[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
Swatinem/rust-cache	action	patch	v2.9.2 → v2.9.3
github/codeql-action	action	patch	v4.39.0 → v4.39.1
jdx/mise	uses-with	patch	v2026.10.13 → v2026.10.17	v2026.10.19 (+1)
python	tools	patch	3.15.0 → 3.15.1
release-plz/action	action	patch	v0.5.142 → v0.5.144	v0.5.146 (+1)
rust (source, changelog)	toolchain	patch	nightly-2026-10-18 → nightly-2026-10-22	nightly-2026-10-25 (+2)
rust-lang/crates-io-auth-action	action	patch	v1.0.5 → v1.0.6
taiki-e/install-action	action	patch	v2.87.29 → v2.87.30	v2.87.31
uv	tools	patch	0.13.1 → 0.13.5

---

Release Notes

Swatinem/rust-cache

v2.9.3

Compare Source

What's Changed

• Issue-375: stop cleanup timestamp pruning after the first entry by @​TethysSvensson in #​377
• fix: log rustup toolchain list failure as info instead of warning by @​SDAChess in #​394

New Contributors

• @​TethysSvensson made their first contribution in #​377
• @​SDAChess made their first contribution in #​394

Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3

github/codeql-action

v4.39.1

Compare Source

• Update default CodeQL bundle version to 2.27.3. #​4256

jdx/mise

v2026.10.17: : Shell names in bootstrap login_shell, templated doctor checks, and a per-plugin vfox cache directory

Compare Source

bootstrap.user.login_shell now accepts a shell name such as fish instead of a full path. [doctor.checks] can use templates, and vfox backend plugins get their own cache directory. This release also fixes PATH handling in zsh setups that deduplicate PATH, stale task cache hits, a pipx interpreter mix-up on macOS, and removes trust in the compromised eMudhra CA certificates.

It also includes the changes prepared for 2026.10.16, which was tagged but never published: relative and templated write_targets paths, version aliases from vfox backend plugins, keyring passwords for private PyPI indexes, vfox-backend: packslip plugin sources, and a change to where find_up starts (see Changed and Upgrading).

Added

• [bootstrap.user].login_shell accepts a shell name. A config shared across machines no longer needs to know where each system installs the shell. mise looks up the name when it checks or applies the setting, which happens after bootstrap.packages has installed the shell. It searches PATH first (never the mise shims directory), then common package-manager locations: /opt/homebrew/bin, /usr/local/bin, /home/linuxbrew/.linuxbrew/bin, ~/.linuxbrew/bin, /usr/bin and /bin. If no executable is found, mise bootstrap user apply fails without changing /etc/shells or the account, and status reports not installed. mise bootstrap user status shows the path it found, and --json output has a new resolved field. Absolute paths work as before. #​14770 (@​jdx)

  [bootstrap.packages]
  "brew:fish" = "latest"
  
  [bootstrap.user]
  login_shell = "fish"

• Doctor checks support templates. run, description and hint in [doctor.checks.*] are rendered with the template context of the config file that declares them, the same way hooks are. A check can now use a value from [vars] instead of hard-coding it. dir is not rendered. If a template fails, only that check reports ERROR and the other checks still run. Text that already contains {{ or {% in these fields is now parsed as a template. #​14771 (@​jdx)

  [doctor.checks."project-a:env"]
  description = "project-a has a .env file"
  run = 'test -f {{ vars.repos_dir | quote }}/project-a/.env'
  hint = "cp {{ vars.repos_dir }}/project-a/.env.example {{ vars.repos_dir }}/project-a/.env"

• vfox plugins get RUNTIME.cacheDirPath. This is a cache directory for each plugin at $MISE_CACHE_DIR/plugins/<plugin-name>. mise creates it before running any hook, and every hook of the plugin sees the same path. Unlike pluginDirPath, it is kept when the plugin is reinstalled. mise cache clear deletes it, so plugins must handle it being missing. It is nil when no cache directory is available. #​14776 (@​jdx)

