v2026.9.5

This release deepens macOS bootstrap support with current-host and nested defaults, lets dotfiles and tasks adapt to the platform and to parsed arguments, and adds an opt-in trial of complete lockfile generation. It also carries a batch of install progress, self-update, brew-cask, and sandbox fixes.

## Added
- **bootstrap:** New `[[bootstrap.macos.defaults_entries]]` blocks let you set macOS preferences explicitly with `domain`, `key`, `value`, and an optional `host` (`any` by default, or `current`), covering preferences normally written via `defaults -currentHost` while keeping the existing `[bootstrap.macos.defaults]` shorthand. Entries also accept an optional `path` to patch a nested dictionary value without replacing its siblings, preserving property-list types and creating missing parents. ([#12983](https://github.com/jdx/mise/pull/12983) by @azohra, [#12984](https://github.com/jdx/mise/pull/12984) by @azohra)

  ```toml
  [[bootstrap.macos.defaults_entries]]
  domain = "com.apple.dock"
  key = "autohide"
  value = true
  host = "current"
  ```
- **bootstrap:** More friendly macOS preferences: Finder folder sorting and default cloud save location, Dock autohide delay and timing (integers or floats), and keyboard automatic capitalization and spelling correction, all using snake_case names consistent with the existing sections. ([#13032](https://github.com/jdx/mise/pull/13032) by @jdx)
- **bootstrap:** `[bootstrap.files]` and `[bootstrap.directories]` entries gain `phase = "pre-packages"` so repository definitions, apt sources, and signing keys can be applied before package installation instead of only afterward. Existing declarations default to `"post-packages"`. ([#13052](https://github.com/jdx/mise/pull/13052) by @jdx)

  ```toml
  [bootstrap.files."/etc/apt/sources.list.d/vendor.sources"]
  source = "./files/vendor.sources"
  phase = "pre-packages"
  ```
- **bootstrap:** Ordinary `[bootstrap.files]` templates can now reference resolved `[vars]` values, alongside the existing `config_root`, `target`, and `secret()` helpers. ([#13033](https://github.com/jdx/mise/pull/13033) by @nettlesh)
- **dotfiles:** A single dotfiles source can deploy to different destinations per operating system, architecture, or mise profile using `variants` with an optional `target`. This works for `copy`, `symlink`, `symlink-each`, and `template` modes. ([#13050](https://github.com/jdx/mise/pull/13050) by @jdx)

  ```toml
  [dotfiles.settings]
  source = "dotfiles/vscode/settings.json"
  mode = "copy"
  variants = [
    { os = "macos", target = "~/Library/Application Support/Code/User/settings.json" },
    { os = "linux", target = "~/.config/Code/User/settings.json" },
  ]
  ```
- **task:** Task `sources` and `outputs` can now use `{{usage.*}}` templates, resolved per invocation from parsed arguments and flags before freshness and artifact-cache checks run, so different argument values track freshness independently. ([#13051](https://github.com/jdx/mise/pull/13051) by @jdx)
- **brew-cask:** Casks with structured `set_permissions` preflight/postflight steps now install correctly (for example `brew-cask:blender`), running an unprivileged `chmod` over resolved staged or appdir paths instead of failing with an unsupported step-type error. ([#13043](https://github.com/jdx/mise/pull/13043) by @azohra)
- **lock:** Opt-in trial of complete lockfile generation via `lockfile_mode = "generate"` (or `MISE_LOCKFILE_MODE=generate`). The default remains incremental `merge`. Generate mode rebuilds lockfiles from current requests while treating the previous file as an immutable baseline, reusing unchanged artifacts and publishing through staged atomic writes so failures or concurrent edits do not clobber a good lockfile. This mode records only cryptographically verified provenance per target platform; `provenance_verified` is no longer treated as a trust signal. ([#13031](https://github.com/jdx/mise/pull/13031) by @jdx)
- **self-update:** New `disable_update_warning` setting (`MISE_DISABLE_UPDATE_WARNING`) suppresses "newer mise available" notices in `mise version`, `mise --version`, and `mise doctor`. Explicit self-update and automatic updates are unaffected. ([#13028](https://github.com/jdx/mise/pull/13028) by @jdx)

## Fixed
- **install:** Interactive installs no longer leave a permanent line for every resolved, skipped, or already-installed tool; live progress shows what is happening while the final summary lists what changed (for example `installed 1 tool in 1.1s: dummy@1.0.0`). `mise upgrade` no longer duplicates its old to new version list. ([#13030](https://github.com/jdx/mise/pull/13030) by @jdx)
- **install:** Long non-TTY installs no longer flood CI logs with a snapshot every three seconds. The heartbeat now scales to roughly 10% of elapsed time, clamped between 3 seconds and 1 minute. ([#13036](https://github.com/jdx/mise/pull/13036) by @jdx)
- **self-update:** On 32-bit ARM, `mise self-update` now selects the correct `linux-armv7` archive instead of requesting a missing `linux-arm` one and falling back to an ARM64 binary that failed signature verification. A missing archive now fails asset selection rather than picking the wrong architecture. ([#13023](https://github.com/jdx/mise/pull/13023) by @jdx)
- **self-update:** npm installs now ship the instructions file that redirects update guidance to the package manager, so they no longer advertise `mise self-update`. ([#13028](https://github.com/jdx/mise/pull/13028) by @jdx)
- **brew-cask:** `mise bootstrap packages upgrade` no longer replaces the bundle of a running self-updating app (for example Chrome), which could strand helper processes and blank out tabs. Such apps are skipped while running and left to update themselves. ([#13041](https://github.com/jdx/mise/pull/13041) by @azohra)
- **brew-cask:** The cask metadata fetch error no longer includes stale advice about installing with `brew` and a broken documentation anchor; it now gives a short, accurate message. ([#12800](https://github.com/jdx/mise/pull/12800) by @Marukome0743)
- **bootstrap:** `mise bootstrap dotfiles origin set <url>` now uses the repository's own default branch when `--branch` is omitted, so repositories on `master` connect correctly instead of publishing a second root branch. A missing requested branch is now reported clearly rather than mistaken for an empty repository. ([#13037](https://github.com/jdx/mise/pull/13037) by @Dhaulagiri)
- **dotfiles:** History watcher locks now live alongside the history store in the state directory instead of being hashed into the cache directory, so a launchd watcher and an interactive shell using different cache directories coordinate correctly and `dotfiles status` no longer misreports `declared-not-running`. Existing watchers must be stopped and restarted with the updated binary. ([#13038](https://github.com/jdx/mise/pull/13038) by @ascarter)
- **sandbox:** The macOS Seatbelt profile now allows `file-read-metadata` on the ancestors of readable paths, fixing `Operation not permitted` failures when a portable Ruby resolves its own executable during third-party tap evaluation. Symlinked data directories and allow-listed paths are also handled. ([#13039](https://github.com/jdx/mise/pull/13039) by @Marukome0743)

## Registry
- Added `clipboard` ([github:Slackadays/Clipboard](https://github.com/Slackadays/Clipboard)) by @i-api in [#13044](https://github.com/jdx/mise/pull/13044)

## New Contributors
- @Dhaulagiri made their first contribution in [#13037](https://github.com/jdx/mise/pull/13037)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.9.4...v2026.9.5

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.