v2026.4.4

A feature-packed release that adds user-defined tool dependencies, .NET runtime-only installs, argument forwarding to task dependencies, and stronger supply-chain security for lockfiles -- along with a large batch of bug fixes across multiple backends and shells.

## Highlights

- **Declare tool dependencies in `mise.toml`** -- A new `depends` field lets you ensure one tool is fully installed before another starts, useful for tools with runtime dependencies on each other.
- **Pass arguments through task dependency chains** -- Task dependencies can now reference the parent task's arguments using `{{usage.*}}` templates, enabling parameterized build/deploy pipelines.
- **.NET runtime-only installs** -- Install just the .NET runtime (or ASP.NET Core runtime) without the full SDK using the new `runtime` tool option.
- **Stronger lockfile provenance verification** -- `mise lock` now cryptographically verifies provenance for the current platform at lock time, and a new `locked_verify_provenance` setting enables re-verification at install time.

## Added

- **User-specified tool dependencies** -- Declare explicit installation dependencies between tools in `mise.toml` with a new `depends` field, ensuring one tool is fully installed before another starts. [#8776](https://github.com/jdx/mise/pull/8776) by @cprecioso

  ```toml
  [tools]
  erlang = "27"
  elixir = { version = "1.18", depends = ["erlang"] }
  ```

- **.NET runtime-only installs** -- Install .NET runtimes alongside or instead of SDKs using the `runtime` tool option. Valid values: `dotnet`, `aspnetcore`, `windowsdesktop`. [#8524](https://github.com/jdx/mise/pull/8524) by @fragon10

  ```toml
  [tools]
  dotnet = ["9", { version = "8.0.14", runtime = "dotnet" }]
  ```

- **Task dependency argument forwarding** -- Task dependencies can reference parent task arguments using `{{usage.*}}` templates in `depends`, `depends_post`, and `wait_for`. Arguments flow through entire dependency chains. [#8893](https://github.com/jdx/mise/pull/8893) by @jdx

  ```toml
  [tasks.build]
  usage = 'arg "<app>"'
  run = 'echo "building {{usage.app}}"'

  [tasks.deploy]
  usage = 'arg "<app>"'
  depends = [{ task = "build", args = ["{{usage.app}}"] }]
  run = 'echo "deploying {{usage.app}}"'
  ```

- **`install_before` enforced on transitive npm dependencies** -- The `install_before` supply-chain cutoff is now forwarded to transitive dependency resolution using each package manager's native mechanism (`npm --before`, `bun --minimum-release-age`, `pnpm --config.minimumReleaseAge`). [#8851](https://github.com/jdx/mise/pull/8851) by @risu729

- **`locked_verify_provenance` setting** -- New setting (also auto-enabled by `MISE_PARANOID`) that forces cryptographic provenance re-verification at install time even when the lockfile already has checksum and provenance data. `mise lock` now also performs full verification for the current platform at lock time. [#8901](https://github.com/jdx/mise/pull/8901) by @jdx

- **`turso` added to the built-in registry** -- Install the Turso CLI via `mise use turso`. [#8884](https://github.com/jdx/mise/pull/8884) by @kenn