• settings.write_targets accepts relative and templated paths. Before, only absolute or ~/ paths worked, so dotfiles shared between machines with different MISE_CONFIG_DIR or XDG_CONFIG_HOME had to hardcode the config directory. Templates are now rendered, and a relative result is joined to the config_root of the settings file that declares it. For a global file that is $HOME, so the portable spelling uses the file's own directory. The resolved path must still be a global config file that mise loads. If a template fails to render, mise warns, and mise use --global fails with "must resolve to an absolute path" instead of writing to the default file. #​14742 (@​jdx)

  # ~/.config/mise/conf.d/settings.toml
  [settings.write_targets]
  tools = "{{ config_source | dirname }}/tools.toml"

• vfox backend plugins can report version aliases. BackendListVersions can return an aliases table, so a registry's moving names resolve to real versions. Before, "mise-ghcup:ghc" = "recommended" passed the literal string to the plugin, installed into installs/.../recommended, never followed the tag when it moved, and showed recommended in mise ls and the lockfile. Now ghc@recommended resolves to 9.10.3, installs into 9.10.3/, and the lockfile records 9.10.3. Aliases you define in config still win. They are cached like the version list, and an expired cache still answers offline. Older mise versions ignore the aliases field, so plugins can adopt it right away. #​14732 (@​jdx, @​cprecioso)

  return {
    versions = { "9.8.4", "9.10.3", "9.14.1" },
    aliases = { recommended = "9.10.3" },
  }

• mise lock and version listing work with a PyPI index that uses a keyring. With an index such as Azure Artifacts and artifacts-keyring, mise install worked because uv read the password from its keyring provider, but mise's own requests sent no credentials and failed with 401 Unauthorized. Set the new pypi.keyring_provider (disabled by default, or subprocess; env var MISE_PYPI_KEYRING_PROVIDER) and give the registry URL a username without a password. mise then runs keyring get <url> <username>, as uv does, and sends the result as HTTP Basic credentials when it lists versions and when mise lock reads a release's requires-python. The password is never written to the lockfile or the version cache. The keyring executable must be on PATH. If it is missing or has no entry, mise sends the request without credentials. #​14733 (@​jdx)

  [settings.pypi]
  keyring_provider = "subprocess"
  registry_url = "https://VssSessionToken@pkgs.dev.azure.com/org/project/_packaging/feed/pypi/simple/{}/"

• vfox-backend: works as a prefix for packslip plugin sources. A vfox backend plugin can be installed from a signed packslip archive, both from the CLI and in [plugins]. Before, mise plugins install vfox-backend:foo 'packslip:owner/repo#1.0.0' failed with packslip plugin sources require the vfox plugin type. An explicit asdf: or package: prefix is still rejected, and the error now says "vfox or vfox-backend". The archive still declares extensions.mise.plugin = "vfox". #​14727 (@​jdx)

  mise plugins install vfox-backend:my-backend 'packslip:your-org/my-backend#1.0.0'

• mise bootstrap packages list is now an alias for status, alongside ls. #​14709 (@​himkt)

Changed

• find_up in env._.file starts at the config root. Every other relative path in a config resolves against the config root, but find_up started at the current directory. A relative find_up path now starts at the config root and walks up through its parents, which suits a monorepo whose root .env applies to every package. An absolute path starts at its own directory. A global config that wants to search from wherever mise runs can use cwd. The env_file setting still discovers dotenv files up from the current directory and is unchanged. See Upgrading. #​14734 (@​jdx, @​thernstig)

  # ~/.config/mise/config.toml
  [env]
  _.file = { path = "{{cwd}}/.env", find_up = true }

• allow_builds approves only the packages it lists. With the embedded aube installer, allow_builds = ["re2"] also ran the install scripts of every package on aube's bundled trusted-dependencies list, such as dtrace-provider. For a package list, mise now turns that default list off, so only the packages you name build. allow_builds = true and the default with no option are unchanged. This updates the embedded aube to 2.8.0. #​14731 (@​jdx)

