jdx/mise v2026.9.8

v2026.9.8: Top-level `mise dot` command, faster brew bootstrap installs, and npm safety-check fixes

on GitHub

Dotfile management moves to the top level as mise dot, Homebrew bootstrap installs run their download, extraction, and linking stages concurrently, and several install paths are corrected: embedded aube reputation gates now report the real reason and honor --yes, PyPI tools fall back to version-only installs when a dependency graph cannot be built, lazy tools no longer trigger missing: warnings, and lockfiles no longer resurrect disabled backends.

Added

• dotfiles: The full dotfiles command tree is now available as mise dotfiles, with mise dot as a short alias. mise bootstrap dotfiles remains supported and all three spellings share the same behavior, including bootstrap hooks around apply. Generated history-watch services now invoke mise dot watch. (#13158 by @jdx)

  mise dot track ~/.zshrc
  mise dot status
  mise dot history

• dotfiles: Enabling encryption on a file that was previously saved in plaintext left older commits that blocked sync. mise dot sync --allow-plaintext-history lets that history reach the origin for one run, and the global-only setting settings.history.allow_plaintext_history = true (default false, env MISE_HISTORY_ALLOW_PLAINTEXT_HISTORY) does the same for sync, publish, the history watcher, and incoming history on pull. New saves still follow the file's encryption policy; the history guide also documents how to remove the old commits instead. (#13175 by @jdx)

• registry: Added poppler (conda:poppler), providing pdftotext, pdfinfo, pdftoppm, pdftocairo, pdfunite, and the other Poppler PDF utilities. (#13133 by @i-api)

Fixed

• npm: Embedded aube reputation gates (low weekly downloads, similar-name, new package name) no longer surface as a misleading user aborted mise add error when stdin is closed or no terminal is attached. Non-interactive installs now report the measured signal (for example 569 weekly downloads against the 1000 threshold) and suggest the mise-native fix, allow_low_downloads = true on the tool; an explicit "no" reports user declined to add <package>. An explicit CLI --yes now reaches the aube prompt and approves it, including auto-installs through use, exec, run, shell, and upgrade; CI mode and a configured yes = true setting alone do not approve reputation gates. (#13123 by @jdx)
• pypi: Ordinary mise install of pypi:/pipx: tools no longer fails when a uv dependency graph cannot represent the package or its configuration, such as a source-only dependency or free-form uvx_args/pipx_args. mise warns and falls back to the version-only install path, reusing an existing version-only installation on later runs. mise lock and mise install --locked remain strict and still reject unsupported arguments or dependencies without usable wheels. (#13170 by @jdx)
• Tools declared with lazy = true are no longer reported as missing: <tool> when entering a project or running a bare mise install, regardless of status.missing_tools; ordinary missing tools are still reported as before. (#13169 by @jdx)
• backend: Backend discovery from lockfiles now skips backends listed in disable_backends. When a parent mise.lock pins a shorthand such as yarn to asdf:yarn and a child project disables asdf, mise tool yarn --backend and a fresh child mise lock now select the first enabled recorded backend or fall back to the enabled registry backend (aqua:yarnpkg/berry) instead of the disabled pin. The parent lockfile is left unchanged and explicitly installing a disabled backend still fails. (#13178 by @jdx)

Changed

• bootstrap: mise bootstrap packages apply installs Homebrew packages substantially faster. Formula metadata for each dependency frontier is fetched concurrently, bottles are extracted, relocated, signed, and receipted concurrently, and each job now downloads and prepares its own bottle so prepared bottles are committed as soon as dependency order allows. All stages respect the existing jobs limit with no new settings; Cellar commits and prefix linking stay dependency-ordered, opt/<name> is linked last so an interrupted install cannot look complete, and a failure cancels queued work while cleaning up in-flight staging. On Apple silicon, a fresh install of brew:jq brew:tree brew:wget brew:just brew:shellcheck dropped from roughly 6.6s to 4.0s, and dependency resolution for brew:ffmpeg from 288ms to 112ms. (#13151, #13152, #13155 by @jdx)

Documentation

• The npm backend, PyPI backend, and mise.lock guides now open with quick-start and everyday workflows (mise use node@24 npm:prettier, mise use python@3.14 uv pypi:black, mise lock, mise install --locked) and group dependency-graph locking, sidecar management, and strict-mode details afterward. The lockfile guide clarifies that URL-lock exemptions do not exempt dependency graphs from validation. (#13149 by @jdx)

Full Changelog: v2026.9.7...v2026.9.8

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.