v2026.5.8

A small release: a new `mise patrons` command, cleaner task command output when scripts start with a shebang, and a fix for `mise upgrade` summaries getting wiped by progress cleanup. Under the hood, signature verification moves to the modern sigstore-rust stack.

## Added

- **(patrons)** New `mise patrons` subcommand lists individuals on the Patron tier supporting mise development ([#9841](https://github.com/jdx/mise/pull/9841)) by @jdx. Data is fetched from the en.dev patrons feed, cached for 24h, and falls back to stale cache on network failure. Each patron's name renders as a clickable OSC 8 hyperlink in supporting terminals.

  ```
  $ mise patrons
  mise is supported by these patrons — thank you

    • Ronald Gierlach
    • youfoundron

  Become a patron: https://en.dev/sponsor
  ```

  Flags: `-J/--json`, `--refresh`.
- **(registry)** Add a `racket` shorthand backed by the aqua `racket/racket/minimal` package, exposing both `racket` and `raco` from the official racket-lang.org release artifacts ([#9784](https://github.com/jdx/mise/pull/9784)) by @albertnetymk.

## Fixed

- **(task)** When a task's `run` body starts with `#!/usr/bin/env bash` or `set -Eeuo pipefail`, the echoed command line would show only that boilerplate and hide the rest of the script. Leading shebang, blank, and `set ...` lines are now skipped when building the displayed command, so the first real command shows up. Execution is unchanged ([#9844](https://github.com/jdx/mise/pull/9844)) by @jdx. Fixes [#9842](https://github.com/jdx/mise/issues/9842).

  ```
  # before
  [generate-completions] $ #!/usr/bin/env bash

  # after
  [generate-completions] $ fzf --fish > ~/.config/fish/completions/fzf.fish
  ```
- **(upgrade)** `mise upgrade` could erase its own `Upgraded N tools:` summary detail lines when an upgrade also performed an uninstall — fresh progress jobs registered for the cleanup phase were still active at shutdown, so `stop_clear()` wiped them along with the summary. Progress jobs are now finished and reset before the summary prints ([#9860](https://github.com/jdx/mise/pull/9860)) by @risu729. Regression from [#9779](https://github.com/jdx/mise/pull/9779); addresses [#9856](https://github.com/jdx/mise/discussions/9856).

## Changed

- **(security)** Sigstore verification (`verify_github_attestation`, `verify_cosign_signature`, `verify_slsa_provenance`, `detect_attestations`) now runs on a local `mise-sigstore` adapter built on `sigstore-verify` 0.7 from sigstore-rust, replacing the previous `sigstore-verification` 0.2 dependency ([#9260](https://github.com/jdx/mise/pull/9260)) by @jdx. The mise call sites and helper API are unchanged. The new adapter still covers legacy cosign v1 bundles (e.g. goreleaser-signed releases) and raw DSSE `*.intoto.jsonl` envelopes (slsa-github-generator) that the upstream `Bundle::from_json` rejects.

## Deprecated

- **(config)** The top-level `env_file` setting (and `MISE_ENV_FILE`) is now marked deprecated. Use `env._.file` in `mise.toml` instead ([#9862](https://github.com/jdx/mise/pull/9862)) by @risu729. The JSON Schema gains the `deprecated` keyword, a warning is scheduled for 2026.11.0, and removal is planned for 2027.11.0.

  ```toml
  # before
  env_file = ".env"

  # after
  [env]
  _.file = ".env"
  ```

## New Contributors

* @albertnetymk made their first contribution in [#9784](https://github.com/jdx/mise/pull/9784)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.5.7...v2026.5.8

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.