jdx/mise

Mise is a polyglot development environment manager that unifies the installation and versioning of runtimes, system packages, and project dependencies. It provides a declarative configuration system to manage tools across diverse ecosystems—including Node.js, Python, Go, and Homebrew—while supporting remote task execution with local and remote caching. The system also integrates with AI coding agents, offers native OCI image building, and manages shell environments and dotfiles to streamline developer workflows.

36 changes.

This period focused on rebranding the project from RTX to mise, updating all packaging, scripts, and test snapshots to reflect the new identity. The CLI was significantly refactored by replacing the argument parsing library with usage-rs and restructuring settings management, while legacy commands and configuration formats were removed. Additionally, core plugin support was expanded to include native backends for major runtimes like Bun, Deno, and Java, and shell integration was extended to support Elvish, Nushell, and PowerShell.

56 changes.

This period focused on integrating the vfox version manager as a new backend, embedding Lua-based plugins, and adding support for the aqua registry. It also significantly expanded the CLI with new task management, generation, and diagnostic commands, while establishing comprehensive end-to-end test coverage for shell activation, environment handling, and cross-platform stability.

51 changes.

This period focused on expanding mise into a comprehensive system management tool, introducing declarative bootstrap commands for OS packages, system users, and services alongside a new interactive TOML configuration editor. Significant architectural work included consolidating core utilities into dedicated crates, implementing native OCI image building, and establishing a robust dependency management subsystem with remote caching. The release also added extensive testing coverage, native Windows shim support, and integrations for AI agent detection and OpenTelemetry observability.

Users can now register and execute custom functions when changing directories in Bash, mimicking Zsh's chpwd hook behavior. This new asset provides a \\_\_zsh\_like\_cd\ wrapper that intercepts \cd\, \pushd\, and \popd\ commands to trigger registered hooks, allowing scripts and configurations to react to directory changes in Bash environments.

_src/assets/bash\_zsh\support · high confidence

Users can now add or remove Homebrew taps directly via the CLI using \mise bootstrap packages brew tap\ and \mise bootstrap packages brew untap\. These commands update the \\[bootstrap.brew.taps\]\ section in the configuration file, allowing mise to fetch formulae and casks from custom repositories without requiring a local Homebrew installation. The commands support writing to local or global config files and include dry-run modes to preview changes.

src/cli/system/brew · high confidence

A new 'attestation' plugin (v0.1.0) has been added to the vfox plugin system. It includes a pre-install hook that returns version and URL information along with GitHub artifact attestation metadata (owner and repo), enabling tools to verify provenance during installation.

crates/vfox/plugins/attestation · high confidence

A new dummy backend plugin has been added to the vfox plugin system to facilitate testing of environment variable propagation to backend hooks. This plugin exposes three hooks: \BackendListTools\ (returning static tool definitions), \BackendSearchTools\ (supporting dynamic search queries), and \BackendListVersions\ (which attempts to read the \MY\_TEST\_VAR\ environment variable to demonstrate env passing, falling back to 'fallback' if unavailable). The plugin is versioned at 0.1.0 and requires runtime version 0.3.0 or higher.

crates/vfox/plugins/dummy-backend · high confidence

The project now includes a man page (man/man1/mise.1) for the mise command-line interface, providing users with local documentation access to the tool's options, arguments, and commands.

man · high confidence

The shell activation system now supports four additional shells: Elvish, Nushell, PowerShell (Pwsh), and Xonsh. This introduces new shell implementations that generate activation scripts, environment variable handling, and deactivation logic specific to each shell's syntax and behavior, expanding the tool's compatibility beyond the previously supported Bash, Fish, and Zsh.

src/shell · high confidence

A new test plugin named 'test-nodejs' has been added to the vfox plugin system to facilitate local testing without requiring network access. This plugin provides a hardcoded list of Node.js versions (including 18, 19, and 20 series) and their associated npm versions, simulates installation via local file paths, and supports legacy version files like .node-version and .nvmrc. It is designed specifically for internal validation of the vfox runtime rather than production use.

crates/vfox/plugins/test-nodejs · high confidence

The vfox crate has been added to the workspace, providing a Rust interface to the vfox version manager. It includes a build script that embeds Lua-based plugin code directly into the binary, allowing plugins to be bundled and accessed without external file dependencies at runtime. The crate also includes standard project configuration files such as a license, README, and mise task definitions for building and testing.

crates/vfox · high confidence

The CLI now displays a text-based logo on the help page, improving visual identity. Additionally, shell completion scripts have been enhanced with specific completions for commands like \alias\, \config\_file\, \plugin\, \setting\, \task\, \tool\, and \tool@version\, allowing for more accurate and context-aware tab-completion in supported shells.

src/assets · high confidence

New Cursor AI configuration files have been added to guide developers on project workflows. The \conventional\_commits.mdc\ rule enforces specific commit and PR title formatting, defining allowed types (such as \feat\, \fix\, \chore\) and scopes. The \development.mdc\ rule provides standard commands for building, running, and linting the project using \mise\. The \testing.mdc\ rule specifies how to execute unit and end-to-end tests, including handling of slow tests and GitHub API rate limits.

.cursor/rules · high confidence

The vfox Lua environment now includes a new HTML parsing library located in crates/vfox/lua/htmlparser. This addition introduces core components including ElementNode for representing parsed HTML structures, voidelements for identifying self-closing tags, and the main htmlparser module which handles parsing logic, including template placeholder escaping and attribute handling. This enables Lua scripts within vfox to parse and manipulate HTML content.

crates/vfox/lua · high confidence

Developers using the Cursor Cloud agent now have an automated setup process for the 'mise development' environment. A new \.cursor/environment.json\ file defines the environment name and user, while \.cursor/install.sh\ provides an idempotent script that installs necessary system dependencies (such as Rust, Python, and shell tools), configures GitHub token synchronization, builds the mise binary, and sets up the PATH and trust configuration. This replaces the previous manual or Docker-based development setup, allowing the cloud agent to automatically prepare the workspace for building and testing.

