v2026.7.6

## Added
- **task:** per-task `output` style field, decoupled from verbosity, so styles like `prefix` and quietness combine freely [#10885](https://github.com/jdx/mise/pull/10885)
- **sandbox:** global `[settings.sandbox]` deny defaults (`deny_all`, `deny_read`, `deny_write`, `deny_net`, `deny_env`) [#10940](https://github.com/jdx/mise/pull/10940)
- **bootstrap:** Flatpak package support for `[bootstrap.packages]` on Linux [#10951](https://github.com/jdx/mise/pull/10951)
- **oci:** reproducible host path copy layers via `mise oci build --copy HOST_PATH:IMAGE_PATH` and `[[oci.copy]]` [#10952](https://github.com/jdx/mise/pull/10952)
- **doctor:** `mise doctor` now warns when a mise shim is shadowed by an earlier executable in `PATH` [#10919](https://github.com/jdx/mise/pull/10919)
- **aqua:** support for private `github_content` and `github_archive` packages via authenticated GitHub API endpoints [#10915](https://github.com/jdx/mise/pull/10915)
- **task:** task-level `timeout` values now render Tera templates [#10959](https://github.com/jdx/mise/pull/10959)
- **http:** `http_download_timeout` setting caps total download wall-clock time (default 30 minutes) [#10920](https://github.com/jdx/mise/pull/10920)
- **registry:** add git-town ([aqua:git-town/git-town](https://github.com/git-town/git-town)) [#10935](https://github.com/jdx/mise/pull/10935) and bundler (gem:bundler) [#10939](https://github.com/jdx/mise/pull/10939)

## Fixed
- **backend:** reinstall rolling versions (e.g. `nightly`) when the installed content is outdated [#10827](https://github.com/jdx/mise/pull/10827)
- **backend:** align migrated backend resolution [#10969](https://github.com/jdx/mise/pull/10969)
- **config:** keep already-installed versions eligible when `minimum_release_age` is configured [#10973](https://github.com/jdx/mise/pull/10973)
- **config:** let user table-syntax tool options override registry defaults [#10924](https://github.com/jdx/mise/pull/10924)
- **config:** reload settings when config is reset so bootstrap phases use a consistent snapshot [#10945](https://github.com/jdx/mise/pull/10945)
- **config:** warn when a tool version uses an unsupported npm-style semver range [#10916](https://github.com/jdx/mise/pull/10916)
- **config:** add Tera contrib helpers [#10970](https://github.com/jdx/mise/pull/10970)
- **task:** preserve structured task-level tool options (arrays/tables such as `os`, `depends`, `install_env`) [#10958](https://github.com/jdx/mise/pull/10958)
- **task:** isolate `usage_*` variables per invocation so nested tasks don't inherit stale parser output [#10963](https://github.com/jdx/mise/pull/10963)
- **task:** invalidate auto freshness after a failed rerun [#10953](https://github.com/jdx/mise/pull/10953)
- **task:** respect configured `includes` directory when editing/adding file tasks [#10955](https://github.com/jdx/mise/pull/10955)
- **s3:** resolve cross-platform lockfile URLs for locked mode [#10873](https://github.com/jdx/mise/pull/10873)
- **bootstrap:** preserve symlinks when extracting DMGs and always detach on copy failure [#10949](https://github.com/jdx/mise/pull/10949)
- **bootstrap:** support localized brew casks (`language`, `on_system_conditional`) and reuse existing Ruby [#10950](https://github.com/jdx/mise/pull/10950)
- **erlang:** lock source install outcomes [#10937](https://github.com/jdx/mise/pull/10937)
- **github:** align SLSA provenance with the selected asset [#10928](https://github.com/jdx/mise/pull/10928)
- **github:** treat `bin`/`rename_exe` as install-time options [#10925](https://github.com/jdx/mise/pull/10925)
- **npm:** isolate version queries from project cwd [#10927](https://github.com/jdx/mise/pull/10927)
- **cargo:** own the cargo-binstall compile fallback [#10926](https://github.com/jdx/mise/pull/10926)
- **registry:** normalize backend platform selectors [#10938](https://github.com/jdx/mise/pull/10938)
- **registry:** rename the podman binary to `podman-remote` [#10826](https://github.com/jdx/mise/pull/10826)
- **file:** ignore malformed pax metadata during sparse detection [#10978](https://github.com/jdx/mise/pull/10978)
- **copr:** fix x86_64 builds (nasm/cmake for Fedora, PREBUILT_NASM for RHEL/EPEL) [#10947](https://github.com/jdx/mise/pull/10947) and add PIE flag for aws-lc probe [#10974](https://github.com/jdx/mise/pull/10974)
- **toolset:** preserve ref selector install identity [#10942](https://github.com/jdx/mise/pull/10942)

## Changed
- **cargo:** disable cargo-quickinstall by default; opt back in with `cargo.binstall_quickinstall = true` [#10923](https://github.com/jdx/mise/pull/10923)
- **registry:** revert preferring aqua for codex [#10922](https://github.com/jdx/mise/pull/10922)

## Performance
- **aqua:** skip public reachability probes for packages marked private [#10914](https://github.com/jdx/mise/pull/10914)

## Documentation
- **aqua:** document local custom registries [#10966](https://github.com/jdx/mise/pull/10966)
- **config:** clarify sub-version arithmetic [#10943](https://github.com/jdx/mise/pull/10943)

## Breaking Changes
- **task:** `--quiet` / `quiet = true` / `MISE_QUIET=1` no longer collapse task output to un-prefixed interleave; they now preserve the resolved style. Use `--output quiet` (or `-o interleave`) for the old behavior [#10885](https://github.com/jdx/mise/pull/10885)
- **task:** `usage_*` variables are now invocation-local; workflows that injected them as implicit inputs must declare an input with `env=` instead [#10963](https://github.com/jdx/mise/pull/10963)

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.