github jdx/mise v2026.6.1
v2026.6.1: aqua multi-registry, SOPS TOML, and a GitHub backend tune-up

2 hours ago

Added

  • (aqua) Support multiple custom registries via aqua.registries; deprecates single-string aqua.registry_url (#10179 by @risu729).
  • (env) Decrypt SOPS-encrypted TOML env files (.env.toml) through rops (#10201 by @risu729).
  • (hooks) Add run_windows for Windows-specific inline hook commands (#10202 by @risu729).
  • (task) Render task_config.includes with the Tera config context and expand ~/ for local includes (#10225 by @risu729).
  • (task) Support standalone .toml task files via git:: directory includes (#10219 by @davidolrik).
  • (aqua) Extract 7z archives, including auto-detection of .7z assets (#10224 by @risu729).

Fixed

  • (env) Include the uv venv (uv.lock + .venv) in the env_cache key so VIRTUAL_ENV no longer leaks across sibling directories when env_cache=true and python.uv_venv_auto is set (#10217 by @Nagato-Yuzuru).
  • (task) Resolve dependency sources relative to each task's directory and pass per-dependency --watch paths to watchexec (#10054 by @43081j).
  • (ruby) Include resolved Ruby install options (compile mode, installer, build repo, precompiled URL, patch inputs) in lock identity (#9992 by @risu729).
  • (elixir) Resolve lockfile URL and SHA-256 from builds.hex.pm metadata; locked installs reuse the lockfile URL (#10226 by @risu729).
  • (github) Accept GitHub-canonicalized owner/repo casing when validating mise-versions release asset URLs (#10240 by @risu729).
  • (github) Detect 401 responses on cached native OAuth tokens, refresh once, and retry transparently (#10246 by @jdx).
  • (github) Warn when mise-versions GitHub metadata lookups hit rate limits or non-404 errors (#10254 by @jdx).
  • (github) Skip the versions host for non-registry github: tools (#10255 by @jdx).
  • (github) Emit logfmt-style structured fields for versions-host calls, with credentials and query stripped from URLs (#10256 by @jdx).
  • Nix flake build test failure by adding git to nativeCheckInputs (#10243 by @okuuva).

Security

  • (http) Sanitize HTTP backend version names in install symlink paths to prevent repository-controlled versions from escaping the installs directory (GHSA-f94h-j2qg-fxw3) (#10245 by @jdx).

Documentation

  • Recommend the stable Snap channel for Linux installation (#10250 by @salim-b).

Registry

💚 Sponsor mise

mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

Don't miss a new mise release

NewReleases is sending notifications on new releases.