.cursor · high confidence

A new crate, mise-interactive-config, has been added to the workspace. It includes a build script that reads the repository's mise.json schema file and generates Rust constants (such as SCHEMA\_SECTIONS, SCHEMA\_ENTRIES, SCHEMA\_SETTINGS, and SCHEMA\_HOOKS) containing metadata about valid configuration keys, their descriptions, and their data types. This provides a centralized, compile-time validated source of schema information for other parts of the application.

crates/mise-interactive-config · high confidence

A new benchmark suite has been added to measure the performance of the task artifact cache. The \benchmarks/task-cache\ directory now contains a shell script and documentation that allow users to run \mise run perf:task-cache\ to measure wall-clock times for hashing sources, publishing and restoring artifacts, and traversing task graphs with cache hits. The harness creates an isolated temporary project with configurable parameters (defaulting to 2,000 source files, a 32 MiB artifact, and 500 graph nodes) to provide a realistic signal of cache performance against the release binary.

benchmarks/task-cache · high confidence

The \xtasks/render/schema.ts\ script now automatically generates JSON schemas for mise configuration and tasks. This tool reads internal type definitions to produce strict, validated schemas (including task schemas with \$defs\ and proper type mapping for integers, booleans, and strings), ensuring that configuration files are validated against the correct structure and types.

xtasks/render · high confidence

mise now manages Homebrew formulae and casks directly, without requiring the \brew\ command-line tool to be installed. It fetches metadata from the Homebrew API, downloads pre-built bottles from GitHub Container Registry with SHA-256 verification, and handles bottle relocation, codesigning, and linking natively. For formulae without bottles, mise provisions a managed Ruby environment to evaluate the formula DSL and build from source. This new system also supports custom taps, cask lifecycle hooks, and declarative pruning of unmanaged packages.

src/system/packages/brew · high confidence

Users can now declare Linux system users and groups in the configuration to have mise create, update, or remove them declaratively. This change introduces the \src/system/accounts\ module to handle user/group lifecycle and the \src/system/compose\ module to manage Docker Compose projects, alongside new modules for system dependencies (\deps\), service drivers (\driver\), and firewall rules (\firewall\).

src/system · high confidence

Users can now declare host-owned system packages in the \\[bootstrap.packages\]\ configuration section, with mise automatically managing their installation and state across a wide range of package managers including apt, dnf, pacman, brew, flatpak, nix, apk, aur, winget, scoop, zypper, and Mac App Store (mas). This declarative approach handles version pinning, platform-specific availability, and automatic metadata refreshes, ensuring that system dependencies remain consistent across environments without manual intervention.

src/system/packages · high confidence

Users can now manage operating-system-level software declaratively using the new \mise bootstrap packages\ command group. This feature introduces subcommands to install (\apply\), upgrade (\upgrade\), and remove (\prune\) packages across multiple managers (including Homebrew, apt, pacman, winget, flatpak, and others) based on declarations in \\[bootstrap.packages\]\. It also provides \use\ to add packages to the config and \status\ to check their state, \import\ to migrate existing Homebrew installations into the config, and \export\ to generate NixOS modules from the current setup.

src/cli/system · high confidence

Added the \mise oci\ subcommand group (build, push, run) to package project toolsets into OCI container images. The build command creates an image layout where each tool version is a separate content-addressable layer, allowing efficient reuse when only specific tools change. The push command uploads images to registries using a built-in client (removing the external skopeo/crane dependency) and supports layer caching and multi-arch index updates. The run command builds an image and executes commands inside it via Docker or Podman. By default, builds are scoped to the project's mise configuration, excluding global user tools, and require the experimental feature flag.

src/cli/oci · high confidence

Added \mise-plugin.lua\, a LuaCATS type definition file that provides IDE autocompletion and type checking for vfox plugin development. This file defines the structure of the global \RUNTIME\ object (including \osType\, \archType\, and \envType\), the \PLUGIN\ table with all supported hook signatures (such as \Available\, \PreInstall\, \PostInstall\, \EnvKeys\, \MiseEnv\, \MisePath\, \MiseInstallSatisfied\, \BackendListVersions\, \BackendInstall\, \BackendExecEnv\, and \BackendUninstall\), and built-in modules like \http\, \json\, and \file\ (including \FileStat\).

crates/vfox/types · high confidence

This change bootstraps the .claude directory for Claude Code integration. It introduces a new 'test-runner' agent that executes tests and provides failure analysis without modifying files, a SessionStart hook that reuses the existing Cursor bootstrap script for remote web sessions, and a settings.json file to configure this hook. A 'skills' symlink is also added to point to the agents/skills directory.

.claude · high confidence

Added the core Lua hook implementations for the vfox plugin system, including \available.lua\ to list supported versions, \env\_keys.lua\ to configure environment variables (specifically PATH) based on the operating system, and \pre\_install.lua\ and \post\_install.lua\ to manage the installation lifecycle. These files establish the foundational behavior for how the plugin interacts with the vfox runtime during version availability checks and SDK installation.

crates/vfox/plugins/hooks · high confidence

The standalone installer script has been renamed from RTX to mise, updating all environment variable checks (e.g., RTX\_DEBUG to MISE\_DEBUG) and error messages to reflect the new product name. The script now detects musl libc environments (including Android/Termux) and supports ARMv7 architectures, providing specific prebuilt binaries for these platforms. Additionally, the installer now intelligently selects between zstd-compressed and standard tar.gz archives based on system capabilities and version requirements.

packaging/standalone · high confidence

The \mise doctor\ command now includes dedicated subcommands: \mise doctor path\ displays the PATH entries provided by mise (with a \--full\ flag to show all entries), and \mise doctor project\ runs configurable diagnostic checks defined in \\[doctor.checks\]\ within mise.toml, reporting pass/fail/error status for each. The main \mise doctor\ output also now includes a \self\_update\_available\ field in JSON output and reports shadowed shims, backend mismatches, and tools that provide no executables.

src/cli/doctor · high confidence

The src/backend directory now includes the aqua backend (src/backend/aqua.rs), the asdf backend (src/backend/asdf.rs), and the unified asset matcher (src/backend/asset\_matcher.rs). The aqua backend integrates with the internal aqua registry to resolve, download, and install tools, supporting checksum verification, cosign/minisign signatures, and GitHub artifact attestations. The asdf backend wraps external asdf plugins, handling idiomatic version file parsing, environment setup, and bin path discovery. The asset\_matcher module provides a unified, platform-aware scoring system to select the best download asset from a list of candidates.

src/backend · high confidence

Added a Dockerfile and build script to enable automated RPM packaging and publishing to Fedora COPR. The Dockerfile sets up a Fedora 45 environment with necessary build tools and installs copr-cli via DNF for proper dependency management. The build script automates the creation of source tarballs, vendoring of Rust dependencies, generation of RPM spec files, and submission of builds to COPR, supporting multiple chroots including Fedora 43, 44, Rawhide, EPEL 10, and CentOS Stream 9.

packaging/copr · high confidence

This change adds the core Bash integration assets for mise: \activate.sh\ sets up the \mise\ shell function, environment variables, and prompt/chpwd hooks to manage tool versions; \deactivate.sh\ cleanly removes these hooks and variables to restore the previous shell state; and \command\_not\_found.sh\ integrates with Bash's \command\_not\_found\_handle\ to automatically resolve and execute commands via mise when they are not found in the standard PATH.

src/assets/bash · high confidence

The aqua-registry crate now supports caching compiled registry data to disk using the rkyv binary format. This change adds a new \RegistryCache\ component that stores both raw source YAML and pre-compiled package indexes, allowing the system to skip repeated YAML parsing and registry lookups when the source has not changed. Users benefit from significantly faster registry operations and reduced memory overhead, as the compiled cache is versioned and pruned automatically to ensure consistency.

