Update dependency jdx/mise to v2026.7.14

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise	uses-with	patch	2026.7.12 → 2026.7.14	v2026.7.16 (+1)

---

Release Notes

jdx/mise (jdx/mise)

v2026.7.14: : Multi-asset GitHub installs, safer defaults, and Windows pip

Compare Source

This release adds overlay installs for GitHub-based tools, closes a config-trust security gap around default shell arguments, and lands a wide batch of correctness fixes across tasks, lockfiles, npm, Swift, brew casks, and Windows Python.

Added

• github: the GitHub/GitLab/Forgejo release backend now accepts additional_asset_patterns, so a single install can overlay multiple release archives from the same tag into one installation directory. Each supplemental artifact is locked and verified (checksums and provenance) on its own, and --locked fails if the recorded set no longer matches. This models release layouts like Ollama's optional ROCm archive without making a large payload unconditional. (#​11272 by @​jdx)

  [tools."github:ollama/ollama"]
  version = "latest"
  additional_asset_patterns = ["ollama-linux-amd64-rocm.tgz"]

• npm: new allow_low_downloads tool option lets an embedded aube install bypass the weekly-download popularity gate for the requested package only, so curated tools like bibtex-tidy and purty install again without npm.shell_out. Transitive dependencies still hit the gate. (#​11305 by @​jdx)

• env: structured env files (env._.file loading JSON/YAML/TOML) support an explicit expand = true option for shell-style variable expansion, including references to earlier values. See Fixed below for the default-behavior change. (#​11269 by @​jdx)

Fixed

• env: values loaded from JSON/YAML/TOML env files are literal by default again, fixing a regression where every value was shell-expanded when env_shell_expand was on. That corrupted literals such as bcrypt-style $6$salt$hash and could pull in matching process-environment values. Opt back into expansion with expand = true. (#​11269 by @​jdx)
• python: pip is now usable on fresh Windows installs. mise synthesizes pip.cmd/pip3.cmd wrappers, adds the install's Scripts directory to PATH so pip-installed console scripts resolve, and fixes default-package installation on Windows. (#​11278 by @​JamBalaya56562)
• github: .exe release assets are now preferred on Windows, so tools that ship both an extensionless and .exe binary no longer install the non-runnable one and fail with "cannot find binary path". (#​11257 by @​gologames)
• github: a rejected GitHub token (401) now produces an actionable error that names the token source (gh CLI, github_tokens.toml, OAuth, env var, etc.) and includes GitHub's response and a remediation hint, instead of a bare 401 Unauthorized. (#​11236 by @​Marukome0743)
• backend: an archive containing a single binary with an OS/arch suffix (e.g. gdscript-formatter-macos-aarch64) is now renamed to its clean name on PATH, matching the existing behavior for single-file downloads. (#​11232 by @​Marukome0743)
• brew: brew-cask installs handle more real-world casks — completion stanzas and system_command in lifecycle blocks are supported, and artifact links into root-owned directories like /usr/local/bin now elevate through mise's sudo policy instead of failing with permission errors. Fixes installing docker-desktop. (#​11273 by @​jdx)
• lockfile: prefix: tool requests now honor the locked version on mise install instead of silently re-resolving to the newest match. Constrained upgrades via mise upgrade/mise lock --bump still work. (#​11255 by @​JamBalaya56562)
• aqua: cross-platform lockfiles for aqua HTTP packages preserve a reachable v-prefixed URL, fixing 404s where an entry locked to another platform's unprefixed URL. (#​11267 by @​jdx)
• swift: Swift lockfile entries now record the target Linux distro (ubuntu24.04, fedora39, ubi9, ...) so checksums are no longer verified across mismatched distro tarballs, and mise lock writes meaningful entries and re-locks correctly after changing swift.platform. (#​11299 by @​jdx)
• task: with a git worktree checked out inside the main checkout, mise no longer loads the enclosing monorepo root's tasks into the nested root's namespace. Env, tools, and vars still inherit as before. (#​11283 by @​jdx)
• task: changing a task's run command, sources, or outputs now invalidates its cached state, so tasks are no longer incorrectly skipped after such edits. (#​11288 by @​rabadin)
• task: a task's source hash is now persisted only after a successful run, so a failed run no longer marks stale sources as up to date. (#​11296 by @​rabadin)
• completions: shell completion no longer offers mise's own global flags after a task name (where they aren't valid), and a task flag that shares a name with a mise flag now completes its own values correctly. (#​11284 by @​jdx)
• npm: npm package versions with very large numeric components (up to Number.MAX_SAFE_INTEGER) now sort correctly, fixing cases where a 0.0.* build could be picked over a newer stable release. (#​11280 by @​jdx)
• npm: aube trust-downgrade failures now surface a clearer explanation, and aube's own progress display no longer competes with mise's output (bumped to 1.33.1). (#​11292, #​11308 by @​jdx)
• npm: aube allow_builds is now serialized as a map. (#​11262 by @​jdx)
• version: the update-check cache now negative-caches, so machines that can't reach the network (or run a build newer than the latest release) stop re-running the full check — including building an HTTP client and parsing the CA trust store — on every invocation. This is a significant speedup for commands like mise --version in those cases. (#​11285 by @​jdx)
• env: remaining std::env::vars() call sites now use vars_safe(). (#​11309 by @​JamBalaya56562)

Changed

• usage: every mise command now declares its effect on the system — read-only, modifies state, or destructive — surfaced in the command reference. This requires usage 4.0 (min_usage_version bumped), so shell completions and doc rendering now depend on it. (#​11306 by @​jdx)

Security

• config: the Unix/Windows default file and inline shell-argument settings are now global-only. Because local config is loaded before trust evaluation, an untrusted repository could previously influence how commands from trusted sources were executed. Global config and MISE_* environment variables still apply. Reported by @​arpitjain099. (#​11293 by @​jdx)

Performance

• cli: the clap command tree is no longer rebuilt twice on every invocation. (#​11297 by @​jdx)

Documentation

• npm: documented Socket integrations. (#​11268 by @​jdx)
• backend: corrected the bin_path/asset_pattern template variable docs. (#​11298 by @​jdx)
• Retargeted a dead clap.rs link to docs.rs/clap. (#​11194 by @​Bartok9)
• Added a generated llms.txt index for AI agents. (#​11300 by @​jdx)

Registry

• Added checkstyle (#​11287 by @​zeitlinger), grok (#​11291), and tak (#​11307) by @​jdx.

