v2026.8.3

This release expands bootstrap package management with per-user Flatpak support and Linux font casks, adds a per-tool pipx registry option and a shim safety setting, and lands a batch of task precedence, lockfile, and Python fixes.

## Added
- **bootstrap:** manage per-user Flatpak installations with a new `flatpak-user` package manager. The existing `flatpak:<id>` entries stay system-scoped, and you can now declare both scopes in the same config, including the same application ID. ([#11757](https://github.com/jdx/mise/pull/11757) by @jdx)
- **brew:** the built-in `brew-cask` manager now works on Linux for font-only casks, installing fonts under `$XDG_DATA_HOME/fonts` via Linuxbrew. Non-font casks on Linux fail with a clear unsupported-platform error. ([#11758](https://github.com/jdx/mise/pull/11758) by @jdx)

  ```bash
  mise bootstrap packages use brew-cask:font-heavy-data-nerd-font
  ```
- **pipx:** add a per-tool `registry_url` option so version listing and `latest` resolution can target a private PyPI-style index without changing the global `pipx.registry_url`. The latest-version cache is keyed by registry URL to avoid cross-registry reuse. ([#11754](https://github.com/jdx/mise/pull/11754) by @jdx)
- **shim:** add a `not_found_system_fallback` setting (`MISE_NOT_FOUND_SYSTEM_FALLBACK`, default `true`). Setting it to `false` prevents a shim for a missing tool from silently falling back to a same-named binary on `PATH`, failing loudly instead — useful for hardened environments that pin an explicit allowlist of tools. ([#11755](https://github.com/jdx/mise/pull/11755) by @richid)

## Fixed
- **task:** inline `[tasks.<name>]` definitions now take precedence over a same-named task from an included TOML file instead of being silently discarded. Metadata-only inline blocks overlay the included command rather than replacing it. ([#11734](https://github.com/jdx/mise/pull/11734) by @jdx)
- **task:** a metadata-only inline task in a higher-precedence file such as `mise.local.toml` now overlays the command-bearing definition from a lower file instead of wiping out its `run`. Command-bearing higher-precedence tasks still fully replace the lower one. ([#11745](https://github.com/jdx/mise/pull/11745) by @jdx)
- **task:** tasks declaring `double_dash="required"` again accept values passed after `--`, which had regressed to being rejected. ([#11729](https://github.com/jdx/mise/pull/11729) by @jdx)
- **config:** configured backend options such as `postinstall` are now applied to explicitly requested runtime versions (e.g. `mise install solidity@0.8.2`) that carry registry defaults, instead of being skipped. ([#11550](https://github.com/jdx/mise/pull/11550) by @risu729)
- **lockfile:** setting `lockfile = true` now creates missing project lockfiles during `mise use`, `mise install`, and upgrade flows. An unset setting continues to update existing lockfiles only. ([#11746](https://github.com/jdx/mise/pull/11746) by @jdx)
- **python:** a plain `mise lock` now preserves the python-build-standalone artifact already recorded for each platform instead of churning the lockfile to the newest build. Use `mise lock --bump` to advance the PBS build explicitly. ([#11747](https://github.com/jdx/mise/pull/11747) by @jdx)
- **python:** skip junctions when syncing installs to uv to avoid errors on Windows. ([#11683](https://github.com/jdx/mise/pull/11683) by @risu729)
- **github:** release-age filters like `minimum_release_age` now use GitHub's `published_at` timestamp rather than the commit `created_at`, so a newly published release pointing at an older commit no longer bypasses the filter. Applies across Aqua, GitHub, Ubi, SPM, Pipx, and GitHub-backed core tools. ([#11756](https://github.com/jdx/mise/pull/11756) by @jdx)
- **use:** adding multiple tools in a single `mise use` now keeps an already-sorted `[tools]` table alphabetically ordered. ([#11713](https://github.com/jdx/mise/pull/11713) by @jdx)
- **rust:** expand `~` in the `home` setting. ([#11752](https://github.com/jdx/mise/pull/11752) by @xqm32)
- **vfox:** resolve backend aliases for custom plugins. ([#11736](https://github.com/jdx/mise/pull/11736) by @jdx)
- **vfox:** cancel in-flight HTTP retries when interrupted with Ctrl-C. ([#11735](https://github.com/jdx/mise/pull/11735) by @jdx)
- **npm shim:** `npm link <package-name>` (and its `npm ln` alias) now triggers an auto-reshim, since it installs a package globally. ([#11748](https://github.com/jdx/mise/pull/11748) by @cheezmil)
- **ls-remote:** suppress the `minimum_release_age` warning during shell completions. ([#11727](https://github.com/jdx/mise/pull/11727) by @beisenherz)
- **docs:** fix an incorrect ripgrep URL in the tool-stub docs. ([#11725](https://github.com/jdx/mise/pull/11725) by @arti5an)

## New Contributors
- @richid made their first contribution in [#11755](https://github.com/jdx/mise/pull/11755)
- @xqm32 made their first contribution in [#11752](https://github.com/jdx/mise/pull/11752)
- @cheezmil made their first contribution in [#11748](https://github.com/jdx/mise/pull/11748)
- @arti5an made their first contribution in [#11725](https://github.com/jdx/mise/pull/11725)
- @beisenherz made their first contribution in [#11727](https://github.com/jdx/mise/pull/11727)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.8.2...v2026.8.3

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.