v2026.6.6

## Added
- `mise bootstrap` command for end-to-end machine setup — system packages, dotfiles, macOS defaults, login shell, tools, and an optional `bootstrap` task — with `--yes`, `--dry-run`, and `--update` ([#10365](https://github.com/jdx/mise/pull/10365), [#10376](https://github.com/jdx/mise/pull/10376) by @jdx).
- Declarative dotfiles via `[dotfiles]` plus `mise dotfiles add` / `apply` / `edit` / `status`, supporting `symlink`, `symlink-each`, `copy`, and `template` modes, glob wildcards in source paths, and block/line edits to files mise doesn't own ([#10365](https://github.com/jdx/mise/pull/10365), [#10368](https://github.com/jdx/mise/pull/10368), [#10374](https://github.com/jdx/mise/pull/10374), [#10376](https://github.com/jdx/mise/pull/10376) by @jdx).
- `[bootstrap.macos.defaults]` for declaratively managing macOS user defaults, applied through `mise bootstrap macos-defaults apply` with drift reporting in status and `mise doctor` ([#10363](https://github.com/jdx/mise/pull/10363) by @jdx).
- `[bootstrap.user].login_shell` to declare and converge the current user's login shell (`chsh -s`, updating `/etc/shells` when needed) ([#10377](https://github.com/jdx/mise/pull/10377) by @jdx).
- `[bootstrap.brew.taps]` and `mise bootstrap packages brew tap` / `untap` for third-party Homebrew taps, with tap context preserved through dependency resolution and source builds ([#10375](https://github.com/jdx/mise/pull/10375), [#10383](https://github.com/jdx/mise/pull/10383) by @jdx).
- `brew-cask:` package manager that installs supported app-bundle casks directly from cask API metadata without requiring a local Homebrew install ([#10383](https://github.com/jdx/mise/pull/10383) by @jdx).
- Native Homebrew source builds: when no usable bottle exists, mise provisions Ruby, evaluates the formula with a built-in Formula DSL shim, and builds from source into the canonical prefix ([#10364](https://github.com/jdx/mise/pull/10364) by @jdx).
- `mise oci build` now bakes `[dotfiles]` and `apt:` `[bootstrap.packages]` into images as dedicated annotated OCI layers ([#10373](https://github.com/jdx/mise/pull/10373) by @jdx).
- Safe `mise.toml` files (no templates, only `min_version` and plain `[tools]` / `[tasks]` strings) auto-load without a trust prompt; everything else still requires trust ([#10360](https://github.com/jdx/mise/pull/10360) by @jdx).

## Fixed
- CLI no longer panics on arguments containing invalid UTF-8; malformed bytes become U+FFFD and surface as a normal error ([#10386](https://github.com/jdx/mise/pull/10386) by @JamBalaya56562, fixes [#10056](https://github.com/jdx/mise/issues/10056)).
- GitHub 403 errors now include the response body, rate-limit headers, and whether the request was authenticated, replacing the bare `403 Forbidden` message ([#10382](https://github.com/jdx/mise/pull/10382) by @jdx).
- Brew shim (`shim.rb`) is now included in the published crate, fixing `cargo publish` for the source-build path ([#10388](https://github.com/jdx/mise/pull/10388) by @jdx).

## Changed
- MCP server, sandboxing, hooks/`watch_files`, monorepo tasks, task templates, native GitHub OAuth, custom vfox backends, Swift, and the dotnet/s3/spm backends are no longer experimental; the monorepo root key is now `monorepo_root` (with `experimental_monorepo_root` kept as a hidden alias) ([#10371](https://github.com/jdx/mise/pull/10371) by @jdx).
- Version lists for `mise-versions` are now fetched from `/data/{tool}.toml` so Cloudflare can serve them as static assets ([#10361](https://github.com/jdx/mise/pull/10361) by @jdx).
- Split archive extraction and single-file decompression into dedicated helpers (`extract_archive`, `decompress_file`), with clearer errors for unsupported formats ([#10274](https://github.com/jdx/mise/pull/10274) by @risu729).

## Documentation
- Documented the 24h default for `minimum_release_age` ([#10366](https://github.com/jdx/mise/pull/10366) by @ThijsdeJong-TomTom).
- Link to all sponsors, add more tips-and-tricks entries, clarify contribution fit, and make the contributing guide canonical ([#10369](https://github.com/jdx/mise/pull/10369), [#10370](https://github.com/jdx/mise/pull/10370), [#10378](https://github.com/jdx/mise/pull/10378), [#10380](https://github.com/jdx/mise/pull/10380) by @jdx).

## New Contributors
- @ThijsdeJong-TomTom made their first contribution in [#10366](https://github.com/jdx/mise/pull/10366)

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.