mise-en-place

mise is much faster in this release and calls the GitHub API far less. Version lists, release tags, attestations and other public GitHub metadata now come from mise-versions, so everyday commands like mise install, exec, shims, outdated, lock and self-update are quicker and users without a GitHub token no longer run into the 60-requests-an-hour limit. Cached version lists are reused for longer, so repeat installs skip most lookups. It also adds mise bootstrap --upgrade and mise env --paths, and closes a trust gap in remote task files.

Speed and GitHub API usage

Cold-cache timings for v2026.10.10 versus v2026.10.11, measured with hyperfine on one Linux x64 machine with no GitHub token set:

The install and outdated runs are noisy (±0.1–0.4s over 4 runs) and the install time includes downloads, so treat them as rough. Requests to api.github.com in a cold mise install of github: tools dropped from 2 to 0. Cold mise outdated made 8 network requests before and none now.

• Public GitHub metadata comes from mise-versions. With use_versions_host on (the default), release lists, latest, git tags (aqua github_tag packages, ubi and go), artifact attestations (including aqua's predicate_type filters) and the digest in the checksum-mismatch hint are read from mise-versions instead of api.github.com. GitHub is still asked directly for repositories mise-versions doesn't list when you have a token (the private-repository case), and in paranoid mode for attestations. The direct API is also used with use_versions_host = false, GitHub url_replacements and custom api_urls. #14460, #14461, #14469, #14481, #14477, #14443
• Other requests also moved off the GitHub API:
  • mise x, mise exec, shims and hook-env use mise-versions when they auto-install a tool. #14458
  • mise self-update reads mise's releases from mise-versions and downloads the archive from github.com release downloads. Packslip and zipsign verification are unchanged. #14464
  • mise lock downloads artifacts for provenance checks from github.com instead of the API asset endpoint. #14465
  • Aqua registries hosted on GitHub are fetched from raw.githubusercontent.com. #14470
  • Ruby looks up the latest ruby-build release through mise-versions. #14471
• Fewer version-list fetches. mise install, use and run now reuse a cached version list for the tool's minimum_release_age window minus one hour, clamped to 1–24h. With the default 24h cutoff, that is 23h. outdated, upgrade, ls-remote, lock and latest still refresh after 1h. If you set fetch_remote_versions_cache yourself, your value applies to every command. #14484, #14485, #14457
• Faster version resolution:
  • Multi-tool commands such as mise outdated can resolve many registry tools with one request to the mise-versions index. #14473
  • latest is resolved without refetching the list. #14456
  • Explicit backend args such as aqua:jqlang/jq reuse the registry tool's version list. #14459
  • Release tags come from the versions host instead of being listed or guessed. #14442
  • Packslip installs no longer re-download what resolution already verified. #14466
  • Install tracking and the Python version list are served from static assets. #14441
• Python version listing no longer clones pyenv. mise ls-remote python, outdated, upgrade and fuzzy mise use python@3.12 read the python-build definitions from mise-versions. A cold listing took about 960ms before and about 90ms now. pyenv is still cloned when mise compiles Python, when python.pyenv_repo points at a fork, when you're offline, or when use_versions_host = false. Some definitions that had no date before now have one, so they are held back by minimum_release_age until they are old enough. #14455
• mise oci build now requires root for apt: packages, as it already did for apk, and fails up front with a clear message. If apt-get still fails, the error now includes the last lines of dpkg's output. #14447
• Registry: native-sdk now installs from npm (@native-sdk/cli), so the native command works. It requires Node 24+. #14431

Security

• Remote task files now need trust before their headers render. A mise.toml with only [tasks] loads without trust. Before this fix, if one of those tasks set file to a remote URL, mise tasks ls, mise tasks info and mise tasks validate rendered the file's #MISE headers, so a template like {{ exec(...) }} ran without a trust prompt. Remote files now follow the same rule as local task includes: if the headers contain template syntax, the config that references them must be trusted first. Remote files with plain headers still list without trust, and braces in the script body need no trust. #14416 (@JamBalaya56562, @risu729)
• Updated rustls to 0.23.46 to address a RustSec advisory. #14434

Added

• mise bootstrap --upgrade installs what is missing and then upgrades what is already installed, in a single run. In the packages phase it runs the same upgrade as mise bootstrap packages upgrade, and pins are respected. In the tools phase it runs mise upgrade without --bump, so configured version ranges hold. Both run before the matching post hooks and dependent services. --dry-run previews both steps and --skip works as before. It does not update mise itself, repositories or images, and it does not restart services. #14433

  mise self-update --yes && mise bootstrap --upgrade
  

• mise env --paths prints the PATH entries mise manages, one per line and in PATH order: tool bin directories, _.path entries, and inherited directories that mise moves forward, such as ~/.cargo/bin. This lets CI integrations export only mise's additions without diffing PATH. #14429

  $ mise env --paths
  /home/me/.local/share/mise/installs/node/24.11.0/bin
  /home/me/.cargo/bin
  

• The install script downloads pinned versions from mise.jdx.dev. curl https://mise.run | MISE_VERSION=<version> sh now tries mise.jdx.dev first and falls back to GitHub Releases if that download fails. Checksums for pinned versions still come only from GitHub's SHASUMS256.txt. If no checksum is found, the script refuses to install. MISE_INSTALL_FROM_GITHUB=1 still uses GitHub only. #14446

• Registry: gdal installs the GDAL/OGR command-line tools from conda-forge (conda:libgdal-core). #14440 (@ivan-ivkovic)

Fixed

• A bare mise upgrade no longer installs lazy tools that have never been installed. Naming the tool still installs it. A lazy tool that already has a version installed upgrades as before. A missing lazy tool is still installed if an upgraded tool depends on it. mise outdated now marks these tools as [MISSING] (lazy), and the bare upgrade no longer looks up their versions. #14422 (@ryanrhughes), #14444
• Fixed false stack limit reached errors on the static musl builds, for example on Ubuntu 26.04. These errors broke aqua version_filter parsing and made shims such as kubectl's report "not a valid shim". #14450
• mise lock --platform ... run on Alpine or NixOS no longer records Node source builds for other platforms. Only an explicit node.compile or all_compile = true forces source builds for those targets. #14432
• mise upgrade --bump and hand-edited version pins no longer drop a pipx tool's locked uv dependency graph. Before, mise install --locked then failed on a fresh checkout. #14426 (@wislertt)
• Packslip prefixes such as fnox@1 now skip releases this host can't install, the same way latest does. Each skipped release gets a warning, and if no match can be installed, mise reports a clear error. #14467
• A bash shim ahead of /bin no longer causes a false "shim fallback recursion detected" error for commands like bash -c 'bash --version'. The docs now recommend installing shells with the system package manager instead of [tools]. #14475
• Bootstrap UFW rules with an interface now render the incoming direction (ufw allow in on tailscale0 ...), which fixes Invalid token 'on' errors. #14480
• Dotfiles:
  • Before the files: apply prompt, mise now lists each file it will create, overwrite or remove and warns that local edits will be replaced. The prompt now defaults to No. #14430
  • mise dot add --changed now also captures edited files that a copy-mode dotfile_groups root discovers automatically, not just files listed explicitly in entries. #14436

Documentation

• The docs now recommend committing mise.lock, so CI and Docker builds skip version lookups. #14453

New Contributors

• @ivan-ivkovic made their first contribution in #14440

Full Changelog: https://github.com/jdx/mise/compare/v2026.10.10...v2026.10.11

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.