v2026.5.0

## Added

- **(conda)** Graduated the conda backend out of experimental ([#9544](https://github.com/jdx/mise/pull/9544)) by @jdx.
- **(deps)** Added `dart` and `flutter` deps providers backed by `pubspec.yaml` / `pubspec.lock` ([#9505](https://github.com/jdx/mise/pull/9505)) by @tjarvstrand.
- **(task)** `sources` entries can now be prefixed with `!` to exclude paths, and a new `sources_exclude` field is supported; exclusions apply to freshness checks, `task_source_files`, and `mise watch` ([#9496](https://github.com/jdx/mise/pull/9496)) by @jlarmstrongiv.
- **(vfox)** Added `stat` to the Lua `file` module so plugins can read file metadata ([#9497](https://github.com/jdx/mise/pull/9497)) by @esteve.
- **(registry)** Added `neo4j` ([#9525](https://github.com/jdx/mise/pull/9525)), `rustfs` ([#9530](https://github.com/jdx/mise/pull/9530)), `expert` ([#9498](https://github.com/jdx/mise/pull/9498)), `systemctl-tui` ([#9521](https://github.com/jdx/mise/pull/9521)), `codon` ([#9538](https://github.com/jdx/mise/pull/9538)), `yr` ([#9542](https://github.com/jdx/mise/pull/9542)), `betterleaks` ([#9541](https://github.com/jdx/mise/pull/9541)), `git-filter-repo` ([#9550](https://github.com/jdx/mise/pull/9550)), `umoci` ([#9555](https://github.com/jdx/mise/pull/9555)), `google-java-format` ([#9488](https://github.com/jdx/mise/pull/9488)), an aqua backend for `elixir-ls` ([#9557](https://github.com/jdx/mise/pull/9557)), and enabled `shellcheck` on Windows ([#9487](https://github.com/jdx/mise/pull/9487)).

## Fixed

- **(backend)** Stamp prerelease metadata via regex for backends that don't expose it upstream ([#9500](https://github.com/jdx/mise/pull/9500)) by @jdx.
- **(backend)** Treat `-nightly`, `-canary`, `-experimental`, `-insider`, `-edge` as prereleases ([#9523](https://github.com/jdx/mise/pull/9523)) by @jdx.
- **(backend)** Scope PEP 440 prerelease detection to Python backends ([#9558](https://github.com/jdx/mise/pull/9558)) by @jdx.
- **(backend)** Honor `dotnet.package_flags = "prerelease"` and `--prerelease` for dotnet ([#9551](https://github.com/jdx/mise/pull/9551)) by @jdx.
- **(backend)** Suppress repeated `No versions found` warnings for backends that support unresolved `latest` ([#9548](https://github.com/jdx/mise/pull/9548)) by @jdx.
- **(install)** Don't warn for configured tools when version is passed via CLI ([#9522](https://github.com/jdx/mise/pull/9522)) by @jdx.
- **(install)** Refresh `latest` before installing missing tools ([#9545](https://github.com/jdx/mise/pull/9545)) by @jdx.
- **(install)** Don't cache nonexistent install paths ([#9553](https://github.com/jdx/mise/pull/9553)) by @jdx.
- **(lockfile)** Don't propagate ad-hoc CLI overrides into the project lockfile ([#9562](https://github.com/jdx/mise/pull/9562)) by @jdx.
- **(plugin)** Detect plugin types after cloning ([#9540](https://github.com/jdx/mise/pull/9540)) by @risu729.
- **(task)** Convert PATH to MSYS Unix form when spawning POSIX shells on Windows ([#9547](https://github.com/jdx/mise/pull/9547)) by @JamBalaya56562.
- **(cargo)** Apply `install_env` during `cargo install` ([#9502](https://github.com/jdx/mise/pull/9502)) by @c22.
- **(github)** Skip attestations on non-default `api_url` ([#9486](https://github.com/jdx/mise/pull/9486)) by @jdx.
- **(github)** Retry IP allow list errors without auth ([#9506](https://github.com/jdx/mise/pull/9506)) by @risu729.
- **(http)** Update versions host tracking endpoint ([#9527](https://github.com/jdx/mise/pull/9527)) by @jdx.
- **(release)** Pass `--no-git-checks` to `aube publish` ([#9483](https://github.com/jdx/mise/pull/9483)) by @jdx.
- **(copr)** Drop `epel-9` chroots since rust >= 1.91 is unavailable ([#9484](https://github.com/jdx/mise/pull/9484)) by @jdx.

## Changed

- **(registry)** Deny inline backend options in registry tool entries ([#9565](https://github.com/jdx/mise/pull/9565)) by @risu729.
- **(registry)** Update entry for `checkmake` ([#9504](https://github.com/jdx/mise/pull/9504)) by @eread.

## Deprecated

- `shorthands_file` setting / `MISE_SHORTHANDS_FILE` is deprecated; warning starts in 2026.6.0, removal planned for 2026.12.0. Use `[plugins]` instead ([#9534](https://github.com/jdx/mise/pull/9534)) by @risu729.

## Documentation

- Document `ghtkn` as a GitHub `credential_command` ([#9546](https://github.com/jdx/mise/pull/9546)) by @jdx.
- Clarify registry backend acceptance policy ([#9543](https://github.com/jdx/mise/pull/9543), [7bbeebe](https://github.com/jdx/mise/commit/7bbeebe6dceabdb98dd3c59a55f6d58d7af34bd1)) by @jdx.
- Update `mise watch` docs to `pitchfork.en.dev` ([#9536](https://github.com/jdx/mise/pull/9536)) by @risu729.
- Use bash in `exec` example for variable echoing ([#9567](https://github.com/jdx/mise/pull/9567)) by @kuboon.

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.