v2026.9.2

This is a large release headlined by the new stable `packslip:` backend for installing tools from a vendor's own signed release manifest, a read-only GitHub SSH relay for remote onboarding, redesigned install progress for both terminals and CI logs, and a rebuilt dotfiles-tracking model for bootstrap. It also carries dozens of fixes across shims, tasks, brew, Go, npm, and the schema, plus two security fixes.

## Highlights
- The `packslip:` backend is now generally available: install tools directly from a project's cryptographically signed release manifest, with signer pinning, trusted stampers, host-requirement checks, shell completions, and agent skills all driven from the same signed source.
- Install output was reimagined end to end. Interactive terminals get a live region with a fractional install-wide bar and permanent completion lines, while CI logs, pipes, and AI-agent terminals get a compact append-only reporter instead of thousands of scrolling rows.
- Bootstrap grows a read-only GitHub SSH relay and `--from-git` onboarding, an AUR package manager, and a rebuilt dotfiles-history model that tracks files through ordinary Git commits synchronized with an origin.

## Added
- **packslip:** New `packslip:` backend installs tools from a vendor-published, signed release manifest (a sigstore bundle) that names every artifact with its digest, platform, format, and executables. The tool name is a pin, like a `known_hosts` entry: `packslip:github.com/owner/repo` accepts only a packslip signed by that repository's release workflow, and signature, log entry, statement, digest, and size are all verified before anything is unpacked. Custom hosts and monorepo tools are supported. The backend is no longer experimental. ([#12778](https://github.com/jdx/mise/pull/12778), [#12811](https://github.com/jdx/mise/pull/12811) by @jdx)

  ```toml
  [tools]
  "packslip:github.com/oxc-project/oxc/oxlint" = "latest"
  ```
- **packslip:** Signer pinning remembers, per project, the signer that signed the first accepted release in a `pins.toml` file (like SSH's known_hosts) and records the signer in `mise.lock`, so a later release signed by anyone else, or one that weakens provenance, is refused. `mise packslip pins` lists what is pinned and `mise packslip forget <project>` accepts an announced key rotation. ([#12783](https://github.com/jdx/mise/pull/12783) by @jdx)
- **packslip:** New `packslip.stampers` setting lets you require that a trusted host has stamped a version before mise offers or installs it (a scanning service, a mirror, or eventually the registry), with a per-tool `trust = "vendor"` override. ([#12782](https://github.com/jdx/mise/pull/12782) by @jdx)
- **packslip:** Declared host requirements (OS/glibc minimums, shared libraries, required commands) are checked before download; confirmed failures refuse the install, gaps mise cannot verify warn only, and `ignore_requirements = true` overrides hard failures. `latest` also resolves from verified vendor recommendations. ([#12804](https://github.com/jdx/mise/pull/12804), [#12805](https://github.com/jdx/mise/pull/12805) by @jdx)
- **packslip:** A tool's packslip can ship shell completions and agent skills. `mise completion <shell> --tool <name>` prints (or `--install` writes a version-aware stub for) completions for whichever version is active in the current directory, and `mise skills ls` / `mise skills sync` link a tool's Agent Skills into `.claude/skills` at the pinned version. Completions are also loaded automatically in activated shells. ([#12779](https://github.com/jdx/mise/pull/12779), [#12780](https://github.com/jdx/mise/pull/12780), [#12848](https://github.com/jdx/mise/pull/12848) by @jdx)
- **install:** Redesigned install progress. Interactive terminals now show a live region with an install-wide fractional bar, per-tool phase/elapsed/artifact rows, dependency-wait rows ("waiting for node@24.20.0"), and permanent completion lines written into scrollback. `prune`, `uninstall`, and upgrade removals reuse the same session, so pruning hundreds of versions no longer floods the screen. ([#12906](https://github.com/jdx/mise/pull/12906) by @jdx)
- **install:** CI logs, pipes, and AI-agent terminals (`CLAUDECODE`/`AI_AGENT`) get a compact append-only reporter: one permanent line per finished tool plus a periodic snapshot of the bar, active phases, transfer rates, and queue count, instead of hundreds of scrolling status rows. Resolver hosts and retry progress are surfaced too. ([#12902](https://github.com/jdx/mise/pull/12902), [#12907](https://github.com/jdx/mise/pull/12907) by @jdx)
- **ssh:** New `mise ssh` runs ordinary OpenSSH sessions with optional session-scoped, read-only GitHub access, and `mise bootstrap remote --from-git` onboards a remote host from a Git repo. The initiating machine keeps the credential and brokers authorized clone/fetch and REST reads over an SSH Unix-socket forward; no token is installed on the target. ([#12830](https://github.com/jdx/mise/pull/12830) by @jdx)

  ```sh
  mise ssh devbox --github-relay-read-only --github-relay-repo jdx/dotfiles
  ```
- **bootstrap:** `mise bootstrap --from-git <GIT_URL>` clones a repository-backed global config into `$MISE_CONFIG_DIR` so its `config.toml`, `conf.d/`, and tasks apply on the first bootstrap and stay active afterward. ([#12715](https://github.com/jdx/mise/pull/12715) by @jdx)
- **bootstrap:** New `aur:` package manager installs from the Arch User Repository via `yay` (preferred) or `paru`, with foreign-package status detection so repo packages with colliding names cannot satisfy an AUR request. Bootstrap can also declare packages as absent to remove them, and now reports which root declarations were selected. ([#12718](https://github.com/jdx/mise/pull/12718), [#12716](https://github.com/jdx/mise/pull/12716), [#12770](https://github.com/jdx/mise/pull/12770) by @jdx)
- **bootstrap:** Rebuilt dotfiles tracking. Files enrolled with `mode = "track"` stay in place while mise commits changes to a separate bare Git store with checkpoints, rollback/undo, and optional origin synchronization, including encryption of shared files before storage. ([#12918](https://github.com/jdx/mise/pull/12918) by @jdx)
- **activate:** New `activate_shims = false` (`MISE_ACTIVATE_SHIMS=false`) keeps tool shim directories off PATH during activation and hooks without changing your auto-install or lazy-tool settings. Command wrappers such as mr-boxington's `cargo` keep working. ([#12926](https://github.com/jdx/mise/pull/12926) by @jdx)
- **core:** Rust tools accept `mr_boxington = true` and `mise use` gains a repeatable `--tool-option KEY=VALUE` flag, so setting up the Cargo wrapper is a single command. ([#12908](https://github.com/jdx/mise/pull/12908) by @jdx)

  ```sh
  mise use --tool-option mr_boxington=true rust mr-boxington
  ```
- **ruby:** mise now reads Bundler's `ruby file: ".ruby-version"` form from a `Gemfile` (resolving the path next to the Gemfile), so projects that pin Ruby through a sibling file resolve correctly. ([#12914](https://github.com/jdx/mise/pull/12914) by @jdx)
- **self-update:** New global-only `self_update.repository` and `self_update.api_url` settings let organizations point manual updates, out-of-date hints, and automatic updates at a curated GitHub or GitHub Enterprise release mirror. Project config cannot redirect updates, and artifacts still pass the embedded-signature check. ([#12735](https://github.com/jdx/mise/pull/12735) by @jdx)
- **backend:** `install_env` is now applied when resolving and downloading tools, not just at build time. ([#12777](https://github.com/jdx/mise/pull/12777) by @rabadin)
- **brew:** mise can now evaluate ordinary third-party taps. ([#12774](https://github.com/jdx/mise/pull/12774) by @jdx)

