Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,58 @@
# Changelog

## [2026.3.4](https://github.com/jdx/mise/compare/v2026.3.3..v2026.3.4) - 2026-03-07

### πŸš€ Features

- **(github)** keep exe extensions on Windows by @iki in [#8424](https://github.com/jdx/mise/pull/8424)
- **(task)** add `interactive` field for exclusive terminal access by @jdx in [#8491](https://github.com/jdx/mise/pull/8491)
- add header comment to generated lockfiles by @ivy in [#8481](https://github.com/jdx/mise/pull/8481)
- runtime musl/glibc detection for correct libc variant selection by @jdx in [#8490](https://github.com/jdx/mise/pull/8490)

### πŸ› Bug Fixes

- **(github)** use registry platform options during install by @jdx in [#8492](https://github.com/jdx/mise/pull/8492)
- **(http)** store tool opts as native TOML to fix platform switching by @jdx in [#8448](https://github.com/jdx/mise/pull/8448)
- **(installer)** error if MISE_INSTALL_PATH is a directory by @jdx in [#8468](https://github.com/jdx/mise/pull/8468)
- **(prepare)** resolve sources/outputs relative to `dir` when set by @jdx in [#8472](https://github.com/jdx/mise/pull/8472)
- **(ruby)** fetch precompiled binary by release tag instead of listing all releases by @jdx in [#8488](https://github.com/jdx/mise/pull/8488)
- **(schema)** support structured objects in task depends by @risu729 in [#8463](https://github.com/jdx/mise/pull/8463)
- **(task)** replace println!/eprintln! with calm_io in task output macros by @vmaleze in [#8485](https://github.com/jdx/mise/pull/8485)
- handle scoped npm package names without backend prefix by @jdx in [#8477](https://github.com/jdx/mise/pull/8477)

### πŸ“¦οΈ Dependency Updates

- update ghcr.io/jdx/mise:copr docker digest to c485c4c by @renovate[bot] in [#8484](https://github.com/jdx/mise/pull/8484)
- update ghcr.io/jdx/mise:alpine docker digest to 8118bc7 by @renovate[bot] in [#8483](https://github.com/jdx/mise/pull/8483)

### πŸ“¦ Registry

- disable sd version test by @jdx in [#8489](https://github.com/jdx/mise/pull/8489)

### New Contributors

- @ivy made their first contribution in [#8481](https://github.com/jdx/mise/pull/8481)
- @iki made their first contribution in [#8424](https://github.com/jdx/mise/pull/8424)

### πŸ“¦ Aqua Registry Updates

#### New Packages (5)

- [`datadog-labs/pup`](https://github.com/datadog-labs/pup)
- [`k1LoW/mo`](https://github.com/k1LoW/mo)
- [`rtk-ai/rtk`](https://github.com/rtk-ai/rtk)
- [`suzuki-shunsuke/docfresh`](https://github.com/suzuki-shunsuke/docfresh)
- [`yashikota/exiftool-go`](https://github.com/yashikota/exiftool-go)

#### Updated Packages (6)

- [`cloudflare/cloudflared`](https://github.com/cloudflare/cloudflared)
- [`mozilla/sccache`](https://github.com/mozilla/sccache)
- [`owenlamont/ryl`](https://github.com/owenlamont/ryl)
- [`spinel-coop/rv`](https://github.com/spinel-coop/rv)
- [`technicalpickles/envsense`](https://github.com/technicalpickles/envsense)
- [`weaviate/weaviate`](https://github.com/weaviate/weaviate)

## [2026.3.3](https://github.com/jdx/mise/compare/v2026.3.2..v2026.3.3) - 2026-03-04

### πŸ› Bug Fixes
Expand Down
4 changes: 2 additions & 2 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ members = [

