v2026.4.8

This release brings significant stability improvements to the task runner -- fixing hangs, deadlocks, and panics across several edge cases in task dependency graphs and parallel execution. It also overhauls Go version resolution for subpath packages by querying the module proxy directly, and adds new configuration options for sandbox environment filtering and lockfile platform targeting.

## Highlights

- **Go subpath version resolution fixed** -- Tools like `go:github.com/foo/bar/cmd/baz` that live under a subpath of their Go module now resolve versions correctly, eliminating persistent "no latest version found" warnings.
- **Five task runner stability fixes** -- Resolved hangs with skipped dependencies, deadlocks with `MISE_JOBS=1`, panics in replacing output mode, stale source caching in dependency chains, and warnings with remote tasks.
- **Wildcard `allow_env` patterns** -- Sandbox env filtering now supports globs like `MYAPP_*` to allow entire namespaces of environment variables.
- **`lockfile_platforms` setting** -- Restrict lockfile operations to only the platforms you care about, avoiding unnecessary checksum resolution.

## Added

- **Wildcard patterns in sandbox `allow_env`** -- `allow_env` now supports glob wildcards (e.g., `MYAPP_*`) to pass through namespaces of environment variables in sandboxed tasks and exec. Works in both CLI flags and task config. [#8974](https://github.com/jdx/mise/pull/8974) by @jdx

  ```toml
  [task.build]
  allow_env = ["NODE_*", "npm_*", "MYAPP_*"]
  ```

- **`lockfile_platforms` setting** -- New setting to restrict which platforms are targeted during lockfile operations. When set, `mise install`, `mise use`, and `mise lock` only resolve checksums/URLs for the configured platforms instead of all common platforms. Explicit `mise lock --platform` flags still override this setting. [#8966](https://github.com/jdx/mise/pull/8966) by @cameronbrill

  ```toml
  [settings]
  lockfile_platforms = ["macos-arm64", "linux-x64"]
  ```

- **Examples rendered in `task --help`** -- `#USAGE example` directives in task scripts now appear in `--help` output, thanks to an upgrade to usage-lib v3. [#8890](https://github.com/jdx/mise/pull/8890) by @baby-joel

## Fixed

- **Go subpath package version resolution** -- The Go backend previously used `go list -m -versions` to resolve versions, which returns an empty version list for subpath packages (e.g., `github.com/ankitpokhrel/jira-cli/cmd/jira`), making it impossible to resolve "latest". mise now queries the Go module proxy (`$GOPROXY`) directly, generating path prefix candidates and using HTTP responses to distinguish real modules from non-module subpaths. This respects the `GOPROXY` environment variable and falls back to `go list` for `GOPROXY=direct`. [#8968](https://github.com/jdx/mise/pull/8968) by @c22

- **Task hang when skipped task has dependents** -- When a task with `sources`/`outputs` was skipped (up-to-date), a race condition in the dependency graph could leave downstream dependents hanging indefinitely. The failed channel send now properly resets the task's "sent" state so it can be re-emitted on a new channel. [#8937](https://github.com/jdx/mise/pull/8937) by @jdx

- **Dependent task source invalidation** -- When a dependency task runs because its own sources changed, downstream tasks that depend on it now also re-run, even if their own sources haven't changed. Sourceless dependencies (which always run) do not trigger this invalidation, preserving the usefulness of `sources` on dependents. [#8975](https://github.com/jdx/mise/pull/8975) by @jdx

- **Deadlock with `MISE_JOBS=1` and sub-task references** -- When `MISE_JOBS=1` and a task's `run` array contains both sub-task references (`{ task = "foo" }`) and scripts, the parent task now temporarily releases its semaphore permit before waiting on the sub-task, preventing a classic deadlock. [#8976](https://github.com/jdx/mise/pull/8976) by @jdx

- **Panic with parallel sub-tasks in replacing output mode** -- Running parallel sub-tasks (via `tasks = [...]` in run steps) with `output = "replacing"` no longer panics. Dynamically injected sub-tasks are now lazily initialized in the progress reporter map. [#8986](https://github.com/jdx/mise/pull/8986) by @jdx

- **Remote task warning with arguments** -- Remote git task files are now fetched before parsing usage specs, fixing spurious "failed to parse task file" warnings when running remote tasks with arguments. [#8979](https://github.com/jdx/mise/pull/8979) by @jdx

- **Tera templates in tool postinstall hooks** -- Tool-level `postinstall` scripts (e.g., `[tools.ripgrep] postinstall`) now render Tera templates before execution, so variables like `{{tools.ripgrep.path}}` work correctly. [#8978](https://github.com/jdx/mise/pull/8978) by @jdx

- **Missing env vars in tool postinstall hooks** -- `MISE_CONFIG_ROOT` and `MISE_PROJECT_ROOT` are now set in tool-level postinstall hooks, matching the behavior of project-level hooks. [#8977](https://github.com/jdx/mise/pull/8977) by @jdx

- **`mise upgrade tool@version` not updating lockfile** -- `mise upgrade tool@version` and `mise lock tool@version` now properly update the lockfile with the specified version. When the version doesn't match the current config prefix (e.g., upgrading from `"2"` to `3.0.1`), the config is auto-bumped to match while preserving the original version precision. [#8983](https://github.com/jdx/mise/pull/8983) by @jdx

- **Bash 3.2 activation with `set -u`** -- The bash activation script no longer fails with `__MISE_FLAGS[@]: unbound variable` on macOS's default bash 3.2 when `set -u` (nounset) is enabled and no flags are set. [#8988](https://github.com/jdx/mise/pull/8988) by @jdx

## New Contributors

* @baby-joel made their first contribution in [#8890](https://github.com/jdx/mise/pull/8890)
* @cameronbrill made their first contribution in [#8966](https://github.com/jdx/mise/pull/8966)
* @c22 made their first contribution in [#8968](https://github.com/jdx/mise/pull/8968)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.7...v2026.4.8