# Why
We've encountered a need for showing a field from the not-authorized entity in the user facing error message. While we explicitly didn't pass this in the past since it's not authorized, upon second thought and the concrete use case it should be okay since this is only able to be used within the error message. While it is technically possible to leak unauthorized data this way, the variable name and docblock should at least hint that it's not authorized and caution should be used.
# How
Add entity and evaluation context params to the message fn.
# Test Plan
Run updated tests.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | digest | `74935e7` → `edb0c08` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `2c2dff7` → `97ec881` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | patch | `v2026.10.15` → `v2026.10.19` |
---
### Release Notes
<details>
<summary>jdx/mise</summary>
### [`v2026.10.19`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.19): : Security hardening across trust, installs and provenance; lockfiles now rebuilt completely by default
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.18...vfox-v2026.10.19)
Most of this release closes ways an untrusted repository, download host or mirror could run code, leak credentials or get around verification. Some of these fixes make mise stricter, so check **Breaking Changes** before you upgrade. Also in this release: `lockfile_mode = "generate"` is now the default, `mise lsp` sends semantic highlighting, and there is a new `{{ mise_config_dir }}` template variable.
#### Highlights
- **Trust is narrower and tied to the files you trusted.** Help output, shims, hooks, config writes and shell completion no longer trust a project or run its code without your consent. Trust also follows worktrees, symlinks and config directories correctly, and safe mode closes several more gaps.
- **Verification fails closed.** Pinned checksums, Node signatures, SLSA provenance (including the tag it was built from) and GitHub attestations are now enforced. Before, a 404 or a missing file could make mise skip them.
- **Hostile inputs are contained.** Archives, asset names, versions, lockfiles and HTTP responses can no longer write outside their directories, use unbounded memory or disk, or hang the prompt. Credentials no longer show up in install paths, lockfiles, logs or redirects.
#### Added
- **`{{ mise_config_dir }}` template variable.** It resolves to the config directory mise itself uses: `MISE_CONFIG_DIR`, or else `xdg_config_home` + `/mise`. It is available wherever `xdg_config_home` is: config templates, `.miserc.toml` and settings paths. This is useful for dotfiles variants that link into `conf.d`. [#​14886](https://redirect.github.com/jdx/mise/pull/14886) ([@​jdx](https://redirect.github.com/jdx), [@​ponko2](https://redirect.github.com/ponko2))
```toml
[dotfiles."git-tools"]
source = "git"
mode = "symlink"
variants = [{ default = true, target = "{{ mise_config_dir }}/conf.d/git-tools" }]
```
- **Semantic highlighting in `mise lsp`.** Editors can now color task names, tools, env vars, `[vars]` keys, `_.` directives, `{{ }}`/`{% %}`/`{# #}` template delimiters and deprecated keys in `mise.toml`. To turn it off, pass `{"semanticTokens": false}` in `initializationOptions`. [#​14918](https://redirect.github.com/jdx/mise/pull/14918) ([@​jdx](https://redirect.github.com/jdx))
- **`extract_max_ratio` setting (global only).** It caps how far an archive may expand during extraction. See Security below. [#​14915](https://redirect.github.com/jdx/mise/pull/14915) ([@​jdx](https://redirect.github.com/jdx))
- **`github.enterprise_hosts` setting (global only, `MISE_GITHUB_ENTERPRISE_HOSTS`).** It lists the GitHub Enterprise hosts that receive the GitHub token on `/api/v3` URLs over https. [#​14913](https://redirect.github.com/jdx/mise/pull/14913) ([@​jdx](https://redirect.github.com/jdx))
- **New vfox attestation fields `slsa_source_repository` and `slsa_source_tag`.** Plugins can use them to pin the repository and tag that SLSA provenance must come from. [#​14904](https://redirect.github.com/jdx/mise/pull/14904), [#​14924](https://redirect.github.com/jdx/mise/pull/14924) ([@​jdx](https://redirect.github.com/jdx))