[package]
name = "mise"
version = "2026.3.3"
version = "2026.3.4"
edition = "2024"
description = "The front-end to your dev env"
authors = ["Jeff Dickey (@jdx)"]
Expand Down
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ $ ~/.local/bin/mise --version
/ / / / / / (__ ) __/_____/ __/ / / /_____/ /_/ / / /_/ / /__/ __/
/_/ /_/ /_/_/____/\___/ \___/_/ /_/ / .___/_/\__,_/\___/\___/
/_/ by @jdx
2026.3.3 macos-arm64 (2026-03-04)
2026.3.4 macos-arm64 (2026-03-07)
```

Hook mise into your shell (pick the right one for your shell):
Expand Down
2 changes: 1 addition & 1 deletion completions/_mise
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ _mise() {
return 1
fi

local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_3.spec"
local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_4.spec"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The completion script uses a predictable filename in a world-writable directory (/tmp or $TMPDIR) to store a spec file. This is vulnerable to a local symlink attack, where an attacker could create a symlink at this path pointing to a sensitive file, causing mise usage to overwrite it when completions are triggered. Consider using a user-specific directory like ~/.cache/mise/completions instead.

if [[ ! -f "$spec_file" ]]; then
mise usage >| "$spec_file"
fi
Expand Down
2 changes: 1 addition & 1 deletion completions/mise.bash
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ _mise() {

local cur prev words cword was_split comp_args
_comp_initialize -n : -- "$@" || return
local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_3.spec"
local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_4.spec"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The completion script uses a predictable filename in a world-writable directory (/tmp or $TMPDIR) to store a spec file. This is vulnerable to a local symlink attack, where an attacker could create a symlink at this path pointing to a sensitive file, causing mise usage to overwrite it when completions are triggered. Consider using a user-specific directory like ~/.cache/mise/completions instead.

if [[ ! -f "$spec_file" ]]; then
mise usage >| "$spec_file"
fi
Expand Down
2 changes: 1 addition & 1 deletion completions/mise.fish
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ if ! type -p usage &> /dev/null
return 1
end
set -l tmpdir (if set -q TMPDIR; echo $TMPDIR; else; echo /tmp; end)
set -l spec_file "$tmpdir/usage__usage_spec_mise_2026_3_3.spec"
set -l spec_file "$tmpdir/usage__usage_spec_mise_2026_3_4.spec"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The completion script uses a predictable filename in a world-writable directory (/tmp or /tmp by default) to store a spec file. This is vulnerable to a local symlink attack, where an attacker could create a symlink at this path pointing to a sensitive file, causing mise usage to overwrite it when completions are triggered. Consider using a user-specific directory like ~/.cache/mise/completions instead.

if not test -f "$spec_file"
mise usage | string collect > "$spec_file"
end
Expand Down
2 changes: 1 addition & 1 deletion completions/mise.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Register-ArgumentCompleter -Native -CommandName 'mise' -ScriptBlock {
param($wordToComplete, $commandAst, $cursorPosition)

$tmpDir = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
$specFile = Join-Path $tmpDir "usage__usage_spec_mise_2026_3_3.kdl"
$specFile = Join-Path $tmpDir "usage__usage_spec_mise_2026_3_4.kdl"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The completion script uses a predictable filename in a temporary directory to store a spec file. This is vulnerable to a local symlink attack, where an attacker could create a symlink at this path pointing to a sensitive file, causing mise usage to overwrite it when completions are triggered. Consider using a user-specific directory like ~/.cache/mise/completions instead.


if (-not (Test-Path $specFile)) {
