v2026.7.11

This release sharpens task handling around remote files, global config, and tool selectors, trims redundant work from shell activation, and fixes several bootstrap and platform-specific edge cases.

> [!NOTE]
> This is the first published release since v2026.7.7 — versions 2026.7.8 through 2026.7.10 were tagged but never published due to a release pipeline issue. Their changes are included here; see [**Also in this release**](#also-in-this-release-v202678v2026710) below.

## Added
- **config:** structured tool definitions now accept `version`, `path`, `prefix`, and `ref` selectors consistently in root `[tools]`, inline task definitions, task templates, and file-task headers. Exactly one selector is required, and conflicting, missing, or non-string selectors now fail with a clear configuration error instead of silently defaulting or panicking. ([#11069](https://github.com/jdx/mise/pull/11069) by @risu729)

  ```toml
  node = { version = "20" }
  go = { prefix = "1.22" }
  python = { ref = "main" }
  shellcheck = { path = "/opt/shellcheck" }
  ```

## Fixed
- **task:** remote HTTP and Git-backed task files now have their `#MISE` headers parsed, so metadata like `tools`, `description`, and `hide` and inline TOML overrides are honored just like local file tasks. Git-backed task files are also made executable after cloning and on cache hits. ([#11111](https://github.com/jdx/mise/pull/11111) by @Marukome0743)
- **task:** file tasks loaded from user-global or system configs are now correctly treated as global regardless of their include path, so custom global scripts appear under `mise tasks --global`, stay out of `--local`, and use the invoking project root. ([#11106](https://github.com/jdx/mise/pull/11106) by @risu729)
- **task:** `mise tasks info`, extended listings, task help, and the MCP tasks resource now report every configuration source contributing to a task, with a new `config_sources` array in JSON output. Changing metadata in a TOML overlay now correctly invalidates the merged file task's cache. ([#11098](https://github.com/jdx/mise/pull/11098) by @risu729)
- **watch:** `mise --env <profile> watch` now propagates the selected environment to the watched task, so profile-specific tasks resolve correctly on each rerun. ([#11114](https://github.com/jdx/mise/pull/11114) by @Marukome0743)
- **http:** raw executables (such as PHP PHARs like Composer) installed via the HTTP backend are now created readable as well as executable (mode `0755` rather than `0711`), fixing "Could not open input file" errors for interpreters run by non-owner users. ([#11135](https://github.com/jdx/mise/pull/11135) by @jdx)
- **java:** `mise latest java@<vendor>` now prefers the base vendor variant over dashed specializations and sorts multi-feature vendor prefixes correctly. ([#11109](https://github.com/jdx/mise/pull/11109) by @roele)
- **config:** reject conflicting tool selectors at parse time (see Added). ([#11069](https://github.com/jdx/mise/pull/11069) by @risu729)
- **bootstrap:** systemd timers can now reference a managed service by its bare TOML key (e.g. `unit = "dotfiles-maintain"`), which resolves to `dev.mise.<name>.service`. Fully qualified names like `nginx.service` are still written verbatim. ([#11128](https://github.com/jdx/mise/pull/11128) by @jdx)
- **bootstrap:** Homebrew casks that declare `auto_updates` are now accepted instead of failing with an unsupported-lifecycle error. ([#11107](https://github.com/jdx/mise/pull/11107) by @casparbreloh)
- **bootstrap:** macOS `defaults` handling now treats a missing key or domain as unset rather than erroring during initial setup. ([#11118](https://github.com/jdx/mise/pull/11118) by @roele)
- **windows:** `mise uninstall` now removes dangling runtime version pointer files (like `16` or `latest`) and cleans up the now-empty tool directory. ([#11095](https://github.com/jdx/mise/pull/11095) by @JamBalaya56562)

## Performance
- **activate:** the redundant initial prompt hook that ran immediately after activation is now skipped for bash, zsh, and fish when the session is unchanged, avoiding an extra `mise` process on shell startup. ([#11130](https://github.com/jdx/mise/pull/11130), [#11131](https://github.com/jdx/mise/pull/11131), [#11134](https://github.com/jdx/mise/pull/11134) by @jdx)
- **backend:** archive extraction and macOS `hdiutil`/`pkgutil` waits now run via `block_in_place`, so parallel installs no longer starve download progress and other tasks of runtime threads. ([#11136](https://github.com/jdx/mise/pull/11136) by @jdx)

## Registry
- Allow the reviewed `@nubjs/nub` postinstall lifecycle script to run via the npm backend so upgrades keep the `~/.nub/shims` hardlinks refreshed; default-deny behavior is preserved for all other packages. ([#11126](https://github.com/jdx/mise/pull/11126) by @risu729)

## Documentation
- **environments:** clarify mise directory variables ([#11127](https://github.com/jdx/mise/pull/11127) by @jdx)
- Fix dead VersionFox and MCP documentation links ([#11117](https://github.com/jdx/mise/pull/11117) by @Bartok9)
- Add an example showing how to alias multiple tools from one GitHub release ([#11110](https://github.com/jdx/mise/pull/11110) by @LukasKnuth)


---

## Also in this release: v2026.7.8–v2026.7.10

Due to a release pipeline issue, versions 2026.7.8 through 2026.7.10 were tagged but never published. This is the first release since [v2026.7.7](https://github.com/jdx/mise/releases/tag/v2026.7.7), so it also ships everything below.

