v2026.5.6

A mix of features and correctness work: a native GitHub OAuth token source (experimental) that drops the dependency on `gh`/`ghtkn`, `mise oci` commands scoped to the current project by default, and two registry-lookup performance wins — plus fixes across activate, exec, java, lock, pipx, and vfox.

## Added

- **(cli)** Add `--before <date>` to `mise ls-remote` and `mise lock` for release-date-aware version discovery ([#9269](https://github.com/jdx/mise/pull/9269)) by @risu729
- **(config)** Hooks can now be defined as a table — `{ run = "...", shell = "bash -c" }` — to pick a shell inline, alongside the existing string form ([#9718](https://github.com/jdx/mise/pull/9718)) by @risu729
- **(github)** Add native GitHub OAuth device-flow token source (experimental) — no dependency on `gh`/`ghtkn` ([#9654](https://github.com/jdx/mise/pull/9654)) by @jdx. Create a GitHub App with device flow enabled, then authorize once:

  ```sh
  mise settings set experimental true
  mise settings set github.oauth_client_id Iv1.yourgithubappclientid
  mise token github --oauth
  ```

  mise caches and refreshes the token for its own GitHub API calls, and auto-exports it as `GITHUB_TOKEN` to shells started under `mise activate`/`exec` so `gh`, `git`, and other GitHub-aware tools pick it up too. See [GitHub Tokens → Native GitHub OAuth](https://mise.en.dev/dev-tools/github-tokens.html#native-github-oauth) for the full setup.
- **(oci)** `mise oci build/run/push` are now scoped to the current project's config by default; pass `--include-global` to opt back into the previous behavior of including global config ([#9766](https://github.com/jdx/mise/pull/9766)) by @jdx
- **(outdated)** Prefixed-version requests now resolve to the latest within the prefix — e.g. `temurin-17.0.19+10` for a `temurin-17.x` request, instead of jumping ahead to `temurin-26.x` ([#9767](https://github.com/jdx/mise/pull/9767)) by @roele

## Fixed

- **(activate)** Guard bash `chpwd_functions` expansion under `set -u` so activated shells no longer fail with `chpwd_functions[@]: unbound variable` ([#9716](https://github.com/jdx/mise/pull/9716)) by @risu729
- **(backend)** Date-check the `latest_stable_version` fast path when `--before` or `minimum_release_age` is active, instead of returning a too-new version ([#9650](https://github.com/jdx/mise/pull/9650)) by @risu729
- **(config)** Parse core tool options consistently between table and bracket syntax, so `[depends=...]` and `os=` set the named core fields ([#9742](https://github.com/jdx/mise/pull/9742)) by @risu729
- **(exec)** Nested `mise -C <dir> exec` correctly resolves the inner toolset's tools again — `__MISE_DIFF` is now propagated to children so the child no longer inherits a mutated PATH that hides its own tools ([#9765](https://github.com/jdx/mise/pull/9765)) by @jdx
- **(forgejo)** Include prereleases when `prerelease = true` / `MISE_PRERELEASES=1` is set ([#9717](https://github.com/jdx/mise/pull/9717)) by @risu729
- **(github)** Avoid caching empty release-asset responses, refetching instead ([#9616](https://github.com/jdx/mise/pull/9616)) by @risu729
- **(java)** Resolve `core:java` lockfile URLs/checksums from mise Java metadata, fixing `mise install --locked` for Java ([#9719](https://github.com/jdx/mise/pull/9719)) by @risu729
- **(lock)** Cache `github_attestations = "unavailable"` so locked installs stop hitting the GitHub attestation API for artifacts known to have none ([#9741](https://github.com/jdx/mise/pull/9741)) by @risu729
- **(pipx)** Preserve `uvx_args`/`pipx_args`/`extras`/`uvx = false` when pipx tools are reinstalled after a Python upgrade ([#9663](https://github.com/jdx/mise/pull/9663)) by @risu729
- **(python)** Skip redundant GitHub attestation re-verification when the lockfile already has checksum + `provenance = "github-attestations"` ([#9739](https://github.com/jdx/mise/pull/9739)) by @risu729
- **(vfox)** Run vfox plugin `pre_uninstall` hooks before removing install directories ([#9662](https://github.com/jdx/mise/pull/9662)) by @risu729
- Quote `program` and `args` in `cmd::cmd(..)` debug output so logged commands are unambiguous ([#9777](https://github.com/jdx/mise/pull/9777)) by @ktetzlaff

## Performance

- **(aqua)** Bake aqua registry packages as rkyv blobs for much faster lookup ([#9535](https://github.com/jdx/mise/pull/9535)) by @risu729
- **(registry)** Use `phf` for the mise registry lookup table, around 3.3x faster than the previous `BTreeMap` path ([#9769](https://github.com/jdx/mise/pull/9769)) by @risu729

## Registry

- Added `vector` ([#9761](https://github.com/jdx/mise/pull/9761)) by @kquinsland
- Added `openshift-install` and an `http:` backend for `oc` ([#9669](https://github.com/jdx/mise/pull/9669)) by @konono

## New Contributors

- @konono made their first contribution in [#9669](https://github.com/jdx/mise/pull/9669)
- @kquinsland made their first contribution in [#9761](https://github.com/jdx/mise/pull/9761)
- @ktetzlaff made their first contribution in [#9777](https://github.com/jdx/mise/pull/9777)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.5.5...v2026.5.6

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.