v2026.10.5

Java versions without a vendor prefix now install Eclipse Temurin builds. Dotfiles gain per-machine and local-only history, a `merge = "missing"` mode, and a secret check before `mise dot sync` publishes anything. Packslip tools can be pinned to the workflow that signs their releases. Several features documented as experimental now actually require `experimental = true`. The rest of the release is fixes across tasks, shims, config loading, bootstrap and backends.

## Breaking Changes

- **`java@21`, `java@lts` and `java@latest` now install Temurin.** The default of `java.shorthand_vendor` changes from `openjdk` to `temurin`. The jdk.java.net OpenJDK builds stop at the next feature release, so `java@21` was stuck on 21.0.2 from January 2024. Vendor-prefixed requests (`openjdk-21`, `corretto-21`, ...) are not affected. Installed OpenJDK versions keep working, and `mise upgrade` offers the Temurin build. Shorthand versions now include Temurin's build suffix (for example `21.0.12+101.0.LTS`). Temurin has no builds of Java 9, 10 or 12–15, so use `openjdk-12` and similar for those. [#14146](https://github.com/jdx/mise/pull/14146)
  - **Lockfiles:** existing shorthand lock entries record `shorthand_vendor = "openjdk"`. Without that setting, `mise install --locked` fails with `java@21 is not in the lockfile`. Either keep OpenJDK:
    ```toml
    [settings]
    java.shorthand_vendor = "openjdk"
    # or per project: java = "openjdk-21"
    ```
    or switch to Temurin with `mise lock --bump java` and commit the result.
- **Some experimental features now require `experimental = true`** (or `MISE_EXPERIMENTAL=1`) when you use them. Config that only mentions them still loads. [#14114](https://github.com/jdx/mise/pull/14114)
  - Running a task with a `git::` remote `file`, including through `mise run --dry-run`, `mise watch`, or as a dependency. Commands that only inspect tasks (`tasks ls`, `tasks info`, `tasks deps`, `generate task-docs`) show the task from its TOML and warn once that the file wasn't fetched. These were documented as experimental but were missing the check in the codebase.
  - `git::` and `oci::` entries in `task_config.includes`. These are skipped with a warning.
  - OpenTelemetry export of `mise run` when an OTLP endpoint is set.
  - Installing `spinel:` tools.
- **`mise.local.toml` now overrides `mise.<env>.toml` in the same directory**, as the docs already said. Before, the committed environment file won in project directories, and also in `~/.config/mise` when the walk up from the cwd reached it. Within each directory the order is now, highest first: `mise.<env>.local.toml`, `mise.local.toml`, `mise.<env>.toml`, `mise.toml`. If you relied on the environment file winning, move those keys into `mise.<env>.local.toml`. [#14148](https://github.com/jdx/mise/pull/14148)
- **MCP:** in the `mise://tasks` resource, `env` is now an array of env directive strings, the same format as `mise tasks ls --json`. It was always an empty object before. [#14111](https://github.com/jdx/mise/pull/14111)
- **`mise settings set` and `add` refuse writes that would have no effect.** This covers early-init settings (`env`, `ceiling_paths`, `env_conf_d`, ...) written to a config file, and global-only settings (`yes`, `paranoid`, `trusted_config_paths`, ...) written with `--local`. The error says where the setting has to go: `miserc.toml`, the global config, or the `MISE_*` variable. [#14126](https://github.com/jdx/mise/pull/14126)