### Added
- **bootstrap:** package manager plugins — vfox Lua plugins can now act as system package managers, with a declarative `[bootstrap.plugins]` config and `mise bootstrap plugins apply|status` commands. Declared plugins install before built-in packages, then plugin-managed packages apply once host tools are available. ([#11023](https://github.com/jdx/mise/pull/11023), [#11024](https://github.com/jdx/mise/pull/11024) by @jdx)
- **bootstrap:** new `mise bootstrap repos update` and `mise bootstrap repos exec` commands. Unpinned `[bootstrap.repos]` entries are intentionally never pulled by declarative apply; `repos update` gives an explicit fetch + fast-forward path (with dry-run and path filtering), and `repos exec` runs a command across configured checkouts. `mise bootstrap --update` now also updates repos. ([#11022](https://github.com/jdx/mise/pull/11022) by @jdx)
- **registry:** opt-in floating registries — with `registry_floating`, mise fetches the latest released registry metadata (and the current aqua registry) instead of the release-pinned copies. Useful on distributions whose mise package lags behind releases while registry entries keep changing. ([#10971](https://github.com/jdx/mise/pull/10971) by @jdx)
- **backend:** exact-version fast path — when a request is an exact semver version, the cargo, npm, go, gem, pipx, and dotnet backends now skip fetching the remote version list entirely and let the underlying installer validate it. This speeds up exact pins without a lockfile, first-time `mise install tool@x.y.z`, and `mise x tool@x.y.z`. ([#11013](https://github.com/jdx/mise/pull/11013) by @Turbo87, [#11070](https://github.com/jdx/mise/pull/11070) by @jdx)
- **task:** dependencies whose templated names render to an empty string are now skipped, so templates can conditionally disable a dependency. Empty templated dependency *args* are omitted as well. ([#11057](https://github.com/jdx/mise/pull/11057) by @risu729, [#11055](https://github.com/jdx/mise/pull/11055) by @jdx)

