v2026.4.13

This release fixes several backend and schema edge cases, including stale GitHub/GitLab/Forgejo version caches, `go:` module `install_before` filtering, vfox plugins pinned to Git commit hashes, and task-local tool options.

## Highlights

- Remote version cache settings now apply consistently to GitHub, GitLab, and Forgejo backends, so users can bypass stale release data when needed.
- `go:` module versions now carry release timestamps, allowing `install_before` to filter them correctly.
- Task-level `tools` now accepts object syntax, matching top-level tool declarations for options like Rust targets.

## Added

- **Object syntax for task-level tools** -- Task-local `tools` entries now support map/object values in addition to strings, matching top-level `[tools]` behavior. This allows task-specific tool options such as Rust cross-compilation targets without requiring those options globally. [#9087](https://github.com/jdx/mise/pull/9087) by @Binlogo

  ```toml
  [tasks.example]
  tools = { rust = { version = "nightly-2024-12-14", targets = "aarch64-linux-android" } }
  ```

## Fixed

- **`MISE_FETCH_REMOTE_VERSIONS_CACHE` ignored by GitHub, GitLab, and Forgejo backends** -- These backends previously hardcoded a daily API cache duration, ignoring `fetch_remote_versions_cache`, `MISE_FETCH_REMOTE_VERSIONS_CACHE=0`, and `prefer_offline`. They now use the shared setting, matching other backends and allowing users to bypass stale release caches. [#9096](https://github.com/jdx/mise/pull/9096) by @mcncl

- **`go:` module versions ignored `install_before`** -- The Go backend now populates version metadata with release timestamps from the module proxy and `go list -m -json`, allowing `install_before` to filter module versions correctly instead of falling back to untimestamped candidates. [#9097](https://github.com/jdx/mise/pull/9097) by @mariusvniekerk

- **vfox plugins pinned to Git commit hashes in `mise.toml`** -- `mise install` could fail for vfox plugins declared with Git URLs and commit hashes because `ensure_installed` did not share the same install path as `mise plugin install`. vfox plugin installation now reuses the plugin install logic so both flows behave consistently. [#9099](https://github.com/jdx/mise/pull/9099) by @Oyami-Srk

- **Schema support for OS/architecture filters** -- The JSON schemas now share reusable tool `os` filter definitions, including compound `os/arch` entries such as `macos/arm64` and `linux/x64`, across top-level tools and task-local tools. [#9095](https://github.com/jdx/mise/pull/9095) by @risu729

## Changed

- **cargo-deny advisory checks unblocked** -- Removed a stale RustSec ignore, updated `rustls-webpki` on the modern rustls stack, and adjusted advisory ignores for the older transitive AWS rustls dependency chain so advisory checks can pass again. [#9112](https://github.com/jdx/mise/pull/9112) by @jdx

## New Contributors

- @Binlogo made their first contribution in [#9087](https://github.com/jdx/mise/pull/9087)
- @mariusvniekerk made their first contribution in [#9097](https://github.com/jdx/mise/pull/9097)
- @mcncl made their first contribution in [#9096](https://github.com/jdx/mise/pull/9096)
- @Oyami-Srk made their first contribution in [#9099](https://github.com/jdx/mise/pull/9099)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.12...v2026.4.13