v2026.6.10

A focused release that adds a `default` shorthand for env vars, brings `.7z` archive support to Unix, and cleans up several long-standing PATH and shim edge cases on Linux, macOS, Windows, and WSL.

## Added
- **env:** New `{ default = "fallback" }` shorthand for `[env]` (and config/task `[vars]`). The default applies only when the variable is unset or empty; existing non-empty values from the process env or earlier config are preserved. Mixing `default` with `value`, `required`, or `age` now fails with a clear message ([#10441](https://github.com/jdx/mise/pull/10441) by @jdx).

  ```toml
  [env]
  EDITOR = { default = "vim" }       # only used if $EDITOR is unset/empty
  PORT   = { default = "3000" }
  ```

- **backend:** `.7z` archives now extract on Unix as well as Windows, and `strip_components` probing works cross-platform. Migrated from the unmaintained `sevenz-rust` to `sevenz-rust2`, and tightened extraction to reject directory traversal and absolute paths ([#10434](https://github.com/jdx/mise/pull/10434) by @risu729).

## Fixed
- **env:** When `env_shell_expand` is enabled, `${VAR:-default}` now follows POSIX semantics: empty strings are treated as missing (fallback applies), `${VAR-default}` only substitutes when the variable is unset, and fallback text is recursively expanded (e.g. `${NONEXISTENT:-$OTHER}`). Braced parsing is also stricter — unterminated `${…` stays literal and `}` inside `$(…)` no longer closes the brace ([#10445](https://github.com/jdx/mise/pull/10445) by @jdx, fixes [#10444](https://github.com/jdx/mise/discussions/10444)).
- **env:** `mise x` / `run` / `env` now strip mise-managed install directories from the inherited PATH when composing the child environment. Stale entries carried in from a frozen env snapshot (IDE terminals, CI wrappers, AI-agent harnesses) no longer sit ahead of the freshly injected bin dir, so subshells, `#!/usr/bin/env` shebangs, and package-manager workers all resolve the requested tool version ([#10422](https://github.com/jdx/mise/pull/10422) by @JamBalaya56562, addresses [#10345](https://github.com/jdx/mise/discussions/10345)).
- **vfox:** Plugin install hooks that shell out via Lua `os.execute` now run under the same sanitized `mise_env` as `cmd.exec`. Combined with new resolution of `tools = true` env *values* during install, this fixes setups like gcloud depending on python where a single `mise install` previously left `CLOUDSDK_PYTHON` pointing at a nonexistent path ([#10432](https://github.com/jdx/mise/pull/10432) by @JamBalaya56562, fixes [#10282](https://github.com/jdx/mise/discussions/10282)).
- **shims:** Windows extensionless bash shims now detect WSL (`WSL_DISTRO_NAME` / `WSL_INTEROP` / `WSLInterop`), drop their own dir from PATH, and `exec` the tool directly. This breaks the infinite `mise x` loop that happened when the Windows shims dir was exposed at `/mnt/c/...` inside WSL, and gives a clean `<tool>: not found` when no Linux tool is installed. `file`-mode shims are now also flagged version-stale so a normal reshim regenerates them on upgrade ([#10421](https://github.com/jdx/mise/pull/10421) by @JamBalaya56562, addresses [#10299](https://github.com/jdx/mise/discussions/10299)).
- **file:** `make_symlink` on Unix now creates the link at a unique temp name in the destination dir and atomically `rename(2)`s it into place. This eliminates the noisy `failed to ln -sf … File exists (os error 17)` warnings that surfaced when several mise processes (shell `hook-env`, direnv, editor integrations) raced on the same tracked-config link, e.g. when spawning a new git worktree ([#10414](https://github.com/jdx/mise/pull/10414) by @JamBalaya56562, fixes [#10292](https://github.com/jdx/mise/issues/10292)).
- **task:** On Windows, script-task lookup now prefers Windows-native variants (e.g. `.ps1`) over their extensionless siblings, and extensionless takeover only applies when the match is unambiguous and stays within the same config family ([#10443](https://github.com/jdx/mise/pull/10443) by @jdx).

## Changed
- **deps:** Replaced the unmaintained `number_prefix` (RUSTSEC-2025-0119) and stale `humansize` crates with `bytesize`. Size strings in generated `tool-stub` comments and `mise cache prune` output now use native `bytesize` IEC formatting — e.g. `821.69 KiB` becomes `821.7 KiB` and `2.15 MiB` becomes `2.2 MiB` ([#10438](https://github.com/jdx/mise/pull/10438) by @risu729).

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.6.9...v2026.6.10

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.