v2026.5.16

## Added
- **(github)** Use the shared `mise-versions` host for release metadata and artifact attestations before falling back to `api.github.com`, dramatically cutting anonymous GitHub API usage in CI/Docker ([#10127](https://github.com/jdx/mise/pull/10127) by @jdx).
- **(node)** New `node.npm_shim` setting (`MISE_NODE_NPM_SHIM`) to opt out of the bundled npm wrapper, letting `corepack` manage `bin/npm` cleanly ([#10082](https://github.com/jdx/mise/pull/10082) by @jjb).
- **(npm)** New `allow_builds` tool option for npm-backend installs that expands to `--allow-build=<pkg>` for aube and pnpm, accepting a string, array, or `true` for all builds ([#10116](https://github.com/jdx/mise/pull/10116) by @jdx).

## Fixed
- **(backend)** Strip the system shims dir from `dependency_env` PATH to prevent npm/go shim re-entry fork-bombs in devcontainer/Docker setups using `mise install --system` ([#10019](https://github.com/jdx/mise/pull/10019) by @andrewjamesbrown).
- **(backend)** Improve libc detection on musl distros so installing `gcompat` on Alpine no longer flips mise to glibc binaries ([#10020](https://github.com/jdx/mise/pull/10020) by @thespags).
- **(aqua)** Skip in-place link creation when src and dst alias the same inode (fixes godot install on macOS/APFS) ([#10012](https://github.com/jdx/mise/pull/10012) by @tvararu).
- **(aqua)** Lock `github_content` packages using raw GitHub content URLs instead of archive URLs ([#10102](https://github.com/jdx/mise/pull/10102) by @risu729).
- **(toolset)** `hook-env` and other prefer-offline flows no longer fetch remote versions to resolve concrete/`latest`/`prefix:*` specs, speeding up shells with many fuzzy tools ([#10098](https://github.com/jdx/mise/pull/10098) by @jdx).
- **(upgrade)** Preserve installed versions still pinned by other tracked project lockfiles during upgrade cleanup ([#10114](https://github.com/jdx/mise/pull/10114) by @jdx).
- **(upgrade)** Improve current version detection so prefix requests like `go = "1.25"` show the best matching installed version in summaries ([#9973](https://github.com/jdx/mise/pull/9973) by @jdx).
- **(lock)** Allow `mise lock` and `mise upgrade` to refresh `mise.lock` even when `locked = true` is set ([#10111](https://github.com/jdx/mise/pull/10111) by @jdx).
- **(install)** Reject install requests whose resolved backend is in `disable_backends`, including explicit syntax like `ubi:owner/repo` ([#9905](https://github.com/jdx/mise/pull/9905) by @risu729).
- **(use)** Reject tool version strings that start with `-` (e.g. `mise use dummy@--version`) ([#10113](https://github.com/jdx/mise/pull/10113) by @jdx).
- **(en)** Preserve `MISE_ENV` / `-E` profile when an activated subshell sources `mise activate` ([#10124](https://github.com/jdx/mise/pull/10124) by @jdx).
- **(unset)** Respect `MISE_GLOBAL_CONFIG_FILE` when running `mise unset` from `$HOME`, matching `mise set`/`use` ([#10105](https://github.com/jdx/mise/pull/10105) by @jdx).
- **(task)** Set `config_root` on tasks loaded from global config so `{{config_root}}` renders correctly ([#10106](https://github.com/jdx/mise/pull/10106) by @jdx).
- **(task)** Render templates and expand `~/` in sandbox `allow_read` / `allow_write` paths ([#10112](https://github.com/jdx/mise/pull/10112) by @jdx).
- **(shim)** Skip dot-prefixed (hidden) executables when generating shims ([#10123](https://github.com/jdx/mise/pull/10123) by @jdx).
- **(pipx)** Combine `--pip-args=VALUE` into a single argv element so pipx's argparse accepts values starting with `--` ([#10120](https://github.com/jdx/mise/pull/10120) by @iloveitaly).
- **(security)** Apply `url_replacements` to the GitHub attestations API base URL ([#9971](https://github.com/jdx/mise/pull/9971) by @SlaterByte).
- Show the mise version in friendly error output ([#10109](https://github.com/jdx/mise/pull/10109) by @jdx).
- **(copr)** Increase build timeout ([#10071](https://github.com/jdx/mise/pull/10071) by @jdx).

## Performance
- Cache repeated successful path canonicalization across hot PATH/shim/activation lookups ([#10068](https://github.com/jdx/mise/pull/10068) by @jdx).

## Changed
- Registry: use the npm backend for `npm` on Windows (aqua's standalone `npm/cli` tarball is broken on Windows) ([#10101](https://github.com/jdx/mise/pull/10101) by @risu729).
- Registry: allow narrow dependency builds for npm-primary tools (`wrangler`, `gemini-cli`, `vercel`, `codebuff`, `jules`, `orval`, `serverless`), and drop npm fallbacks for `ast-grep`, `lefthook`, `claude`, `code` ([#9916](https://github.com/jdx/mise/pull/9916) by @risu729).
- Registry: add `modem-dev/hunk` ([#10051](https://github.com/jdx/mise/pull/10051) by @naoki-mizuno), `wacli` ([#10043](https://github.com/jdx/mise/pull/10043) by @dovocoder), `liquibase` via the github backend ([#10052](https://github.com/jdx/mise/pull/10052) by @benberryallwood), `longbridge-terminal` ([#10073](https://github.com/jdx/mise/pull/10073) by @hogan-yuan), and make `aube` more resilient ([#10092](https://github.com/jdx/mise/pull/10092) by @bgeron, [#10110](https://github.com/jdx/mise/pull/10110)).

## Documentation
- Fix Scoop installation section ([#10059](https://github.com/jdx/mise/pull/10059) by @ofek).
- Clarify untrusted config behavior ([#10097](https://github.com/jdx/mise/pull/10097) by @jdx).
- Remove outdated terraform `main.tf` reference ([#10099](https://github.com/jdx/mise/pull/10099) by @risu729).
- Remove broken "How I Use mise" link ([#10081](https://github.com/jdx/mise/pull/10081) by @HYP3R00T).

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.