## Fixed
- **shim:** Lazy tool names now match on Windows, and `mise-shim.exe` resolves correctly through a symlinked `mise.exe`. ([#12699](https://github.com/jdx/mise/pull/12699) by @jdx, [#12915](https://github.com/jdx/mise/pull/12915) by @acooler15)
- **activate:** Paths are translated for the calling Windows POSIX shell, and PowerShell pipeline input is now forwarded. ([#12736](https://github.com/jdx/mise/pull/12736), [#12925](https://github.com/jdx/mise/pull/12925) by @jdx)
- **nushell:** The activation prelude preserves the PATH list type. ([#12754](https://github.com/jdx/mise/pull/12754) by @Junaid-PK)
- **task:** Task globs no longer loop on symlinks, `sources` accepts a single string, task status is preserved when the cache audit tracer fails, and POSIX shells no longer have PATH pre-converted (the shell already does it). ([#12711](https://github.com/jdx/mise/pull/12711), [#12769](https://github.com/jdx/mise/pull/12769) by @jdx, [#12530](https://github.com/jdx/mise/pull/12530) by @risu729, [#12696](https://github.com/jdx/mise/pull/12696) by @JamBalaya56562)
- **npm:** Global installs now work with pnpm 12. ([#12717](https://github.com/jdx/mise/pull/12717) by @jdx)
- **go:** Private modules resolve via Go, and loong64 uses the correct artifact architecture. ([#12731](https://github.com/jdx/mise/pull/12731) by @kejne, [#12767](https://github.com/jdx/mise/pull/12767) by @jdx)
- **brew:** A tapped install now explains why it found no API metadata, and all tap formula layouts are supported. brew-cask packages with `auto_updates` enabled are upgraded correctly. ([#12645](https://github.com/jdx/mise/pull/12645) by @Marukome0743, [#12837](https://github.com/jdx/mise/pull/12837) by @soodoh, [#12857](https://github.com/jdx/mise/pull/12857) by @himkt)
- **github:** Releases with no assets are omitted from the version list, and OAuth-refresh warnings are silenced during env export and shown only once when a refresh is rejected. ([#12572](https://github.com/jdx/mise/pull/12572) by @Marukome0743, [#12855](https://github.com/jdx/mise/pull/12855), [#12911](https://github.com/jdx/mise/pull/12911) by @jdx)
- **config:** Every newly added `.tool-versions` line is now terminated with a newline. ([#12740](https://github.com/jdx/mise/pull/12740) by @dylanpulver)
- **env:** Bootstrap shims for lazy tools are created when printing the env, and duplicate unset directives are removed from hook output. ([#12726](https://github.com/jdx/mise/pull/12726) by @hktitof, [#12707](https://github.com/jdx/mise/pull/12707) by @jdx)
- **http:** A failed download's partial file is flushed before giving up, and cache compression finishes before files are published. ([#12823](https://github.com/jdx/mise/pull/12823) by @Marukome0743, [#12894](https://github.com/jdx/mise/pull/12894) by @jdx)
- **bootstrap:** Tera templates render in hooks, tildes expand in managed file sources, and the relative config dir is pinned during reexec. ([#12727](https://github.com/jdx/mise/pull/12727), [#12768](https://github.com/jdx/mise/pull/12768), [#12721](https://github.com/jdx/mise/pull/12721) by @jdx)
- **backend:** Disabled plugins are excluded from shorthand resolution, and installed plugins are included in plugin completion. ([#12927](https://github.com/jdx/mise/pull/12927), [#12720](https://github.com/jdx/mise/pull/12720) by @jdx)
- **rust:** Incomplete rustup toolchains are reconciled. ([#12771](https://github.com/jdx/mise/pull/12771) by @jdx)
- **oci/vfox/aqua:** OCI reused tool layers preserve their paths, vfox preserves the tool name from legacy lockfiles, and aqua handles repository transfers in attestations. ([#12749](https://github.com/jdx/mise/pull/12749), [#12745](https://github.com/jdx/mise/pull/12745), [#12766](https://github.com/jdx/mise/pull/12766) by @jdx)
- **sandbox:** `SYS_fork`/`SYS_vfork` are omitted on aarch64. ([#12807](https://github.com/jdx/mise/pull/12807) by @jamescassell)
- **dotfiles:** A stale directory the deeper walk already removed is tolerated. ([#12697](https://github.com/jdx/mise/pull/12697) by @vladbisceanu)
- **schema:** Absent bootstrap packages, inline dotfile content, and missing built-in deps providers are now modeled. ([#12785](https://github.com/jdx/mise/pull/12785) by @nettlesh, [#12738](https://github.com/jdx/mise/pull/12738), [#12739](https://github.com/jdx/mise/pull/12739) by @risu729)
- **lockfile:** The deferred provenance baseline is dropped once auto-lock verifies the upgrade. ([#12825](https://github.com/jdx/mise/pull/12825) by @jdx)

