[renovate]

This PR contains the following updates:

Package	Type	Update	Change
jdx/mise	uses-with	patch	2026.10.20 → 2026.10.22

---

Release Notes

jdx/mise

v2026.10.22: : Project-scoped uninstall, JSONC dotfile merges, and node@lts moves to Node.js 26

Compare Source

You can now uninstall only the tools the current project requests, and new --no-global and --project flags replace the two different meanings --local had. Dotfiles can merge into JSONC files like VS Code's settings.json and can seed a file once without overwriting later edits. node@lts now resolves to Node.js 26. The rest of the release adds an ipv4_only setting, JSON output for mise vars, and fixes for Windows, lockfiles, pruning and GitHub release listing.

Added

• mise uninstall --project and mise ls --project. mise uninstall --project removes the installed versions requested by the nearest project's config files: mise.toml, mise.local.toml, conf.d fragments, .tool-versions and idiomatic version files in that directory. Config in parent directories and global config is not included. It lists each version with the file that requests it and asks before removing anything. --yes skips the prompt, and --dry-run only shows the list. mise ls --project lists the same scope. Installs are shared between projects, so another project using the same version will need to reinstall it. #​15079, #​15081 (@​jdx, @​httpete-broadcom)

  $ cd ~/work/app            # ~/work/mise.toml also exists
  $ mise ls --no-global      # app's config and ~/work's, not the global config
  $ mise ls --project        # app's config only
  $ mise uninstall --project # removes the versions app's config names, after asking

• --no-global on ls, outdated, upgrade and tasks ls. It selects tools or tasks from all non-global config, including parent directories, and does what --local did on these commands. #​15081 (@​jdx)

• Dotfile merges into JSONC files. A merge entry can now edit files that contain comments and trailing commas, such as VS Code's settings.json. It keeps the file's comments, indentation and any keys the source doesn't set. .jsonc targets are detected automatically. For other files, set the new format key (json, jsonc, toml or yaml). A .json target without format is still parsed as strict JSON. Merge sources that fail to parse now report the file path and the parse error. #​15077 (@​jdx, @​TimonLukas)

  [dotfiles]
  "~/.config/Code/User/settings.json/shared" = { source = "vscode/shared.json", merge = true, format = "jsonc" }

• create_if_missing for dotfiles. copy, template and inline content entries with create_if_missing = true write the target only when nothing exists there. After that, local edits are left alone and do not count as drift in mise dot status or mise dot diff. If you delete the target, the next apply creates it again. This works for files that are filled in on each machine, such as local tokens. #​15080 (@​jdx, @​thernstig)

  [dotfiles]
  "~/.config/mise/conf.d/private.local.toml" = { source = "templates/private.toml", mode = "copy", permissions = "0600", create_if_missing = true }

• permissions on dotfile merge entries. The mode is applied only when the merge creates the file. Files that already exist keep their mode. Merge entries for the same file must not set different modes. #​15087 (@​jdx, @​thernstig)

• ipv4_only setting. Set ipv4_only = true (or MISE_IPV4_ONLY=1) for networks where a host fails over IPv6, for example dl.google.com returning 404 or Sigstore TUF fetches failing. This applies to mise's own HTTP connections: downloads, version lookups, GitHub API calls, attestation verification and vfox plugins. External programs such as git, npm and the npm: backend's package manager still use the system resolver. The default is false. #​15057 (@​jdx, @​Alby02)

• mise vars --json and --json-extended. Prints vars as JSON. --json-extended also includes the file each value comes from. Redacted values stay [redacted]. #​15069 (@​jdx, @​artemklevtsov)

• mise shell --unset --all. Removes every MISE_<TOOL>_VERSION override from the current shell in one command, including ones you exported by hand. #​15088 (@​jdx, @​wfouche)

• Bootstrap hook descriptions. A hook table can set description, and mise bootstrap prints it instead of the hook's script. Without a description, mise prints $ followed by the command's first line, cut to the terminal width. --verbose and --dry-run still print the full script. #​15106 (@​jdx, @​owpac)

  [bootstrap.hooks.final]
  description = "Remove the root copy of pam_reattach if Homebrew removed the module"
  run = "..."

