v2026.6.1

## Added
- **(aqua)** Support multiple custom registries via `aqua.registries`; deprecates single-string `aqua.registry_url` ([#10179](https://github.com/jdx/mise/pull/10179) by @risu729).
- **(env)** Decrypt SOPS-encrypted TOML env files (`.env.toml`) through `rops` ([#10201](https://github.com/jdx/mise/pull/10201) by @risu729).
- **(hooks)** Add `run_windows` for Windows-specific inline hook commands ([#10202](https://github.com/jdx/mise/pull/10202) by @risu729).
- **(task)** Render `task_config.includes` with the Tera config context and expand `~/` for local includes ([#10225](https://github.com/jdx/mise/pull/10225) by @risu729).
- **(task)** Support standalone `.toml` task files via `git::` directory includes ([#10219](https://github.com/jdx/mise/pull/10219) by @davidolrik).
- **(aqua)** Extract `7z` archives, including auto-detection of `.7z` assets ([#10224](https://github.com/jdx/mise/pull/10224) by @risu729).

## Fixed
- **(env)** Include the uv venv (`uv.lock` + `.venv`) in the `env_cache` key so `VIRTUAL_ENV` no longer leaks across sibling directories when `env_cache=true` and `python.uv_venv_auto` is set ([#10217](https://github.com/jdx/mise/pull/10217) by @Nagato-Yuzuru).
- **(task)** Resolve dependency `sources` relative to each task's directory and pass per-dependency `--watch` paths to watchexec ([#10054](https://github.com/jdx/mise/pull/10054) by @43081j).
- **(ruby)** Include resolved Ruby install options (compile mode, installer, build repo, precompiled URL, patch inputs) in lock identity ([#9992](https://github.com/jdx/mise/pull/9992) by @risu729).
- **(elixir)** Resolve lockfile URL and SHA-256 from `builds.hex.pm` metadata; locked installs reuse the lockfile URL ([#10226](https://github.com/jdx/mise/pull/10226) by @risu729).
- **(github)** Accept GitHub-canonicalized owner/repo casing when validating `mise-versions` release asset URLs ([#10240](https://github.com/jdx/mise/pull/10240) by @risu729).
- **(github)** Detect 401 responses on cached native OAuth tokens, refresh once, and retry transparently ([#10246](https://github.com/jdx/mise/pull/10246) by @jdx).
- **(github)** Warn when `mise-versions` GitHub metadata lookups hit rate limits or non-404 errors ([#10254](https://github.com/jdx/mise/pull/10254) by @jdx).
- **(github)** Skip the versions host for non-registry `github:` tools ([#10255](https://github.com/jdx/mise/pull/10255) by @jdx).
- **(github)** Emit logfmt-style structured fields for versions-host calls, with credentials and query stripped from URLs ([#10256](https://github.com/jdx/mise/pull/10256) by @jdx).
- Nix flake build test failure by adding `git` to `nativeCheckInputs` ([#10243](https://github.com/jdx/mise/pull/10243) by @okuuva).

## Security
- **(http)** Sanitize HTTP backend version names in install symlink paths to prevent repository-controlled versions from escaping the installs directory (GHSA-f94h-j2qg-fxw3) ([#10245](https://github.com/jdx/mise/pull/10245) by @jdx).

## Documentation
- Recommend the stable Snap channel for Linux installation ([#10250](https://github.com/jdx/mise/pull/10250) by @salim-b).

## Registry
- Prefer `aqua:endevco/aube` for `aube` so glibc/musl libc variants are picked up automatically ([#10171](https://github.com/jdx/mise/pull/10171) by @jdx).
- Add `pgroll` ([#10252](https://github.com/jdx/mise/pull/10252) by @diegoholiveira).
- Add `cargo-release` ([#10258](https://github.com/jdx/mise/pull/10258) by @jdx).

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.