## Added

### Dotfiles

- **Per-machine tracked files.** Some files describe the machine, such as a monitor layout. Use `variants = [{ machine = true }]` or `mise dot track --machine` to keep a separate history for each machine. Sync pushes every machine's version to the origin but never applies one machine's version on another. Each machine gets a generated name, which you can set with `[history] machine = "desk"`. A machine variant must be the entry's only variant and can't be combined with `encrypt`. Upgrade every machine that shares a setup before using it. [#14062](https://github.com/jdx/mise/pull/14062)
  ```toml
  [dotfiles]
  "~/.config/hypr/monitors.lua" = { mode = "track", variants = [{ machine = true }] }
  ```
- **`mode = "track-local"`** (or `mise dot track --local`) keeps a file's history in a separate store on this machine, with no origin. The file never reaches the shared manifest, a commit or a push. Commands that name a path use the history that holds it. Use `mise dot --local history` or `mise dot --local undo` to work with the local history directly. `save`, `capture` and `watch` cover both histories. [#14082](https://github.com/jdx/mise/pull/14082)
- **`merge = "missing"`** sets only the keys the target file doesn't have yet. Values an app writes itself, such as the model picked with `/model` in Codex or Claude Code, are left alone. Works with TOML, YAML and JSON. [#14081](https://github.com/jdx/mise/pull/14081)
  ```toml
  [dotfiles]
  "~/.codex/config.toml/shared" = { merge = true }
  "~/.codex/config.toml/defaults" = { source = "codex/defaults.toml", merge = "missing" }
  ```
- Merge entries can leave out `source`. mise then reads the target's path under `dotfiles.root`. Switching an entry from `symlink` to `merge` now replaces a link that points at the merge source with a writable copy, so the app's own keys survive. [#14076](https://github.com/jdx/mise/pull/14076)
- **`mise dot sync` refuses to publish saved versions that look like secrets.** It checks for provider tokens, private key blocks, and `*_KEY`/`*_TOKEN`/`*_SECRET`/`*_PASSWORD` assignments. Only versions the origin doesn't have yet are checked. The error names the file, line and version, never the value. `--allow-plaintext-history` skips the check. [#14171](https://github.com/jdx/mise/pull/14171)
- `mise bootstrap --adopt <url> --take-remote-all` takes the repository's version of every file that differs, in one step. Combined with `--replace-history`, it also adopts the repository on a machine that already has history of its own. [#14065](https://github.com/jdx/mise/pull/14065)
- `mise doctor` shows the dotfiles history repo path and the connected origin (URL, branch, sync mode), in both text and `--json` output. [#14173](https://github.com/jdx/mise/pull/14173)

### Bootstrap

- `[bootstrap.files]` and `[bootstrap.directories]` accept the same `os` selector as packages. Entries that don't match the host are skipped completely. [#14058](https://github.com/jdx/mise/pull/14058)
  ```toml
  [bootstrap.files."/etc/docker/daemon.json"]
  os = "linux"
  source = "./files/docker-daemon.json"
  ```
- `fish = "auto"` in `[bootstrap.mise_shell_activate]` writes a block that runs `mise activate fish` in interactive shells and `--shims` everywhere else. [#14172](https://github.com/jdx/mise/pull/14172)
- `[bootstrap]` is now allowed in config includes. It merges below the including file, so a shared baseline can declare packages, hooks and services, and the project still wins on any key it sets itself. [#14176](https://github.com/jdx/mise/pull/14176)
- Systemd units accept `state = "absent"`, which stops, disables and deletes the matching mise-managed service and timer. `mise bootstrap unapply` now also removes the units an environment added. [#14139](https://github.com/jdx/mise/pull/14139)