• Debian packages from the mise APT repository now include Bash, Zsh and Fish completions. #​15074 (@​gilesw)

• Registry: added an aqua backend for oxfmt. #​15092 (@​scop)

Changed

• node@lts now resolves to Node.js 26, which entered Active LTS on 2026-10-28. It used to resolve to 24. lts/lithium (also lts-lithium) selects the 26.x line. Aliases for older lines, such as lts/krypton, are unchanged. To stay on Node.js 24, pin node@24 or node@lts/krypton. #​15105 (@​jdx)
• Setting system_packages.elevate_with = "" now means "never elevate": package manager commands run as the current user. This helps on hosts without root, such as Termux. Before, an empty value fell back to sudo, run0 or doas. If the setting is unset, mise still picks an elevator from PATH. #​15049 (@​jdx, @​iliqiliev)

Deprecated

• --local on ls, outdated, upgrade and tasks ls is deprecated in favor of --no-global. It still works and prints no warning for now. Warnings start in 2027.1.0, and the flag is removed in 2027.7.0. settings --local and lock --local are not affected. #​15081 (@​jdx)

Fixed

• On Windows, background tool updates started from the shell prompt no longer open a visible console window for each tool. #​15038 (@​yusoofsh)
• mise prune and automatic upgrade pruning used to keep every version of a tool while a process started through a runtime link such as installs/claude/latest was running. They now keep only the version that process is running, so long-running sessions no longer stop old versions from being cleaned up. #​15113 (@​jdx)
• mise install pipx:<tool> no longer fails with missing lockfile entry when lockfile_platforms lists only the current platform. #​15091 (@​jdx, @​drewbitt)
• When api.github.com times out (5xx) listing releases for repositories with many assets per release, such as github:be5invis/Iosevka, mise now retries with smaller pages of 30 and then 10 releases instead of failing. #​15078 (@​jdx)
• mise version --json no longer reports a latest older than the running version, which happened with fresh or nightly builds because of minimum_release_age. #​15068 (@​jdx)
• mise backends switch no longer fails with No such file or directory when the locks/ directory next to it exists but is empty. Rollback after a failed switch also restores sidecar directories more reliably. #​15060 (@​zeitlinger)
• Packages from a custom aqua registry whose names are not in owner/repo form no longer print invalid aqua tool repeatedly. A name that no registry defines still fails with package not found. #​15048 (@​jdx, @​trothwell)
• A version file that links to a sibling version file, such as .nvmrc -> .node-version, no longer prints a not reading warning. Links to other files are still not read and still warn. #​15058 (@​jdx, @​owpac)
• Packslip versions held back by minimum_release_age or --before are now logged at debug level instead of printing one warning per version. #​15056 (@​jdx, @​owpac)
• Gem wrapper scripts now quote GEM_HOME and the executable path, so gems work when the install directory contains spaces or shell metacharacters. #​15055 (@​jdx)
• Remote git sources (HTTPS and SSH) now reject a ref that is empty, is HEAD, or starts with -. This stops option injection into git, and these sources now follow the same rules as plain git repo sources. #​14832 (@​Huge)

Documentation

• The secrets docs now note that reads through the fnox daemon require fnox 1.43.0. #​15115 (@​jdx)

New Contributors

• @​yusoofsh made their first contribution in #​15038
• @​gilesw made their first contribution in #​15074

Full Changelog: jdx/mise@v2026.10.21...v2026.10.22

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

v2026.10.21: : Easier dotfiles setup from a checkout or Stow packages, plus prune --force for casks

Compare Source

You can now keep mise's global config inside your dotfiles checkout, and deploy Stow-style packages without writing a table for each one. Dotfiles also get new protections for template entries, and mise bootstrap packages prune can force-remove casks it cannot prove are unchanged. The rest of the release fixes bugs in monorepos, lockfiles and pypi locking.

Added

• Bootstrap from a dotfiles checkout with --config-dir. mise bootstrap --from accepts --config-dir <path>. It links mise's config directory (~/.config/mise, or wherever XDG_CONFIG_HOME/MISE_CONFIG_DIR point) to that path inside the checkout, then bootstraps from it. config.toml, config.<env>.toml, conf.d/ and miserc.toml in the repository all act as global config from the first run. After that, git -C ~/.dotfiles pull && mise bootstrap is enough, and mise use -g and mise dot add write into the checkout.

  mise bootstrap --from <dotfiles-git-url> --from-dir ~/.dotfiles --config-dir .config/mise

  The path must stay inside the checkout. The existing config directory must be missing, empty, or already that link; mise refuses anything else and leaves it alone. --dry-run creates no link. The docs now recommend mise dot track ~/.config/mise, which tracks the whole config directory rather than only config.toml. Files ending in .local.toml stay on each machine. #​15025 (@​jdx, @​lhs-12, @​Mossop)