#### Changed
- **`lockfile_mode = "generate"` is now the default.** Installs now rebuild `mise.lock` from the current requests, reuse unchanged entries and also lock the other platforms. A lockfile committed from one machine therefore no longer fails `mise install --locked` on another platform because of missing entries. Neither mode creates a lockfile (use `mise lock` or `lockfile = true`), and the lockfile format is unchanged. To keep the previous behavior, set `lockfile_mode = "merge"` or `MISE_LOCKFILE_MODE=merge`. [#​14893](https://redirect.github.com/jdx/mise/pull/14893) ([@​jdx](https://redirect.github.com/jdx))
#### Security
**Trust and safe mode**
- Several actions no longer count as consent to trust a project: printing `mise run --help`/`mise watch --help`, running a shim, a hook starting `mise run`, an MCP call, or `mise set`/`unset`/`tasks add` saving config. Config writes now ask before they trust an untrusted sibling config. A task counts as trusted only if every config that adds to it is trusted. The MCP server refuses untrusted file tasks, task names that look like file paths, and inline tool options. [#​14903](https://redirect.github.com/jdx/mise/pull/14903) ([@​jdx](https://redirect.github.com/jdx))
- Trust now stays with the files you trusted. A forged git worktree, a symlink to your global config, a clone named `.mise`, or a project `.miserc.toml` can no longer borrow trust or hide global config. In paranoid mode, idiomatic version files, each local task file and project-named aqua registries need trust of their own. Remote git includes pinned to a commit SHA must check out exactly that commit. [#​14902](https://redirect.github.com/jdx/mise/pull/14902) ([@​jdx](https://redirect.github.com/jdx))
- Safe mode (`MISE_SAFE=1`) now also blocks:
- a project's lazy tools, `[deps]`, `path:` versions and spm `install_command`;
- all S3 requests;
- forge tokens and netrc credentials sent to hosts that project config names;
- `env` and filesystem helpers in project templates.
In every mode, a project `.miserc.toml` gets a restricted, size-limited template language, and `bin_path` must stay inside the tool's install directory. [#​14900](https://redirect.github.com/jdx/mise/pull/14900) ([@​jdx](https://redirect.github.com/jdx))
- Pressing TAB no longer runs untrusted task code. The dynamic completers (`complete run=`, `complete delegate=`, `choices run=`, `mount`) only run for trusted config. mise's own completers quote typed words, and control characters are removed from candidates. Quoting for fish and PowerShell is also fixed. [#​14898](https://redirect.github.com/jdx/mise/pull/14898) ([@​jdx](https://redirect.github.com/jdx))
- Hook commands are now rendered once, when they load. Before, a directory name containing `{{ exec(...) }}` could run code from a `cd` hook. A project's `enter`, `leave` and `watch_files` hooks now start in the project root. `mise use`, `mise upgrade --bump` and every other writer refuse to write a version containing template syntax, and a rewritten option keeps its `{{ env.X }}` template instead of the rendered secret. [#​14897](https://redirect.github.com/jdx/mise/pull/14897) ([@​jdx](https://redirect.github.com/jdx))
- `cd`-ing into a hostile repository can no longer hang or crash `hook-env` or make mise print files from outside the repo. Causes this covers include configs linked to devices, symlink mazes in task directories, non-UTF-8 paths, oversized files, glob characters in paths, and version files that link to another file. [#​14916](https://redirect.github.com/jdx/mise/pull/14916) ([@​jdx](https://redirect.github.com/jdx))
**Install verification**
- A checksum pinned in `mise.lock` is now enforced for erlang, npm, spm and http instead of being replaced or skipped. If Node's `SHASUMS256.txt.sig` is missing, the install fails. bun and deno check the publisher's sha256 when there is no lock entry. A locked node or spm artifact that returns 404 no longer silently falls back to a source build. [#​14899](https://redirect.github.com/jdx/mise/pull/14899) ([@​jdx](https://redirect.github.com/jdx))
- SLSA, attestation and signed-checksum checks now fail closed:
- the provenance file can no longer stand in for the artifact;
- `slsa_signer_*` pins require provenance;
- `mise lock` runs the cosign, minisign and SLSA checks that aqua recipes declare;
- SHA-512 signed checksum files are compared with the artifact;
- aqua honors `attestations_since`.