crates/aqua-registry/src · high confidence

A new dependency management subsystem has been added to handle tool and package installation via a provider architecture. This system introduces a dependency graph engine that schedules provider execution based on declared dependencies, supports scoped providers for monorepo environments, and persists freshness state (source/output hashes and command digests) to a dedicated state directory. It includes built-in support for various package managers (such as npm, pip, go, deno, and others) and allows configuration of run commands, sources, outputs, and environment variables, enabling automatic and ordered installation of project dependencies.

src/deps · high confidence

Users can now edit mise configuration files using a new interactive terminal-based editor (\mise edit\). This feature provides a structured, cursor-driven interface for managing tools, settings, and tasks, supporting features such as version selection for tools, boolean toggles for settings, and inline editing for complex values. The editor includes navigation via vim-style keys (j/k), undo/redo capabilities, and validation for environment variable formats, allowing users to modify their configuration without manually editing TOML files.

crates/mise-interactive-config/src/editor · high confidence

Mise now supports managing background services (daemons) for your projects, including built-in presets for CockroachDB, NATS, and SpiceDB. The system automatically allocates stable ports for linked git worktrees to prevent conflicts, manages daemon lifecycles via shell hooks, and allows you to define custom providers for shared database servers. It also includes automatic cleanup of state from deleted projects and ensures daemons do not run as root.

src/daemons · high confidence

Users can now manage shell aliases via the new \mise shell-alias\ command, which replaces the previous \alias\ command. This command provides subcommands to list (\ls\), retrieve (\get\), set (\set\), and remove (\unset\) aliases defined in the global configuration file (\\~/.config/mise/config.toml\). The \set\ subcommand supports both standard argument syntax and a \KEY=VALUE\ format for convenience.

_src/cli/shell\alias · high confidence

Users can now install and manage plugins using the vfox ecosystem, including the ability to install plugins from signed packslip archives for enhanced security. The system automatically detects and loads vfox plugins alongside existing asdf plugins, and vfox plugins can be configured via mise.plugin.toml to specify package manager requirements and script caching. This adds a new plugin type that integrates with the existing tool installation workflow.

src/plugins · high confidence

This change adds the \crates/vfox\ crate, which serves as the new runtime for vfox-style plugins. It embeds Lua code into the binary, manages plugin loading from both filesystem and embedded sources, and exposes a structured API for hooks (install, env\_keys, pre\_uninstall, etc.) and system dependency detection. The runtime includes built-in HTTP retry logic with backoff, cancellation support, and integration with mise's attestation and URL rewriting systems, allowing plugins to interact with the host environment via a consistent Lua interface.

crates/vfox/src · high confidence

The \mise-cache-core\ crate has been introduced to provide the foundational implementation for the remote action cache. This change adds the core protocol definitions, including media types and header constants for the cache API, and implements the \RemoteCacheConfig\ structure for configuring remote cache connections (base URL, namespace, authentication tokens, and timeouts). It also defines the \CacheDigest\ struct for handling content-addressable storage digests using Blake3 and SHA-256, and establishes the \RemoteActionResult\ structure for serializing action results. This module serves as the low-level engine for cache interactions, supporting both local and remote caching modes.

crates/mise-cache-core · high confidence

Mise now builds OCI images and pushes them to registries using a fully native Rust implementation, removing the previous dependency on external binaries like skopeo, crane, or docker. The new \src/oci\ module handles the entire lifecycle: it orchestrates the build with one content-addressable layer per tool version for efficient caching, constructs reproducible tar layers, and manages registry authentication by reading standard Docker/Podman credential files. It also supports pushing images directly to registries (including AWS ECR compatibility) and loading layouts into the Docker daemon via a streaming docker-archive conversion, all without requiring a container engine to be installed on the host.

src/oci · high confidence

The pipx backend now supports native dependency locking for PyPI tools using the uv package manager. This change introduces a new lock mechanism that persists Python dependency graphs, requiring uv version 0.12.10 or newer. Users can now lock tool environments to specific dependency versions, ensuring reproducible installs. The implementation includes validation to ensure compatible options are used and handles Python interpreter identity binding for the locked environments.

src/backend/pipx · high confidence

Users can now install Cargo packages via native pre-compiled binaries (binstall) instead of compiling from source, resulting in significantly faster installation times. This new capability, implemented in the \native\_binstall\ module, automatically discovers and downloads platform-specific binary artifacts from Crates.io, handling archive extraction and binary placement directly into the tool's bin directory.

src/backend/cargo · high confidence

The workspace detection logic in \src/task/workspace\ has been expanded to natively discover and resolve dependencies for Rust (Cargo), Go, Node.js, and Python (uv) ecosystems. New provider modules (\cargo.rs\, \go.rs\, \node.rs\, \uv.rs\) parse respective workspace manifests—such as \Cargo.toml\, \go.work\, \package.json\, and \pyproject.toml\—to identify member packages and their internal path dependencies. This enables the tool to automatically infer task dependencies and project structures within these multi-package workspaces without relying on external heuristics.

src/task/workspace · high confidence

Added the \mise skills\ command group with \ls\ and \sync\ subcommands to manage agent skills declared by active tools via packslips. The \ls\ command lists skills currently installed and active, showing the skill name, tool, version, and path, while also warning if a declared skill is missing from disk. The \sync\ command creates symlinks for these skills in a target directory (defaulting to \.claude/skills\ in the project root or \\~/.claude/skills\ with the \--global\ flag), allowing agents to access the correct version of each skill; it supports a \--prune\ option to remove links for skills that are no longer active.

src/cli/skills · high confidence

A new Cloudflare Worker (mise-run.js) has been added to proxy and serve mise installation scripts for bash, zsh, and fish shells. This worker handles GET requests to specific paths (/bash, /zsh, /fish, and /) by fetching the corresponding scripts from mise.jdx.dev, setting appropriate caching headers (1-hour immutable cache), and returning the content as plain text. This provides a reliable, cached endpoint for users to source or install mise via shell-specific URLs.

cloudflare · high confidence

The \src/system/packages/brew/cask\ module has been replaced with a new Rust implementation that significantly improves performance and reliability for macOS app installations. It now fetches cask metadata from Homebrew's bulk index (\api/cask.json\) instead of making individual requests per cask, reducing network overhead. The new code supports structured \preflight\ and \postflight\ flight steps, allowing for more robust handling of installation scripts, and includes logic to detect and skip upgrades for self-updating apps that are currently running. It also correctly resolves cask variations for different macOS releases and handles artifact types like \command\_wrapper\ and \pkg\ receipts with greater precision.

src/system/packages/brew/cask · high confidence

Plugins now have access to a comprehensive set of Lua modules for common tasks. The \archiver\ module allows decompressing archives with optional path stripping. The \cmd\ module provides \exec\ and \stream\ for running commands with timeouts and interactive support, and routes \os.execute\/\os.getenv\ through mise's environment to avoid stale values. The \env\ module lets plugins set environment variables. The \file\ module adds \read\, \symlink\, \exists\, \stat\, \list\, \glob\, \move\, and \join\_path\ for file system operations. The \hooks\ module manages plugin lifecycle hooks. The \html\ module provides an HTML parser. The \http\ module offers \get\, \head\, \download\file\ (and their \try\\ variants) with retry logic and GitHub API authentication. The \json\ module handles encoding and decoding. The \log\ module provides structured logging levels and overrides \print\. The \semver\ module enables version parsing, comparison, and sorting. The \strings\ module offers string manipulation functions like \split\, \trim\, and \join\.