Fixed

• exec() in [env] values, and other commands mise runs with the pre-activation environment, can now find commands in a _.path directory that was already on PATH before activation, even if the shell deduplicates PATH (for example zsh with typeset -U path PATH). #​14772 (@​jdx)
• With task.source_freshness_hash_contents = true, a task now re-runs when a source file is changed to content of the same size and its old mtime is restored (for example by rsync -a, cp -p or touch -r). On Unix, mise now also compares the file's ctime. Cache entries written by older versions are rehashed once. #​14778 (@​jdx)
• On macOS, pipx: installs no longer fail when aqua:aws/aws-cli is in the toolset. Because macOS filesystems ignore case by default, mise's lookup for python matched aws-cli's executable Python shared library and passed it to uv as the interpreter. This lookup now requires the exact case. #​14769 (@​jdx)
• An aqua registry template with an unterminated string literal now fails with an "unterminated string literal" error instead of hanging. Escaped quotes after backslashes are also detected correctly. #​14752 (@​Huge, @​jdx)
• The built-in npm backend no longer trusts the eight eMudhra intermediate CA certificates whose private keys were compromised. The fix comes from updating its bundled root certificates (webpki-root-certs 1.0.10, rustls-webpki 0.103.16). Builds that use the OS trust store are fixed by OS updates instead. #​14781 (@​jdx)
• A [bootstrap.compose] project no longer reports drift on every run when a service uses a service: reference such as network_mode: service:vpn. Compose hashes the reference as written but stamps the container with the hash of the resolved container:<id>, so the two never matched. mise now pins these references (network_mode, ipc, pid, volumes_from) to the running container before it asks compose for the hash. This needs an explicit files list in the project's config. Projects without one hash as before. #​14729 (@​jdx)
• vfox plugins now keep symlinks when they extract .zip archives returned by PreInstall. Before, entries such as bin/npm -> ../lib/node_modules/npm/bin/npm-cli.js became regular files holding the link target, and the tool failed with No such file or directory. Links that resolve outside the install directory are still rejected. The http: backend and tarballs were not affected. #​14730 (@​jdx)
• [daemons.<name>] task = "worker" now finds a file task such as .mise/tasks/worker.sh, as mise run worker does. Before, it failed with daemon srv runs unknown task "worker" unless you wrote worker.sh. #​14741 (@​jdx)
• On Windows, mise self-update no longer replaces the winget mise-shim.exe link with a copy. It updates the real mise-shim.exe next to the real mise.exe. Before, mise reshim kept warning that the shim was older than mise. #​14737 (@​jdx)
• An inherited [dotfiles] entry turned off with only enabled = false no longer prints no recognized operation (block, source, or line), ignoring entry on every command. Other tables with no recognized operation, such as a misspelled line, still warn. #​14726 (@​jdx, @​ponko2)

Upgrading

• find_up in a global config: a relative find_up entry in env._.file used to search from the current directory. It now searches from the config root, which is ~ for a global config, so it no longer finds project files. To keep the old behavior, put {{cwd}}/ in front of the path. find_up was added in 2026.10.12.

Documentation

• The dotfiles docs now explain that a group entry with only permissions does not inherit the group's mode, so it deploys nothing. Removing mode from an entry that used to deploy a file leaves that file orphaned, and --prune deletes it. To deploy a file and set its permissions, use { mode = "copy", permissions = "0600" }. #​14768 (@​jdx)

New Contributors

• @​Huge made their first contribution in #​14752

Full Changelog: jdx/mise@v2026.10.15...v2026.10.17

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.15: : Default minimum_release_age covers every backend, plus a PowerShell installer

Compare Source

The default 24-hour minimum_release_age now applies to every backend. Many more backends report release dates, so the cooldown can actually hold new versions back, and mise warns when it installs a version it couldn't date. This release also adds a PowerShell installer for Windows, read_json/read_yaml/read_toml template functions, dotnet@lts/dotnet@sts, and new dotfiles options.

Changed

• The default minimum_release_age applies to every backend. The built-in 24h cooldown used to cover only backends that reported release dates (aqua, cargo, core, github, npm, pypi and others). asdf, vfox, conda, dotnet, http: and s3: tools had no cutoff at all. Now every backend gets the cooldown. A tool whose only version is less than 24h old now resolves to "no versions found", as aqua and github tools already did. To opt a tool out, add it to minimum_release_age_excludes. To turn the cooldown off, set minimum_release_age = "0s". #​14701 (@​jdx)

• mise warns when it can't check a version's release date. A version with no known date still passes the cutoff, but mise install, mise upgrade and mise use now print a one-time warning naming the version. Exact pins you wrote yourself don't trigger it. mise env, mise ls, mise outdated and mise ls-remote never print it. #​14694 (@​jdx)

