chore(deps): update dependency mise to v2026.4.1

[renovate-sh-app]

This PR contains the following updates:

Package	Update	Change	Pending
mise	minor	v2026.3.16 → v2026.4.1	v2026.4.4 (+2)

---

Release Notes

jdx/mise (mise)

v2026.4.1: : Per-tool install_before and musl detection fixes

Compare Source

This release adds per-tool install_before overrides for more granular control over version freshness, fixes musl/glibc detection in minimal Docker containers, and ensures the -q flag works correctly with mise prepare.

Added

• Per-tool install_before option -- You can now set install_before on individual tools to override the global setting. This is useful when some tools need tighter freshness windows than others. Precedence is: --before CLI flag > per-tool install_before > global install_before setting. #​8842 by @​sargunv-headway

  [settings]
  install_before = "7d"  # default for all tools
  
  [tools.trivy]
  version = "latest"
  install_before = "1d"  # trivy updates are time-sensitive, use a shorter window

• Registry: dbt-fusion -- dbt-fusion is now available as a short name in the mise registry, backed by aqua:getdbt.com/dbt-fusion. #​8837 by @​ryan-pip

Fixed

• Musl detection in minimal Docker containers -- A musl-compiled mise binary running in a minimal container (scratch, busybox, distroless) with no /lib/ld-* files would incorrectly identify the platform as glibc, causing it to select the wrong lockfile entries or tool variants. When no dynamic linker is found at runtime, mise now falls back to the binary's compile-time target. Additionally, a new MISE_LIBC environment variable (musl or gnu) allows explicitly overriding the detection. #​8825 by @​davireis

  ENV MISE_LIBC=musl
  RUN mise install

• mise prepare -q not suppressing output -- The -q (quiet) flag was not suppressing status messages in mise prepare because they used miseprintln!() which bypasses the logging system. These messages now use standard logging macros that respect the quiet setting. #​8792 by @​Marukome0743

• Wrong option in mise prepare docs example -- The ansible-galaxy example in the prepare documentation used -f (force) instead of -r (requirements file). #​8839 by @​rndmh3ro

New Contributors

• @​Marukome0743 made their first contribution in #​8792
• @​sargunv-headway made their first contribution in #​8842
• @​Rohan5commit made their first contribution in #​8844
• @​ryan-pip made their first contribution in #​8837
• @​rndmh3ro made their first contribution in #​8839

Full Changelog: jdx/mise@v2026.4.0...v2026.4.1

v2026.4.0: : Linked version fixes, monorepo task aliases, and Azure Developer CLI

Compare Source

This release fixes a panic when using mise link with aqua-backed tools, resolves bare task alias lookup in monorepo configurations, and handles a rustup check exit code that was incorrectly treated as an error.

Added

• Registry: azd (Azure Developer CLI) -- azd is now available as a short name in the mise registry, backed by aqua:Azure/azure-dev. Install with mise use -g azd@latest. #​8828 by @​rajeshkamal5050

Fixed

• Panic with linked versions on aqua-backed tools -- Running mise doctor, mise reshim, or any command that calls list_bin_paths on an aqua-backed tool with a linked version (created via mise link) would panic with a StripPrefixError. The root cause was that non-version link names like "brew" or "mylink" were passed to the aqua registry as version strings, where they unexpectedly matched semver constraints and produced absolute paths. Linked versions are now detected early and skip the aqua registry lookup entirely, returning install_path/bin directly. #​8801 by @​nikobockerman

• mise outdated failing for Rust -- rustup check returns exit code 100 when toolchain updates are available, which is normal behavior. Previously, mise treated this as a command failure, causing mise outdated to report an error for core:rust. The exit code is now handled correctly. #​8832 by @​shalk

• Bare task aliases not resolving in monorepo mode -- In a monorepo with config_roots configured, running mise run prl (a bare alias) would fail with "no task //:prl found", even though mise run //:prl worked. The issue was that expand_colon_task_syntax expanded bare aliases to //:prl, but the task loader then skipped config root discovery entirely. Both bare and prefixed alias forms now resolve correctly, and tab completion also works for monorepo-prefixed aliases. #​8819 by @​nkakouros

• Task help not shown for metadata-only usage specs -- When a task script defined #USAGE long_about, before_help, after_help, or examples without any arg or flag directives, mise run task --help would show the generic "This task does not accept any arguments" message instead of the usage-based help with the detailed description. #​8824 by @​nkakouros

New Contributors

• @​shalk made their first contribution in #​8832
• @​jedymatt made their first contribution in #​8833
• @​nikobockerman made their first contribution in #​8801
• @​rajeshkamal5050 made their first contribution in #​8828

Full Changelog: jdx/mise@v2026.3.18...v2026.4.0

v2026.3.18: : Python provenance verification, Go sub-module fixes, and shim recursion guards

Compare Source

This release adds supply-chain security improvements for Python, fixes several shim recursion issues that could cause system hangs, and improves Go backend version resolution for deeply nested sub-modules.

