v2026.6.4

## Added
- **(system)** Declarative system packages (`[system.packages]`) for apt, dnf, pacman, and Homebrew core formulae (installed without a brew CLI) via new experimental `mise system status` / `install` commands ([#10326](https://github.com/jdx/mise/pull/10326) by @jdx).
- **(system)** New `mise system use` and `mise system upgrade` to write `[system.packages]` entries and refresh installed system packages ([#10346](https://github.com/jdx/mise/pull/10346) by @jdx).
- **(github)** Added `matching` (substring) and `matching_regex` asset options to the `github`, `gitlab`, and `forgejo` backends, applied before platform autodetection and scoped through SLSA provenance verification ([#10325](https://github.com/jdx/mise/pull/10325) by @devnulled).
- **(oci)** `mise oci build --owner UID[:GID]` plus `[oci].user_id` / `[oci].group_id` config for layer file ownership ([#10075](https://github.com/jdx/mise/pull/10075) by @ThomasK33).

## Fixed
- **(backend)** `--minimum-release-age=0s` now correctly disables the release-age cutoff instead of falling back to the default, and stable fast-path metadata avoids an unnecessary full version-list fetch ([#10344](https://github.com/jdx/mise/pull/10344) by @jdx).
- **(aqua)** Route GitHub metadata through `mise-versions` only for mise-registry-backed Aqua tools, eliminating noisy `403` warnings for packages like `aqua:aws/session-manager-plugin` ([#10341](https://github.com/jdx/mise/pull/10341) by @jdx).
- **(aqua)** Support `overrides[].envs` selectors so platform-specific Aqua overrides for packages like `apache/tomcat` and `eza-community/eza` apply correctly ([#10200](https://github.com/jdx/mise/pull/10200) by @risu729).
- **(task)** Resolve monorepo-relative task refs (`:task`, `//pkg:task`, aliases) the same way at validation time as runtime, so `mise tasks validate` no longer reports false missing-dependency errors ([#10342](https://github.com/jdx/mise/pull/10342) by @jdx).
- **(task)** Forwarded args now reach inline `bash -c` tasks on Windows instead of being assigned to `$0` ([#10321](https://github.com/jdx/mise/pull/10321) by @JamBalaya56562).
- **(task)** Multiline task `description` values are surfaced in `mise <task> --help` and `mise run <task> --help` while task listings remain single-line ([#10204](https://github.com/jdx/mise/pull/10204) by @risu729).
- **(tasks)** Refactor editor (`EDITOR` / `VISUAL`) command handling to support values with arguments and improve error reporting ([#9752](https://github.com/jdx/mise/pull/9752) by @roele).
- **(core)** Preserve inner double quotes for the remaining `cmd /c` call sites on Windows (`mise exec -c`, tera `exec()`, `watch_files`, postinstall hooks, `[deps]`, credential commands) ([#10323](https://github.com/jdx/mise/pull/10323) by @JamBalaya56562).
- **(install)** Skip unknown tools that are inactive on the current OS or disabled via `disable_tools`/`enable_tools` before raising registry errors ([#10206](https://github.com/jdx/mise/pull/10206) by @risu729).
- **(java)** Include the resolved `shorthand_vendor` in the lockfile identity for shorthand requests like `java@17` ([#9989](https://github.com/jdx/mise/pull/9989) by @risu729).
- **(dotnet)** Include `runtime` in the core .NET plugin lockfile identity so SDK and runtime installs no longer share a lock entry ([#10175](https://github.com/jdx/mise/pull/10175) by @risu729).

## Registry
- Added `ghtkn` ([#9967](https://github.com/jdx/mise/pull/9967) by @TyceHerrman) and `antigravity-cli` ([#10324](https://github.com/jdx/mise/pull/10324) by @rhanneken).

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.