[#​14908](https://redirect.github.com/jdx/mise/pull/14908) ([@​jdx](https://redirect.github.com/jdx))
- The SLSA signing run must come from the workflow's repository or the tool's own repository. Attestations must name the requested repository. Public-good bundles without a Rekor entry are rejected. [#​14904](https://redirect.github.com/jdx/mise/pull/14904) ([@​jdx](https://redirect.github.com/jdx))
- SLSA provenance built from a different tag is now rejected, so a mirror can't serve an older release's genuine artifact and provenance as a newer version. [#​14924](https://redirect.github.com/jdx/mise/pull/14924) ([@​jdx](https://redirect.github.com/jdx))
- packslip signer pins are checked by repository ID, including `workflow` pins. Backdated GitLab `released_at` dates and bundles with no transparency-log time can no longer get around `minimum_release_age`. [#​14912](https://redirect.github.com/jdx/mise/pull/14912) ([@​jdx](https://redirect.github.com/jdx))
**Paths, subprocesses and resource limits**
- Release asset names must be plain file names. Archives from the github, http, aqua, cargo-binstall, packslip and vfox backends may not contain symlinks that point outside the install directory. [#​14895](https://redirect.github.com/jdx/mise/pull/14895) ([@​jdx](https://redirect.github.com/jdx))
- Resolved versions, plugin names and task stub names are checked before they become paths or URL segments. A remote version containing `..`, quotes, `$` or a leading `-` now fails as an invalid tool version. [#​14901](https://redirect.github.com/jdx/mise/pull/14901) ([@​jdx](https://redirect.github.com/jdx))
- Git lookups, build tools (ruby-build, python-build, `cargo install`, `gem install`) and npm now run outside the project directory, so the repo's `.git/config` and other project files can't change what they do. Untrusted values are kept out of their command-line arguments. In safe mode, asdf `exec-env` is refused. [#​14896](https://redirect.github.com/jdx/mise/pull/14896) ([@​jdx](https://redirect.github.com/jdx))
- Committed symlinks around lockfiles, tool stubs and the remote task cache can no longer make mise read, write or delete files outside the repo. An untrusted lockfile still pins versions and checksums, but it can no longer switch a tool's backend, add inline options or supply download URLs. [#​14906](https://redirect.github.com/jdx/mise/pull/14906) ([@​jdx](https://redirect.github.com/jdx))
- The task sandbox has fewer escapes:
- `--allow-write` refuses project symlinks that lead outside the project;
- `--deny-net` also blocks other socket families, io_uring and x32 syscalls;
- an empty `allow_write` blocks all writes instead of turning the sandbox off;
- macOS always uses `/usr/bin/sandbox-exec`;
- OCI whiteouts can't delete through planted symlinks.