_crates/vfox/src/lua\mod · high confidence

Users can now manage tool backends directly via the CLI. The new \mise backends ls\ command lists all built-in backends available in the toolset. Additionally, \mise backends switch\ allows users to migrate locked tools to the backend currently specified by the registry, handling lockfile updates and reinstallation when a tool's backend has changed. The legacy \mise b\ alias for this command group is deprecated and will be removed in version 2027.4.0.

src/cli/backends · high confidence

Users can now manage mise configuration files directly via the CLI with \mise config get\, \mise config set\, and \mise config ls\. \config get\ retrieves specific values or the entire file from a target TOML source (local, global, or system), while \config set\ allows editing these files with support for dotted keys, type inference, and append/remove operations on collections. \config ls\ lists active configuration files and their associated tools, with options to output JSON or list tracked configs. These commands also feature shell completion for configuration keys based on the schema and current file contents.

src/cli/config · high confidence

Users can now inspect the history of tracked dotfiles using the new \mise dot history\ command. This feature provides a checkpoint browser with subcommands to list recent changes (\ls\), view detailed checkpoint information including triggers and file changes (\show\), compare differences between checkpoints or against the current working tree (\diff\), and annotate checkpoints with custom descriptions (\describe\).

src/cli/dotfiles/history · high confidence

A new \mise dot\ subcommand is introduced to manage dotfiles and their history. This suite includes commands to add, apply, edit, diff, and track files (\add\, \apply\, \edit\, \diff\, \track\), as well as to manage history checkpoints (\save\, \status\, \history\), synchronization with a remote repository (\origin\, \sync\, \pull\, \conflicts\), and file exclusions (\exclude\, \include\). The implementation also adds a background watcher service to automatically capture file changes and supports encrypted file storage.

src/cli/dotfiles · high confidence

The \mise generate\ command now includes dedicated subcommands to scaffold common project files: \config\ generates a mise configuration file (wrapping the interactive editor), \devcontainer\ creates a \.devcontainer/devcontainer.json\ for VS Code remote environments, \git-pre-commit\ installs a pre-commit hook that runs mise tasks, \github-action\ generates a CI workflow file, \install-script\ (renamed from \bootstrap\) produces a self-contained mise installer script with optional Windows launchers, \task-docs\ renders task documentation into Markdown, \task-stubs\ creates executable shims for running tasks locally, and \tool-stub\ generates stubs for downloading and running external tools. These commands replace the previous experimental or scattered generation capabilities with a unified, documented interface.

src/cli/generate · high confidence

Developers can now use \mise plugins link \<name\> \<path\>\ to symlink a local plugin directory into mise, allowing edits in the source directory to take effect without reinstalling the plugin. This new command, located in \src/cli/plugins/link.rs\, creates a symlink in the plugins directory and supports an optional \--force\ flag to overwrite existing links. The command infers the plugin name from the directory path by stripping common prefixes like \mise-\, \vfox-\, or \asdf-\.

src/cli/plugins · high confidence

A new \mise sync\ command has been added to synchronize tool versions from external managers into mise. The command supports syncing Node.js versions from nvm, nodenv, and Homebrew (\mise sync node\), Python versions from pyenv and uv (\mise sync python\), and Ruby versions from Homebrew (\mise sync ruby\). This allows users to make existing installations from other tools available to mise without reinstalling them.

src/cli/sync · high confidence

The \src/cli/tasks\ module has been restructured into dedicated subcommand files, introducing \mise tasks add\ to create new tasks (either as TOML entries or executable scripts), \mise tasks edit\ to open task definitions in an editor, \mise tasks deps\ to visualize dependency trees (with compact and DOT output modes), \mise tasks graph\ to inspect the workspace project graph, \mise tasks info\ to display detailed task metadata, and \mise tasks validate\ to check for configuration errors and circular dependencies. These changes provide a more granular and user-friendly interface for managing, inspecting, and validating tasks within the CLI.

src/cli/tasks · high confidence

A new \mise token\ command has been added to help users debug authentication issues by displaying which token source is being used for Git providers. It supports subcommands for GitHub, GitLab, and Forgejo, showing the masked token and its source (e.g., environment variable, OAuth). The GitHub subcommand includes additional capabilities: a \--oauth\ flag to resolve tokens specifically via the native OAuth source, a \--refresh\ flag to mint a fresh OAuth token, a \--raw\ flag to output only the token value, and a hidden \--git-credential\ mode to supply tokens to Git's credential helper protocol.

src/cli/token · high confidence

The CLI now includes a \mise cache\ command group with four subcommands: \clear\ removes cache files for specific tools or all caches (including environment and task caches), optionally marking files as old via a hidden \--outdate\ flag; \prune\ removes stale cache files based on age settings, with support for dry-run and verbose modes; \path\ displays the current cache directory location; and \task\ inspects output cache entries for specific tasks, displaying details like size, time saved, and outputs in a table or JSON format.

src/cli/cache · high confidence

The core plugin system now includes native backends for Bun, Deno, .NET, Elixir, Erlang, Go, and Java. These plugins allow you to install and manage these runtimes directly through mise without relying on external tools like asdf or pyenv. The Bun plugin handles Windows ARM64 and creates the bunx shim automatically. The Deno plugin fetches versions from the official deno.com API. The .NET plugin supports isolated installs and runtime-only modes. The Elixir and Erlang plugins use precompiled binaries where available and handle checksum verification. The Go plugin respects GOROOT and GOPATH settings and installs default packages. The Java plugin supports multiple vendors, release types, and uses a metadata API for version listing.

src/plugins/core · high confidence

Added the \mise-brew-metadata\ crate, which introduces data models and parsing logic for Homebrew formula metadata. This new component allows mise to parse formula, bottle, source, and tap URL metadata, supporting features such as handling formula aliases, old names, build-time dependencies, and platform-specific bottle variations.

crates/mise-brew-metadata · high confidence

The \mise-agent-env\ crate has been added to detect whether a command is running under an AI coding agent by inspecting environment variables alone, without spawning subprocesses or accessing the filesystem. It provides \detect()\ and \is\_agent()\ functions that identify specific agents (such as Cursor, Claude Code, GitHub Copilot, and Codex) based on known environment signals, and includes a \detect\_with\_env()\ helper for testing or custom environment lookups.