  WARN  asdf:tiny@3.1.0 has no release date, so the ... cutoff cannot be checked and it is allowed (exclude it with minimum_release_age_excludes to silence this)
  

• More backends report release dates, so the cooldown applies to them:

  • conda versions use the channel's earliest index timestamp. #​14693
  • aqua packages that take versions from git tags (version_source: github_tag, such as aws/aws-cli, docker/cli and cockroachdb/cockroach) are now dated. #​14691
  • dotnet dates come from Microsoft's releases index. deno and erlang dates come from their GitHub releases. #​14692
  • Every python version now has a date, and so do many more ruby versions (from ruby-lang.org, Maven Central for JRuby, and GitHub for TruffleRuby). Rust's stable, beta and nightly channels are dated too. With an explicit past cutoff, rust@stable resolves to the newest stable release that is old enough, and beta/nightly resolve to a dated build from before the cutoff. #​14697
  • The dart, flutter, nim, julia, nomad-pack, sentinel, tfc-agent, android-cli, cursor-agent and twg registry tools now report dates. #​14698

  All by @​jdx.

• Version lists for more backends come from the mise-versions host. npm:, pipx:, cargo:, gem:, go:, dotnet: and spm: tools now list versions from mise-versions, like other registry tools, instead of going to their own source. So do http/s3 tools with a version_list_url. If you redirect a source, mise still lists from that source directly. That covers a custom npm registry or npm.shell_out, pypi.registry_url, a non-default GOPROXY, cargo.registry_name, a custom gem source, dotnet.registry_url, S3 endpoint overrides, and local listing options. conda always lists from its channel. The host cache TTL now follows the tool's minimum_release_age. To list everything from the source, set MISE_USE_VERSIONS_HOST=0. #​14700 (@​jdx)

Added

• PowerShell installer for Windows. It's published with each release as install.ps1 and served from mise.run at /powershell and /pwsh, so you pipe it into iex with irm. It works on PowerShell 5.1+ and doesn't need admin rights. It installs the newest release that is at least 24h old, or MISE_VERSION if set. The download is verified against SHASUMS256.txt from GitHub Releases. mise.exe and mise-shim.exe go into ~\.local\bin, and that directory is added to your user Path. Re-running it upgrades an existing install. Options include MISE_INSTALL_PATH, MISE_INSTALL_MODIFY_PATH=0, MISE_INSTALL_SHIMS_PATH=1 and MISE_INSTALL_FROM_GITHUB=1. See the "Installing mise" docs for the full command. #​14660 (@​jdx, @​lhs-12)

• read_json(), read_yaml() and read_toml() template functions parse a file so a template can use a value from it. This saves copying a version from package.json or Pulumi.yaml into mise.toml by hand. Relative paths resolve from the config file's directory. A missing key is an error unless you add | default(value="..."). Like read_file(), these functions need a trusted config, and they don't work in safe mode, .miserc.toml or OCI dotfile templates. #​14705 (@​jdx, @​edahlseng)

  [tools]
  node = "{{ read_json(path='package.json')['volta']['node'] }}"
  pulumi = "{{ read_yaml(path='Pulumi.yaml')['requiredPulumiVersion'] }}"

• dotnet@lts and dotnet@sts resolve to the newest SDK in the current LTS or STS channel, using Microsoft's release index. Preview, go-live and end-of-life channels are skipped. A lts alias you define in [tool_alias.dotnet.versions] still takes precedence. Runtime-only installs still need an exact version. #​14683 (@​jdx)

• mise bootstrap --prune-dotfiles removes dotfiles that are no longer deployed, the same way mise dot apply --prune does, so mise bootstrap --upgrade --prune-dotfiles handles everything in one run. The prune runs at the end of the dotfiles phase. It respects --dry-run, --yes and --skip dotfiles. Copies you edited are left in place. #​14681 (@​jdx, @​thernstig)

• dotfiles.windows_symlinks (default false) makes symlink and symlink-each create real file symlinks on Windows. With it on, apply fails if Windows refuses to create a link, instead of silently copying. To create symlinks, Windows needs Developer Mode or an elevated shell. If you turn the setting back off, mise dot unapply needs --force on entries that still hold links. #​14682 (@​jdx)

