v2026.9.6 v2026.9.7
jdx/miseSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Introduces lockfile revision 2 and dotfile conflict inspection.
Breaking Changes
- Lockfile revision 2 requires running `mise lock --upgrade`.
- Project-level `history.describe_command` configuration is ignored.
- OCI build templates cannot call `secret()`, `get_env()`, `exec()`, or `read_file()`.
New Features
- New `mise bootstrap dotfiles conflicts` command.
- Lockfile revision 2 records transitive dependency graphs for npm and Python.
- Dotfile templates can reference bootstrap secrets.
- Support for `mise install --locked` to replay recorded dependency graphs.
Improvements
- Security updates restrict `history.describe_command` to global config.
- Security updates restrict OCI build templates to prevent credential exposure.
- Support for `mise lock --bump` to refresh transitive graphs.
- `pypi:` is now the preferred name for the Python CLI backend.
Bug Fixes
- `minimum_release_age` no longer rejects versions committed to lockfiles.
- Closes security gap in `history.describe_command`.
Upgrade Notes
Run `mise lock --upgrade` to migrate existing lockfiles to revision 2. Move `history.describe_command` configuration from project-level to global config or environment variables. Update OCI build templates to remove restricted functions like `secret()` and `read_file()`.
The Two Releases
v2026.9.6: Project daemons, mise doctor project, and vfox backend tool discovery
Sep 12, 2026· 1 month ago
This release introduces experimental project daemons managed by Pitchfork, a `mise doctor project` command for custom diagnostics, and vfox backend tool discovery. It also improves performance for lockfile generation and OCI builds, along with various fixes for shells, monorepos, and bootstrap processes.
Full release notesv2026.9.7: Lockfile revision 2 with npm and Python dependency graphs, dotfile conflict inspection
Sep 13, 2026· 1 month ago
This release introduces lockfile revision 2 to record transitive dependency graphs for npm and Python tools, adds a command to inspect dotfile conflicts, and restricts dotfile templates in OCI builds to prevent credential exposure.
Full release notes