### Fixed
- **http:** mise now fails fast when the network is unavailable: DNS resolver failures are treated as non-retryable, a process-local circuit opens after hard DNS/connection failures, and remote-version lookups are capped at 3 seconds under `prefer_offline`. Shims, shell activation, and `mise x` make one bounded attempt instead of grinding through full retry schedules per endpoint. ([#11066](https://github.com/jdx/mise/pull/11066) by @jdx)
- **config:** stricter, clearer configuration validation: `env` directive value aliases ([#11062](https://github.com/jdx/mise/pull/11062)), `env.mise` directives ([#11053](https://github.com/jdx/mise/pull/11053)), and the experimental monorepo root key ([#11052](https://github.com/jdx/mise/pull/11052)) are deprecated, and non-string `postinstall` hooks are rejected at parse time ([#11061](https://github.com/jdx/mise/pull/11061)) (all by @risu729)
- **hooks:** hook definitions are validated more strictly — unknown table fields ([#11047](https://github.com/jdx/mise/pull/11047)) and nested hook arrays ([#11051](https://github.com/jdx/mise/pull/11051)) are rejected, and the spawned-scripts form is deprecated ([#11043](https://github.com/jdx/mise/pull/11043)) (all by @risu729)
- **schema:** a large batch of JSON schema corrections so editors validate real configs correctly: OCI copy entries ([#11009](https://github.com/jdx/mise/pull/11009)), bootstrap shell activation ([#11004](https://github.com/jdx/mise/pull/11004)) and bootstrap hooks ([#11039](https://github.com/jdx/mise/pull/11039)), structured task tool options ([#11021](https://github.com/jdx/mise/pull/11021)), required watch file patterns ([#11040](https://github.com/jdx/mise/pull/11040)), plugin manifest fields ([#11035](https://github.com/jdx/mise/pull/11035)), root hook definitions ([#11041](https://github.com/jdx/mise/pull/11041)), integer types for integer settings ([#11037](https://github.com/jdx/mise/pull/11037)), array-typed deps provider paths ([#11064](https://github.com/jdx/mise/pull/11064)) (all by @risu729), and systemd timer/lifecycle options ([#11050](https://github.com/jdx/mise/pull/11050) by @jdx)
- **dry runs** no longer cause side effects: task setup is skipped ([#11015](https://github.com/jdx/mise/pull/11015)), install hooks are previewed instead of executed ([#11010](https://github.com/jdx/mise/pull/11010)), and `mise prune --dry-run` preserves runtime symlinks ([#11017](https://github.com/jdx/mise/pull/11017)) (all by @risu729)
- **bootstrap:** Homebrew cask metadata is preserved ([#11012](https://github.com/jdx/mise/pull/11012)) and macOS metadata files in cask artifacts are ignored ([#11063](https://github.com/jdx/mise/pull/11063)); repo origins are compared transport-agnostically so `git@` vs `https://` remotes don't trigger spurious mismatches ([#11034](https://github.com/jdx/mise/pull/11034) by @jeremy); static systemd units no longer break `bootstrap status` ([#11056](https://github.com/jdx/mise/pull/11056) by @jdx)
- **backend:** prerelease versions without a separator (like `1.2.3rc1`) are detected correctly ([#11032](https://github.com/jdx/mise/pull/11032) by @jdx); cargo sparse-index version discovery is restored ([#11011](https://github.com/jdx/mise/pull/11011) by @Turbo87); go resolves direct package module prefixes ([#11054](https://github.com/jdx/mise/pull/11054) by @jdx)
- **install:** `false` install env values are treated as removals ([#11033](https://github.com/jdx/mise/pull/11033) by @risu729)
- **lockfile:** platform-specific tool option variants are preserved instead of being collapsed ([#10999](https://github.com/jdx/mise/pull/10999) by @jdx)
- **shell:** hyphenated tool names work in shell integrations ([#10961](https://github.com/jdx/mise/pull/10961) by @risu729), and bash `deactivate` no longer errors on empty array expansions under `set -u` ([#11026](https://github.com/jdx/mise/pull/11026) by @jdx)
- **shim:** recursion is prevented when the directory env is filtered ([#10982](https://github.com/jdx/mise/pull/10982) by @risu729)
- **task:** file tasks resolve source files relative to the task directory ([#11073](https://github.com/jdx/mise/pull/11073) by @JamBalaya56562), and tasks generated from templates inherit the template's `output` setting ([#11059](https://github.com/jdx/mise/pull/11059) by @risu729)
- **launchd:** `bootout` EIO for not-loaded agents is tolerated on macOS ([#10965](https://github.com/jdx/mise/pull/10965) by @hsbt)
- **nix:** `TZDIR` is set so timezone tests pass in the sandbox build ([#11019](https://github.com/jdx/mise/pull/11019) by @coryzibell)

### Performance
- **startup:** ~2ms shaved off every invocation — config lookup no longer compiles ~200 glob patterns per startup (literal filenames are stat'd directly), and the clap command tree is built once instead of twice. `mise version` drops from 8.1ms to 6.6ms, `hook-env` from 10.9ms to 9.3ms. ([#11025](https://github.com/jdx/mise/pull/11025) by @jdx)
- **release:** release binaries for linux-x64 and macos-arm64 are now built with profile-guided optimization, trained on a hermetic offline workload covering config load, toolset resolution, `hook-env`, env rendering, tasks, and exec — ~10% faster on hot paths and ~4% smaller binaries ([#11031](https://github.com/jdx/mise/pull/11031) by @jdx). macOS tarballs now target macOS 12 ([#11027](https://github.com/jdx/mise/pull/11027) by @jdx).
- **runtime:** default tokio worker threads are capped at 16, avoiding oversized thread pools on many-core machines ([#11029](https://github.com/jdx/mise/pull/11029) by @jdx)

### Refactor
- tar extraction, inspection, and verification are consolidated onto `jdx-tar`, removing the system `tar` fallback and a duplicate tar implementation — consistent archive behavior across platforms ([#11028](https://github.com/jdx/mise/pull/11028) by @jdx)

### Registry
- add zmx ([github:neurosnap/zmx](https://github.com/neurosnap/zmx)) ([#11006](https://github.com/jdx/mise/pull/11006) by @offbyone)
- docker-compose switched from the aqua to the github backend ([#10823](https://github.com/jdx/mise/pull/10823) by @konono)
- eza switched from the asdf to the vfox backend ([#11068](https://github.com/jdx/mise/pull/11068) by @jdx)

### Documentation
- **templates:** clarify `exec` behavior in dry runs ([#11018](https://github.com/jdx/mise/pull/11018) by @risu729)

## New Contributors
- @Bartok9 made their first contribution in [#11117](https://github.com/jdx/mise/pull/11117)
- @LukasKnuth made their first contribution in [#11110](https://github.com/jdx/mise/pull/11110)
- @jeremy made their first contribution in [#11034](https://github.com/jdx/mise/pull/11034)
- @Turbo87 made their first contribution in [#11011](https://github.com/jdx/mise/pull/11011)
- @coryzibell made their first contribution in [#11019](https://github.com/jdx/mise/pull/11019)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.7.7...v2026.7.11

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.