v2026.4.18

A feature-packed release that renames `mise prepare` to `mise deps` with new package management subcommands, adds aube as an npm backend package manager, enables vfox plugins to declare their own dependencies, and ships several important fixes for version resolution, lockfile concurrency, and GitHub Enterprise attestation verification.

## Highlights

- **`mise prepare` renamed to `mise deps` with add/remove subcommands** -- The experimental dependency management command is now `mise deps`, with new `mise deps add npm:react` and `mise deps remove npm:lodash` subcommands for managing individual packages. All config keys, settings, state files, and CLI flags have been updated accordingly (`[prepare]` to `[deps]`, `--no-prepare` to `--no-deps`).
- **Aube package manager support for npm backend** -- `npm.package_manager` now defaults to `"auto"`, which prefers the `aube` package manager when available and falls back to `npm`. Explicit `npm.package_manager = "aube"` is also supported.
- **vfox plugins can declare dependencies** -- Plugin authors can now specify `PLUGIN.depends = {"node", "python"}` in `metadata.lua`, so mise resolves installation order automatically without users needing `depends = [...]` in their config.
- **Stale versions host cache bypassed for package-registry backends** -- npm, pipx, cargo, gem, go, and http/s3 backends with `version_list_url` now query their upstream sources directly, fixing the issue where tools like Flutter showed outdated versions.

## Added

- **`mise deps` command with add/remove subcommands** -- The experimental `mise prepare` command has been renamed to `mise deps`. New `mise deps add` and `mise deps remove` subcommands let you manage individual packages using `ecosystem:package` syntax. Currently supports npm, yarn, pnpm, and bun ecosystems. Bare `mise deps` defaults to `mise deps install` (the previous `mise prepare` behavior). [#9056](https://github.com/jdx/mise/pull/9056) by @jdx

  ```bash
  mise deps add npm:react           # add a dependency
  mise deps add -D npm:vitest       # add as dev dependency
  mise deps remove npm:lodash       # remove a dependency
  mise deps                         # install all project dependencies
  ```

  ```toml
  # Configuration uses [deps] instead of [prepare]
  [deps.npm]
  auto = true
  ```

- **`--before` flag for `mise latest`** -- One-off latest-version lookups can now be constrained by release date. Supports absolute dates (`2024-06-01`) and relative durations (`90d`, `1y`). Overrides per-tool `install_before` options and the global `install_before` setting. [#9168](https://github.com/jdx/mise/pull/9168) by @risu729

  ```bash
  mise latest node --before 2024-01-01
  mise latest node --before 90d
  ```

- **Aube package manager support for npm backend** -- The npm backend now supports `aube` as an alternative package manager. The new default `npm.package_manager = "auto"` prefers `aube` when it is available in the active toolset and falls back to `npm` otherwise. [#9256](https://github.com/jdx/mise/pull/9256) by @jdx

- **`filter_bins` option for SPM backend** -- Restrict which executable products are built and linked from a Swift package. Filtering happens before `swift build`, so unwanted products are never compiled. [#9253](https://github.com/jdx/mise/pull/9253) by @jdx

  ```toml
  [tools]
  "spm:swiftlang/swiftly" = { version = "latest", filter_bins = ["swiftly"] }
  ```

- **vfox plugin-declared dependencies via `metadata.lua`** -- Plugin authors can now declare tool dependencies directly in their plugin's `metadata.lua`. User-specified `depends` in `mise.toml` remains additive. [#9051](https://github.com/jdx/mise/pull/9051) by @ahemon

  ```lua
  -- metadata.lua
  PLUGIN = {}
  PLUGIN.name = "my-tool"
  PLUGIN.version = "1.0.0"
  PLUGIN.depends = {"node", "python"}
  ```

- **Registry: bitwarden-secrets-manager** -- Now available via the aqua backend (`aqua:bitwarden/sdk-sm`), replacing the legacy asdf plugin for better checksum/SLSA verification. [#9255](https://github.com/jdx/mise/pull/9255) by @msuzoagu

## Fixed

- **Stale version listings for package-registry backends** -- Backends with canonical upstream sources (npm, pipx, cargo, gem, go, and http/s3 with `version_list_url`) now skip the `mise-versions.jdx.dev` cache and query upstream directly. This fixes the issue where tools like Flutter showed outdated versions until users set `MISE_USE_VERSIONS_HOST=0`. [#9245](https://github.com/jdx/mise/pull/9245) by @jdx

- **Concurrent lockfile save race condition** -- Fixed `ENOENT` errors when multiple mise processes updated the same lockfile simultaneously (commonly seen with parallel tool installs in CI via `hk`). Each save now uses a uniquely named temp file instead of a fixed `mise.lock.tmp` path. [#9250](https://github.com/jdx/mise/pull/9250) by @jdx

- **GitHub Enterprise attestation verification** -- Artifact attestation verification now routes to the configured `api_url` instead of always hitting `api.github.com`, fixing `401 Unauthorized` errors for GHES users. [#9254](https://github.com/jdx/mise/pull/9254) by @jdx

- **Noisy third-party debug/trace logs suppressed** -- Debug and trace logs from dependency crates (h2, hyper, reqwest, rustls, etc.) are now filtered out of `-v`/`-vv` output. Set `MISE_LOG_VERBOSE_DEPS=1` to restore them. [#9248](https://github.com/jdx/mise/pull/9248) by @jdx

- **Animated progress UI disabled in CI** -- CI environments no longer show animated progress frames even when stderr is allocated as a TTY, preventing thousands of duplicate log lines. [#9249](https://github.com/jdx/mise/pull/9249) by @jdx

- **`mise use` respects `--quiet` and `--silent`** -- The "tools:", "removed:", and "would update" messages are now suppressed when `--quiet` or `--silent` is passed. [#9251](https://github.com/jdx/mise/pull/9251) by @jdx

- **`--locked` works for vfox backend plugins** -- Custom Lua backend plugins that cannot provide download URLs no longer fail with "No lockfile URL found" when using `mise install --locked`. [#9252](https://github.com/jdx/mise/pull/9252) by @jdx

## New Contributors

* @ahemon made their first contribution in [#9051](https://github.com/jdx/mise/pull/9051)
* @msuzoagu made their first contribution in [#9255](https://github.com/jdx/mise/pull/9255)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.17...v2026.4.18