v2026.6.11

A focused release that adds Alpine `apk` as a bootstrap package manager, stops the default Windows `exe` shims from leaking into WSL, and fixes a handful of aqua, HTTP cache, Rust, and Deno corners.

## Added
- **bootstrap:** Alpine Linux `apk` joins apt, dnf, pacman, and brew as a supported `[bootstrap.packages]` manager. Specify packages as `apk:name` (with optional `@version`), or pass `--manager apk` explicitly; status, install, and upgrade all wire through the same paths as the other Linux managers ([#10476](https://github.com/jdx/mise/pull/10476) by @jdx).

  ```toml
  [bootstrap.packages]
  "apk:curl" = "*"
  "apk:git" = "@2.45.2-r0"
  ```

- **registry:** Added [`pinniped`](https://github.com/vmware/pinniped) to the registry ([#10456](https://github.com/jdx/mise/pull/10456) by @tony-sol).

## Fixed
- **task:** `mise run //projects/backend` and `mise run //...` no longer behave like `//projects/backend:*` — the monorepo pattern parser now rejects path-only targets with a clear error pointing to `//path:<task>` or `//path:*` ([#10479](https://github.com/jdx/mise/pull/10479) by @jdx).
- **shim (Windows):** Default `exe` `windows_shim_mode` no longer writes a second, extension-less bash shim next to `<tool>.exe`. Git Bash / Cygwin / MSYS2 already resolve a bare `gh` to `gh.exe`, and dropping the extras stops them from leaking into WSL via `/mnt/c/...` PATH interop (the source of the `mise: not found` / infinite-recursion loops). `file` mode still emits the bash shim where it is required. Old extras are cleaned up on the next `reshim` ([#10475](https://github.com/jdx/mise/pull/10475) by @JamBalaya56562).
- **aqua:** `format_overrides` are now parsed from the aqua registry and applied to the compiled package model. They run after version overrides and before normal platform overrides — matching aqua's own ordering — so per-OS archive formats finally resolve correctly. Aqua registry caches will rebuild on first use due to a serialized-layout bump ([#10461](https://github.com/jdx/mise/pull/10461) by @risu729).
- **aqua:** Minisign asset templates such as `{{.Asset}}.minisig` now render against the selected package asset, fixing signature verification for packages like `jedisct1/minisign` 0.12 ([#10462](https://github.com/jdx/mise/pull/10462) by @risu729).
- **deno:** Deno's Windows `.sha256sum` files use PowerShell `Get-FileHash` multi-line output. mise now parses that format alongside the standard whitespace-delimited one, validates the algorithm/length, and stores hashes lowercased as `"<algo>:<hash>"` ([#10464](https://github.com/jdx/mise/pull/10464) by @risu729).
- **http:** Auto-detected `strip_components` is now resolved before HTTP archive cache lookup and folded into the `http-tarballs` cache key. Stripped and unstripped extractions of the same URL no longer share a cache entry, fixing tool-stub installs that re-used a previous `bin_path`-based extract ([#10468](https://github.com/jdx/mise/pull/10468) by @risu729).
- **install:** When resolving lockfiles, absolute symlink targets that live under mise-managed data/cache/download/install/shared dirs are no longer misclassified as `mise link` versions. External symlink targets remain classified as linked. This fixes `mise install --locked` idempotency for HTTP-backed tools ([#10463](https://github.com/jdx/mise/pull/10463) by @risu729).
- **rust:** `rust-toolchain.toml` `profile`, `components`, and `targets` are now stored on the generated `ToolRequest`, so install and lockfile-option resolution both read the same `request.options()` instead of re-parsing the file. As a side effect, lockfile keys are canonicalized: TOML arrays now match comma-separated strings, `components`/`targets` are sorted and deduplicated, and an empty `profile` no longer emits a spurious key ([#10178](https://github.com/jdx/mise/pull/10178) by @risu729).
- **exec:** `COLORTERM` is now passed through to child processes (alongside `TERM`), preserving 24-bit truecolor signalling in sandboxed environments ([#10451](https://github.com/jdx/mise/pull/10451) by @sschuberth).
- **docs:** The Tera task-argument deprecation page now says removal is in `2027.5.0`, matching the warning emitted by the CLI ([#10453](https://github.com/jdx/mise/pull/10453) by @reitzig).
- **docs:** The `minimum_release_age` example uses `6mo` (not `6m`) for "6 months", matching jiff's friendly duration format ([#10193](https://github.com/jdx/mise/pull/10193) by @sisp).

## Changed
- **deps:** Replaced the unmaintained `fuzzy-matcher` crate (archived, last published 2020) with `nucleo-matcher` for registry/task suggestion scoring and picker highlight indices ([#10467](https://github.com/jdx/mise/pull/10467) by @risu729).
- **deps:** Removed the `os-release` and `sys-info` crates in favor of mise's internal `/etc/os-release` parser, which is now shared by libc detection, env, Swift, and Erlang Linux fallbacks ([#10465](https://github.com/jdx/mise/pull/10465) by @risu729).

## Aqua Registry

New packages: [`Latias94/merman`](https://github.com/Latias94/merman), [`bitnami/sealed-secrets`](https://github.com/bitnami/sealed-secrets), [`coder/boo`](https://github.com/coder/boo). Updated: [`suzuki-shunsuke/ghtkn`](https://github.com/suzuki-shunsuke/ghtkn).

## New Contributors
* @sschuberth made their first contribution in [#10451](https://github.com/jdx/mise/pull/10451)
* @sisp made their first contribution in [#10193](https://github.com/jdx/mise/pull/10193)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.6.10...v2026.6.11

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.