v2026.10.2

This release adds an experimental `spinel:` backend for compiling Ruby CLIs to native binaries. The `mise.toml` schema now checks each backend's own tool options, and daemon presets work on Windows. It also includes fixes for shell activation with untrusted configs, task timeouts and Windows quoting.

## Added

- **Experimental `spinel:` backend.** It builds a Ruby command-line tool from a GitHub repository into a native executable using [Spinel](https://github.com/matz/spinel), Matz's Ruby AOT compiler. Versions come from git tags through `git ls-remote`, so listing them doesn't call the GitHub API. Available options: `entrypoint`, `bin`, `tag_prefix`, `source_ref` and `spinel`. You need the `spinel` compiler on `PATH` (mise doesn't install it yet) and `mise settings experimental=true`. It works on macOS and Linux only, and it may be removed later if it becomes a maintenance burden. Based on [nateberkopec/mise-backend-spinel](https://github.com/nateberkopec/mise-backend-spinel). [#13922](https://github.com/jdx/mise/pull/13922)

  ```toml
  [tools."spinel:tobi/try"]
  version = "1.10.1"
  entrypoint = "try.rb"
  bin = "try"
  tag_prefix = "v"
  ```

- **Typed tool options in the JSON schema.** Editors that use `schema/mise.json` now validate and autocomplete options for each backend, based on the tool's prefix. This covers github, gitlab, forgejo, ubi, http, s3, aqua, cargo, npm, pypi/pipx, gem, go, conda, spm, packslip and spinel. It also covers core-tool options for `python`, `java`, `rust` and `dotnet`, per-platform overrides (`platforms.<os>-<arch>`) and `[tasks.*.tools]` tables. For example, a numeric `asset_pattern` or `java` `release_type = "stable"` is now flagged. Boolean options accept `true`/`false`, `"true"`/`"false"` and `1`/`0`, the same values mise accepts. `lazy_bins` accepts a single string. The deprecated `experimental_monorepo_root` key is allowed again. Runtime behavior is unchanged, but your editor may now flag mistakes in existing configs. [#13924](https://github.com/jdx/mise/pull/13924)
- **Daemon presets on Windows.** `mise daemons start` no longer refuses preset daemons on Windows. Every preset except `redis`, which has no Windows build, now runs under pitchfork's default `cmd /C` shell. For PostgreSQL to stop cleanly, you need pitchfork 2.29.0 or later. PostgreSQL also won't start from an elevated prompt. Windows reserves some port ranges for Hyper-V and WSL, so a preset's default port can be blocked. If it is, set a different one with `ports`. [#13929](https://github.com/jdx/mise/pull/13929) by @JamBalaya56562

  ```toml
  [daemons.db]
  preset = "postgres"
  version = "18"
  options = { database = "app" }
  ```

- **Install mise with packslip.** The installation guide now covers installing mise's signed release without running an install script. packslip verifies the Sigstore signature and the archive digest. `mise self-update` works with this install method. [#13710](https://github.com/jdx/mise/pull/13710)

  ```sh
  packslip install github.com/jdx/mise --pin ps1_nlhmwtfeufglxv5myvwvronk7a
  ```

## Fixed

### Config and activation

- **An untrusted project config no longer breaks shell activation.** Before, `mise hook-env` failed completely, so tools and env from your trusted global config were not applied either. Now it skips the untrusted file, prints the usual one-time warning and loads everything else. Explicit commands such as `mise run` and `mise x` still error on untrusted configs. [#13919](https://github.com/jdx/mise/pull/13919)
- **A failed settings reload is reported as an error instead of crashing.** Commands such as `mise install`, `mise use`, `mise upgrade` and `mise ls-remote --prerelease` reload settings partway through. Before, a failed reload aborted mise with SIGABRT and a core dump. Now mise prints `failed to reload settings` with the cause and keeps using the previous settings. [#13925](https://github.com/jdx/mise/pull/13925)
- **`--no-config` and `MISE_NO_CONFIG=1` now skip `.miserc.toml` discovery.** Before, a malformed project, global or system miserc broke commands like `mise --no-config version`. [#13926](https://github.com/jdx/mise/pull/13926) by @donbeave

### Tasks

- **A timed-out task fails even if it exits cleanly.** On Unix, a task that caught SIGTERM and exited 0 after its `timeout` was reported as successful. Now `mise run` reports `timed out` and exits non-zero. [#13930](https://github.com/jdx/mise/pull/13930) by @Marukome0743
- **Timed-out tasks on Windows can clean up.** When a task hits its `timeout`, mise now sends it Ctrl+C and gives it 5 seconds before ending its process tree, the way Unix uses SIGTERM followed by SIGKILL. For example, PowerShell `finally` blocks now run. Only the timed-out task gets the Ctrl+C. The whole-run `mise run --timeout` still stops tasks immediately on Windows. [#13889](https://github.com/jdx/mise/pull/13889) by @JamBalaya56562

### Windows

- **`mise exec -- cmd /c` keeps double quotes.** Before, `mise exec -- cmd /c 'echo "a b"'` printed `\"a b\"`. Pitchfork daemons with `mise = true` whose `run` contained a quote, such as a quoted program path with a space, also failed to start. mise now passes a single quoted command after `/c` or `/k` to cmd unchanged. [#13887](https://github.com/jdx/mise/pull/13887) by @JamBalaya56562
- **Task daemons with `init` steps start under `cmd.exe`.** Before, they failed with `'exec' is not recognized`. On Windows, mise now builds the command with cmd quoting and escaping. Write `init` steps as cmd commands. [#13928](https://github.com/jdx/mise/pull/13928) by @JamBalaya56562

### Other

- **packslip follows repositories that moved to a new owner.** mise now treats a transfer like a rename, matching on repository ID with a one-time warning. It still refuses a different repository that reuses a deleted repository's name. Refusal messages now tell you which records to clear: `mise packslip forget`, the tool's `mise.lock` entries, or both. Existing pins and lockfile entries still load. [#13710](https://github.com/jdx/mise/pull/13710)
- **`mise dot save` and history sync work after a tracked directory is replaced by a symlink.** Before, they failed while reading older checkpoints. [#13931](https://github.com/jdx/mise/pull/13931)

## Registry

- `helmfile` (1.8.1 and later) and `dagu` (2.18.0 and later) now install from signed packslip manifests. Older versions still install through `aqua:`. To list them, run `mise ls-remote aqua:helmfile/helmfile` or `mise ls-remote aqua:dagucloud/dagu`. [#13933](https://github.com/jdx/mise/pull/13933)
- New aqua packages: `goccy/tobari`, `ymmt2005/pbschema-lens`.

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.10.1...v2026.10.2

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.