## Fixed

- **`--env=VALUE` and `-E=VALUE` flag parsing** -- The equals-sign form of the environment flag (e.g., `mise --env=production`) was silently ignored, causing fallback to the default environment. Both `--env=VALUE` and `--env VALUE` forms now work correctly. [#8889](https://github.com/jdx/mise/pull/8889) by @jdx
- **PEP 440 `.dev` versions filtered in fuzzy matching** -- Versions like `2026.3.3.162408.dev0` no longer incorrectly satisfy stable version requests. The version regex now matches `.dev` in addition to `-dev`. [#8849](https://github.com/jdx/mise/pull/8849) by @richardthe3rd
- **Stale lockfile entries pruned during `mise lock <tool>`** -- Running `mise lock node` after a version change no longer leaves duplicate entries for the old and new versions. [#8599](https://github.com/jdx/mise/pull/8599) by @altendky
- **Spurious direnv warning suppressed** -- The `failed to update DIRENV_DIFF` warning no longer appears when the direnv diff environment variable is empty. [#8857](https://github.com/jdx/mise/pull/8857) by @yaleman
- **Duplicate trust warning in zsh** -- Entering an untrusted project directory in zsh no longer shows the `mise trust` warning twice. [#8898](https://github.com/jdx/mise/pull/8898) by @timothysparg
- **Plain `.tool-versions` no longer requires trust for task listing** -- Files without Tera template syntax (`{{`, `{%`, `{#`) are skipped during the trust check in `mise task ls`. [#8876](https://github.com/jdx/mise/pull/8876) by @dportalesr
- **Tool options preserved with CLI version overrides** -- `filter_bins` and other tool options are no longer lost when specifying a version via CLI (e.g., `mise bin-paths tool@version`). [#8888](https://github.com/jdx/mise/pull/8888) by @jdx
- **Alias-specific options respected** -- Tools configured with `tool_alias` now correctly use the alias-specific `asset_pattern` and other options instead of inheriting from the original tool. [#8892](https://github.com/jdx/mise/pull/8892) by @jdx
- **Precompiled Python uses lockfile URL** -- Precompiled Python installs now honor the download URL recorded in `mise.lock` instead of always recomputing it, fixing reproducibility for locked installs. [#8750](https://github.com/jdx/mise/pull/8750) by @hehaoqian
- **Ruby build revisions in lockfiles** -- Precompiled Ruby binaries from `jdx/ruby` now support build revision tags (e.g., `3.3.11-1`), preventing lockfile breakage when binaries are rebuilt with different checksums. [#8900](https://github.com/jdx/mise/pull/8900) by @jdx
- **Swift installs on unsupported Ubuntu versions** -- Swift installs on Ubuntu versions newer than 24.04 now fall back to the 24.04 binary instead of 404ing. [#8916](https://github.com/jdx/mise/pull/8916) by @jdx

## Changed

- **Go settings renamed to `go.*` namespace** -- All `go_*` settings (e.g., `go_set_goroot`) have been renamed to the nested `go.*` format (e.g., `go.set_goroot`) for consistency with other language settings. The old names are preserved as deprecated aliases. [#8598](https://github.com/jdx/mise/pull/8598) by @jdbruijn

## Breaking Changes

- **Deprecated settings removed** -- The following settings, deprecated for 18+ months, have been removed. If you are still using them, switch to their replacements: [#8904](https://github.com/jdx/mise/pull/8904) by @jdx
  - `asdf` -- use `disable_backends` instead
  - `vfox` -- use `disable_backends` instead
  - `cargo_binstall` -- use `cargo.binstall` instead
  - `disable_default_shorthands` -- use `disable_default_registry` instead
  - `pipx_uvx` -- use `pipx.uvx` instead
  - `python_compile` -- use `python.compile` instead
  - `python_default_packages_file` -- use `python.default_packages_file` instead
  - `python_patch_url` -- use `python.patch_url` instead
  - `python_patches_directory` -- use `python.patches_directory` instead
  - `python_precompiled_arch` -- use `python.precompiled_arch` instead
  - `python_precompiled_os` -- use `python.precompiled_os` instead
  - `python_pyenv_repo` -- use `python.pyenv_repo` instead
  - `python_venv_stdlib` -- use `python.venv_stdlib` instead

## New Contributors

- @cprecioso made their first contribution in [#8776](https://github.com/jdx/mise/pull/8776)
- @fragon10 made their first contribution in [#8524](https://github.com/jdx/mise/pull/8524)
- @dportalesr made their first contribution in [#8876](https://github.com/jdx/mise/pull/8876)
- @timothysparg made their first contribution in [#8898](https://github.com/jdx/mise/pull/8898)
- @hehaoqian made their first contribution in [#8750](https://github.com/jdx/mise/pull/8750)
- @jdbruijn made their first contribution in [#8598](https://github.com/jdx/mise/pull/8598)
- @yaleman made their first contribution in [#8857](https://github.com/jdx/mise/pull/8857)
- @kenn made their first contribution in [#8884](https://github.com/jdx/mise/pull/8884)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.3...v2026.4.4