v2026.10.1

This release is mostly bug fixes. `mise run` now stops tasks properly when `--timeout` expires or you press Ctrl-C. Task daemons and native shims work better on Windows. `core:rust` now follows `mise.lock` and picks up new stable and beta toolchains. Lockfile, GitHub asset selection, Homebrew cask and plugin update problems are also fixed.

## Fixed

### Tasks

- **`mise run --timeout` now stops the tasks it was running.** Before, mise printed the timeout error and exited, but the task processes could keep running in the background. Now the whole-run timeout (`--timeout` or the `task.timeout` setting) stops tasks the same way a per-task `timeout` does. On Unix, mise sends SIGTERM and then SIGKILL after 5 seconds. On Windows, it runs `taskkill /F /T`. Tasks with `raw = true` are not stopped by the whole-run timeout. [#13876](https://github.com/jdx/mise/pull/13876) by @Marukome0743
- **A single Ctrl-C lets tasks shut down cleanly.** Before, one Ctrl-C could make mise exit right away while tasks were still cleaning up. This happened in three cases: a task that runs `mise run` itself got SIGINT twice; a tool like `docker compose up` treated the duplicate SIGINT as a force-quit; and a task that exits non-zero on SIGINT caused mise to send SIGTERM to its sibling tasks. Now mise waits for tasks to finish and then exits with status 130. A second Ctrl-C still force-quits. [#13904](https://github.com/jdx/mise/pull/13904)
- **Tab completion for the `:task` shorthand.** In a monorepo, `mise run :<TAB>` now suggests tasks from the current config root, and task flags complete after the shorthand. [#13882](https://github.com/jdx/mise/pull/13882) by @pikeas

### Daemons

- **Task daemons start on Windows.** A daemon declared with `task =` failed under `cmd /C` with `'exec' is not recognized`. mise now registers it as an argv command that pitchfork starts without a shell, so `args` reach the task exactly as written on every platform. **This needs pitchfork 2.28.0 or later.** With an older pitchfork, mise shows an error that tells you to upgrade, for example with `mise use pitchfork@latest`. Task daemons that use `init` still run through a shell, so they still don't work under `cmd /C`. [#13714](https://github.com/jdx/mise/pull/13714) by @JamBalaya56562
- **Daemon `run` commands can use `[env]` and `[vars]`.** Before, a template such as `{{ vars.test_var }}` failed with `Variable 'vars' is not defined`. `mise x` now renders the command when the daemon starts, using the project's `[env]`, `[vars]` and mise template filters. Pitchfork's own variables, such as `{{ name }}`, still work. This applies only to `run` and requires a pitchfork release newer than 2.29.0. [#13894](https://github.com/jdx/mise/pull/13894)

  ```toml
  [vars]
  greeting = "it's"

  [daemons.hello]
  run = "exec echo {{ vars.greeting | quote }} from {{ name }}"
  ```

### Windows shims

- **No more endless process chains from duplicate shim copies.** If two copies of `mise-shim.exe` were on PATH (for example, one from winget's `Links` directory), they could keep calling each other through `mise x`. Running `mise-shim` by its own name now exits with an error. If `mise x` resolves a tool to another shim copy, mise stops after one step and names the PATH directory to remove. [#13681](https://github.com/jdx/mise/pull/13681) by @JamBalaya56562
- **Node IPC works through the `node.exe` shim.** A Node parent that spawned the shim with an `'ipc'` stdio entry used to wait forever. JSON IPC messages and disconnects now pass through the shim. Passing socket or server handles over the channel is still not supported. [#13903](https://github.com/jdx/mise/pull/13903)

### Rust

- **`mise upgrade rust` updates `stable` and `beta`.** mise didn't recognize rustup 1.29's new `update available:` text. Even when it detected an update, the upgrade skipped the toolchain as already installed. mise now reads both spellings, counts only updates for the toolchain it manages, and updates the toolchain in place. If the update fails, the old toolchain stays usable. [#13898](https://github.com/jdx/mise/pull/13898)
- **`core:rust` follows `mise.lock`.** mise mistook rustup's symlinks for `mise link`ed versions, so it ignored the lockfile and installed the newest version even with `locked = true`. [#13915](https://github.com/jdx/mise/pull/13915)

### Backends, lockfiles and bootstrap

- **GitHub auto-detection no longer installs metadata files.** SBOMs, signatures, checksums and other sidecar files with platform names, such as `*.tar.gz.sbom.json`, could be chosen as the tool and saved to `mise.lock`. Automatic selection now skips them. Explicit `url` and `asset_pattern` options are unchanged. [#13908](https://github.com/jdx/mise/pull/13908)
- **`mise lock` removes outdated duplicate entries.** After you changed a tool option, for example by adding `uvx = false` to a `pipx:` tool, `mise lock --upgrade` could leave the old unbound entry next to the new bound one. Unfiltered `mise lock` runs now remove the old entry, unless it has platform data (checksum or URL) that the new entry doesn't have. [#13909](https://github.com/jdx/mise/pull/13909)
- **Aqua registry cache errors after upgrading.** Compiled registry caches from earlier versions could load but then fail when a package was resolved. mise now ignores those caches and rebuilds them. [#13884](https://github.com/jdx/mise/pull/13884)
- **Packslip installs retry missing skills.** If the binary installed but a declared skill couldn't be fetched, mise still marked the install as complete. Now the install fails with an error. The next `mise install` fetches only the missing skills and doesn't reinstall the tool. [#13885](https://github.com/jdx/mise/pull/13885)
- **Pkg-based `brew-cask` packages are no longer reinstalled on every run.** Casks such as `google-drive` list package IDs for several architectures, and mise expected every one of them to be installed. Receipts now store only the patterns that match on your machine. Casks recorded by earlier versions are reinstalled once to write a corrected receipt. [#13893](https://github.com/jdx/mise/pull/13893)
- **`mise plugins update` works when the remote isn't named `origin`.** This happens, for example, when git's `clone.defaultRemoteName` is set to something else. mise uses `origin` if it exists and otherwise uses the first remote. [#13914](https://github.com/jdx/mise/pull/13914)

## Changed

- `mise skills sync`, the table output of `mise skills ls`, and other human-facing messages now show paths under your home directory with `~`. This includes output from `mise deps install`, task source lines, `mise completion --install` and daemon messages. `--json` output and script-oriented commands still print full paths. [#13910](https://github.com/jdx/mise/pull/13910)

**Full Changelog**: https://github.com/jdx/mise/compare/vfox-v2026.10.0...v2026.10.1

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.