mise-en-place

This release brings Windows bootstrap into the package-manager era with WinGet support, extends the packslip signing model to vfox plugins, and speeds up simple tasks by skipping the shell on Unix. It also carries a batch of bootstrap, sandbox, and Windows ARM64 fixes.

Added

• bootstrap: WinGet is now a built-in [bootstrap.packages] manager on Windows, so mise bootstrap packages can check status, install, and upgrade apps by exact package ID. It supports version pins, source refresh, and automatic source-agreement acceptance. Scoop, Chocolatey, and package removal remain future work. (#12928 by @jdx)

  [bootstrap.packages]
  "winget:Microsoft.PowerShell" = "latest"
  

• vfox: External vfox plugins can now be installed from signed packslip archives instead of a Git clone, reusing the packslip backend's release selection, signature verification, digest checks, and signer pins. This is aimed at non-registry plugins; registry defaults and embedded plugins are unchanged. (#12948 by @jdx)

  mise plugins install vfox:bfs 'packslip:mise-plugins/vfox-bfs#0.1.0'
  

• bootstrap: Dotfile line edits gain position = "prepend" to insert a managed line at the top of a file instead of appending (the default). An existing exact match is left in place, and unrelated bytes, CRLF endings, and a UTF-8 BOM are preserved. (#12941 by @jdx)

  [dotfiles]
  "/etc/zshrc/zdotdir" = { line = 'ZDOTDIR=$HOME/.config/zsh/', position = "prepend" }
  

• bootstrap: macOS bootstrap defaults now support nested TOML arrays and tables (for example Dock persistent-apps), reading and writing preferences through Core Foundation so booleans, numbers, strings, arrays, and dictionaries keep their plist types. Collections apply as whole-value replacements; datetimes and binary plist data are still skipped with a warning. (#12947 by @jdx)

Changed

• bootstrap: Adopting global configuration or a shared dotfile-history setup repository is now spelled mise bootstrap --adopt (and mise bootstrap remote --adopt), separate from mise bootstrap --from for running a bootstrap project. The dotfiles, history, setup, and services guides were reorganized to lead with usable examples. The previous --from-git spelling still works as a hidden alias but warns and is scheduled for removal in mise 2026.10.0. (#12953 by @jdx)

Fixed

• github: Git operations (clones, fetches, submodules) that GitHub now challenges with HTTP 401 on public repositories can authenticate using mise's existing GitHub token sources via a command-scoped github.com HTTPS credential helper. Tokens are kept out of command arguments and URLs, and Enterprise hosts are out of scope. (#12945 by @jdx)
• config: The default inline task shell is now sh -o errexit -c so shells that consume the argument right after -c (such as FreeBSD sh) run your command instead of trying to execute -o. (#12949 by @jdx)
• windows: Fixed two Windows ARM64 issues: stale command-wrapper shims (like a leftover cargo.exe) that caused recursive .exe/.cmd dispatch after shim-mode changes are now pruned, and Aqua ARM64 emulation candidates apply the registry's amd64 replacement so tools like LuaLS resolve their published win32-x64 assets. (#12931 by @jdx)
• bootstrap: Bootstrap no longer aborts on Arch when pacman -Q prints a file advisory for a missing package that shares its name with a directory in the current working directory (for example a fish/ folder in a dotfiles checkout). (#12932 by @nettlesh)
• sandbox: Read-restricted macOS Seatbelt profiles now allow metadata-only access to /private, fixing startup failures for load-relative binaries like Ruby 4.0.6 when run under /private/tmp. Directory listings and descendant reads stay denied. (#12940 by @jdx)
• bootstrap: The macOS notification helper is now built and Developer ID-signed at release time and spawned with a start handshake, so short dotfiles sync runs no longer race the helper and macOS accepts it. Unsigned source builds (such as Homebrew) disable notifications and warn during origin setup. (#12946 by @jdx)
• vfox: vfox install phases now flow through the active install progress reporter, mapping noisy download, checksum, attestation, and extraction lines into concise phases instead of scrolling log output. (#12944 by @jdx)
• java: The java -version banner shown during install verification now stays inside the interactive install progress row instead of printing to the terminal. (#12943 by @jdx)
• version: The auto-update hint from mise version now uses the mise settings auto_update=true syntax to match the rest of mise settings. (#12957 by @jdx)

Performance

• On Unix, plain inline commands (like node build.js) now run directly when a conservative planner deems them safe, skipping the shell wrapper. Anything involving shell syntax, quoting, expansion, builtins, ambiguous PATH lookup, explicit shell settings, or sandboxed/audited tasks still uses the shell, and Windows is unchanged. In a microbenchmark of short commands this cut about 11% off elapsed time. (#12950 by @jdx)

Registry

• Added cargo-deny, kingfisher, nushell, shellharden, sherif, and tauri-cli. (#12938 by @jrandolf)

Documentation

• Restored the prominent project name and pronunciation on the homepage. (#12936 by @jdx)
• Dropped the "you need Git installed" prerequisite from the install docs. (#12958 by @jdx)

Full Changelog: https://github.com/jdx/mise/compare/v2026.9.2...v2026.9.3

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.