crates/mise-agent-env · high confidence

The dependency management system now includes built-in providers for aube (aube-lock.yaml), Bun (bun.lockb/bun.lock), Dart and Flutter (pubspec.yaml/lock), Deno (deno.lock), and Git submodules (.gitmodules). These additions allow the tool to automatically detect and manage dependencies in projects using these ecosystems, handling installation, package addition/removal, and freshness checks via their respective lockfiles and output directories.

src/deps/providers · high confidence

This update introduces several new scripts in the xtasks directory to streamline development and release workflows. A new \fetch-gpg-keys\ task automates the collection of Node.js and Swift release keys into the \mise-util\ assets, replacing manual or fragmented fetching. Linting is consolidated via new \lint-fix.sh\ and \lint-fix.ps1\ scripts that wrap the \hk\ linter and Rust tooling, ensuring consistent code formatting across platforms. The \release-plz\ script is expanded to handle complex release logic, including idempotent publishing, subcrate version synchronization, and preventing duplicate GitHub Actions dispatches. Additionally, a new \test-tool-retry\ script adds resilience to CI by automatically retrying failed tool tests and applying a 7-day grace period for recent upstream releases, reducing false positives from transient upstream issues.

xtasks · high confidence

The configuration module now supports \mise doctor\ checks defined in \.miserc.toml\ or \mise.toml\, allowing users to run custom diagnostic commands with platform-specific constraints and timeouts. Additionally, a new \command\_wrapper\ feature enables intercepting binary dispatch (e.g., wrapping \cargo\ via \mr-boxington\) with custom commands, arguments, and environment variables, controlled by the \mr\_boxington\ tool option.

src/config · high confidence

This change embeds a suite of new vfox plugins directly into the tool, including support for 1Password CLI, aapt2, the Silver Searcher (ag), Android SDK command-line tools, Apache Ant, AsciidoctorJ, Azure Functions Core Tools, bfs, and bpkg. These plugins allow users to install and manage these specific tools via vfox without relying on external plugin sources. The implementation includes hooks for fetching available versions from their respective sources (GitHub, Maven, AgileBits), downloading the correct binaries or source code for the user's OS and architecture, and performing post-installation steps such as extracting archives, compiling from source (for ag and bfs), or setting up environment variables like ANDROID\_HOME and PATH.

crates/vfox/embedded-plugins · high confidence

Users can now launch \mise edit\ to interactively view and modify their configuration file using a terminal-based interface. This new crate provides a navigable, menu-like experience where the TOML structure itself serves as the UI, allowing users to browse sections (such as tools, env, tasks, and settings), edit values inline, and add new entries via fuzzy-searchable pickers. The editor preserves comments and formatting, supports cursor navigation that skips non-editable comment lines, and includes built-in providers for tool registries and version selection, making configuration management more intuitive than manual text editing.

crates/mise-interactive-config/src · high confidence

Added a new \mise direnv\ subcommand group containing \activate\, \envrc\, and \exec\ to facilitate integration with direnv. The \activate\ command outputs a shell function that allows mise to manage environment variables within direnv, while \envrc\ generates a temporary \.envrc\ file containing the current toolset's environment variables and watched config files. The \exec\ command runs a user command with the mise-managed environment and direnv watches applied. These commands are hidden from standard help and are intended for internal use to bridge mise's tool management with direnv's environment loading.

src/cli/direnv · high confidence

The task system now uses a pluggable provider architecture to resolve task files from local paths, remote Git repositories, and HTTP URLs. This change introduces dedicated providers for each source type, enabling features such as caching for remote Git and HTTP tasks, automatic cleanup of temporary artifacts, and path validation to ensure remote Git files remain within their checked-out directories. Users benefit from more robust handling of remote task includes, including support for Azure DevOps SSH URLs and remote subdirectories, as well as improved performance and stability through caching and race-condition fixes.

_src/task/task\_file\providers · high confidence

This change introduces a suite of new shell and PowerShell scripts to the \scripts/\ directory, enhancing the release pipeline, build optimization, and testing infrastructure. Key additions include \pgo.bash\ and \bolt.bash\ for Profile-Guided Optimization and LLVM BOLT binary reordering to improve startup performance, and \check-glibc.sh\ to enforce Linux binary compatibility by validating glibc and libstdc++ dependencies. The release workflow is supported by \publish-s3.sh\, \publish-r2.sh\, and \publish-version.sh\ for uploading assets to Cloudflare R2/S3 and managing CDN cache purges, while \render-mise-run.sh\ generates shell-specific installation scripts. Additionally, \test-check-glibc.sh\ and \task-cache-remote-compat.sh\ add unit and conformance tests for the new compatibility checks and remote task caching protocol, and \smoke-test-vfox-lua-error.ps1\ addresses Windows-specific Lua error handling in release builds.

scripts · high confidence

Added a new shell script (shell.envsubst) that automates the installation and shell activation of mise. The script downloads and installs mise using curl or wget, then configures the appropriate shell initialization file (bash, zsh, or fish) to activate mise, providing clear feedback and verification steps for the user.

packaging/mise.run · high confidence

The new \crates/mise-sigstore\ library introduces Sigstore-based verification for GitHub attested releases and SLSA provenance. It integrates the \sigstore-verify\ crate to fetch and validate TUF roots and bundles, implements HTTP retry logic with exponential backoff for transient GitHub API failures, and provides test fixtures for GitHub build provenance, release attestations, and SLSA bundles to ensure correct parsing and verification of these artifacts.

crates/mise-sigstore · high confidence

This change introduces a new \src/system/history\ module that provides automatic, background checkpointing of tracked dotfiles. It captures file changes into a private Git repository, allowing users to view history, rollback mutations, and recover from failed operations via a write-ahead journal. The system supports configurable exclusions, file encryption, and custom description commands, while ensuring that sensitive configuration history remains local and independent of the user's primary dotfile repository.

src/system/history · high confidence

The vfox plugin system now exposes a comprehensive set of Rust-side hook implementations (available, backend\_exec\_env, backend\_install, backend\_list\_tools, backend\_list\_versions, backend\_search\_tools, backend\_tools, backend\_uninstall, env\_keys, mise\_env, mise\_install\_satisfied, mise\_path, package, parse\_legacy\_file, post\_install, pre\_install, pre\_uninstall) that define the context structures and Lua serialization logic for plugin interactions. This adds support for advanced plugin capabilities including tool discovery and search, rolling release version tracking with checksums, package manager plugin support (install/upgrade/uninstall), attestation metadata verification (GitHub, SLSA, Cosign) during pre-install, environment variable redaction, and install-state satisfaction checks, while also integrating legacy file parsing into the backend.

crates/vfox/src/hooks · high confidence

Users can now export OpenTelemetry traces and logs for \mise run\ tasks. Traces are enabled by setting \otel.enabled = true\ (or \MISE\_OTEL\_ENABLED=1\) and configuring a traces endpoint; logs are enabled separately via \otel.logs = true\ (or \MISE\_OTEL\_LOGS=1\) and a logs endpoint. Task stdout and stderr are forwarded as log records correlated with the task's trace context, with stderr mapped to WARN severity. Nested \mise run\ invocations automatically coordinate to avoid duplicate log exports by claiming the output stream.

src/otel · high confidence

The idiomatic version parser now reads package manager versions and checksums from package.json files, supporting both the standard packageManager field and the devEngines.packageManager field. It handles corepack-compatible version strings that include checksums (e.g., npm@10.0.0+sha512...), automatically configuring the backend to verify the downloaded package manager binary against the specified checksum. This enables automatic installation of specific package manager versions with integrity verification when using idiomatic version files.

