v2026.8.13

This release adds a few configuration and task features and delivers a large batch of fixes across completions, tools, lockfiles, tasks, config parsing, and shell integration. It also restores dynamic shell completions that regressed after the recent CLI parser change.

## Added
- **task:** New `task_config.excludes` lets file-task discovery skip config-root-relative paths, directories, and glob patterns, so accidental TOML files (like a `pyproject.toml` inside a task directory) or entire subtrees are no longer treated as tasks. The closest config that sets `excludes` replaces inherited values, and an empty list clears the cascade. Relative `task.disable_paths` now resolve from the declaring config file. ([#12366](https://github.com/jdx/mise/pull/12366) by @jdx)

  ```toml
  [task_config]
  excludes = ["scripts/vendor", "**/*.generated.toml"]
  ```
- **config:** Project configuration can now be split into visible `mise/conf.d/*.toml` fragments, mirroring the existing `.mise/conf.d` and `.config/mise/conf.d` support but without a hidden dot-directory. Fragments merge alphabetically, `mise/config.toml` still wins over fragments, and environment-specific and `.local` variants (for example `mise/conf.d/tools.development.toml`) follow the usual env config rules. ([#12395](https://github.com/jdx/mise/pull/12395) by @jdx)
- **bootstrap:** Added `--skip-dirty` to `mise bootstrap`, `mise bootstrap repos apply`, and `mise bootstrap repos update` to warn and skip repos with local changes so the remaining repos still update. Origin mismatches and non-git targets still fail closed as before. ([#12364](https://github.com/jdx/mise/pull/12364) by @jdx)

## Fixed
- **completion:** Restored dynamic shell completions that broke after the switch to usage-rs. Task names, task-specific flags, task value choices, and `run=` completers work again in fish and zsh, while native file/path completion still falls back correctly. ([#12376](https://github.com/jdx/mise/pull/12376), [#12379](https://github.com/jdx/mise/pull/12379) by @jdx)
- **env:** Command-prefix and runtime environment overrides (for example `VAR=override mise run ...`) are no longer wiped when reconstructing the pre-mise environment in an activated shell; mise-managed values are only rolled back when the live value still matches what mise recorded. ([#12390](https://github.com/jdx/mise/pull/12390) by @jdx)
- **env:** A leading UTF-8 byte-order mark in an env file is now stripped before parsing. ([#12320](https://github.com/jdx/mise/pull/12320) by @JamBalaya56562)
- **backend:** Fixed a regression where an offline `latest` request failed for a tool installed only with `mise install --system`; the effective install directory is now recovered so system/shared-only installs satisfy `latest`. ([#12406](https://github.com/jdx/mise/pull/12406) by @jdx)
- **github:** When a lockfile records a checksum but no provenance, mise no longer probes the GitHub releases API at install time. This avoids hard install failures under rate limiting in high-concurrency CI, since the lockfile checksum already guarantees artifact integrity. The lockfile checksum now also takes priority over release-metadata digests. ([#12377](https://github.com/jdx/mise/pull/12377) by @effati)
- **brew:** Cask installs now recursively extract single nested archives (matching Homebrew's `extract_nestedly`, for example a zip containing only a DMG), and bare cask `.pkg` downloads are staged correctly. ([#12373](https://github.com/jdx/mise/pull/12373), [#12371](https://github.com/jdx/mise/pull/12371) by @jdx)
- **pipx:** Non-GitHub Git `latest` requests now resolve to the remote default branch HEAD and are treated as a rolling channel, so `outdated` and `upgrade` detect branch movement. An unavailable configured executable is now rejected instead of failing later. ([#12407](https://github.com/jdx/mise/pull/12407), [#12416](https://github.com/jdx/mise/pull/12416) by @jdx)
- **lockfile:** Each new version is now attributed to its own request source, so in monorepo or parent/child layouts that request the same tool at different versions, every lockfile receives its own entry instead of the first request's lockfile getting them all. Monorepo root requests are also included in lockfile maintenance. ([#12381](https://github.com/jdx/mise/pull/12381), [#12382](https://github.com/jdx/mise/pull/12382) by @pikeas)
- **task:** Several ordering and output fixes: keep-order buffers are flushed instead of discarded, injected tasks are anchored at their parent's keep-order slot, `#MISE` header keys that need quoting are no longer dropped, and negative template argument bounds are rejected. Sandbox errors now name which paths do not exist yet. ([#12370](https://github.com/jdx/mise/pull/12370), [#12397](https://github.com/jdx/mise/pull/12397), [#12415](https://github.com/jdx/mise/pull/12415), [#12421](https://github.com/jdx/mise/pull/12421), [#12309](https://github.com/jdx/mise/pull/12309))
- **config:** Clearer parse errors, each reported once: TOML and settings parse failures name the offending file a single time (through the logger), and a message now explains what a backslash does when a config fails to parse. Picker descriptions are truncated safely. ([#12329](https://github.com/jdx/mise/pull/12329), [#12327](https://github.com/jdx/mise/pull/12327), [#12330](https://github.com/jdx/mise/pull/12330) by @JamBalaya56562; [#12422](https://github.com/jdx/mise/pull/12422) by @jdx)
- **generate:** Generated files are now each named in output, and a task stub is named after the task rather than its file. ([#12333](https://github.com/jdx/mise/pull/12333), [#12341](https://github.com/jdx/mise/pull/12341) by @JamBalaya56562)
- **trust:** A path that does not exist is now refused rather than trusting its parent. ([#12372](https://github.com/jdx/mise/pull/12372) by @JamBalaya56562)
- **prune:** Tracked configs that cannot be a config file are now removed. ([#12380](https://github.com/jdx/mise/pull/12380) by @Marukome0743)
- **self-update:** A failure updating plugins no longer fails the whole command. ([#12363](https://github.com/jdx/mise/pull/12363) by @JamBalaya56562)
- **cli:** On Windows, mise now defaults to an editor that exists and names the editor that failed to launch. ([#12375](https://github.com/jdx/mise/pull/12375) by @JamBalaya56562)
- **nushell:** `__MISE_SESSION` is now unset on deactivate. ([#12361](https://github.com/jdx/mise/pull/12361) by @NgoQuocViet2001)
- **elvish:** The prepended PATH entry is now separated correctly from the existing PATH. ([#12362](https://github.com/jdx/mise/pull/12362) by @NgoQuocViet2001)
- **ui:** Tables no longer pad the last column past its content. ([#12334](https://github.com/jdx/mise/pull/12334) by @JamBalaya56562)

## Documentation
- **security:** Updated the description of paranoid mode behavior. ([#12394](https://github.com/jdx/mise/pull/12394) by @jdx)

## Registry
- Added `mr-boxington`, `ori`, `hey-cli`, `playwright`, and `ghui`, and switched `claude-code` to aqua on Windows. ([#12384](https://github.com/jdx/mise/pull/12384), [#12388](https://github.com/jdx/mise/pull/12388), [#12387](https://github.com/jdx/mise/pull/12387), [#12385](https://github.com/jdx/mise/pull/12385), [#12386](https://github.com/jdx/mise/pull/12386), [#12399](https://github.com/jdx/mise/pull/12399))

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.8.12...v2026.8.13

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.