v2026.10.0

This release tightens supply-chain verification. Keyless cosign bundles must now match a pinned signer identity, and GitHub attestation workflow checks no longer accept partial matches. It also closes a `.tool-versions` trust gap that could leak `GITHUB_TOKEN`, adds a per-cask `appdir` option for Homebrew casks, and fixes problems with locked SLSA installs, musl hosts and `mise backends switch`.

## Security

- **Inline tool options in `.tool-versions` now require trust.** This is the `.tool-versions` version of the `mise.toml` fix in 2026.9.18. An untrusted project could ship a `github:` entry with inline options, such as `[api_url=...]`, pointing at another host. Commands such as `mise ls`, `env`, `current`, `outdated` and `latest` would then send your `GITHUB_TOKEN` to that host without asking for trust. Any entry whose tool name contains `[` now requires trust, the same as Tera templates. Plain lines like `node 20.0.0` still load without trust, and a `[` inside a comment is ignored. Run `mise trust` for projects you rely on. `MISE_SAFE=1` still skips trust checks. (GHSA-wcqh-j26q-g44x) [#13869](https://github.com/jdx/mise/pull/13869)
- **Keyless cosign verification now checks who signed.** Before, the aqua backend only checked that a bundle chained to Sigstore's Fulcio CA. Any GitHub Actions workflow in any repository can get such a certificate, so a bundle signed by the wrong workflow would still pass. mise now applies the registry's `--certificate-identity[-regexp]`, `--certificate-oidc-issuer[-regexp]` and `--certificate-github-workflow-{repository,ref,name,trigger,sha}` options to the signing certificate. It does this for both current and legacy bundles. Keyless verification now requires a pinned identity, and an unknown or empty `--certificate-*` option is an error. Key-based verification (`--key`) is unchanged. Registry patterns that use RE2 `\Q…\E` quoted literals, such as the one for `vfox`, are supported. [#13875](https://github.com/jdx/mise/pull/13875), [#13879](https://github.com/jdx/mise/pull/13879)
- **GitHub attestation signer workflow matching is anchored.** The expected `signer_workflow` must now match the end of the certificate's workflow path as whole path segments. Before, it was a substring match against the whole identity, so a longer workflow file name such as `release.yml.evil.yml`, or a ref that contained the expected path, would pass. An empty `signer_workflow` now fails verification. Both the bare form (`.github/workflows/release.yml`) and the repository-qualified form (`owner/repo/.github/workflows/release.yml`) still work. [#13877](https://github.com/jdx/mise/pull/13877)

## Added

- **Per-cask app directories.** A `brew-cask:` bootstrap package can set its own `appdir`. This overrides the global `MISE_BREW_CASK_OPT_APPDIR` setting, expands `~/`, and also applies to the cask's dependencies. [#13865](https://github.com/jdx/mise/pull/13865)

  ```toml
  [bootstrap.packages]
  "brew-cask:1password" = { appdir = "/Applications" }
  ```

  The setting only applies to installs and upgrades: apps that are already installed are not moved. A first install into a new `appdir` won't replace an existing app it doesn't own unless you set `adopt = true`. Other package managers ignore `appdir` and print a warning.
- **`slsa_signer_identity` and `slsa_signer_issuer` options for aqua tools.** These work the same as in the github backend. They let `mise lock` verify and record SLSA provenance for packages whose registry entry has no signer, such as `aqua:google/osv-scanner`. You must set both options to non-empty strings, and together they override any signer in the registry, including version overrides. [#13856](https://github.com/jdx/mise/pull/13856)
- **Registry:** `cloudflare-cf`, Cloudflare's `cf` CLI, which is in beta and installs from `npm:cf`. It provides the `cf` and `cloudflare` binaries. Pin a beta version for now, such as `mise use cloudflare-cf@1.0.0-beta.10`. An unpinned install currently resolves to an unrelated old `0.x` release. [#13871](https://github.com/jdx/mise/pull/13871)
- **Docs:** a new Releases page (under About in the docs) shows a timeline of release sizes, the issues each release resolved, and expandable release notes. [#13855](https://github.com/jdx/mise/pull/13855)