[#​14911](https://redirect.github.com/jdx/mise/pull/14911) ([@​jdx](https://redirect.github.com/jdx))
- HTTP response bodies are capped at 128 MiB, and slow bodies are bounded by `http_download_timeout`. Downloads are saved exactly as sent. Archive extraction stops once the output exceeds both 256 MiB and 100 times the download size (`extract_max_ratio`). [#​14915](https://redirect.github.com/jdx/mise/pull/14915) ([@​jdx](https://redirect.github.com/jdx))
**Credentials**
- The GitHub token is sent only to GitHub API hosts or the configured `api_url`, not to any host that serves `/api/v3`. Release caches are keyed by the exact repository. A download that fails its pinned checksum is not kept. A project can no longer mark a task `global`. In safe mode, remote task files from project config are not fetched. [#​14913](https://redirect.github.com/jdx/mise/pull/14913) ([@​jdx](https://redirect.github.com/jdx))
- Credentials are now kept out of install directory names, install manifests, `mise.lock`, `Referer` headers, logs and error messages. Age keys and Forgejo tokens are redacted in `mise doctor`, `mise settings` and `mise tool`. Shebang task scripts are readable only by their owner, and multi-line secrets are redacted in task output. [#​14917](https://redirect.github.com/jdx/mise/pull/14917) ([@​jdx](https://redirect.github.com/jdx))
#### Fixed
- `uv_venv_auto` could fork-bomb the machine when uv probed mise's python shims while creating a venv. mise now skips venv creation when it is started from inside that venv creation. [#​14927](https://redirect.github.com/jdx/mise/pull/14927) ([@​jdx](https://redirect.github.com/jdx))
- With `minimum_release_age` set, `mise upgrade` no longer downgrades tools that use date versions with leading zeros (for example `2026.10.21` to `2026.08.19`). [#​14923](https://redirect.github.com/jdx/mise/pull/14923) ([@​jdx](https://redirect.github.com/jdx))
- File tasks that `extends` a task template now use the template's `usage` spec, so its flags show in `-h` and are accepted. [#​14888](https://redirect.github.com/jdx/mise/pull/14888) ([@​jdx](https://redirect.github.com/jdx))
- `mise tasks add --file` now quotes and escapes `#MISE` header values. Before, `--dir` and values containing quotes produced invalid TOML that broke the next `mise run`. [#​14925](https://redirect.github.com/jdx/mise/pull/14925) ([@​xucian](https://redirect.github.com/xucian))
- `mise uninstall` can now remove installs whose directories deny their owner write access, such as read-only `0555` runtime trees. [#​14883](https://redirect.github.com/jdx/mise/pull/14883) ([@​HengYangDS](https://redirect.github.com/HengYangDS))
- A `pypi:` tool with a private `git+ssh://` github.com source now lists versions through `git ls-remote` over SSH when GitHub can't see the repository. [#​14905](https://redirect.github.com/jdx/mise/pull/14905) ([@​jdx](https://redirect.github.com/jdx), [@​owpac](https://redirect.github.com/owpac))
#### Breaking Changes
Most setups need no changes. Check these cases:
- **Lockfiles:** installs now rewrite `mise.lock` in `generate` mode. To keep the old behavior, set `lockfile_mode = "merge"`.
- **Trust prompts:** `mise set`/`unset`/`tasks add` in a directory with an untrusted sibling config now ask for trust, or fail without a terminal. A project that has only a `mise-tasks/` directory needs `mise trust .` before its dynamic task completions work. In paranoid mode, run `mise trust <file>` once for each existing task file.
- **Worktrees and includes:** a worktree you moved by hand needs `git worktree repair` before it shares trust again. A remote include pinned to an annotated tag's object ID must pin the commit SHA instead. Your own `~/.miserc.toml` can no longer ignore the global config.
- **Project `.miserc.toml`:** templates that read `env` or use loops or functions other than `arch()`, `os()`, `os_family()`, `libc()`, `avx2()` and `num_cpus()` are no longer rendered. Move them to the global `.miserc.toml`.
- **Safe mode:** project templates that read an env var without a `default` now fail to render. Projects that point at a private forge or a netrc-protected server can no longer list versions there.
- **Node:** mirrors that don't copy the `.sig` files, and early releases without one (for example 4.0.0 and 5.12.0), need `node.gpg_verify = false`.
- **SLSA:** a `github:` tool that sets `slsa_signer_identity` but builds from a branch instead of a tag no longer verifies. A lock entry that has a checksum but no provenance installs on the checksum alone; re-run `mise lock` or set `locked_verify_provenance`.
