloads. Packslip and zipsign verification are unchanged. #14464
  • mise lock downloads artifacts for provenance checks from github.com instead of the API asset endpoint. #14465
  • Aqua registries hosted on GitHub are fetched from raw.githubusercontent.com. #14470
  • Ruby looks up the latest ruby-build release through mise-versions. #14471
• Fewer version-list fetches. mise install, use and run now reuse a cached version list for the tool's minimum_release_age window minus one hour, clamped to 1–24h. With the default 24h cutoff, that is 23h. outdated, upgrade, ls-remote, lock and latest still refresh after 1h. If you set fetch_remote_versions_cache yourself, your value applies to every command. #14484, #14485, #14457
• Faster version resolution:
  • Multi-tool commands such as mise outdated can resolve many registry tools with one request to the mise-versions index. #14473
  • latest is resolved without refetching the list. #14456
  • Explicit backend args such as aqua:jqlang/jq reuse the registry tool's version list. #14459
  • Release tags come from the versions host instead of being listed or guessed. #14442
  • Packslip installs no longer re-download what resolution already verified. #14466
  • Install tracking and the Python version list are served from static assets. #14441
• Python version listing no longer clones pyenv. mise ls-remote python, outdated, upgrade and fuzzy mise use python@3.12 read the python-build definitions from mise-versions. A cold listing took about 2.4s before and about 130ms now. pyenv is still cloned when mise compiles Python, when python.pyenv_repo points at a fork, when you're offline, or when use_versions_host = false. Some definitions that had no date before now have one, so they are held back by minimum_release_age until they are old enough. #14455
• mise oci build now requires root for apt: packages, as it already did for apk, and fails up front with a clear message. If apt-get still fails, the error now includes the last lines of dpkg's output. #14447
• Registry: native-sdk now installs from npm (@native-sdk/cli), so the native command works. It requires Node 24+. #14431

Fixed

• A bare mise upgrade no longer installs lazy tools that have never been installed. Naming the tool still installs it. A lazy tool that already has a version installed upgrades as before. A missing lazy tool is still installed if an upgraded tool depends on it. mise outdated now marks these tools as [MISSING] (lazy), and the bare upgrade no longer looks up their versions. #14422 (@ryanrhughes), #14444
• Fixed false stack limit reached errors on the static musl builds, for example on Ubuntu 26.04. These errors broke aqua version_filter parsing and made shims such as kubectl's report "not a valid shim". #14450
• mise lock --platform ... run on Alpine or NixOS no longer records Node source builds for other platforms. Only an explicit node.compile or all_compile = true forces source builds for those targets. #14432
• mise upgrade --bump and hand-edited version pins no longer drop a pipx tool's locked uv dependency graph. Before, mise install --locked then failed on a fresh checkout. #14426 (@wislertt)
• Packslip prefixes such as fnox@1 now skip releases this host can't install, the same way latest does. Each skipped release gets a warning, and if no match can be installed, mise reports a clear error. #14467
• A bash shim ahead of /bin no longer causes a false "shim fallback recursion detected" error for commands like bash -c 'bash --version'. The docs now recommend installing shells with the system package manager instead of [tools]. #14475
• Bootstrap UFW rules with an interface now render the incoming direction (ufw allow in on tailscale0 ...), which fixes Invalid token 'on' errors. #14480
• Dotfiles:
  • Before the files: apply prompt, mise now lists each file it will create, overwrite or remove and warns that local edits will be replaced. The prompt now defaults to No. #14430
  • mise dot add --changed now also captures edited files that a copy-mode dotfile_groups root discovers automatically, not just files listed explicitly in entries. #14436

Documentation

• The docs now recommend committing mise.lock, so CI and Docker builds skip version lookups. #14453

New Contributors

• @ivan-ivkovic made their first contribution in #14440

Full Changelog: v2026.10.10...v2026.10.11

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.