  [settings.dotfiles]
  windows_symlinks = true

• http: tools can report release dates with the new version_date_expr option. It maps versions to dates from the version_list_url response. Use version_date_url to read the dates from a different URL, and version_date_next_expr to follow paged listings (same host only). Dates can be RFC 3339, YYYY-MM-DD or HTTP dates. #​14696 (@​jdx)

• vfox plugins can report release dates. An Available or BackendListVersions hook can return created_at (RFC 3339) for each version. Plain version strings still work. #​14695 (@​jdx)

• mise tasks -a is a short alias for mise tasks --all. #​14674 (@​williamsjokvist)

Fixed

• mise fmt no longer breaks multiline inline tables (TOML 1.1). It used to pull comments out of the table and drop indentation. Now it leaves these tables exactly as written. #​14670 (@​jdx, @​ponko2)
• If one task's dir template fails to render, other task commands keep working. Before, every command failed, including mise tasks validate. Now mise tasks validate reports the broken task as invalid-directory-template, and only running that task fails. #​14680 (@​jdx)
• aqua tools now find their binaries in macOS universal archives, such as fastfetch 2.70.0. #​14665 (@​jdx)
• npm: lifecycle scripts approved by allow_builds now run even when ~/.npmrc sets ignore-scripts=true. #​14661 (@​jdx)
• npm: mise lock no longer fails when your aube config sets a different default lockfile, such as pnpm-lock.yaml. #​14659 (@​jdx)
• .7z tool archives now extract when mise's data directory path contains .., for example in a localized mise setup. #​14657 (@​jdx, @​sevenc-nanashi)
• The mise-shim.exe in the Windows release now keeps its version tag, so mise doctor and mise reshim --force stop reporting it as outdated. The warning goes away after you update and run mise reshim --force. #​14656 (@​jdx)
• On Windows, symlink-each dotfiles messages and dry-run previews now say the files were copied rather than symlinked. #​14654 (@​jdx, @​lhs-12)
• Rust: with a RUSTUP_DIST_SERVER mirror configured and GitHub unreachable, mise now lists the stable, beta and nightly channels instead of failing, so rust@stable installs through the mirror. #​14662 (@​jdx)
• On Windows, http: installs of large archives no longer fail with "Access is denied" while antivirus is scanning the extracted files. mise now retries the final move for up to about a minute. #​14703 (@​jdx)

Documentation

• New mise.toml playground: a schema-aware editor with hover help, completion and error checking. You can share a config as a link. Every mise.toml example in the docs now shows hover help on its keys. #​14673, #​14686 (@​jdx)
• The mise.toml reference is now a searchable key explorer grouped by topic. Each key shows its type, default and a real example. Nearly every key now has a description, and these also appear in mise config explain. #​14687, #​14690, #​14688 (@​jdx)
• The fnox secrets page now covers setup, CI and migration. The dotnet page explains how private feeds authenticate. #​14675, #​14679 (@​jdx)

Full Changelog: jdx/mise@v2026.10.14...v2026.10.15

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.14: : Global override config, mise config explain, and stricter tool option checks

Compare Source

A global config.override.toml can now take precedence over project config, and mise config explain describes each key in a config file. Paranoid mode can be turned on per category, and in that mode dotenv files need their own content-bound trust. Installs now fail when a tool has an option its backend doesn't read, which affects existing configs (see Changed).

Added

• Global override files. ~/.config/mise/config.override.toml, and config.<env>.override.toml for each MISE_ENV, rank above every project file, including mise.local.toml and mise.<env>.toml. This covers [env], [tools], [settings], [tasks], hooks and the other sections. Anything the override file doesn't set still comes from the project. mise never writes to these files by default. To write to one, pass --override to use, unuse, set, unset, settings set|add|unset or config get|set. A tool declared in an override file resolves from the global mise.lock and is exempt from the project's --locked check. If MISE_GLOBAL_CONFIG_FILE is set, override files are not loaded. mise config ls shows a Tier column and mise doctor labels the files. #​14610 (@​jdx)

  # ~/.config/mise/config.override.toml
  [env]
  AWS_PROFILE = "personal"
  
  [tools]
  node = "24"

