v2026.9.18 v2026.10.0
jdx/miseSep 30, 2026 → Oct 2, 20262 days between releases
What's New
Tightens security with stricter cosign checks and requires trust for .tool-versions inline options.
Breaking Changes
- --from-git removed from mise bootstrap
- vfox tool plugins using keyless cosign must now pin an identity
New Features
- Per-cask appdir option for Homebrew
- slsa_signer_identity and slsa_signer_issuer options for aqua tools
- New Cloudflare CF registry support
- New Releases page in docs
Improvements
- New Releases page in docs
Bug Fixes
- Fixed locked SLSA installs and musl hosts
- Fixed mise backends switch
Upgrade Notes
Replace --from-git with ?ref= in mise bootstrap commands. Update vfox tool plugins to pin cosign identities. Run mise trust for projects using inline options in .tool-versions.
The Two Releases
v2026.9.18: Remote config includes, OCI task catalogs, and a trust fix for inline tool options
Sep 30, 2026· 22 days ago
This release introduces remote config includes from git or OCI registries, adds support for OCI task catalogs, and fixes a critical security vulnerability where inline tool options could leak tokens to unauthorized hosts.
Full release notesv2026.10.0: Stricter signer checks for cosign and GitHub attestations, trust for inline options in .tool-versions
Oct 2, 2026· 20 days ago
This release significantly tightens supply-chain security by enforcing stricter identity checks for cosign and GitHub attestations, while introducing new features like per-cask app directories and registry support for Cloudflare's CF CLI.
Full release notes