Highlights

• Python provenance verification -- Precompiled Python binaries from astral-sh/python-build-standalone can now be verified using GitHub Artifact Attestations, with downgrade protection in lockfiles.
• Shim recursion guards -- Two separate infinite-recursion bugs involving mise shims have been fixed, preventing fork bombs in devcontainer environments and when using exec() templates with mise-managed tools.
• Go sub-module support -- Deeply nested Go sub-modules that return no versions from go list -versions now correctly install with @latest instead of incorrectly resolving to a parent module's version.

Added

• Python GitHub Artifact Attestations -- Precompiled Python binaries are now verified against GitHub Artifact Attestations from astral-sh/python-build-standalone, following the same pattern already used for Ruby. A new python.github_attestations setting (env: MISE_PYTHON_GITHUB_ATTESTATIONS) overrides the global github_attestations setting for Python specifically. When enabled, mise lock records provenance = "github-attestations" in lockfile entries, and mise install verifies downloaded tarballs. If a lockfile records provenance but verification is disabled at install time, the install fails with a downgrade-attack error. #​8820 by @​malept

  # settings.toml or mise.toml [settings]
  [python]
  github_attestations = true  # defaults to the global github_attestations value

• Registry: svgo -- svgo (SVG Optimizer) is now available as npm:svgo. #​8817 by @​3w36zj6

Fixed

• Shim infinite recursion with system shims on PATH -- When tools are installed via mise install --system (e.g. in Docker/devcontainer images), a second shims directory is created at MISE_SYSTEM_DATA_DIR/shims. If both the user and system shims directories were on PATH, invoking a shim for a tool not in any config file would hang indefinitely. The PATH fallback now skips both shims directories and rejects any binary that canonicalizes to the mise binary itself. #​8816 by @​andrewthauer

• Fork bomb from exec() templates, credential commands, and git credentials -- Three subprocess-spawning code paths inherited mise shims in PATH. When the subprocess invoked a mise-managed tool (e.g. gh auth token in an exec() template or credential_command), the shim re-entered mise, triggering the same subprocess again -- causing infinite recursion. Observed as load average >1800 on affected systems. A new shared path_env_without_shims() helper now strips the shims directory from PATH in all three call sites. #​8802 by @​antonioacg

• Go backend --locked mode -- The Go backend was missing a supports_lockfile_url() -> false override, causing mise install --locked to fail for any go-backend tool since their lockfile entries never contain download URLs. #​8790 by @​palootcenas-outreach

• Go deeply nested sub-module version resolution -- mise ls-remote for deeply nested Go sub-modules (e.g. github.com/go-kratos/kratos/cmd/kratos/v2) would incorrectly resolve to the root module's versions. The version fetching logic now tries the exact tool path first and treats an empty version list as authoritative, falling back to @latest for installation instead of using a parent module's version. Results are now cached per module path. #​8823 by @​roele

• Flutter version sorting -- Fixed version sorting in the Flutter registry entry by stripping the -stable suffix before sorting, and switched to per-platform URL templates. #​8818 by @​roele

New Contributors

• @​antonioacg made their first contribution in #​8802
• @​palootcenas-outreach made their first contribution in #​8790

Full Changelog: jdx/mise@v2026.3.17...v2026.3.18

v2026.3.17: : Shims always at the front of PATH

Compare Source

A small patch release with a single bug fix for mise activate --shims PATH ordering.

Fixed

• Shims always prepended in --shims mode -- When using mise activate --shims, if the shims directory was already present in PATH (e.g. from a previous activation or a VS Code terminal re-sourcing the shell config), mise would skip the prepend and leave shims at their existing position. This meant system binaries earlier in PATH could silently shadow mise-managed tools. Shims are now always moved to the front. For fish, MovePrependEnv is used to reorder without duplicating; for all other shells, PrependEnv is emitted unconditionally, accepting a harmless duplicate entry in exchange for guaranteed ordering. #​8757 by @​ctaintor

New Contributors

• @​ctaintor made their first contribution in #​8757

Full Changelog: jdx/mise@v2026.3.16...v2026.3.17

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.