New Contributors

• @​gologames made their first contribution in #​11257

Full Changelog: jdx/mise@v2026.7.13...v2026.7.14

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.7.13: : Multi-binary renaming, cask completions, and go.mod support

Compare Source

This release expands archive backends to rename multiple binaries from a single release, adds Homebrew cask shell completions and go.mod version-file support, and fixes a broad batch of task, install, lockfile, and language-plugin correctness issues.

Added

• backend: rename_exe now accepts a table mapping source patterns to target names, so an archive that ships several executables can expose all of them cleanly on PATH instead of only one. The existing string form is unchanged. (#​11231 by @​jdx)

  [tools."github:DanielGavin/ols"]
  version = "latest"
  rename_exe = { "ols-*" = "ols", "odinfmt-*" = "odinfmt" }

• brew: brew-cask now installs shell completions (declared bash_completion/fish_completion/zsh_completion files and generate_completions_from_executable for bash, zsh, fish, and pwsh) instead of skipping them, tracking them in cask receipts and installed-state checks. (#​11198 by @​jdx)

• go: go.mod can now be used as an idiomatic version file. A toolchain goX.Y.Z directive resolves as an exact pin, while a go X.Y minimum resolves to the latest matching patch. It is opt-in and unchanged unless enabled per-tool. (#​11213 by @​JamBalaya56562)

  mise settings add idiomatic_version_file_enable_tools go

• task: PowerShell task shells (pwsh/powershell) now run with -NoProfile by default, matching how mise spawns POSIX shells, so a profile that mutates PATH (such as a mise activation snippet) can no longer shadow a task's own tools and cause confusing "cannot find binary path" errors. Opt out with the new windows_powershell_no_profile setting (MISE_WINDOWS_POWERSHELL_NO_PROFILE=false). (#​11199 by @​jdx)

Fixed

• env: _.path/_.file/_.source directives within a single [env]._ block are now resolved in written order, so a _.path can reference a variable exported by a _.source written before it. (#​11163 by @​JamBalaya56562)
• install: failed installs no longer print a contradictory "installed but not activated" hint before the real error. (#​11227 by @​jdx)
• install: logical state mutations during install are now serialized to avoid races. (#​11207 by @​risu729)
• lockfile: upgrading a locked github: tool to a newer version that is already installed on disk no longer triggers a false supply-chain "provenance regression" error. (#​11230 by @​jdx)
• npm: aube install failures now surface the full cause chain instead of an opaque "failed to resolve dependencies" message, with mise-native remediation guidance (trust_policy_excludes or npm.shell_out) for trust-downgrade errors. (#​11226 by @​jdx)
• task: inline task definitions now follow a consistent first-wins precedence model across local, conf.d, and monorepo configs, so lower-precedence metadata no longer leaks into script tasks and the winning config's context is preserved. (#​11103 by @​risu729)
• task: source freshness now tracks files correctly for workspace-rooted sources patterns used in nested subproject tasks, so edits inside a subproject trigger a rerun. (#​11202 by @​rabadin)
• brew: cask upgrades handle structured preflight_steps/postflight_steps for move/remove operations, and cleanup-only zap pkgutil IDs are no longer treated as install receipts (which could leave pkg cask status permanently missing). (#​11197 by @​jdx)
• brew: cask upgrades no longer fail when removing a protected app backup (e.g. docker-desktop) hits "Permission denied", recovering permissions the way Homebrew does before retrying. (#​11219 by @​jdx)
• python: a python3 executable is now provided on Windows. (#​11212 by @​jdx)
• ruby: custom ruby.precompiled_url = "owner/repo" sources now fetch release metadata directly from GitHub instead of the restricted versions host, avoiding 403 warnings. (#​11154 by @​risu729)
• ruby: Gemfile version pins with multi-digit segments (e.g. ruby "3.4.10") are now parsed correctly. (#​11229 by @​capnregex)
• bootstrap: ./-prefixed relative [bootstrap.repos] paths no longer display with a leading ./ component. (#​11214 by @​lilienblum)
• http: invalid URLs now return an error instead of panicking. (#​11160 by @​Marukome0743)
• settings: avoid a panic when a parent settings key is an inline table. (#​11184 by @​Marukome0743)
• self-update: the updater's TLS backend now matches the feature it was built with, fixing failures when compiled with native-tls. (#​10834 by @​bltavares)

Deprecated

• python: the legacy virtualenv tool option is deprecated in favor of the _.python.venv env directive. It now emits a warning and is scheduled for removal around 2027.7.0. (#​11234 by @​JamBalaya56562)

Documentation

• python: clarify that uv_venv_auto requires a uv.lock file. (#​11223 by @​jdx)
• Fix dead links in the contributing guide and the aqua-registry/pipx installation docs. (#​11123, #​11167 by @​Bartok9)

New Contributors

• @​capnregex made their first contribution in #​11229
• @​rabadin made their first contribution in #​11202

Full Changelog: jdx/mise@v2026.7.12...v2026.7.13

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.