- **packslip:** after a repository rename, a pin without a repository ID needs `mise packslip forget <tool>`.
- **GitHub Enterprise:** `http:` tools, aqua packages and remote tasks on `/api/v3` URLs no longer get the GitHub token automatically. Add the host to `github.enterprise_hosts` in global config, or set `api_url`.
- **Credentials in URLs:** `mise lock` refuses URLs whose query has a credential-like parameter. Use `headers` or netrc instead. Tools installed under a directory name that contained credentials are reinstalled under a clean name.
- **Task sandbox:** `--deny-write`/`allow_write` sandboxes no longer start on Linux before 6.2. Programs that need io_uring no longer run under `--deny-net`. To allow writes through a project symlink that points outside the project, name its target instead.
- **Archives:** archives that contain symlinks pointing outside the install directory fail to install (brew casks and aqua dmg/pkg are exempt). Archives that legitimately expand more than 100 times and past 256 MiB need a higher `extract_max_ratio`, or `0` to turn the check off.
- **Hooks:** a project's `enter`, `leave` and `watch_files` hooks now start in the project root. Use `$MISE_PROJECT_ROOT` if a hook needs the root explicitly.
- **Other changes:**
- `MISE_OVERRIDE_*_FILENAMES` entries are matched as literal file names;
- config, lock and task files over 16 MiB are refused;
- a `.tool-versions` or idiomatic version file that links to a file with a different name is skipped;
- a relative `go.repo` resolves from `$HOME`;
- a bare `OWNER/REPO` passed to `bootstrap --adopt` that matches a local path is an error (write `./OWNER/REPO` for the local path).
#### New Contributors
- [@​xucian](https://redirect.github.com/xucian) made their first contribution in [#​14925](https://redirect.github.com/jdx/mise/pull/14925)
- [@​HengYangDS](https://redirect.github.com/HengYangDS) made their first contribution in [#​14883](https://redirect.github.com/jdx/mise/pull/14883)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.18...v2026.10.19>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.18`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.18): : mise lsp: a language server for mise.toml
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.17...vfox-v2026.10.18)
mise now includes a language server, `mise lsp`, which gives editors diagnostics, completion, hover, navigation and quick fixes for `mise.toml`. Doctor checks can depend on other checks, and `mise dot history purge` erases a tracked file from dotfiles history. This release also fixes many lockfile, prune, Windows and dotfiles issues.
#### Added
- **`mise lsp`, a language server for mise config files.** It runs over stdin/stdout, so any editor with an LSP client can use it (Neovim, Helix, Emacs, Zed, VS Code, ...). It uses the schema and formatter of the installed mise, so its answers match your version. [#​14744](https://redirect.github.com/jdx/mise/pull/14744), [#​14808](https://redirect.github.com/jdx/mise/pull/14808), [#​14811](https://redirect.github.com/jdx/mise/pull/14811), [#​14812](https://redirect.github.com/jdx/mise/pull/14812) ([@​jdx](https://redirect.github.com/jdx))
- **Diagnostics:** TOML syntax errors, unknown keys with a "did you mean" suggestion, values of the wrong type, and deprecated keys. It warns about task references that point to no task and reports `depends` cycles as errors.
- **Completion and hover:** config keys and enum or boolean values, task names in `depends`, `depends_post`, `wait_for`, `run = [{ task = ... }]` and `extends`, and tool names from the registry under `[tools]`. Hover shows the description and backends of a tool, or the description and command of a task.
- **Navigation and editing:** go to a task's definition (also in included files), find its references, and rename a task together with every reference in the file. Quick fixes replace an unknown key or task name, and rewrite a deprecated key such as `env_path` to the key that replaces it. Formatting gives the same output as `mise fmt`.
