v2026.4.9

This release fixes cross-device tool installation failures, makes lockfile provenance resolution deterministic across platforms, and adds sandbox field support to task templates. Several smaller fixes address env precedence in multi-environment setups and spurious warnings from `tools=true` module hooks.

## Highlights

- **Cross-device tool installation** -- Installing bun, deno, erlang, java, or ruby no longer fails when the downloads directory and installs directory are on different filesystems (e.g., Docker cache mounts). mise now falls back to copy+remove when `rename()` returns a cross-device error.
- **Deterministic lockfile provenance** -- `mise lock` now resolves SLSA provenance URLs for all target platforms, not just the current host. This eliminates non-deterministic lockfile diffs when running `mise lock` on different machines.
- **Sandbox fields in task templates** -- Task templates now support all sandbox fields (`deny_all`, `deny_read`, `deny_write`, `deny_net`, `deny_env`, `allow_read`, `allow_write`, `allow_net`, `allow_env`), with deny fields composing restrictively and allow lists combining template and task-local values.

## Fixed

- **Cross-device tool installation** -- When the downloads folder is on a different mount than the installs folder (common with Docker cache mounts or devcontainers), `rename()` fails with `EXDEV`. mise now uses a `move_file` helper that falls back to copy+remove, fixing installation of bun, deno, erlang, java, and ruby in these setups. [#9032](https://github.com/jdx/mise/pull/9032) by @bgeron

- **Deterministic SLSA provenance in lockfiles** -- `mise lock` previously only resolved full SLSA provenance URLs for the current host platform, writing `provenance = "slsa"` (short form) for cross-platform entries. Now both the GitHub and Aqua backends resolve provenance URLs for all target platforms, producing byte-for-byte identical lockfiles regardless of which machine generates them. [#8982](https://github.com/jdx/mise/pull/8982) by @cameronbrill

- **Sandbox fields in task templates** -- Task templates now accept sandbox configuration fields. Deny fields compose restrictively (OR with task-local settings), and allow lists combine template values with task-local values. [#9046](https://github.com/jdx/mise/pull/9046) by @risu729

  ```toml
  [task_templates.restricted]
  deny_net = true
  allow_env = ["CI"]

  [tasks.build]
  extends = "restricted"
  allow_env = ["NODE_ENV"]  # combined: ["CI", "NODE_ENV"]
  ```

- **Env precedence for task config** -- With multiple `MISE_ENV` values (e.g., `MISE_ENV=prod,ci`), `task_config.includes` and `task_config.dir` now correctly respect the documented last-env-wins precedence. Previously the order was reversed, causing the wrong profile's task config to take effect. [#9039](https://github.com/jdx/mise/pull/9039) by @risu729

- **Spurious warnings from `tools=true` module hooks** -- When a vfox backend tool triggered `dependency_env()`, it previously resolved all `tools=true` env modules with an incomplete PATH, causing "command not found" warnings. The dependency env now skips `tools=true` module resolution entirely. [#9011](https://github.com/jdx/mise/pull/9011) by @jdx

- **Implicit `self_update` with rustls features** -- Building mise with `--features rustls` or `--features rustls-native-roots` no longer implicitly enables the `self_update` feature. The `self_update/rustls` entries in these feature lists were redundant and caused the optional `self_update` dependency to be silently pulled in. [#9040](https://github.com/jdx/mise/pull/9040) by @salim-b

- **JSON schema completeness** -- Added missing fields to the mise JSON schema: sandbox fields on tasks, legacy top-level `env_file`/`dotenv`/`env_path` shortcuts (marked deprecated), and age encryption directive options with proper nesting. [#9044](https://github.com/jdx/mise/pull/9044) by @risu729

- **Windows `.exe` in release checksums** -- Release builds now publish the extracted `mise.exe` alongside the Windows `.zip` archives and include it in `SHASUMS256.txt`, enabling SHA256 verification of the standalone binary (e.g., by `mise-action`). [#8997](https://github.com/jdx/mise/pull/8997) by @zeitlinger

- **`granted` registry entry** -- Updated the `granted` tool to point to the new `fwdcloudsec/granted` repository after the project moved from `common-fate/granted`. [#9033](https://github.com/jdx/mise/pull/9033) by @risu729

## New Contributors

* @bgeron made their first contribution in [#9032](https://github.com/jdx/mise/pull/9032)
* @salim-b made their first contribution in [#9040](https://github.com/jdx/mise/pull/9040)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.4.8...v2026.4.9