v2026.4.25

A patch release focused on smoothing rough edges in tasks (sandbox path resolution, dependency templates, a new `--name-only` listing) and fixing a handful of upgrade/`ls-remote` pitfalls.

## Added

- **(task)** New `--name-only` flag on `mise tasks ls` (and `mise tasks`) prints one task name per line — no headers, no padding, no description column ([#9435](https://github.com/jdx/mise/pull/9435)) by @jdx. It composes with `--all`, `--global`/`--local`, `--hidden`, `--sort`/`--sort-order`, and uses a broken-pipe-tolerant writer so dropping it into `fzf` Just Works:

  ```sh
  mise run "$(mise tasks ls --name-only --all | fzf)"
  ```

  Conflicts with `--json`, `--extended`, and `--usage`.

## Fixed

- **(task)** Dependency templates can now branch on `usage` values inside Tera statement tags, not just output expressions, and boolean/array flags are passed through with their real types instead of stringified ([#9424](https://github.com/jdx/mise/pull/9424)) by @jdx. So this finally does what it looks like:

  ```toml
  [tasks.lint]
  usage = 'flag "--run-post" default=#false'
  depends_post = ['''
      {%- if usage.run_post -%}
          postlint:**
      {%- else -%}
          noop
      {%- endif -%}
  ''']
  run = 'echo "lint ran"'
  ```

- **(task)** Tasks that define `usage` with subcommands but no top-level args/flags now correctly populate `usage.cmd` for dependency templates, fixing a regression from [#9424](https://github.com/jdx/mise/pull/9424) where the early-return path skipped subcommand handling ([#9431](https://github.com/jdx/mise/pull/9431)) by @jdx. The fix also de-duplicates `make_usage_ctx` between the script parser and the dep renderer so they can't drift again.

- **(task)** Sandbox `allow_read` / `allow_write` paths declared on a task are now resolved against the task's effective working directory rather than the shell's `pwd` ([#9428](https://github.com/jdx/mise/pull/9428)) by @jdx. Previously, `dir = "../bar"` plus `allow_read = ["."]` opened up the *caller's* directory while the task itself ran in `bar/` and got blocked. CLI overrides like `mise run --allow-read=…` still resolve against shell cwd. Closes [#9423](https://github.com/jdx/mise/discussions/9423).

- **(lockfile)** `mise upgrade` now updates the global lockfile (`~/.config/mise/mise.lock`) when bumping a fuzzy version such as `latest` ([#9442](https://github.com/jdx/mise/pull/9442)) by @jdx. The grouping pass was excluding global config files entirely, and fuzzy requests could re-resolve through the stale lockfile entry mid-update. Newly installed versions are now overlaid before lockfiles are rewritten, so a global `dummy = "latest"` upgrading from `1.0.0` to `2.0.0` actually pins `2.0.0`.

- **(aqua)** When `list_releases_including_prereleases` returned an empty list (paginated/cached edge case, throttling, or a repo that genuinely has no releases), aqua fell back to `list_tags` and pulled in every git tag in the repo ([#9443](https://github.com/jdx/mise/pull/9443)) by @jdx. For monorepos that tag sub-crates, that meant ripgrep's `grep-regex-0.1.1` and friends ended up in the shared `mise-versions` snapshot, so `ripgrep = "latest"` resolved to a tag with no matching release asset and 404'd on install. Empty release lists now propagate as empty version lists; packages that legitimately use tags as their version source still opt in via `version_source = "github_tag"`. The `remote_versions` cache filename is also reverted to `remote_versions.msgpack.z` to avoid needlessly invalidating existing caches — `VersionInfo` already deserializes forward-compatibly. (Server-side `mise-versions` snapshots will need to be regenerated with this fix.)

- **(ls-remote)** `mise ls-remote --json` no longer emits `"rolling":false,"prerelease":false` on every entry ([#9439](https://github.com/jdx/mise/pull/9439)) by @jdx. Dummy output is now `[{"version":"1.0.0"},{"version":"1.1.0"},{"version":"2.0.0"}]`. Backends that legitimately set either flag (rust nightly/beta/stable, github/aqua pre-releases) still emit the field; cached entries written by older builds continue to deserialize.

- **(docs)** The docs site no longer flickers between light/dark themes on initial load ([#9427](https://github.com/jdx/mise/pull/9427)) by @vhespanha. VitePress's anti-flicker inline script is now marked `data-cfasync="false"` so Cloudflare's Rocket Loader stops deferring it. Fixes [#9393](https://github.com/jdx/mise/discussions/9393).

- **(Dockerfile)** `copr-cli` is now installed via `dnf` instead of pip, fixing `ModuleNotFoundError: No module named 'rich'` in the publish-copr workflow ([#9421](https://github.com/jdx/mise/pull/9421)) by @bestagi.

## New Contributors

- @vhespanha made their first contribution in [#9427](https://github.com/jdx/mise/pull/9427)
- @bestagi made their first contribution in [#9421](https://github.com/jdx/mise/pull/9421)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.24...v2026.4.25