- It only handles files that mise loads as configs (`mise.toml`, `mise.<env>.toml`, `conf.d/*.toml`, ...) and ignores `Cargo.toml`, `pyproject.toml` and other TOML files, so you can attach it to the TOML filetype. Configs are parsed but never rendered, and it makes no network requests, so opening an untrusted file runs nothing. Clients can turn off `formatting`, `hover`, `completion`, `definition`, `references` or `rename` with `initializationOptions`.
```lua
vim.lsp.config("mise", { cmd = { "mise", "lsp" }, filetypes = { "toml" }, root_markers = { "mise.toml" } })
vim.lsp.enable("mise")
```
- **Doctor checks can depend on other checks.** Add `depends` (a single name or a list) to a check in `[doctor.checks.*]`. If a dependency fails, errors, is skipped or is blocked, the dependent check is reported as `blocked`, and its command and hint are skipped. A `blocked` result does not change the exit code on its own. An unknown dependency name or a cycle is reported as a config error, and then no checks run. [#​14773](https://redirect.github.com/jdx/mise/pull/14773) ([@​jdx](https://redirect.github.com/jdx))
```toml
[doctor.checks."examplectl:project"]
depends = ["examplectl:auth"]
run = 'test -n "$(examplectl config get project)"'
```
- **`mise dot history purge <path>` removes a tracked path from local dotfiles history.** Use it after tracking a secret by mistake. Checkpoints that changed only that path are removed. All other checkpoints keep their numeric IDs, messages and dates, so `history`, `rollback` and `undo` keep working. Use `--dry-run` to preview and `--yes` to skip the prompt. `--backup` keeps the old history under `refs/mise/purge-backup/`, and `--keep-objects` skips pruning. The command refuses if any version of the path is already reachable from the origin, because mise never force-pushes. [#​14831](https://redirect.github.com/jdx/mise/pull/14831) ([@​jdx](https://redirect.github.com/jdx))
- **A dotfiles variant's `target` can be a template**, so one shared config can link into locations that differ between machines. Only the variant `target` is rendered. Templates get the standard config context (`env`, `xdg_config_home`, `config_root`, ...), but `exec()` and `vars` are not available. The rendered path must be absolute or start with `~/`. [#​14856](https://redirect.github.com/jdx/mise/pull/14856) ([@​jdx](https://redirect.github.com/jdx), [@​ponko2](https://redirect.github.com/ponko2))
```toml
[dotfiles.examplectl]
source = "dotfiles/examplectl"
mode = "symlink"
variants = [{ default = true, target = "{{ xdg_config_home }}/examplectl" }]
```
- **`mise upgrade --bump --pin` writes resolved versions to config.** Requests such as `latest` or `20` become the exact version, for example `24.14.0`, even if the tool was already up to date. With the `pin` setting (`MISE_PIN=1`), a plain `mise upgrade --bump` now does the same. `--dry-run` shows what would change. [#​14791](https://redirect.github.com/jdx/mise/pull/14791) ([@​jdx](https://redirect.github.com/jdx))
- **`[bootstrap.hooks]` tables accept `run_windows`**, as tasks and `[hooks]` already do. On Windows it is used instead of `run`. A table with only `run_windows` does nothing on other platforms. [#​14851](https://redirect.github.com/jdx/mise/pull/14851) ([@​jdx](https://redirect.github.com/jdx))
- **Registry:** `goose-agent` (`aqua:aaif-goose/goose`), the Goose AI agent CLI. The installed binary is still named `goose`. [#​14822](https://redirect.github.com/jdx/mise/pull/14822) ([@​kwsantiago](https://redirect.github.com/kwsantiago))
#### Changed
- **`pin` now also affects a plain `mise upgrade --bump`.** If you have `pin` enabled, your next `mise upgrade --bump` rewrites non-exact requests such as `"22"` to exact versions such as `"22.1.0"`. Without `pin`, requests keep their precision as before. [#​14791](https://redirect.github.com/jdx/mise/pull/14791) ([@​jdx](https://redirect.github.com/jdx))