• Stow packages need no [dotfile_groups] tables. If a name in [bootstrap] dotfile_groups has no matching table but is a directory under dotfiles.root, mise treats it as a group with the default settings: that directory is deployed into ~ file by file. A table with the same name still overrides the defaults. mise dot add --group, mise dot unapply --group and orphan reporting work for these groups too. #​15025 (@​jdx, @​lhs-12, @​Mossop)

  [bootstrap]
  dotfile_groups = ["kitty", "nvim", "zsh"]

• mise bootstrap packages prune --manager brew-cask --force. This removes mise-installed casks that prune skips because it cannot prove they are unchanged, such as self-updating apps, casks with install steps, and casks installed before mise recorded prune metadata. Without --force, prune now lists which casks --force would remove. A forced prune removes only what the receipt recorded and only while it is still where mise put it. It still skips casks Homebrew owns, casks without a mise receipt, interrupted installs and shared targets. Use --dry-run to preview. #​14985 (@​jacobbednarz)

• mise dot apply warns before overwriting an edited template target. If you edited a rendered template target by hand since mise last wrote it, apply now warns that the edit will be overwritten and names the source to move it into. apply still overwrites the file, so unattended runs are not blocked. #​15020 (@​jdx, @​owpac)

• Registry: tuios (aqua:Gaurav-Gosain/tuios). #​14990 (@​Gaurav-Gosain)

Fixed

• Dotfiles
  • mise dot add on a mode = "template" entry now refuses by default. Before, it copied the rendered file over the template source, which deleted the template code and could write secrets pulled in with exec() into your repository in clear text. If you really want to capture the rendered file, pass --force. #​15019 (@​jdx, @​owpac)
  • Switching from Stow no longer destroys source files. When Stow had linked a whole directory into the source, symlink-each apply failed, and the suggested --force replaced each source file with a link to itself. Apply now replaces the folded link with a real directory of links, without needing --force. #​15025 (@​jdx, @​lhs-12, @​Mossop)
  • mise bootstrap --adopt --dry-run now previews the whole config directory, including conf.d/, config.<env>.toml and this machine's miserc.local.toml. Before, it only previewed config.toml. #​15025 (@​jdx, @​lhs-12, @​Mossop)
• Config and monorepos
  • With monorepo.config_roots = [".", "child"], a child with no tool overrides lost the tools it inherits from the root config and fell back to global versions. This broke mise install --monorepo --locked. Each declared root now loads its full config hierarchy. #​15023 (@​jdx, @​swizzlr)
  • Running mise run //app:task from the monorepo root with MISE_LOCKED=1 now looks up idiomatic version files such as app/.node-version in app/mise.lock, not the root lockfile. #​15021 (@​jdx)
  • When .nvmrc is a symlink to .node-version, the .node-version file is read again. mise still skips .nvmrc with a warning, but that skip no longer hides .node-version. Before, the directory resolved no Node version (regression in 2026.10.19). #​15006 (@​jdx, @​jjb)
• Lockfiles
  • mise lock now re-resolves platform entries whose URL points to a different release than the locked version. This happens, for example, after Renovate bumps the version in mise.lock. Before, mise lock left the old URL and checksum, and mise install --locked then refused the lockfile. #​15010 (@​jdx)
  • A mise lock sweep with no tool arguments no longer aborts when a pypi:/pipx: tool sets uvx_args or pipx_args. That tool gets a warning and a version-only lock entry. Naming the tool explicitly still errors. #​15030 (@​jdx)
  • For pypi: tools, mise lock now checks that the resolved uv dependency graph can actually be installed with uv sync --frozen --no-build. If it can't, for example because a dependency has no wheel for the interpreter, mise warns and keeps a version-only entry. Before, mise wrote a graph that the next mise install failed on. #​15031 (@​jdx)
• Other
  • mise doctor no longer lists uninstalled lazy = true tools as problems. The toolset list marks them (lazy), and --json adds "lazy": true. #​15024 (@​jdx)
  • packslip: installs on shared CI runners no longer fail when raw.githubusercontent.com returns a 429. mise now asks mise-versions whether a repository publishes a release list, and falls back to GitHub when the mirror is unavailable, use_versions_host is off, or a url_replacements rule applies. #​15032 (@​jdx)
  • SmolVM (smol-machines/smolvm) installs through aqua again. mise now rewrites the absolute symlinks in its guest root filesystem as relative links inside the install directory. Links that escape the install directory are still rejected. #​15015 (@​jdx)

New Contributors

• @​Gaurav-Gosain made their first contribution in #​14990

Full Changelog: jdx/mise@v2026.10.20...v2026.10.21

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.