### Tools and backends

- **Packslip `workflow` option.** It accepts only releases signed by the named GitHub Actions workflow on tags. It takes one workflow or a list, and an entry can name a ref (`release.yml@refs/heads/main`). It can't be combined with `pubkey`, `identity`, `identity_prefix` or `issuer`. [#14075](https://github.com/jdx/mise/pull/14075), [#14093](https://github.com/jdx/mise/pull/14093)
  ```toml
  [tools]
  "packslip:github.com/aubepkg/aube" = { version = "latest", workflow = ["release-plz.yml", "release.yml"] }
  ```
  - Registry entries for dagu, timoni, helmfile, fnox, hk, usage, communique, mr-boxington, pitchfork, aube and worktrunk are now pinned to the workflow that signs their releases. A `workflow` or `pubkey` you set yourself replaces the registry pin. [#14092](https://github.com/jdx/mise/pull/14092), [#14091](https://github.com/jdx/mise/pull/14091), [#14073](https://github.com/jdx/mise/pull/14073) (@max-sixty)
- **MCP `install_tool` is implemented.** It installs the requested version, or the configured version, or latest, and returns the resolved version and install path. `install_tool` and `run_task` now refuse to act on untrusted config instead of trusting it on the client's behalf. [#14111](https://github.com/jdx/mise/pull/14111)
- `mise installs migrate` no longer fails on installs it can't reinstall, such as withdrawn releases, signer changes or no network. It moves them into the identity layout as they are and leaves a link at the old path. It also handles lockfile-suffixed `~aube~`/`~uv~` directories correctly. [#14079](https://github.com/jdx/mise/pull/14079)
- Registry: `mprocs` is renamed to `dekit` to match upstream, and `mprocs` stays as an alias. From v0.10.0 the binary is `dekit`. [#14169](https://github.com/jdx/mise/pull/14169)

## Changed

- Dotfile operations you can undo no longer ask for confirmation after showing their plan. This covers `dot pull`, `dot track`, `undo`, `rollback`, `connect` and `bootstrap --adopt`. Destructive ones still ask, such as `--replace-history`, `dot recover --keep-current` and `implode`. `--yes` and `MISE_YES` are still accepted. [#14077](https://github.com/jdx/mise/pull/14077), [#14071](https://github.com/jdx/mise/pull/14071), [#14067](https://github.com/jdx/mise/pull/14067)
- Safe mode (`MISE_SAFE=1`) now ignores a project's `[bootstrap]`, `[dotfiles]` and `[dotfile_groups]`. Before, an untrusted repo could link files into `$HOME` or clone repositories. Global and system config still apply. [#14110](https://github.com/jdx/mise/pull/14110)
- Node downloads are checked against the GPG signature for every version that publishes one. Before, only versions starting with `2` were checked. Set `node.gpg_verify = false` for mirrors without signatures. [#14132](https://github.com/jdx/mise/pull/14132)
- `mise generate github-action` now uses `actions/checkout@v7` and `jdx/mise-action@v5` and no longer sets `MISE_EXPERIMENTAL`. `mise generate devcontainer` now adds `"postCreateCommand": "mise install"`. [#14145](https://github.com/jdx/mise/pull/14145)

## Deprecated

- `task.cache.stats_report`, `sops.age_recipients` and `plugin_autoupdate_last_check_duration` never had any effect. Setting one now prints a warning, and they will be removed in 2027.10.5. [#14112](https://github.com/jdx/mise/pull/14112)
- `mise bootstrap launchd|systemd|macos-defaults`, the old `--only`/`--skip` part names (`launchd`, `systemd`, `defaults`, `shell`) and `mise direnv` now print a warning that names the replacement. They will be removed in 2027.10.4. [#14113](https://github.com/jdx/mise/pull/14113)

## Fixed

### Tasks

- A raw or interactive task with `cache` enabled is now skipped when its sources are fresh and its cache key hasn't changed. Before, it ran every time. [#14121](https://github.com/jdx/mise/pull/14121)
- A typo in `sources` that matches no files now prints a warning. `mise tasks deps <task>` now shows `depends_post` tasks. Scripts in `$MISE_CONFIG_DIR/tasks` load even without a global config file. [#14122](https://github.com/jdx/mise/pull/14122)
- `mise run ./script` resolves relative to the current directory. [#14120](https://github.com/jdx/mise/pull/14120)
- Script extensions are stripped only from file task names. [#14159](https://github.com/jdx/mise/pull/14159)
- Requests to the remote task cache include the mbx-cache headers. [#14147](https://github.com/jdx/mise/pull/14147)
- `mise generate task-stubs` skips hidden and global tasks. [#14127](https://github.com/jdx/mise/pull/14127)