- **`mise unuse tool@version` only prunes the version you named.** It used to prune every unused version of the tool. If the named version is kept, mise now explains why, for example `[email protected].0 is kept: required by ~/proj/mise.toml`. `mise unuse node` without a version still prunes all unused versions of node. [#​14863](https://redirect.github.com/jdx/mise/pull/14863) ([@​jdx](https://redirect.github.com/jdx), [@​Strepto](https://redirect.github.com/Strepto))
#### Fixed
##### Lockfiles
- If a pipx tool selects its own Python (`python = "3.12"`), `mise use`, `mise up -l`, `mise lock pipx:...` and `mise lock python` now keep both that Python and the project's Python in `mise.lock`. Before, one entry was dropped and `mise install --locked` failed. [#​14794](https://redirect.github.com/jdx/mise/pull/14794) ([@​jdx](https://redirect.github.com/jdx), [@​AllDmeat](https://redirect.github.com/AllDmeat))
- `mise install tool@latest` no longer fails with "lockfile contains multiple resolutions" when nested configs pin different versions. The nearest lockfile now decides. [#​14818](https://redirect.github.com/jdx/mise/pull/14818) ([@​jdx](https://redirect.github.com/jdx))
- When a monorepo root config is in `.config/mise.toml`, the shared lockfile is now written to `.config/mise.lock` instead of `<root>/mise.lock`. [#​14860](https://redirect.github.com/jdx/mise/pull/14860) ([@​jdx](https://redirect.github.com/jdx), [@​fxsalazar](https://redirect.github.com/fxsalazar))
- `mise lock` for `pipx:` and `pypi:` tools now accepts PyPI simple indexes that respond with a PEP 691 `+html` content type, such as Azure Artifacts. [#​14852](https://redirect.github.com/jdx/mise/pull/14852) ([@​jdx](https://redirect.github.com/jdx), [@​alexanderlinne](https://redirect.github.com/alexanderlinne))
- Locked conda installs reuse cached downloads whose checksum is known, instead of downloading the package again. [#​14866](https://redirect.github.com/jdx/mise/pull/14866) ([@​zeitlinger](https://redirect.github.com/zeitlinger))
##### Install, upgrade and prune
- A project-level `[hooks].postinstall` now runs with the version that was just installed. Before, during `mise upgrade` of a fuzzy request such as `latest`, its `PATH` pointed at the old version. [#​14853](https://redirect.github.com/jdx/mise/pull/14853) ([@​jdx](https://redirect.github.com/jdx), [@​sam9191](https://redirect.github.com/sam9191))
- `mise prune` no longer aborts with "points to an unknown mise Python installation" when a pypi/pipx tool's receipt reaches mise's Python through a minor-version link such as `python/3.14`. [#​14857](https://redirect.github.com/jdx/mise/pull/14857), [#​14874](https://redirect.github.com/jdx/mise/pull/14874) ([@​jdx](https://redirect.github.com/jdx), [@​chancez](https://redirect.github.com/chancez))
- With `MISE_OVERRIDE_TOOL_VERSIONS_FILENAMES` set, tracked `.tool-versions` files are still loaded. Before, `mise prune` could remove versions that those projects still used. [#​14779](https://redirect.github.com/jdx/mise/pull/14779) ([@​jdx](https://redirect.github.com/jdx))
- `java = "latest"` now selects the newest installed build when two installed versions differ only after `+` (for example `+7` and `+101`). [#​14876](https://redirect.github.com/jdx/mise/pull/14876) ([@​jdx](https://redirect.github.com/jdx), [@​javabrett](https://redirect.github.com/javabrett))
- `gem:` installs and `bundle install` no longer fail when `mise` is not on `PATH`. This applies to Rubies installed with this release or later. [#​14850](https://redirect.github.com/jdx/mise/pull/14850) ([@​jdx](https://redirect.github.com/jdx), [@​fxsalazar](https://redirect.github.com/fxsalazar))
