v2026.9.8

Dotfile management moves to the top level as `mise dot`, Homebrew bootstrap installs run their download, extraction, and linking stages concurrently, and several install paths are corrected: embedded aube reputation gates now report the real reason and honor `--yes`, PyPI tools fall back to version-only installs when a dependency graph cannot be built, lazy tools no longer trigger `missing:` warnings, and lockfiles no longer resurrect disabled backends.

## Added
- **dotfiles:** The full dotfiles command tree is now available as `mise dotfiles`, with `mise dot` as a short alias. `mise bootstrap dotfiles` remains supported and all three spellings share the same behavior, including bootstrap hooks around `apply`. Generated history-watch services now invoke `mise dot watch`. ([#13158](https://github.com/jdx/mise/pull/13158) by @jdx)

  ```sh
  mise dot track ~/.zshrc
  mise dot status
  mise dot history
  ```
- **dotfiles:** Enabling encryption on a file that was previously saved in plaintext left older commits that blocked sync. `mise dot sync --allow-plaintext-history` lets that history reach the origin for one run, and the global-only setting `settings.history.allow_plaintext_history = true` (default `false`, env `MISE_HISTORY_ALLOW_PLAINTEXT_HISTORY`) does the same for sync, publish, the history watcher, and incoming history on pull. New saves still follow the file's encryption policy; the history guide also documents how to remove the old commits instead. ([#13175](https://github.com/jdx/mise/pull/13175) by @jdx)
- **registry:** Added `poppler` (`conda:poppler`), providing `pdftotext`, `pdfinfo`, `pdftoppm`, `pdftocairo`, `pdfunite`, and the other Poppler PDF utilities. ([#13133](https://github.com/jdx/mise/pull/13133) by @i-api)

## Fixed
- **npm:** Embedded aube reputation gates (low weekly downloads, similar-name, new package name) no longer surface as a misleading `user aborted mise add` error when stdin is closed or no terminal is attached. Non-interactive installs now report the measured signal (for example 569 weekly downloads against the 1000 threshold) and suggest the mise-native fix, `allow_low_downloads = true` on the tool; an explicit "no" reports `user declined to add <package>`. An explicit CLI `--yes` now reaches the aube prompt and approves it, including auto-installs through `use`, `exec`, `run`, `shell`, and `upgrade`; CI mode and a configured `yes = true` setting alone do not approve reputation gates. ([#13123](https://github.com/jdx/mise/pull/13123) by @jdx)
- **pypi:** Ordinary `mise install` of `pypi:`/`pipx:` tools no longer fails when a uv dependency graph cannot represent the package or its configuration, such as a source-only dependency or free-form `uvx_args`/`pipx_args`. mise warns and falls back to the version-only install path, reusing an existing version-only installation on later runs. `mise lock` and `mise install --locked` remain strict and still reject unsupported arguments or dependencies without usable wheels. ([#13170](https://github.com/jdx/mise/pull/13170) by @jdx)
- Tools declared with `lazy = true` are no longer reported as `missing: <tool>` when entering a project or running a bare `mise install`, regardless of `status.missing_tools`; ordinary missing tools are still reported as before. ([#13169](https://github.com/jdx/mise/pull/13169) by @jdx)
- **backend:** Backend discovery from lockfiles now skips backends listed in `disable_backends`. When a parent `mise.lock` pins a shorthand such as `yarn` to `asdf:yarn` and a child project disables asdf, `mise tool yarn --backend` and a fresh child `mise lock` now select the first enabled recorded backend or fall back to the enabled registry backend (`aqua:yarnpkg/berry`) instead of the disabled pin. The parent lockfile is left unchanged and explicitly installing a disabled backend still fails. ([#13178](https://github.com/jdx/mise/pull/13178) by @jdx)

## Changed
- **bootstrap:** `mise bootstrap packages apply` installs Homebrew packages substantially faster. Formula metadata for each dependency frontier is fetched concurrently, bottles are extracted, relocated, signed, and receipted concurrently, and each job now downloads and prepares its own bottle so prepared bottles are committed as soon as dependency order allows. All stages respect the existing `jobs` limit with no new settings; Cellar commits and prefix linking stay dependency-ordered, `opt/<name>` is linked last so an interrupted install cannot look complete, and a failure cancels queued work while cleaning up in-flight staging. On Apple silicon, a fresh install of `brew:jq brew:tree brew:wget brew:just brew:shellcheck` dropped from roughly 6.6s to 4.0s, and dependency resolution for `brew:ffmpeg` from 288ms to 112ms. ([#13151](https://github.com/jdx/mise/pull/13151), [#13152](https://github.com/jdx/mise/pull/13152), [#13155](https://github.com/jdx/mise/pull/13155) by @jdx)

## Documentation
- The npm backend, PyPI backend, and `mise.lock` guides now open with quick-start and everyday workflows (`mise use node@24 npm:prettier`, `mise use python@3.14 uv pypi:black`, `mise lock`, `mise install --locked`) and group dependency-graph locking, sidecar management, and strict-mode details afterward. The lockfile guide clarifies that URL-lock exemptions do not exempt dependency graphs from validation. ([#13149](https://github.com/jdx/mise/pull/13149) by @jdx)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.9.7...v2026.9.8

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.