• mise config explain [KEY] lists each key a config file sets, with its line number and its description from the schema. It flags unknown keys with a "did you mean" suggestion and marks deprecated keys. It reads the file as plain TOML, so it also works on a config mise refuses to load. Pass a key such as tasks to show only that section, --json for machine-readable output, and --file, --global, --system or --override to pick a file. #​14642 (@​jdx)

• Paranoid mode can be turned on per category. paranoid now accepts a list of config, env_files, plugins and provenance in addition to true/false. MISE_PARANOID=config,env_files also works. true still turns on all four categories. An unknown category name is an error. #​14609 (@​jdx, @​thernstig)

  [settings]
  paranoid = ["env_files"]

• env_file takes several filenames, for example env_file = [".env", ".env.local"] or MISE_ENV_FILE=.env:.env.local. The file nearest the current directory wins. Within one directory, a name later in the list wins. A single string still works. #​14606 (@​jdx, @​thernstig)

• A find_up entry in env._.file can search several names together. Give one entry a path list, and mise searches directory by directory. The closest directory wins, then the later name within a directory. With two separate entries, a .env.local in a parent directory still overrides the project's .env. The docs now explain this difference and how env_file differs from _.file. #​14620, #​14602 (@​jdx)

  [env]
  _.file = { path = [".env", ".env.local"], find_up = true }

• #MISE headers in file tasks accept the same keys as [tasks.<name>], including timeout, vars and the deny_*/allow_* sandbox keys. Before, these keys were ignored with a warning. If one header value is invalid, mise warns and skips that key, and every other task still loads. An invalid confirm or deny_* value is still an error, so a typo can't remove a confirmation prompt or a sandbox restriction. Before, a template named with extends overrode a header's silent. Now the header's value wins. #​14637 (@​jdx)

• Interactive mise.toml reference in the docs at configuration/reference. It lists every key with its type, choices and default, and you can filter keys and link to them directly. Plain Markdown copies are also published for agents. #​14641 (@​jdx)

Changed

• Installs fail on tool options the backend doesn't read. Before, such options were silently ignored. A typo or a key meant for another backend now stops the install, and the error names the option: cargo:eza: option 'asset_pattern' is not used by the cargo backend. Keys under platforms are checked too. So far this applies to the cargo, conda, gem, github, gitlab, forgejo, go, http, npm, packslip, pipx, s3, spinel, spm and ubi backends. aqua, plugin and core-language tools are not checked. The npm backend accepts the checksum option that comes from a packageManager field in package.json. #​14629, #​14655 (@​jdx)
• Paranoid mode needs content-bound trust for env files. In paranoid mode, files loaded through _.file, found by the env_file setting, or run by _.source each need their own trust. Editing one of these files revokes its trust. Before, trusting mise.toml also approved these files, and later edits went unchecked. Running mise trust with no path trusts the project's config and every env file it loads. The error names the file but prints none of its values. To exempt a file by path, add it to trusted_config_paths in your global config. With a category list, this check belongs to env_files. #​14604 (@​jdx, @​thernstig)
• More specific config error messages.
  • A warning about an unknown mise.toml key now gives the line and column, and suggests a close match, for example mise.toml:5:1: settings.experimantal (did you mean experimental?). #​14639 (@​jdx)
  • A wrong value for a hook, a task run/depends entry or an [env] variable now says which forms are accepted, or names the unknown key. Before, the error was data did not match any variant of untagged enum. An unknown key in a run or depends table now gets a warning. Before, it was silently ignored. #​14640 (@​jdx)
• [bootstrap.linux.firewall] is validated on every OS. macOS and Windows still skip the section at bootstrap time, but an invalid value such as backend = "iptables" is now an error there too. #​14615 (@​jdx)
• Editor schema updates. Editors now flag unknown keys in most [bootstrap] tables and in [dotfiles] entries. The schema now documents launchd keep_alive_on_failure and nice, and dotfile autosave and enabled. It also accepts valid configs it used to reject: templated login_shell, queue_directories and umask, nested macOS defaults values, and tools on [vars] entries. On Windows, [bootstrap.brew].adopt no longer causes an unknown-field warning. #​14616, #​14644, #​14613 (@​jdx)
• mise dot status and mise dot sync are faster with many tracked files. They start one git process per tracked file instead of three, which took about 10s down to 4s for 860 files. #​14607 (@​waynehoover)

