jdx/mise v2026.3.6

v2026.3.6: Per-environment lockfiles, Windows fixes, and fork bomb prevention

on GitHub

This release redesigns environment-specific lockfiles for better CI isolation, fixes a critical fork bomb caused by shim recursion in go: backend tools, and addresses several Windows-specific issues including locked .exe shims and env._.source support.

Highlights

• Per-environment lockfiles replace the previous env tag system, so mise.test.toml now generates mise.test.lock instead of tagging entries in a shared mise.lock. This means CI caches are no longer invalidated by dev-only tool changes.
• Fork bomb prevention strips mise shims from dependency environment PATHs, fixing infinite process spawning when go: backend tools are configured alongside an uninstalled Go version in shims mode.
• Windows .exe shim handling gracefully renames locked shim executables instead of failing with "Access is denied" during reshim.

Changed

• Lockfiles are now per-environment -- Environment-specific configs now get their own lockfiles (mise.test.toml -> mise.test.lock, mise.local.toml -> mise.local.lock) instead of using env = ["test"] tags in a single mise.lock. This improves CI cache isolation -- environments that don't set MISE_ENV only depend on mise.lock, so dev tool version bumps won't invalidate CI caches. Old lockfiles with env fields are silently accepted and migrated on the next mise lock. #8523 by @jdx

  Config file	Lockfile
  mise.toml	mise.lock
  mise.test.toml	mise.test.lock
  mise.local.toml	mise.local.lock

• touch_outputs removed from prepare providers -- The touch_outputs configuration option has been removed from prepare providers. Freshness checking now uses blake3 content hashing exclusively, so touching output modification times is no longer necessary. #8535 by @jdx

Fixed

• Fork bomb when using go: backend tools in shims mode -- When a go: backend tool (e.g., go:github.com/pulumi/upgrade-provider) was configured alongside a Go version that wasn't installed, and the version cache was cleared, mise could enter infinite shim recursion -- the Go shim would call mise exec, which would resolve the go: backend, which would call go list via the shim, and so on. The fix strips mise's shims directory from the PATH in dependency_env, ensuring dependency tools either resolve to a real installed binary or fail cleanly. This applies to all backends that use dependency environments (go, npm, gem, dotnet, spm, elixir). #8475 by @pose

• Locked .exe shims on Windows during reshim -- mise reshim would fail with "Access is denied" on Windows when .exe shims were locked by running processes. The fix removes shims individually (instead of wiping the entire directory) and uses a rename-to-.old fallback for locked files, which Windows allows even when the file is in use. The .old files are cleaned up on the next reshim. #8517 by @davireis

• env._.source now works on Windows -- env._.source would fail on Windows because it searched for bash without the .exe extension. The Windows API executable search now correctly looks for bash.exe. #8520 by @pjeby

• GitHub @latest version resolution -- The github: backend would fail with a 404 when using @latest because it constructed /releases/tags/latest instead of using GitHub's /releases/latest API endpoint. This was a regression introduced in v2026.3.5. #8532 by @jdx

• Fish shell shim PATH ordering on re-source -- When config.fish is re-sourced (e.g., in VS Code integrated terminals), mise activate fish --shims now correctly moves shims to the front of PATH using fish_add_path --global --move, instead of silently skipping them because they were already present. Other shells are unaffected. #8534 by @jdx

• Task output prefix disambiguation -- When running the same task multiple times with different arguments (e.g., mise run greet alice ::: greet bob), output prefixes now include the arguments to distinguish runs ([greet alice] vs [greet bob]). Arguments are only included when disambiguation is needed; single-instance tasks keep clean prefixes. Long prefixes are truncated to 40 characters. #8533, #8536 by @jdx

• Non-MRI Ruby on Windows -- Requesting non-MRI Ruby engines (jruby, truffleruby, etc.) on Windows now fails early with a clear error message explaining that only standard MRI Ruby is supported via RubyInstaller2, instead of producing a confusing 404 from an invalid download URL. #8539 by @jdx

Added

• Registry: tigerbeetle -- Added tigerbeetle (github:tigerbeetle/tigerbeetle) to the tool registry. #8514 by @risu729

Breaking Changes

• Per-environment lockfiles: If you were relying on env tags within mise.lock for environment-specific version pinning, running mise lock will migrate to the new format automatically, creating separate mise.<env>.lock files. Make sure to commit the new lockfiles and update your .gitignore if needed for mise.<env>.local.lock files.
• touch_outputs removed: If you were using touch_outputs in prepare provider configuration, that field is no longer recognized. Freshness is now determined entirely by blake3 hashing of source files.

New Contributors

• @pjeby made their first contribution in #8520
• @davireis made their first contribution in #8517
• @Aurorxa made their first contribution in #8511

Full Changelog: v2026.3.5...v2026.3.6