v2026.6.3

This release smooths over follow-ups to v2026.6.2's built-in `minimum_release_age` cutoff, introduces opt-in platform-aware config environments, and tightens lockfile and Windows behavior for tasks and installs.

## Added
- **(config)** New `auto_env` early-init setting (`MISE_AUTO_ENV` or `.miserc.toml`) that automatically activates platform-derived config environments — `unix`, `{os}` (`linux` / `macos` / `windows`), and `{os}-{arch}` (e.g. `windows-x64`, `macos-arm64`) — so files like `mise.windows.toml`, `mise/config.macos-arm64.toml`, and matching `mise.<env>.lock` lockfiles load automatically. Precedence is `unix` < `{os}` < `{os}-{arch}` < explicit `MISE_ENV`, and auto envs are deliberately not propagated through `MISE_ENV` or `{{ mise_env }}`. Off by default in this release; a transitional warning ships in 2026.12.0 and the default flips on in 2027.6.0 ([#10316](https://github.com/jdx/mise/pull/10316) by @jdx).
- **(github)** `mise token github --oauth --refresh` (and the hidden `mise github token` alias) forces a fresh OAuth token mint even when the cached token is still time-valid. The refresh-token grant is tried first with no user interaction, falling back to a new device-code flow. Useful when you authorize the app first and install it on a repo afterwards and the cached token still has the pre-installation permissions ([#10317](https://github.com/jdx/mise/pull/10317) by @jdx).
- **(backend)** `version_expr` can now post-process `version_regex` results as a pipeline — when both are set, regex output is exposed as a `versions` variable to expr. This fixes `oc` and `openshift-install` `latest` resolution (now `4.22.0` instead of `4.9.9`) by sorting the lexicographic HTML listing from `mirror.openshift.com` via `version_expr = 'sortVersions(versions)'` ([#10302](https://github.com/jdx/mise/pull/10302) by @konono).
- **(deps)** First-class Deno support in `mise deps` — automatic detection plus list, install, add, and remove ([#10291](https://github.com/jdx/mise/pull/10291) by @felipecrs).
- **(registry)** Added `imagemagick` (`aqua:ImageMagick/ImageMagick`) ([#10118](https://github.com/jdx/mise/pull/10118) by @thernstig) and `vscode-cli` (`aqua:microsoft/vscode/code`) ([#10314](https://github.com/jdx/mise/pull/10314) by @felipecrs).

## Fixed
- **(config)** The built-in 24h default `minimum_release_age` introduced in v2026.6.2 no longer disables installed-version fast paths, fixing a regression where shell startup grew from ~2.5s to ~65s because every `mise which` / `mise hook-env` invocation fetched remote version lists. Cutoff resolution now tracks provenance (`Default` / `Provided` / `Explicit`): the default only gates remote picks at install time, while explicit CLI / setting / per-tool cutoffs keep their date-aware semantics ([#10315](https://github.com/jdx/mise/pull/10315) by @jdx).
- **(backend)** `minimum_release_age = "0s"` is now correctly treated as disabling the cutoff. Backends can also expose fast-path latest release metadata (with `created_at`), so the canonical latest can pass an age check even when cached remote version lists are stale ([#10310](https://github.com/jdx/mise/pull/10310) by @jdx).
- **(python)** Core Python remote versions now carry release timestamps — python-build-standalone dates for precompiled listings and python-build definition commit timestamps for source-build listings — so `minimum_release_age` actually filters them ([#10311](https://github.com/jdx/mise/pull/10311) by @jdx).
- **(lock)** Tools resolved from idiomatic version files (`.node-version`, `.python-version`, …) are now written to the project `mise.lock` instead of a phantom sibling lockfile, so `mise install --locked` no longer rejects them as missing ([#10309](https://github.com/jdx/mise/pull/10309) by @jdx). When multiple base configs share a project root, lockfile selection is now deterministic and picks the highest-precedence config — e.g. colocated `mise.toml` and `.mise/config.toml` consistently target `.mise/mise.lock` ([#10319](https://github.com/jdx/mise/pull/10319) by @jdx).
- **(task)** Tasks loaded via `task_config.includes` now receive the collected `task_templates` map, so a task that only has `extends = "template:..."` actually inherits its `run` entries instead of silently exiting successfully ([#10312](https://github.com/jdx/mise/pull/10312) by @jdx).
- **(task)** On Windows, inline tasks and `[hooks]` commands routed through `cmd /c` preserve inner double quotes. Previously, the std argv serializer produced `\"`-escaped strings that `cmd.exe` passed through literally, so e.g. `uv run --no-project python -c "import pathlib; print(pathlib.Path.home())"` failed with `SyntaxError: unterminated string literal`. Commands are now built verbatim via `cmd /s /c "..."`, with forwarded args still MSVCRT-quoted inside ([#10301](https://github.com/jdx/mise/pull/10301) by @JamBalaya56562).
- File renames during install now retry up to 5 times on Windows for transient `ERROR_ACCESS_DENIED (5)` and `ERROR_SHARING_VIOLATION (32)` errors (typically Windows Defender holding extracted files), with exponential backoff from 50ms to 800ms ([#10300](https://github.com/jdx/mise/pull/10300) by @jhult).
- **(completions)** Require `usage` 3.5 in the generated usage spec to pick up zsh colon completion fixes; the zsh completion script now consumes three tab-separated fields and uses `compadd` ([#10313](https://github.com/jdx/mise/pull/10313) by @jdx).
- **(registry)** `podman` now points at its new GitHub organization after the upstream rename on 2026-06-01 ([#10288](https://github.com/jdx/mise/pull/10288) by @TyceHerrman).

## New Contributors
* @felipecrs made their first contribution in [#10314](https://github.com/jdx/mise/pull/10314)
* @jhult made their first contribution in [#10300](https://github.com/jdx/mise/pull/10300)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.6.2...v2026.6.3

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.