### Shims and exec

- Shims, `mise x` and `mise env` no longer look up remote versions for lazy tools that aren't installed. With 20 lazy tools and no network, running an installed tool went from about 42s to 0.09s. [#14063](https://github.com/jdx/mise/pull/14063)
- On Unix, a system wrapper that execs the same command name can no longer send an unconfigured shim into an endless loop. [#14088](https://github.com/jdx/mise/pull/14088)
- Windows lazy shim names now match regardless of letter case. [#14090](https://github.com/jdx/mise/pull/14090)
- `mise x tool@1.2.3` installs the exact version when the version list times out, instead of failing with "couldn't exec process". [#14164](https://github.com/jdx/mise/pull/14164)
- `mise doctor` recognizes a `mise` entry in the dedicated shims dir. [#14069](https://github.com/jdx/mise/pull/14069)

### Config, settings and CLI

- With an environment active and no `config.toml` yet, `mise use -g` creates `config.toml` instead of writing into `config.<env>.toml`. [#14179](https://github.com/jdx/mise/pull/14179)
- Booleans set through `mise config set --type bool` and boolean settings accept `yes`/`no`/`1`/`0`. For `env.*` and other keys that aren't settings, only `true` and `false` become booleans, and anything else is stored as written. `mise latest tool@prefix:X` works, and `--log-level warn` is accepted. `mise doctor` prints the full chain when config fails to load. [#14125](https://github.com/jdx/mise/pull/14125)
- Help output uses the command name you typed. [#14123](https://github.com/jdx/mise/pull/14123)
- `mise edit` no longer overwrites an existing config when there is no terminal. [#14124](https://github.com/jdx/mise/pull/14124)
- `.monorepo` markers are verified in paranoid mode. [#14105](https://github.com/jdx/mise/pull/14105)
- Bad input now gives an error instead of a panic, in places including `mise config ls` and `mise prune` with an invalid tool version, the `--monorepo` flags, and `mise plugins uninstall --purge`. [#14118](https://github.com/jdx/mise/pull/14118), [#14094](https://github.com/jdx/mise/pull/14094) (@JamBalaya56562), [#14103](https://github.com/jdx/mise/pull/14103) (@JamBalaya56562), [#14116](https://github.com/jdx/mise/pull/14116), [#14117](https://github.com/jdx/mise/pull/14117)
- `mise env --redacted` honors `redact = false` exclusions. `watch_files` hooks don't run in safe mode or with `--no-hooks`. [#14109](https://github.com/jdx/mise/pull/14109), [#14108](https://github.com/jdx/mise/pull/14108)
- `mise watch` passes watchexec flags through to watchexec. [#14115](https://github.com/jdx/mise/pull/14115)
- Error and warning hints point at current commands, for example the PATH advice from `bootstrap remote` and the watchexec install hint. [#14142](https://github.com/jdx/mise/pull/14142)
- If stderr can't be written to during a migration, mise no longer aborts. [#14158](https://github.com/jdx/mise/pull/14158) (@JamBalaya56562)
- When the default cache and temp directories overlap (the Windows default), temp files now go to `<temp>/mise-tmp`, so `mise cache clear` no longer deletes files that are still in use. [#14134](https://github.com/jdx/mise/pull/14134)

### Bootstrap and dotfiles

- `mise bootstrap` keeps writing the shell activation block into a startup file that is only tracked. [#14135](https://github.com/jdx/mise/pull/14135)
- If one package manager fails, the others still run. [#14138](https://github.com/jdx/mise/pull/14138)
- The firewall section is skipped on systems that don't support it. [#14137](https://github.com/jdx/mise/pull/14137)
- Dry runs show hooks that use `exec()`. [#14136](https://github.com/jdx/mise/pull/14136)
- Pulling onto a machine with no history now saves the files it replaces first, so `mise dot undo` restores them. `--replace-history` no longer fails on its first attempt. [#14065](https://github.com/jdx/mise/pull/14065)
- `mise dot pull` says so when incoming history changes no files on this machine. [#14066](https://github.com/jdx/mise/pull/14066)

