Release watcher
tools login

mise-en-place

notes:

Edit component notes:

 
Release list
2026.5.1: Aqua cosign and a reshim rescue
RECENT
2026.5.0: Conda graduates, smarter pres, and Windows POSIX tasks
RECENT
2026.4.28: Remote tasks pinned by commit SHA
RECENT
2026.4.27: npm install args, smarter watch, and a macOS shim recursion fix
RECENT
2026.4.25: Sharper task tooling and lockfile fixes
2026.4.24: Resilient downloads and global pre- opt-in
2026.4.23: Pre-s, libc preference, and a Node musl fix
2026.4.21: untrust command and prune lockfile fixes
2026.4.22: Repaired latest resolution and clearer deps output
2026.4.20: Lockfile cleanup and path: fixes
2026.4.19: OCI images, aqua templates, and more resilient installs
2026.4.18: Deps management, aube support, and vfox plugin dependencies
2026.4.17: install_before fixes, lockfile repair, and new registry tools
2026.4.16: Tera templates in inline tasks, raw_args passthrough, and runtime symlink paths
2026.4.15: Windows path separator fix and improved GitHub token detection
2026.4.13: Remote cache, Go install_before, and task tool objects
2026.4.14: Fix GitHub attestation verification for some tools
2026.4.12: OS/arch filtering, task confirmation defaults, and npm supply chain improvements
2026.4.11: Task dependency templates and npm semver range support
2026.4.10: Fix spurious warnings from postinstall hooks running tasks
Release notes:

A small patch release: remote tasks pinned to a commit SHA no longer panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes again.

Fixed

  • (task) Remote tasks referenced by commit SHA (a git:: source with ?ref=<40-char hex>) no longer crash mise with we map by name only and have no object-id in refspec from gix (#9473) by @jdx. gix-refspec parses any 40- or 64-char hex string as an ObjectId refspec, but gix::clone::fetch::util::find_custom_refname only handles name-based matches and expect()s on the result, so passing a bare SHA to prepare_clone.with_ref_name() triggered a hard process panic on every cache miss. Git::clone now detects SHA-shaped refs via a looks_like_sha heuristic, skips both the with_ref_name() and git clone -b paths (neither accepts bare SHAs), drops --depth 1 since shallow clones may not contain the requested object, and checks out the SHA after the clone via the existing CLI-backed update. Named branches and tags continue to use the existing fast paths. Closes #9472.

  • (copr) The copr-publish workflow no longer pins a stale ghcr.io/jdx/mise:copr image digest, and docker.yml now rebuilds the :copr image whenever packaging/copr/Dockerfile changes on main (#9451) by @bestagi. Previously the workflow kept hitting ModuleNotFoundError: No module named 'rich' even after #9421 switched copr-cli to dnf install, because the hardcoded digest still pointed at the old pip-installed image.

New Contributors

  • @bestagi made their first contribution in #9451

Full Changelog: https://github.com/jdx/mise/compare/v2026.4.27...v2026.4.28

Copyright © 2023 - All right reserved by Yadoc SAS