v2026.8.9

This release expands declarative bootstrap into a composable, multi-root system; adds environment-specific `conf.d` fragments and glob-based ignored config paths; smooths out shell activation so runtime overrides stick; and delivers major startup performance gains for vfox-backed setups. It also includes several security hardening fixes worth noting.

## Highlights
- Bootstrap can now compose declarative resources (dotfiles, files, directories, services, and Compose projects) from multiple independent config roots, with provenance tracking and clear conflict diagnostics.
- Startup is dramatically faster on machines with vfox plugins: idiomatic file detection is now gated on opt-in, and vfox plugin metadata is cached on disk, cutting common invocations from hundreds of milliseconds to single digits.
- Security hardening: forge tokens no longer leak to third-party hosts, and safe mode now blocks tool-level install hooks.

## Added
- **bootstrap:** Compose declarative resources from multiple independent config roots via `[bootstrap].config_roots`. Selected roots contribute `[dotfiles]`, `[bootstrap.files]`, `[bootstrap.directories]`, `[bootstrap.services]`, and `[bootstrap.compose]` without gaining precedence from list or glob order; identical declarations are deduplicated and conflicting declarations fail with both origins reported. ([#12105](https://github.com/jdx/mise/pull/12105), [#12132](https://github.com/jdx/mise/pull/12132) by @jdx)

  ```toml
  [bootstrap]
  config_roots = ["bundles/*"]
  ```
- **bootstrap:** Declaration provenance is now retained and exposed for dotfiles and managed files/directories. `mise bootstrap plan`, bootstrap status, and `mise dotfiles status` include origin details (declaring config, config root, environment, resolved source) in JSON, and human-readable tables gain a Config column. ([#12100](https://github.com/jdx/mise/pull/12100) by @jdx)
- **bootstrap:** Homebrew-compatible support for self-updating and adopted casks in `[bootstrap.packages]`. Casks declaring `auto_updates: true` are left to update themselves, and existing app bundles can be adopted globally with `[bootstrap.brew].adopt = true` or per cask with `adopt = true`. ([#12074](https://github.com/jdx/mise/pull/12074) by @ascarter)
- **bootstrap:** Remote bootstrap gains symlink materialization controls. Use `--copy-link <PATH>` (repeatable) to dereference selected source-relative symlinks or `--copy-links` to recursively dereference all archived symlinks; both are also configurable in `[bootstrap.remote]` and per-host. Default behavior is unchanged (links stay links). ([#12121](https://github.com/jdx/mise/pull/12121) by @jdx)
- **config:** Environment-specific `conf.d` fragments. Files like `.mise/conf.d/*.{env}.toml` (and `.local` variants) load only when that config environment is active, applying to project, global, and system `conf.d` directories. ([#12151](https://github.com/jdx/mise/pull/12151) by @jdx)
- **config:** `ignored_config_paths` now supports relative entries and glob patterns (including recursive `**`). Entries in `.miserc.toml` resolve against the declaring file, while `MISE_IGNORED_CONFIG_PATHS` resolves against the invocation directory — making it easy to exclude vendored repos portably. ([#12169](https://github.com/jdx/mise/pull/12169) by @jdx)
- **config:** `mise run`, naked `mise <task>`, `mise install`, `mise exec`, and `mise watch` now implicitly trust and persist the active config in normal mode, avoiding a redundant prompt. Automatic `hook-env`/inspection commands still require explicit trust, and paranoid and safe modes are unchanged. ([#12107](https://github.com/jdx/mise/pull/12107) by @jdx)
- **system:** Plugins can declare an ordered list of candidate package names per package manager in `systemDependencies`, so the same capability can be expressed across distro renames (for example `apt = { "libaio1t64", "libaio1" }`). mise resolves the first available candidate. ([#12149](https://github.com/jdx/mise/pull/12149) by @jdx)
- **vfox:** Traditional vfox plugins can now read configured `[tools]` options from `ctx.options` in `PreInstall` and `PostInstall` hooks, with scalars as strings and arrays/tables as structured Lua values. Existing hook environment variables continue to work. ([#12174](https://github.com/jdx/mise/pull/12174) by @jdx)

