jdx/mise v2026.5.8

v2026.5.8: Patrons, cleaner task output, and sigstore-rust

on GitHub

A small release: a new mise patrons command, cleaner task command output when scripts start with a shebang, and a fix for mise upgrade summaries getting wiped by progress cleanup. Under the hood, signature verification moves to the modern sigstore-rust stack.

Added

• (patrons) New mise patrons subcommand lists individuals on the Patron tier supporting mise development (#9841) by @jdx. Data is fetched from the en.dev patrons feed, cached for 24h, and falls back to stale cache on network failure. Each patron's name renders as a clickable OSC 8 hyperlink in supporting terminals.

  $ mise patrons
  mise is supported by these patrons — thank you
  
    • Ronald Gierlach
    • youfoundron
  
  Become a patron: https://en.dev/sponsor
  

  Flags: -J/--json, --refresh.

• (registry) Add a racket shorthand backed by the aqua racket/racket/minimal package, exposing both racket and raco from the official racket-lang.org release artifacts (#9784) by @albertnetymk.

Fixed

• (task) When a task's run body starts with #!/usr/bin/env bash or set -Eeuo pipefail, the echoed command line would show only that boilerplate and hide the rest of the script. Leading shebang, blank, and set ... lines are now skipped when building the displayed command, so the first real command shows up. Execution is unchanged (#9844) by @jdx. Fixes #9842.

  # before
  [generate-completions] $ #!/usr/bin/env bash
  
  # after
  [generate-completions] $ fzf --fish > ~/.config/fish/completions/fzf.fish
  

• (upgrade) mise upgrade could erase its own Upgraded N tools: summary detail lines when an upgrade also performed an uninstall — fresh progress jobs registered for the cleanup phase were still active at shutdown, so stop_clear() wiped them along with the summary. Progress jobs are now finished and reset before the summary prints (#9860) by @risu729. Regression from #9779; addresses #9856.

Changed

• (security) Sigstore verification (verify_github_attestation, verify_cosign_signature, verify_slsa_provenance, detect_attestations) now runs on a local mise-sigstore adapter built on sigstore-verify 0.7 from sigstore-rust, replacing the previous sigstore-verification 0.2 dependency (#9260) by @jdx. The mise call sites and helper API are unchanged. The new adapter still covers legacy cosign v1 bundles (e.g. goreleaser-signed releases) and raw DSSE *.intoto.jsonl envelopes (slsa-github-generator) that the upstream Bundle::from_json rejects.

Deprecated

• (config) The top-level env_file setting (and MISE_ENV_FILE) is now marked deprecated. Use env._.file in mise.toml instead (#9862) by @risu729. The JSON Schema gains the deprecated keyword, a warning is scheduled for 2026.11.0, and removal is planned for 2027.11.0.

  # before
  env_file = ".env"
  
  # after
  [env]
  _.file = ".env"

New Contributors

• @albertnetymk made their first contribution in #9784

Full Changelog: v2026.5.7...v2026.5.8

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.