v2026.5.5

A grab-bag release: a new `--inactive` flag for catching installed-but-unconfigured tools, several Windows fixes around `bunx` and the `bash` task shell, and correctness fixes for the npm shim, aqua bin-path resolution, and dotnet prereleases.

## Added

- **(outdated/upgrade)** New `--inactive` flag on `mise outdated` and `mise upgrade` that includes installed-but-inactive tools — versions you have installed but that aren't referenced by the current config ([#9640](https://github.com/jdx/mise/pull/9640)) by @roele. Useful for cleaning up or upgrading old tool installs:

  ```sh
  # show every installed tool that has a newer version, even if it's not in mise.toml
  mise outdated --inactive

  # upgrade an installed-but-inactive tool to its current latest
  mise upgrade tiny --inactive
  ```

  When a tool has no config source, `--inactive` resolves against the backend's latest version rather than the pinned installed version.

## Fixed

- **(node)** The generated npm shim now invokes `<this-install>/bin/node` directly instead of `node` from `PATH`. Previously, running one Node install's `npm` while a different Node version was active could let npm derive its global prefix from the other install, sending default packages to the wrong place ([#9749](https://github.com/jdx/mise/pull/9749)) by @jdx.

- **(bun, Windows)** `mise install bun` on Windows now creates a `bunx` entry alongside `bun.exe`, matching what the upstream PowerShell installer does. mise tries a `bunx.exe -> bun.exe` hardlink first (bun switches to bunx mode based on argv[0]) and falls back to a `bunx.cmd` shim. `reshim` picks it up automatically, so `bunx <pkg>` finally works under mise-managed bun on Windows ([#9732](https://github.com/jdx/mise/pull/9732)) by @JamBalaya56562.

- **(task, Windows)** When a task uses `shell = "bash -c"` and mise is invoked from PowerShell, `C:\Windows\System32\bash.exe` (the WSL launcher) used to win the `PATH` search, silently running the task body inside a WSL Linux user-space where mise-managed Windows tools aren't visible. mise now resolves bash in this order: `MISE_BASH_PATH`, common Git Bash install locations (`C:\Program Files\Git\bin\bash.exe`, the x86 variant, `%LOCALAPPDATA%\Programs\Git\bin\bash.exe`), the existing PATH search, and finally an explicit reject of the WSL launcher with a warning ([#9750](https://github.com/jdx/mise/pull/9750)) by @JamBalaya56562. `sh`/`zsh`/`fish`/`ksh`/`dash` and non-Windows builds are unaffected.

- **(aqua)** Aqua `list_bin_paths()` correctly handles packages whose actual git tags add an extra `v` after a version prefix (e.g. `tool-v1.2.3` for canonical `1.2.3`), without putting remote resolution back on the bin-path hot path that was reverted in #5574. Install passes the already-resolved tag/version directly into file-link creation instead of recomputing it ([#9759](https://github.com/jdx/mise/pull/9759)) by @risu729.

- **(dotnet)** The dotnet backend now uses the shared `prerelease = true` tool option used by aqua/github, fetches the NuGet prerelease superset, and skips the latest fast paths when prereleases are enabled. The global `prereleases` setting and the deprecated `dotnet.package_flags = ["prerelease"]` continue to work ([#9720](https://github.com/jdx/mise/pull/9720)) by @risu729:

  ```sh
  MISE_EXPERIMENTAL=1 mise ls-remote 'dotnet:GitVersion.Tool[prerelease=true]'
  ```

## Registry

- Added `scalafmt` ([github:scalameta/scalafmt](https://github.com/scalameta/scalafmt)) — the official Scala formatter ([#9757](https://github.com/jdx/mise/pull/9757)) by @pokir.
- Removed `flarectl`: upstream `cloudflare/cloudflare-go` no longer ships release binaries (the existing registry test was already commented out) ([#9756](https://github.com/jdx/mise/pull/9756)) by @risu729.
- Removed 49 registry shorthands with zero recorded users (bbr, brig, btrace, carp, clarinet, cli53, concourse, conduit, copper, credhub, datree, djinni, dome, draft, dtm, envcli, esy, glen, grain, inlets, kcctl, ki, kp, krab, kube-credential-cache, kubefedctl, kubefirst, kubemqctl, kwt, lab, lane, levant, melt, opsgenie-lamp, pachctl, psc-package, purerl, redo, rke, sinker, soracom, starboard, sver, terradozer, titan, uaa-cli, wasm4, wren-cli, zbctl) ([#9725](https://github.com/jdx/mise/pull/9725)) by @jdx. Tools added in 2026 were skipped, and any of these can still be installed with explicit backend syntax (e.g. `mise use aqua:cloudfoundry/uaa-cli`).

## Documentation

- **(secrets)** Document that direct age encryption requires experimental mode, that age decryption is strict by default, and that `age.strict=false` skips undecryptable values and keeps resolving the environment ([#9737](https://github.com/jdx/mise/pull/9737)) by @risu729.
- **(tasks)** Add a bash shebang to the conditional-dependencies example ([#9747](https://github.com/jdx/mise/pull/9747)) by @JamBalaya56562.
- Backend tool option docs: document S3 support for `size`, `strip_components`, `bin`, and `rename_exe`; add `no_app` to GitLab and Forgejo; clarify that GitHub-family `api_url` covers release lookup and private/self-hosted API downloads, not just version listing ([#9738](https://github.com/jdx/mise/pull/9738)) by @risu729.

## New Contributors

- @pokir made their first contribution in [#9757](https://github.com/jdx/mise/pull/9757)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.5.4...v2026.5.5

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.