v2026.9.3

This release brings Windows bootstrap into the package-manager era with WinGet support, extends the packslip signing model to vfox plugins, and speeds up simple tasks by skipping the shell on Unix. It also carries a batch of bootstrap, sandbox, and Windows ARM64 fixes.

## Added
- **bootstrap:** WinGet is now a built-in `[bootstrap.packages]` manager on Windows, so `mise bootstrap packages` can check status, install, and upgrade apps by exact package ID. It supports version pins, source refresh, and automatic source-agreement acceptance. Scoop, Chocolatey, and package removal remain future work. ([#12928](https://github.com/jdx/mise/pull/12928) by @jdx)

  ```toml
  [bootstrap.packages]
  "winget:Microsoft.PowerShell" = "latest"
  ```
- **vfox:** External vfox plugins can now be installed from signed packslip archives instead of a Git clone, reusing the packslip backend's release selection, signature verification, digest checks, and signer pins. This is aimed at non-registry plugins; registry defaults and embedded plugins are unchanged. ([#12948](https://github.com/jdx/mise/pull/12948) by @jdx)

  ```sh
  mise plugins install vfox:bfs 'packslip:mise-plugins/vfox-bfs#0.1.0'
  ```
- **bootstrap:** Dotfile line edits gain `position = "prepend"` to insert a managed line at the top of a file instead of appending (the default). An existing exact match is left in place, and unrelated bytes, CRLF endings, and a UTF-8 BOM are preserved. ([#12941](https://github.com/jdx/mise/pull/12941) by @jdx)

  ```toml
  [dotfiles]
  "/etc/zshrc/zdotdir" = { line = 'ZDOTDIR=$HOME/.config/zsh/', position = "prepend" }
  ```
- **bootstrap:** macOS bootstrap `defaults` now support nested TOML arrays and tables (for example Dock `persistent-apps`), reading and writing preferences through Core Foundation so booleans, numbers, strings, arrays, and dictionaries keep their plist types. Collections apply as whole-value replacements; datetimes and binary plist data are still skipped with a warning. ([#12947](https://github.com/jdx/mise/pull/12947) by @jdx)

## Changed
- **bootstrap:** Adopting global configuration or a shared dotfile-history setup repository is now spelled `mise bootstrap --adopt` (and `mise bootstrap remote --adopt`), separate from `mise bootstrap --from` for running a bootstrap project. The dotfiles, history, setup, and services guides were reorganized to lead with usable examples. The previous `--from-git` spelling still works as a hidden alias but warns and is scheduled for removal in mise 2026.10.0. ([#12953](https://github.com/jdx/mise/pull/12953) by @jdx)

## Fixed
- **github:** Git operations (clones, fetches, submodules) that GitHub now challenges with HTTP 401 on public repositories can authenticate using mise's existing GitHub token sources via a command-scoped `github.com` HTTPS credential helper. Tokens are kept out of command arguments and URLs, and Enterprise hosts are out of scope. ([#12945](https://github.com/jdx/mise/pull/12945) by @jdx)
- **config:** The default inline task shell is now `sh -o errexit -c` so shells that consume the argument right after `-c` (such as FreeBSD sh) run your command instead of trying to execute `-o`. ([#12949](https://github.com/jdx/mise/pull/12949) by @jdx)
- **windows:** Fixed two Windows ARM64 issues: stale command-wrapper shims (like a leftover `cargo.exe`) that caused recursive `.exe`/`.cmd` dispatch after shim-mode changes are now pruned, and Aqua ARM64 emulation candidates apply the registry's `amd64` replacement so tools like LuaLS resolve their published `win32-x64` assets. ([#12931](https://github.com/jdx/mise/pull/12931) by @jdx)
- **bootstrap:** Bootstrap no longer aborts on Arch when `pacman -Q` prints a file advisory for a missing package that shares its name with a directory in the current working directory (for example a `fish/` folder in a dotfiles checkout). ([#12932](https://github.com/jdx/mise/pull/12932) by @nettlesh)
- **sandbox:** Read-restricted macOS Seatbelt profiles now allow metadata-only access to `/private`, fixing startup failures for load-relative binaries like Ruby 4.0.6 when run under `/private/tmp`. Directory listings and descendant reads stay denied. ([#12940](https://github.com/jdx/mise/pull/12940) by @jdx)
- **bootstrap:** The macOS notification helper is now built and Developer ID-signed at release time and spawned with a start handshake, so short `dotfiles sync` runs no longer race the helper and macOS accepts it. Unsigned source builds (such as Homebrew) disable notifications and warn during origin setup. ([#12946](https://github.com/jdx/mise/pull/12946) by @jdx)
- **vfox:** vfox install phases now flow through the active install progress reporter, mapping noisy download, checksum, attestation, and extraction lines into concise phases instead of scrolling log output. ([#12944](https://github.com/jdx/mise/pull/12944) by @jdx)
- **java:** The `java -version` banner shown during install verification now stays inside the interactive install progress row instead of printing to the terminal. ([#12943](https://github.com/jdx/mise/pull/12943) by @jdx)
- **version:** The auto-update hint from `mise version` now uses the `mise settings auto_update=true` syntax to match the rest of `mise settings`. ([#12957](https://github.com/jdx/mise/pull/12957) by @jdx)

## Performance
- On Unix, plain inline commands (like `node build.js`) now run directly when a conservative planner deems them safe, skipping the shell wrapper. Anything involving shell syntax, quoting, expansion, builtins, ambiguous PATH lookup, explicit shell settings, or sandboxed/audited tasks still uses the shell, and Windows is unchanged. In a microbenchmark of short commands this cut about 11% off elapsed time. ([#12950](https://github.com/jdx/mise/pull/12950) by @jdx)

## Registry
- Added cargo-deny, kingfisher, nushell, shellharden, sherif, and tauri-cli. ([#12938](https://github.com/jdx/mise/pull/12938) by @jrandolf)

## Documentation
- Restored the prominent project name and pronunciation on the homepage. ([#12936](https://github.com/jdx/mise/pull/12936) by @jdx)
- Dropped the "you need Git installed" prerequisite from the install docs. ([#12958](https://github.com/jdx/mise/pull/12958) by @jdx)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.9.2...v2026.9.3

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.