## Security
- **http:** URL replacements no longer forward authorization headers or URL credentials when an HTTPS origin is rewritten to HTTP; such credential-carrying downgrades are refused, and errors omit URLs so embedded credentials cannot leak through diagnostics. ([#12879](https://github.com/jdx/mise/pull/12879) by @jdx)
- **self-update:** Self-update now requires secure release sources. ([#12737](https://github.com/jdx/mise/pull/12737) by @jdx)

## New Contributors
* @acooler15 made their first contribution in [#12915](https://github.com/jdx/mise/pull/12915)
* @soodoh made their first contribution in [#12837](https://github.com/jdx/mise/pull/12837)
* @jamescassell made their first contribution in [#12807](https://github.com/jdx/mise/pull/12807)
* @nettlesh made their first contribution in [#12785](https://github.com/jdx/mise/pull/12785)
* @Junaid-PK made their first contribution in [#12754](https://github.com/jdx/mise/pull/12754)
* @kejne made their first contribution in [#12731](https://github.com/jdx/mise/pull/12731)
* @dylanpulver made their first contribution in [#12740](https://github.com/jdx/mise/pull/12740)
* @Svector-anu made their first contribution in [#12714](https://github.com/jdx/mise/pull/12714)
* @vladbisceanu made their first contribution in [#12697](https://github.com/jdx/mise/pull/12697)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.9.1...v2026.9.2

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.