_src/config/config\_file/idiomatic\version · high confidence

The .bin/rtx shell script, which previously invoked cargo to build and run the chim tool, has been removed from the repository.

.bin · high confidence

The \log\_level\ and \runtime\ argument modules have been removed from the CLI argument definitions. This eliminates the previous implementation for the \--log-level\ flag and the \RuntimeArg\ parser (used for parsing \plugin@version\ syntax), indicating a shift in how these specific configuration and input patterns are handled within the application.

src/cli/args · high confidence

The Homebrew packaging file for the \rtx\ runtime manager has been deleted. This change removes the specific Homebrew formula that previously handled the installation and verification of the \rtx\ binary across macOS and Linux architectures, indicating a shift away from this specific packaging method or a consolidation of release assets.

packaging/homebrew · high confidence

The \alias\ and \aliases\ CLI commands (including the \ls\ subcommand) have been removed from the tool. Users can no longer list or manage aliases via the command line interface using these commands.

src/cli/alias · high confidence

The end-to-end test suite for directory-based Node.js version switching has been removed. This includes the deletion of the \test\_bash\, \test\_fish\, and \test\_zsh\ scripts, as well as the associated \.tool-versions\ files for Node.js 16 and 18, which previously verified that the tool correctly activated different Node.js versions when changing directories.

e2e/cd · high confidence

Mise has refactored its internal structure by moving a wide range of self-contained modules into the new \mise-util\ crate. This change centralizes shared functionality, including file and path helpers, process execution, caching, environment and directory statics, argument parsing, age encryption, GPG signature verification, and dependency graph scheduling. For users, this is an internal architectural improvement that consolidates code without altering external behavior or command-line interfaces.

crates/mise-util · high confidence

The logic for rewriting Homebrew bottle placeholders (such as @@HOMEBREW\_PREFIX@@ and @@HOMEBREW\_CELLAR@@) in text files, Mach-O load commands, and Linux ELF linkage has been moved into a new internal crate, \mise-brew-relocation\. This change refactors the codebase by isolating the platform-specific binary patching and string replacement logic, making it a distinct, reusable component within mise rather than being embedded in the main application logic.

crates/mise-brew-relocation · high confidence

The environment directive handling in \src/config/env\_directive\ has been restructured from a monolithic implementation into distinct modules (\file\, \module\, \path\, \source\, \venv\). This change introduces a unified \EnvDirective\ enum that explicitly supports various directive types including key-value pairs, file loading (JSON, YAML, TOML, dotenv), path manipulation, shell script sourcing, and Python virtual environment creation. The refactoring centralizes directive resolution logic, improves cache invalidation tracking for plugins, and ensures consistent handling of environment variable expansion and redaction across all directive types.

_src/config/env\directive · high confidence

The toolset management logic in \src/toolset\ has been reorganized into distinct modules to improve clarity and maintainability. A new \ToolsetBuilder\ now handles the construction of toolsets from configuration, environment variables, and CLI arguments, supporting scoped resolution (local vs. global). Environment variable caching is now managed by a dedicated \env\_cache\ module that uses encrypted storage and file-mtime validation to ensure cache validity. Installation prerequisites are validated via a new \helpers\ module that checks for plugin-declared system dependencies before installation begins. Additionally, \install\_options\ centralizes configuration for installation behavior (such as parallelism and dry-run modes), while \install\_state\ consolidates the tracking of installed tools and their metadata into a unified manifest file.

src/toolset · high confidence

The generated Rust types for configuration settings and the process-wide cache mechanism have been extracted into the new \mise-settings\ crate. This change allows lower-level components to read settings without depending on the main \mise\ application's config system, while the \build.rs\ script ensures these types are regenerated from the root \settings.toml\ during compilation.

crates/mise-settings · high confidence

The task execution logic has been reorganized into distinct modules to improve maintainability and separation of concerns. This change introduces a dedicated dependency graph manager (\deps.rs\) for handling task ordering and cycle detection, a comprehensive caching system (\task\_cache.rs\, \task\_cache\_store.rs\, \task\_cache\_audit.rs\) supporting local and remote storage with integrity verification, and a new confirmation dialog system (\task\_confirm.rs\). Additionally, environment and toolset resolution for tasks is now handled by a specialized builder (\task\_context\_builder.rs\) that optimizes caching for monorepo scenarios.

src/task · high confidence

The system now includes a configuration file for the Fish shell that automatically activates mise (a tool version manager) if the MISE\_FISH\_AUTO\_ACTIVATE environment variable is not set to 0. This replaces previous rtx integration with mise-specific activation logic.

share · high confidence

The Aqua integration has been refactored to support a baked-in registry snapshot compiled into the binary, which can be used as a fallback or primary source. Users can now configure multiple custom registries via settings, and the system respects the \prefer\_offline\ and \MISE\_OFFLINE\ modes by skipping network calls when tools are uninstalled or when the baked registry is preferred. The baked registry includes platform-specific backend overrides (e.g., Go vs. Cargo) and libc variants, ensuring accurate package resolution without requiring a live download of the aqua-registry repository in all cases.

src/aqua · high confidence

The tool now automatically updates its executable shims after global package installations or uninstallations for both Node.js and Ruby. For Node.js, a new npm wrapper script intercepts global install, uninstall, and link commands to trigger a reshim operation, ensuring that newly installed or removed binaries are immediately available in the PATH. For Ruby, a new plugin script sets the PKG\_CONFIG\_PATH to help native gem extensions find necessary headers and libraries, and hooks into the gem and Bundler install/uninstall processes to automatically reshim, keeping the environment consistent after package changes.

src/plugins/core/assets · high confidence

The command-line interface now uses the \usage-rs\ library instead of \clap\ for parsing arguments and generating help text. This change updates the underlying CLI framework, which may affect how flags and subcommands are processed and displayed, while maintaining the existing command structure for users.

src/cli · high confidence

The config file handling has been restructured to improve error reporting and template capabilities. TOML parsing errors now provide rich, context-aware diagnostics using miette, including specific help text for common Windows path issues. The legacy \.rtxrc\ and \legacy\_version\ file parsers have been removed in favor of the unified \mise.toml\ and \.tool-versions\ formats. Template rendering (Tera) is now supported in \.tool-versions\ files, requiring trust checks when templates are detected. Additionally, a new \config\_root\ module provides robust logic for determining project roots across various config file locations (e.g., \.mise/\, \.config/mise/\, \conf.d/\), and a \min\_version\ module enforces hard and soft version constraints on config files.

