v2026.6.2

This release tightens mise's default supply-chain posture: fuzzy version resolution now waits 24 hours after a release by default on timestamp-aware backends, with new excludes, opt-outs, and warnings so it stays out of your way when you don't want it. A couple of long-standing GitHub-attestation and npm-install rough edges are smoothed over as well.

## Added
- **(config)** Apply a built-in 24-hour `minimum_release_age` when no global or per-tool value is set, for backends that expose release timestamps (core, aqua, github, npm, pipx, etc.). Asdf/vfox/plugin-style tools without release metadata are unaffected. `mise ls-remote` now reports how many releases were hidden, and `mise upgrade` warns when a newer release is being ignored by the cutoff, e.g.:

  ```
  newer jq release 1.7.2 ignored by minimum_release_age
  ```

  Set `minimum_release_age = "0s"` to disable the default. Pinned exact versions still bypass the filter. ([#10279](https://github.com/jdx/mise/pull/10279) by @jdx)

- **(config)** New `minimum_release_age_excludes` setting to skip the global (and built-in) release-age policy for selected tools or whole backends. Entries may be tool shorthands, full backend IDs, or backend wildcards:

  ```toml
  [settings]
  minimum_release_age = "24h"
  minimum_release_age_excludes = ["jq", "npm:prettier", "npm:*"]
  ```

  Per-tool `minimum_release_age` and CLI `--minimum-release-age` still take precedence as before. ([#10277](https://github.com/jdx/mise/pull/10277) by @jdx)

- **(registry)** `cargo-msrv` is now available in the registry, installed via aqua (`foresterre/cargo-msrv`) with a `cargo:cargo-msrv` fallback ([#10276](https://github.com/jdx/mise/pull/10276) by @jdx).

## Fixed
- **(github)** GitHub artifact attestation detection and verification now respect the existing registry/default-backend gate, so custom `github:` repos and non-registry aqua packages talk to GitHub directly instead of routing through the `mise-versions` host. Python precompiled builds still use the versions host; Ruby precompiled attestations use it only for the default `jdx/ruby` source ([#10260](https://github.com/jdx/mise/pull/10260) by @jdx).
- **(npm)** After global npm installs, mise warns when the package declares lifecycle scripts (`preinstall` / `install` / `postinstall`) that were skipped because mise still passes `--ignore-scripts=true`. Setting `npm_args = "--ignore-scripts=false"` (or `--no-ignore-scripts`) correctly suppresses the warning, with later flags winning ([#10280](https://github.com/jdx/mise/pull/10280) by @jdx).

## Changed
- **(registry)** `aube` and `pitchfork` now resolve to `jdx/aube` and `jdx/pitchfork` in both the mise registry and the vendored aqua registry, with `endevco/*` aliases retained for compatibility. Aube `<= 1.18.1` skips GitHub artifact attestations to match the upstream aqua registry change ([#10285](https://github.com/jdx/mise/pull/10285) by @jdx).

## Documentation
- **(security)** A new Security page consolidates software verification and supply-chain guidance, documents the 24h `minimum_release_age` default and `0s` opt-out, and clarifies that only `npm:` and `pipx:` currently forward the cutoff to transitive dependency resolution ([#10278](https://github.com/jdx/mise/pull/10278) by @jdx).
- **(settings)** Examples and CLI hints prefer the shorter `mise settings set key=value` form ([#10271](https://github.com/jdx/mise/pull/10271) by @jdx).
- Debian/Ubuntu install instructions now recommend `extrepo`, since mise's deb repository was added to Debian extrepo ([#10262](https://github.com/jdx/mise/pull/10262) by @okulev).
- Sponsor logos on the docs site now have better contrast ([#10270](https://github.com/jdx/mise/pull/10270) by @jdx).

## New Contributors
* @okulev made their first contribution in [#10262](https://github.com/jdx/mise/pull/10262)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.6.1...v2026.6.2

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.