mise 2026.5.8

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

A small release: a new `mise patrons` command, cleaner task command output when scripts start with a shebang, and a fix for `mise upgrade` summaries getting wiped by progress cleanup. Under the hood, signature verification moves to the modern sigstore-rust stack.
Added


(patrons) New mise patrons subcommand lists individuals on the Patron tier supporting mise development (#9841) by @jdx. Data is fetched from the en.dev patrons feed, cached for 24h, and falls back to stale cache on network failure. Each patron's name renders as a clickable OSC 8 hyperlink in supporting terminals.
$ mise patrons
mise is supported by these patrons — thank you

  • Ronald Gierlach
  • youfoundron

Become a patron: https://en.dev/sponsor

Flags: -J/--json, --refresh.


(registry) Add a racket shorthand backed by the aqua racket/racket/minimal package, exposing both racket and raco from the official racket-lang.org release artifacts (#9784) by @albertnetymk.


Fixed


(task) When a task's run body starts with #!/usr/bin/env bash or set -Eeuo pipefail, the echoed command line would show only that boilerplate and hide the rest of the script. Leading shebang, blank, and set ... lines are now skipped when building the displayed command, so the first real command shows up. Execution is unchanged (#9844) by @jdx. Fixes #9842.
# before
[generate-completions] $ #!/usr/bin/env bash

# after
[generate-completions] $ fzf --fish > ~/.config/fish/completions/fzf.fish



(upgrade) mise upgrade could erase its own Upgraded N tools: summary detail lines when an upgrade also performed an uninstall — fresh progress jobs registered for the cleanup phase were still active at shutdown, so stop_clear() wiped them along with the summary. Progress jobs are now finished and reset before the summary prints (#9860) by @risu729. Regression from #9779; addresses #9856.


Changed

(security) Sigstore verification (verify_github_attestation, verify_cosign_signature, verify_slsa_provenance, detect_attestations) now runs on a local mise-sigstore adapter built on sigstore-verify 0.7 from sigstore-rust, replacing the previous sigstore-verification 0.2 dependency (#9260) by @jdx. The mise call sites and helper API are unchanged. The new adapter still covers legacy cosign v1 bundles (e.g. goreleaser-signed releases) and raw DSSE *.intoto.jsonl envelopes (slsa-github-generator) that the upstream Bundle::from_json rejects.

Deprecated


(config) The top-level env_file setting (and MISE_ENV_FILE) is now marked deprecated. Use env._.file in mise.toml instead (#9862) by @risu729. The JSON Schema gains the deprecated keyword, a warning is scheduled for 2026.11.0, and removal is planned for 2027.11.0.
# before
env_file = ".env"

# after
[env]
_.file = ".env"


New Contributors

@albertnetymk made their first contribution in #9784

Full Changelog: jdx/mise@v2026.5.7...v2026.5.8
💚 Sponsor mise
mise is built by @jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.
If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

View the full release notes at https://github.com/jdx/mise/releases/tag/v2026.5.8.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.