_src/config/config\file · high confidence

The \mise github\ command is now deprecated and will be removed in version 2027.5.0; users should migrate to \mise token github\. The new \github\ subcommand in the CLI module now delegates to the token management system, displaying the GitHub token source and value (with options to unmask, show raw output, or force a native OAuth refresh) for debugging authentication issues.

src/cli/github · high confidence

The end-to-end test infrastructure has been completely overhauled to improve reliability and speed. The new harness enforces strict environment isolation by creating temporary, sandboxed directories for each test, preventing cross-test pollution. It introduces parallel execution with configurable concurrency (E2E\_JOBS) and supports retry logic for flaky tests. The runner is now portable across different shells (bash, zsh, fish) and operating systems, including specific workarounds for macOS path limits and older bash versions. Additionally, the test runner integrates with CI systems via GitHub Actions annotations and step summaries, and provides better timeout handling and performance warnings for slow tests.

e2e · high confidence

The mise shim on Windows is now a native executable rather than a shell script wrapper. This change delivers Windows launcher arguments intact, prevents infinite recursion when the shim directory is filtered, and allows the shim to correctly detect and execute task stubs located beside the executable. Users benefit from more reliable argument passing and robust handling of task stubs on Windows.

crates/mise-shim · high confidence

Lockfile generation now stores Python (uv.lock) and npm (package.json) dependency graphs in separate sidecar files alongside the lockfile, rather than embedding them inline. This change improves performance by avoiding redundant graph generation and ensures cross-platform consistency by normalizing line endings before hashing, which prevents digest mismatches on Windows. The system automatically migrates existing inline graphs to this new sidecar format on the next save.

src/lockfile · high confidence

The \mise prepare\ command has been renamed to \mise deps\ and now provides a dedicated interface for managing project dependencies (such as \node\_modules\) separately from versioned tools. This new command supports adding (\add\), removing (\remove\), and installing (\install\) packages using an ecosystem-specific provider model (e.g., \npm:react\). It introduces features like dry-run mode, force reinstall, monorepo support, and the ability to explain why a provider is considered fresh or stale, allowing users to manage dependencies via a structured \ecosystem:package\ syntax.

src/cli/deps · high confidence

The build system now enforces stricter validation for registry tool entries, ensuring that project homepage URLs are valid HTTP/HTTPS addresses without template placeholders or whitespace, and introduces a release-version gate that will require a decision on promoting lockfile generation to the default mode before December 2026.

build · medium confidence

The RPM build infrastructure has been renamed from rtx to mise, replacing the old rtx.spec and rtx.repo files with new mise.spec and mise.repo definitions. The package now installs the mise binary and its man page, and the GPG signing key has been updated to a new identifier.

packaging/rpm · high confidence

The Debian package generation process has been updated to reflect the project's rebranding from 'RTX' to 'mise', updating repository metadata (Origin, Label, Description) and the maintainer label in the Dockerfile. Additionally, the \generate-release.sh\ script has been modernized by switching the interpreter from \sh\ to \bash\, enabling stricter error handling with \set -euo pipefail\, and adding shellcheck directives to improve script reliability and maintainability.

packaging/deb · high confidence

The \src/ui\ module has been refactored to replace the previous progress bar implementation with a new \clx\-based system. This introduces a unified install progress model (\install\_progress\) that renders either a live, animated terminal region (\tty\_install\_progress\) for interactive sessions or an append-only text log (\text\_install\_progress\) for CI and captured output. The new system features a dedicated header bar for the overall install, per-tool rows with dynamic layout adaptation, and weighted progress bars that account for post-install hooks. Additionally, Ctrl-C handling (\ctrlc\) has been rewritten to keep the application alive during interruption, allowing users to cancel specific tasks or the entire install gracefully, with platform-specific logic for Windows console events.

src/ui · high confidence

The CLI argument parsing library has been replaced from clap to usage-rs. This change updates the underlying framework for defining and parsing command-line arguments, which may affect how help text is generated and how arguments are processed internally, though the external command interface remains consistent.

(repo-wide) · high confidence

The settings management commands have been restructured into dedicated subcommands (\add\, \get\, \ls\, \set\, \unset\) under \mise settings\, replacing the previous flat interface. This change introduces \mise settings add\ for appending values to array settings, \mise settings get\ for retrieving specific setting values, and \mise settings ls\ with enhanced output options including \--json-extended\ to show source paths. The \set\ command now strictly prevents writing to environment-only settings and correctly handles OS-specific path separators for list settings. Additionally, legacy \pipx\ settings are automatically migrated to \pypi\ during these operations.

src/cli/settings · high confidence

The pre-commit hook script located in the .husky directory has been deleted. This file previously executed linting and help rendering tasks via 'just' before commits, and its removal indicates that this specific pre-commit automation is no longer active in this location.

.husky · high confidence

The shell completion scripts for Bash, Zsh, Fish, and PowerShell have been replaced with new versions generated by the \usage-argv\ tool. These scripts now invoke \mise \_\_complete\word\\_\ to provide dynamic completions, ensuring that command-line suggestions stay in sync with the tool's current help definitions and behavior.

completions · high confidence

The underlying Tera templating library has been upgraded from v1 to v2. This change affects all configuration files that use Tera syntax, such as mise.toml, .tool-versions, and .miserc.toml. Users should verify that their existing template expressions remain compatible with the v2 API, as the upgrade may introduce breaking changes to filter or function behavior.

src · high confidence

The vfox CLI has been refactored to use the usage-rs library for argument parsing, replacing the previous clap-based implementation. This change introduces a new command structure with dedicated subcommands: 'available' to list available SDKs, 'env-keys' to retrieve environment variables for a specific SDK and version, 'install' to install an SDK version to a specified directory, and 'plugins' (aliased as 'plugin') to manage plugins, including a 'list' subcommand to display installed SDKs. The CLI module now orchestrates these commands through a unified entry point.