Fixed

• With an external rustup that keeps its proxies in a shared directory, such as pacman's /usr/bin, mise no longer puts that directory ahead of its own tools. Before, mise exec -- node could run the system Node. Only the Rust proxies are now exposed, through a directory that mise owns. #​14597 (@​jdx)
• The cargo backend now honors rename_exe. Before, it ignored the option and installed the executable under its original name. #​14626 (@​jdx)
• Locked pypi: installs through uv now pass the configured mise Python to uv sync. Before, mise passed an empty path, so uv could pick another interpreter and fail on --no-build tools such as yamllint. #​14593 (@​jdx, @​hollow)
• When the TLS root store or a CA file can't be loaded, the npm backend now reports an error instead of crashing mise with a core dump. #​14595 (@​jdx)
• On fish, mise no longer recurses until fish hits its call stack limit after mise implode. #​14594 (@​jdx, @​thernstig)
• mise bootstrap now finds Nix in /nix/var/nix/profiles/default/bin when a pre-packages hook installed it earlier in the same run, so nix: packages install. #​14596 (@​jdx)
• MISE_WATCH_FILES_GIT_REWRITTEN is no longer set when HEAD stayed on the same commit, for example after git checkout -b, git reset or git branch -m. Before, format-on-edit hooks skipped files you had just edited. #​14585 (@​JamBalaya56562)
• Command wrapper templates can now use config_root and config_source. Relative paths in template functions resolve from the wrapper's config file instead of the current directory. #​14628 (@​JamBalaya56562)

Upgrading

• Unsupported tool options: if an install now fails with option '...' is not used by the ... backend, remove the option or fix its spelling. mise config explain tools shows which keys mise doesn't recognize.
• Paranoid mode: after upgrading, run mise trust in each project to approve its env files. Run it again after editing them. If you only want the env-file check, set paranoid = ["env_files"].
• Firewall config on macOS and Windows: if a shared config has an invalid [bootstrap.linux.firewall] value, it now fails to load on macOS and Windows too. Correct the value.

Full Changelog: jdx/mise@v2026.10.13...v2026.10.14

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

python/cpython (python)

v3.15.1

Compare Source

release-plz/action

v0.5.144

Compare Source

What's Changed

• fix(updater): fail when a git or gh command fails by @​marcoienibot in #​576
• feat(updater): move the minor tag in updater release by @​marcoienibot in #​577
• Update to 0.3.174 by @​marcoieni in #​578

Full Changelog: release-plz/action@v0.5.143...v0.5.144

v0.5.143

Compare Source

What's Changed

• chore(deps): update dependency taiki-e/install-action to v2.87.29 by @​renovate[bot] in #​572
• chore(deps): update dependency cargo-bins/cargo-binstall to v1.26.0 by @​renovate[bot] in #​573
• chore(deps): lock file maintenance by @​renovate[bot] in #​574
• Update to 0.3.173 by @​marcoieni in #​575

Full Changelog: release-plz/action@v0.5.142...v0.5.143

rust-lang/crates-io-auth-action

v1.0.6

Compare Source

What's Changed

update dependencies

Full Changelog: rust-lang/crates-io-auth-action@v1.0.5...v1.0.6

taiki-e/install-action

v2.87.30: 2.87.30

Compare Source

• Update zizmor@latest to 1.31.1.

• Update wasmtime@latest to 50.0.0.

• Update vacuum@latest to 0.33.2.

• Update uv@latest to 0.13.4.

• Update trunk@latest to 0.22.0.

• Update tombi@latest to 1.8.9.

• Update syft@latest to 1.55.0.

• Update release-plz@latest to 0.3.173.

• Update prek@latest to 0.5.6.

• Update mise@latest to 2026.10.15.

• Update knope@latest to 0.23.1.

• Update kingfisher@latest to 2.14.0.

• Update kache@latest to 1.2.2.

• Update dprint@latest to 0.64.1.

• Update cosign@latest to 3.1.4.

• Update cargo-crap@latest to 0.9.0.

• Update cargo-binstall@latest to 1.26.0.

astral-sh/uv (uv)

v0.13.5

Compare Source

Released on 2026-10-21.