## Fixed

- **Locked SLSA installs work again without a registry signer.** Since 2026.9.17, a lockfile that recorded a checksum and SLSA provenance failed with "Aqua registry metadata has no signer_identity and signer_issuer" for tools such as `aqua:google/osv-scanner` and `aqua:fluxcd/flux2`. A lock entry with a checksum and recorded provenance is now trusted for SLSA too: the install only checks the artifact digest, as it already did for other provenance types. `locked_verify_provenance` or paranoid mode still re-verify and still require a signer. [#13856](https://github.com/jdx/mise/pull/13856)
- **aqua on musl hosts.** On Alpine and other musl hosts, an aqua tool whose registry entry only names a glibc build (such as `zizmor`) failed with "no asset found: ...-unknown-linux-musl...". mise now installs the asset the registry names. The binary still needs glibc or `gcompat` to run. `mise lock` for `linux-x64-musl` records the same asset. [#13857](https://github.com/jdx/mise/pull/13857)
- **`mise backends switch` handles stale lock entries.** Sometimes `mise install` warned that a tool was locked to a replaced backend, for example `asdf:clojure` instead of `vfox:jdx/vfox-clojure`, but `mise backends switch` then reported there was nothing to switch. This happened when the config's version no longer matched the lock entry. The command now switches those entries too. Entries at a version the config no longer resolves to are relocked at the config's version and reported as `replacing stale <tool>@<version>`. [#13859](https://github.com/jdx/mise/pull/13859)
- **Ctrl-C exits with status 130.** Interrupting `mise install`, `upgrade`, `exec` and similar commands used to exit with 1, the same as an ordinary failure. They now exit with 130 (128 + SIGINT), matching `mise run`, so shells and scripts can tell when a user interrupted. A repeated Ctrl-C during `mise run` also exits with 130. This applies on Unix and Windows. [#13862](https://github.com/jdx/mise/pull/13862)
- **Declining a trust prompt skips the config for that run.** Before, declining still failed the current command with "not trusted". [#13868](https://github.com/jdx/mise/pull/13868)
- The one-time startup migration for stale `latest` runtime directories has been removed. It was due to expire in this release and would have blocked normal installs. `mise install` still repairs a stale `latest` directory, but passive commands such as `mise ls` no longer touch it. [#13868](https://github.com/jdx/mise/pull/13868)
- **Stale dotfile history watchers are diagnosed.** A history watcher started on an older mise can fail every capture with an unknown-field error for newer settings such as `exclude`. `mise doctor` and `mise dot status` now report that the watcher is outdated and tell you to run `mise bootstrap services apply`, which restarts it. [#13864](https://github.com/jdx/mise/pull/13864)
- **Java:** the missing-metadata error now names the target platform, for example `no metadata found for version zulu-8 on windows-arm64`. [#13873](https://github.com/jdx/mise/pull/13873) (@jsiu93)

## Breaking Changes

- **`--from-git` removed from `mise bootstrap`.** `mise bootstrap --from-git` and `mise bootstrap remote --from-git` now fail with an unexpected-argument error. Use `--adopt`, which has been the documented flag since 2026.9.3: [#13872](https://github.com/jdx/mise/pull/13872)

  ```sh
  mise bootstrap --adopt git@github.com:me/dotfiles.git
  ```
- **vfox tool plugins that use keyless cosign must pin an identity.** If a `PreInstall` attestation sets `cosign_sig_or_bundle_path` without `cosign_public_key_path`, it must also set `cosign_certificate_identity` or `cosign_certificate_identity_regexp`. You can also set `cosign_certificate_oidc_issuer`. Without an identity, the attestation is rejected. Registry entries that already work with the aqua CLI are not affected. [#13875](https://github.com/jdx/mise/pull/13875)
- **Alpine/musl:** if a registry entry names a gnu asset but the release also ships a musl build, mise now installs the gnu build. Before, it switched to musl. Set `libc = "musl"` on that tool to keep the musl build. [#13857](https://github.com/jdx/mise/pull/13857)
- **Exit code on Ctrl-C:** scripts that checked for exit status 1 after an interrupt should now check for 130. [#13862](https://github.com/jdx/mise/pull/13862)

## New Contributors

* @jsiu93 made their first contribution in [#13873](https://github.com/jdx/mise/pull/13873)

**Full Changelog**: https://github.com/jdx/mise/compare/vfox-v2026.9.20...v2026.10.0

## 💚 Sponsor mise

mise is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.