### Backends and plugins

- `mise install cargo:...` no longer uses an inactive `cargo-binstall` shim. It falls back to native binstall or `cargo install`. [#14070](https://github.com/jdx/mise/pull/14070)
- With `npm.shell_out`, a mise shim from another data dir can no longer be run as `npm` and fork until the machine runs out of memory. [#14084](https://github.com/jdx/mise/pull/14084) (originally found and fixed by @tfournet)
- Java: changing `java.shorthand_vendor` takes effect without waiting for the cache to expire. Inline `java[release_type=ea]` is respected when listing and resolving versions. [#14131](https://github.com/jdx/mise/pull/14131)
- Ruby precompiled URLs expand `{os}` and `{arch}` correctly. [#14133](https://github.com/jdx/mise/pull/14133)
- `ls-remote` respects `disable_backends`. [#14130](https://github.com/jdx/mise/pull/14130)
- SPM uses a custom `api_url` for cloning and skips lockfile URLs. [#14129](https://github.com/jdx/mise/pull/14129)
- GitHub assets are size-checked even when there is no checksum. GitLab release lookups percent-encode the tag. [#14128](https://github.com/jdx/mise/pull/14128), [#14102](https://github.com/jdx/mise/pull/14102) (@thespags)
- Brew infers the formula version from the GitHub release tag path, and detaches a DMG left attached by an interrupted install. [#14165](https://github.com/jdx/mise/pull/14165) (@JamBalaya56562), [#14177](https://github.com/jdx/mise/pull/14177)
- `git::` plugins install from a subdirectory, and `[plugins]` entries compare those sources correctly. Packslip entries in `[plugins]` install as vfox plugins. [#14140](https://github.com/jdx/mise/pull/14140), [#14150](https://github.com/jdx/mise/pull/14150) (@onokonem), [#14141](https://github.com/jdx/mise/pull/14141)
- vfox: an env plugin with no source no longer makes every command fail. Embedded plugin files are found relative to the manifest directory. [#14119](https://github.com/jdx/mise/pull/14119), [#14167](https://github.com/jdx/mise/pull/14167)

### Daemons and sandbox

- On Windows, deferred daemon commands are quoted for cmd.exe. Argv and Windows readiness probes run in the tool environment. [#14055](https://github.com/jdx/mise/pull/14055), [#14080](https://github.com/jdx/mise/pull/14080) (@JamBalaya56562)
- `--deny-env` clears inherited variables on Windows. On macOS, `allow_net` is rejected instead of writing invalid sandbox rules. [#14107](https://github.com/jdx/mise/pull/14107), [#14106](https://github.com/jdx/mise/pull/14106)

## Security

- Remote task cache keys store env, `[vars]` and task arg values as `blake3:` digests instead of plaintext, so secret values are no longer uploaded. Existing cache entries miss once after upgrading. [#14104](https://github.com/jdx/mise/pull/14104)
- URL credentials are redacted from HTTP debug logs and from npm Git-source and SSH diagnostics. [#14155](https://github.com/jdx/mise/pull/14155), [#14057](https://github.com/jdx/mise/pull/14057), [#14064](https://github.com/jdx/mise/pull/14064)

## Documentation

- The documentation site, CLI help and settings descriptions have been restructured and rewritten, and moved pages still resolve. [#14097](https://github.com/jdx/mise/pull/14097), [#14098](https://github.com/jdx/mise/pull/14098), [#14096](https://github.com/jdx/mise/pull/14096), [#14163](https://github.com/jdx/mise/pull/14163)

## New Contributors

* @onokonem made their first contribution in [#14150](https://github.com/jdx/mise/pull/14150)
* @max-sixty made their first contribution in [#14073](https://github.com/jdx/mise/pull/14073)

**Full Changelog**: https://github.com/jdx/mise/compare/vfox-v2026.10.4...v2026.10.5

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.