Following uv 0.13.4, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to python-build-standalone 20261021, including the CPython 3.15.1, 3.14.9, and 3.13.17 security patch releases. These builds include pip 26.2.2 both preinstalled in the managed interpreter and bundled with ensurepip, which installs pip by default when you run python -m venv. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run uv python upgrade to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.

Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.

Enhancements

• Report incompatible self-dependencies directly in resolution errors (#​21845)

Python

• Add CPython 3.15.1, 3.14.9, and 3.13.17 (#​22802)

Preview features

• Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants (#​22535, #​22536, #​22687, #​22688)

Performance

• Reduce peak memory use when resolving dependencies across multiple environments (#​22769, #​22770, #​22784)
• Speed up exports with complex transitive extras by resolving activation across the dependency graph (#​22751)
• Reduce uv's binary size by keeping additional error formatters out of line (#​22775)
• Reduce overhead when parsing custom build cache keys (#​22749)

Bug fixes

• Lock packages distributed only as Android wheels without a source distribution (#​22806)
• Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (#​22751)
• Reject invalid custom build cache keys instead of silently falling back to the defaults (#​22749)

Security

• Reject certificate chains containing compromised eMudhra intermediate keys via rustls-webpki 0.103.16 (#​22777)
• Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (#​22773)

v0.13.4

Compare Source

Released on 2026-10-20.

Preview features

• Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under wheel-variants (#​22512)

Other changes

• Update the bundled Mozilla root certificates via webpki-root-certs 1.0.10 (#​22760)

v0.13.3

Compare Source

Released on 2026-10-20.

Performance

• Avoid severe uv export slowdowns in dependency graphs with extras (#​22750)

v0.13.2

Compare Source

Released on 2026-10-19.

Enhancements

• Report all installed packages in uv workspace metadata, including packages outside the selected resolution (#​22395)
• Include supported environment restrictions when exporting pylock.toml (#​22596)
• Retry dropped GET and HEAD requests when fetching package and index data (#​22672)
• Preserve encoding declarations in wheel data scripts that require shell launchers (#​22526)
• Show causes and hints when uv python find --script cannot discover an interpreter, including with -q (#​22549)
• Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh (#​22538, #​22572)
• Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation (#​22577)

Python

• Add PyPy 3.11.17 and 3.12.15 (#​22578)

Preview features

• Fetch and parse PEP 825 index-level variant metadata with wheel-variants (#​22509, #​22511)

Performance

• Avoid exponential work when simplifying, traversing, and exporting complex dependency markers (#​22608, #​22615, #​22651, #​22674)
• Reduce the time and memory used to parse and store complex dependency markers (#​22675, #​22676, #​22681)
• Reduce resolver memory use for large dependency graphs, forks, extras, and dependency groups (#​22565, #​22625)
• Speed up project discovery in large workspaces by caching member names (#​22635)
• Reduce uv's binary size and speed up CycloneDX exports (#​22431)
• Reduce uv-build binary size, including Linux x86_64 wheels (#​22539, #​22573)
• Reduce allocations when parsing TOML (#​22679)

Bug fixes

• Respect --exclude-newer when a newer wheel for the selected source distribution is already cached (#​22685)
• Prevent URL credentials from leaking through diagnostics or persisted metadata (#​22600, #​22601, #​22617, #​22622, #​22646)
• Keep separate cache entries for signed --find-links URLs that differ only in sensitive query values (#​22630)
• Honor PEP 751 environment restrictions when installing or syncing from pylock.toml (#​22594)
• Use configured credentials before prompting during uv publish, and avoid prompting when no upload occurs (#​22593)
• Match recursive build globs against complete file paths and ignore invalid license symlinks (#​22581, #​22583)
• Return an error for invalid uv pip compile --python-version values instead of panicking (#​22727)
• Reject invalid pylock.toml output filenames before resolution instead of panicking (#​22725)
• Avoid panicking during repeated resolution conflicts involving fixed-priority packages (#​22589)
• Create version aliases correctly when installing managed Python into a relative directory (#​22547)
• Show incompatibilities from failing uv pip check invocations with -q (#​22544)
• Treat logically equivalent dependency markers as equal regardless of construction order ([#​22680](https://redirect.github.com

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 81368cfd-87c4-433e-806a-6d05268cc2d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}