## Fixed
- **hook-env:** Runtime environment overrides now persist between refreshes. Changes made with `export`, shell aliases, sourced scripts, or direct PATH edits are no longer reverted on every prompt, reversing the continuous enforcement introduced in 2026.8.0. ([#12094](https://github.com/jdx/mise/pull/12094) by @jdx)
- **aqua:** Prefer glibc release assets on unqualified glibc Linux targets, falling back to a musl asset only when no glibc sibling exists. Explicit `libc` selections stay strict. ([#12093](https://github.com/jdx/mise/pull/12093) by @jdx)
- **python:** Automatic venv creation now resolves the configured `uv` even when invoked through a tool override (for example `mise x tiny@3`), so `python.uv_venv_auto` no longer reports `uv` as missing right after mise installs it. ([#12177](https://github.com/jdx/mise/pull/12177) by @jdx)
- **which:** `mise which <bin> --tool=<tool>@<version>` now reports that the requested version is not installed (with an install hint) instead of the misleading "not currently active" message. ([#12106](https://github.com/jdx/mise/pull/12106) by @TrevorBurnham)
- **shell:** The pwsh command-not-found hook now branches on the command exit code and skips mise's own commands, and the environment is refreshed on auto-install when `--no-hook-env` omits the hook. ([#12089](https://github.com/jdx/mise/pull/12089), [#12131](https://github.com/jdx/mise/pull/12131), [#12117](https://github.com/jdx/mise/pull/12117) by @JamBalaya56562)
- **bootstrap:** Create missing parent directories when bootstrapping. ([#12096](https://github.com/jdx/mise/pull/12096) by @jdx)
- **github:** Match arm assets on arm64 hosts. ([#12098](https://github.com/jdx/mise/pull/12098) by @jdx)
- **use:** Scope global install hooks correctly. ([#12101](https://github.com/jdx/mise/pull/12101) by @jdx)
- **task:** Support Azure DevOps cloud SSH URLs as remote git task sources, and normalize Windows task environment paths. ([#12102](https://github.com/jdx/mise/pull/12102) by @cheesemans, [#12173](https://github.com/jdx/mise/pull/12173) by @jdx)
- **system:** Resolve dependency executables on Windows. ([#12178](https://github.com/jdx/mise/pull/12178) by @jdx)
- **backend:** Keep flavour queries from crossing a `+`, and key the remote version cache by listing tool options. ([#12118](https://github.com/jdx/mise/pull/12118) by @Marukome0743, [#12164](https://github.com/jdx/mise/pull/12164) by @JamBalaya56562)
- **http:** Order remote versions consistently. ([#12170](https://github.com/jdx/mise/pull/12170) by @jdx)
- **vfox:** Follow symlinks when fingerprinting plugin sources, honor `systemDependencies` in embedded plugins, and apply netrc credentials to HTTP requests. ([#12155](https://github.com/jdx/mise/pull/12155), [#12152](https://github.com/jdx/mise/pull/12152), [#12168](https://github.com/jdx/mise/pull/12168) by @jdx)
- Asset selection now handles non-gz tar variants. ([#12156](https://github.com/jdx/mise/pull/12156) by @sgammon)

## Changed
- **backend:** Removed the remaining legacy `RTX_*` environment variables (including `RTX_TOOL_OPTS__*` and `RTX_ADD_PATH`) passed to asdf and vfox plugin hooks. Plugin authors should use the equivalent `MISE_*` variables; standard `ASDF_*` variables remain available to asdf plugins. ([#12172](https://github.com/jdx/mise/pull/12172) by @jdx)

## Performance
- **config:** Idiomatic version file detection is now gated on `idiomatic_version_file_enable_tools`, so mise no longer boots a Lua VM for every vfox plugin on ordinary invocations. Common commands dropped from hundreds of milliseconds to single-digit milliseconds, and nested `mise run`/`mise x` chains improved dramatically. ([#12143](https://github.com/jdx/mise/pull/12143) by @jdx)
- **vfox:** Filesystem plugin metadata (idiomatic filenames, dependencies, system dependencies) is now cached on disk and invalidated by plugin file changes, avoiding repeated Lua execution. ([#12145](https://github.com/jdx/mise/pull/12145) by @jdx)
- **activate:** pwsh no longer runs `hook-env` twice per directory change. ([#12147](https://github.com/jdx/mise/pull/12147) by @jdx)
- **cache:** Batch remote blob prefetch. ([#12103](https://github.com/jdx/mise/pull/12103) by @jdx)

## Security
- **backend:** GitLab and Forgejo authentication headers are now bound to the configured API origin, preventing tokens from leaking to third-party release asset hosts or cross-origin pagination URLs. ([#12167](https://github.com/jdx/mise/pull/12167) by @jdx)
- Safe mode (`MISE_SAFE=1`) now blocks tool-level `postinstall` hooks and `install_env` from running during installation. ([#12140](https://github.com/jdx/mise/pull/12140) by @jdx)

## Registry
- Added `workerd` via `github:cloudflare/workerd`. ([#12180](https://github.com/jdx/mise/pull/12180) by @mikea)
- Pointed `vlang` at the maintained `vfox:jdx/vfox-v` backend so it shares versions with `v`, replacing an unmaintained third-party version source. ([#12153](https://github.com/jdx/mise/pull/12153) by @jdx)

## Breaking Changes
- **conf.d filenames:** A `conf.d` fragment with an extra dot before `.toml` (for example `node.tools.toml`) is now interpreted as environment-specific. Use hyphens for unconditional multi-word fragment names (for example `node-tools.toml`). ([#12151](https://github.com/jdx/mise/pull/12151))
- **vlang versions:** Configs pinning `vlang = "2026.x"`-style versions must move to a real upstream version such as `0.5.2` or a `weekly.*` tag, since the previous version strings did not correspond to upstream tags. ([#12153](https://github.com/jdx/mise/pull/12153))
- **RTX_* variables:** Plugins relying on legacy `RTX_*` variables must switch to `MISE_*`. ([#12172](https://github.com/jdx/mise/pull/12172))

## New Contributors
- @sgammon made their first contribution in [#12156](https://github.com/jdx/mise/pull/12156)
- @ascarter made their first contribution in [#12074](https://github.com/jdx/mise/pull/12074)
- @TrevorBurnham made their first contribution in [#12106](https://github.com/jdx/mise/pull/12106)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.8.8...v2026.8.9

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.