mise usage | Out-File -FilePath $specFile -Encoding utf8
Expand Down
2 changes: 1 addition & 1 deletion crates/aqua-registry/Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "aqua-registry"
version = "2026.3.0"
version = "2026.3.1"
edition = "2024"
description = "Aqua registry backend for mise"
authors = ["Jeff Dickey (@jdx)"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,62 @@ packages:
- type: github_release
repo_owner: cloudflare
repo_name: cloudflared
description: cloudflared connects your machine or user identity to Cloudflare's global network
rosetta2: true
supported_envs:
- darwin
- linux
- amd64
asset: cloudflared-{{.OS}}-{{.Arch}}
overrides:
- goos: darwin
asset: cloudflared-{{.OS}}-{{.Arch}}.tgz
description: Cloudflare Tunnel client
version_constraint: "false"
version_overrides:
- version_constraint: semver("<= 2021.3.4")
error_message: This version is too old. Please update.
- version_constraint: Version in ["2021.6.0"]
asset: cloudflared-{{.OS}}-{{.Arch}}
format: raw
windows_arm_emulation: true
supported_envs:
- linux
- windows/amd64
- version_constraint: Version == "2021.8.0"
asset: cloudflared-{{.OS}}-{{.Arch}}
format: raw
rosetta2: true
windows_arm_emulation: true
overrides:
- goos: linux
replacements:
arm64: arm
- goos: darwin
format: tgz
asset: cloudflared-{{.OS}}-{{.Arch}}.{{.Format}}
- version_constraint: Version in ["2021.8.5", "2021.10.2"]
asset: cloudflared-{{.OS}}-{{.Arch}}
format: raw
windows_arm_emulation: true
supported_envs:
- linux
- windows/amd64
- version_constraint: Version == "2022.12.0"
asset: cloudflared-{{.OS}}-{{.Arch}}.{{.Format}}
format: tgz
rosetta2: true
overrides:
- goos: linux
format: raw
asset: cloudflared-{{.OS}}-{{.Arch}}
supported_envs:
- linux
- darwin
- version_constraint: semver("<= 2024.6.1")
asset: cloudflared-{{.OS}}-{{.Arch}}
format: raw
rosetta2: true
windows_arm_emulation: true
overrides:
- goos: darwin
format: tgz
asset: cloudflared-{{.OS}}-{{.Arch}}.{{.Format}}
- version_constraint: "true"
asset: cloudflared-{{.OS}}-{{.Arch}}
format: raw
windows_arm_emulation: true
overrides:
- goos: darwin
format: tgz
asset: cloudflared-{{.OS}}-{{.Arch}}.{{.Format}}
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/registry.json
packages:
- type: github_release
repo_owner: datadog-labs
repo_name: pup
description: Give your AI agent a Pup β€” a CLI companion with 200+ commands across 33+ Datadog products
version_constraint: "false"
version_overrides:
- version_constraint: semver("<= 0.21.0")
asset: pup_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
format: tar.gz
windows_arm_emulation: true
replacements:
amd64: x86_64
darwin: Darwin
linux: Linux
windows: Windows
checksum:
type: github_release
asset: pup_{{trimV .Version}}_checksums.txt
algorithm: sha256
- version_constraint: "true"
asset: pup_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
format: tar.gz
replacements:
amd64: x86_64
darwin: Darwin
linux: Linux
checksum:
type: github_release
asset: pup_{{trimV .Version}}_checksums.txt
algorithm: sha256
cosign:
opts:
- --certificate-identity-regexp
- "^https://github\\.com/datadog-labs/pup/\\.github/workflows/.+\\.ya?ml@refs/tags/\\Q{{.Version}}\\E$"
- --certificate-oidc-issuer
- https://token.actions.githubusercontent.com
bundle:
type: github_release
asset: pup_{{trimV .Version}}_checksums.txt.sigstore.json
supported_envs:
- linux
- darwin
19 changes: 19 additions & 0 deletions crates/aqua-registry/aqua-registry/pkgs/k1LoW/mo/registry.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/registry.json
packages:
- type: github_release
repo_owner: k1LoW
repo_name: mo
description: mo is a Markdown viewer that opens .md files in a browser
version_constraint: "false"
version_overrides:
- version_constraint: "true"
asset: mo_{{.Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
format: tar.gz
windows_arm_emulation: true
checksum:
type: github_release
asset: checksums.txt
algorithm: sha256
overrides:
- goos: darwin
format: zip
Loading
Loading