crates/vfox/src/cli · high confidence

Add dummy vfox plugin for local testing; Add dummy vfox plugin hooks for testing; Add mutable PyPI test fixture for regression testing; Added Nix bootstrap test suite; Added Windows backend tests for aqua, HTTP, and GitHub tool installations; Added dummy plugin test fixtures; Added e2e tests for OCI image building, pushing, and layer caching; Added e2e tests for task execution and caching; Added e2e tests for the aqua backend; Added end-to-end test for direnv integration with mise; Added end-to-end tests for NVM and Python (uv) sync operations; Added end-to-end tests for SOPS-based secret decryption; Added end-to-end tests for npm and pnpm override behavior; Added end-to-end tests for plugin management and backend capabilities; Added end-to-end tests for the generate command suite; Added end-to-end tests for tool filtering, path ordering, and runtime symlink migrations; Added performance testing infrastructure and scripts; Added regression test for node-gyp bootstrap trampoline; Added test fixture for plugin dependency validation; Added test fixture for signed vfox plugin packslip archives; Added test fixtures for environment variable handling and configuration schemas; Added test fixtures for vfox.rs; E2E tests now use local HTTP and Git servers instead of external services; End-to-end tests for configuration behavior; End-to-end tests for shell activation and deactivation; Expanded Windows end-to-end test coverage for activation, bootstrap, and tool execution; Expanded e2e/core test coverage for idiomatic version files, lockfiles, and tool-specific behaviors; Expanded end-to-end test coverage for lockfile behavior; Expanded end-to-end testing for environment management; Local fake npm registry for e2e tests; Migration of test snapshots from rtx to mise; New e2e fixtures for GitHub OAuth, Git redirects, and Homebrew package lookup; New end-to-end tests for shell activation, shims, and hooks; Removal of CLI test snapshot files; Removed test fixture files in test/cwd; Test infrastructure updates: new test tool versions and gitignore rules; Updated configuration loading snapshot for mise integration; Updated shell activation and deactivation test snapshots; Updated snapshot for mise plugin TOML configuration; Updated test snapshots for mise.toml configuration parsing.

This release updates dependencies across 18 manifests, including routine lock-file maintenance and version bumps for Rust crates such as confique, age, aube-registry, aube, indexmap, bytes, log, base64, either, zip, ctrlc, curve25519-dalek, serde\_json, hyper-util, system-configuration, lru, aws-sdk, regex, strum, usage-lib, demand, chrono, sha2, clap, reqwest, tera, sigstore-verify, petgraph, junction, versions, rmp-serde, self\_update, aws-lc-rs, and clap\_complete. It also updates JavaScript dependencies including markdown-it, @tsconfig/node24, tar, and @types/node, alongside lock-file maintenance for various packages.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 43 → 75 (+31.4)
• Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 55 → 81 (+26.4)
• Architecture 69 → 94 (+25.0)
• Maturity 74 → 76 (+2.7)
• Readiness 23 → 89 (+66.2)
• Security 66 → 77 (+10.5)
• Domain Modelling 100 (new)
• Accessibility 69 (new)

• Coverage not measured — test suite did not build
• Dimension evaluation failed
• Duplicated block (10 lines × 2) (e2e/helpers/scripts/tool_stub_test_server.py)
• High CVE: [GHSA redacted] (bun.lock)
• High IaC: DS-0002 (packaging/e2e/Dockerfile)
• High IaC: DS-0002 (test/fixtures/bootstrap-linux-host/Dockerfile)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 33 more

• AccountAction::apply (cognitive 37) (src/system/accounts.rs)
• AccountAction::apply (cyclomatic 25) (src/system/accounts.rs)
• AquaBackend::install (cognitive 26) (src/backend/aqua.rs)
• AquaBackend::install (cyclomatic 20) (src/backend/aqua.rs)
• AquaBackend::install_version_ (cognitive 52) (src/backend/aqua.rs)
• AquaBackend::install_version_ (cyclomatic 27) (src/backend/aqua.rs)
• AquaBackend::resolve_lock_info (cognitive 44) (src/backend/aqua.rs)
• AquaBackend::resolve_lock_info (cyclomatic 32) (src/backend/aqua.rs)
• AquaBackend::run_cosign_check (cognitive 20) (src/backend/aqua.rs)
• AquaBackend::verify_provenance (cognitive 54) (src/backend/aqua.rs)
• AquaBackend::verify_provenance (cyclomatic 38) (src/backend/aqua.rs)
• AquaBackend::verify_provenance_at_lock_time (cognitive 18) (src/backend/aqua.rs)
• AquaChecksum::merge (cognitive 20) (crates/aqua-registry/src/types.rs)
• AquaChecksum::merge (cyclomatic 16) (crates/aqua-registry/src/types.rs)
• AsdfPlugin::ensure_installed (cognitive 19) (src/plugins/asdf_plugin.rs)
• Backend::install_version (cognitive 42) (src/backend/mod.rs)
• Backend::install_version (cyclomatic 36) (src/backend/mod.rs)
• Backend::is_version_installed (cognitive 22) (src/backend/mod.rs)
• Backend::is_version_installed (cyclomatic 18) (src/backend/mod.rs)
• Backend::list_remote_versions_with_info_and_options (cognitive 18) (src/backend/mod.rs)
• …and 1736 more

• 300 commits — 191 feature/other, 109 fixes

• (root) — 53 commits
• src/system — 36 commits
• src/cli — 25 commits
• .github/workflows — 17 commits
• e2e/cli — 17 commits
• src/backend — 14 commits
• docs/dev-tools — 10 commits
• crates/mise-util — 9 commits
• docs/bootstrap — 9 commits
• src/daemons — 9 commits
• e2e/backend — 7 commits
• docs/tasks — 6 commits
• e2e/config — 6 commits
• e2e/tasks — 6 commits
• src/config — 5 commits
• crates/vfox — 4 commits
• e2e/lockfile — 4 commits
• docs/.vitepress — 3 commits
• docs/cli — 3 commits
• src/file.rs — 3 commits

• fix: chore(deps): bump locked dev tools and fix communique 1.4.1 lock entry (#13490)
• fix: chore: fix lints reported by the Rust 1.99 beta toolchain (#13627)
• fix: fix(activate): make bash mise function work without $__MISE_EXE (#13491)
• fix: fix(activate): run enter hooks when activating inside a project (#13383)
• fix: fix(aqua): create .mise-bins for registry files listed by name only (#13525)
• fix: fix(aqua): report only the provenance and signature checks mise performs (#13549)
• fix: fix(backend): don't reuse versions-host version lists when MISE_USE_VERSIONS_HOST=0 (#13605)
• fix: fix(backend): give every backend's postinstall hook the config env (#13316)
• fix: fix(backend): keep .exe when bin renames a raw Windows download (#13529)
• fix: fix(backend): keep release-age cutoffs exact when a listing lacks dates (#13364)
• fix: fix(backend): run cask installer scripts that need sudo or placeholders (#13380)
• fix: fix(backend): support staged_path in third-party casks (#13369)
• fix: fix(bootstrap): ignore mise shims when selecting tap Ruby (#13198)
• fix: fix(bootstrap): name the config behind an unresolvable brew formula in prune (#13661)
• fix: fix(bootstrap): point config_roots deprecation warning at conf.d folders (#13598)
• fix: fix(bootstrap): refresh apt lists when a package has no install candidate (#13659)
• fix: fix(bootstrap): reject two spellings of one package that disagree (#13334)
• fix: fix(bootstrap): resolve Homebrew formula aliases and old names (#13382)
• fix: fix(bootstrap): run history reload commands for dotfiles bootstrap writes (#13509)
• fix: fix(bootstrap): skip volume metadata when extracting DMGs (#13378)
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

jdx/mise was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.