- packslip tools no longer warn on every `mise outdated` or `mise up` about skipping a version that is past the `minimum_release_age` cutoff when that version is already installed. [#​14835](https://redirect.github.com/jdx/mise/pull/14835) ([@​jdx](https://redirect.github.com/jdx), [@​alx-xo](https://redirect.github.com/alx-xo))
- Homebrew tap formulae that define their own `Requirement` classes no longer break `mise bootstrap packages apply`. mise does not enforce these requirements and logs a warning about them. [#​14807](https://redirect.github.com/jdx/mise/pull/14807) ([@​jdx](https://redirect.github.com/jdx))
- `mise oci build` images that include `rust` now contain a working `cargo` and `rustc`, with `CARGO_HOME` and `RUSTUP_HOME` set, so containers no longer download the toolchain again on first use. The build now fails if rust comes from a rustup that mise does not manage. [#​14854](https://redirect.github.com/jdx/mise/pull/14854) ([@​jdx](https://redirect.github.com/jdx), [@​eiswind](https://redirect.github.com/eiswind))
##### Network and backends
- In official rustls Linux builds, mise falls back to its bundled Mozilla root certificates, with a warning, when no system CA certificates can be loaded (for example in minimal containers, or when `SSL_CERT_FILE` points to a missing file). Roots that do load are not changed. [#​14817](https://redirect.github.com/jdx/mise/pull/14817) ([@​jdx](https://redirect.github.com/jdx))
- GitHub assets now download correctly when `.netrc` has credentials for `github.com`. The reachability check no longer sends those credentials, which had caused a fallback to the rate-limited API. [#​14786](https://redirect.github.com/jdx/mise/pull/14786) ([@​jdx](https://redirect.github.com/jdx))
- `github:` tools for which mise-versions returned an empty release list (such as `github:caarlos0/svu`) now fall back to paged listing, so their versions are found. [#​14877](https://redirect.github.com/jdx/mise/pull/14877) ([@​jdx](https://redirect.github.com/jdx))
- Expired glab OAuth2 tokens are now ignored instead of sent. This fixes `401 Unauthorized` errors when installing `gitlab:` tools from public projects. [#​14873](https://redirect.github.com/jdx/mise/pull/14873) ([@​jdx](https://redirect.github.com/jdx), [@​chung1905](https://redirect.github.com/chung1905))
##### Windows
- Zip archives that contain read-only files, such as the Flutter SDK, now extract without "Access is denied". [#​14869](https://redirect.github.com/jdx/mise/pull/14869) ([@​jdx](https://redirect.github.com/jdx), [@​akiWagashi](https://redirect.github.com/akiWagashi))
- uv-locked `pipx:` tools whose console script names end in `.py` (for example `pipx:clang-format`) now install. [#​14825](https://redirect.github.com/jdx/mise/pull/14825) ([@​jdx](https://redirect.github.com/jdx))
- In tasks, `run_windows = []` now skips the task on Windows instead of running `run`. [#​14859](https://redirect.github.com/jdx/mise/pull/14859) ([@​jdx](https://redirect.github.com/jdx))
##### Tasks, bootstrap and generate
- `mise tasks list` now works as an alias for `mise tasks ls`. If you have a task named `list`, that task still runs. [#​14878](https://redirect.github.com/jdx/mise/pull/14878) ([@​jdx](https://redirect.github.com/jdx), [@​mcstafford-git](https://redirect.github.com/mcstafford-git))
- `mise bootstrap` no longer fails when a namespaced task such as `system:bootstrap` exists but no task is named exactly `bootstrap`. [#​14858](https://redirect.github.com/jdx/mise/pull/14858) ([@​jdx](https://redirect.github.com/jdx))
- `mise generate install-script --write` and `mise generate task-stubs` now write files that end with a newline. Existing stubs regenerate as before. [#​14819](https://redirect.github.com/jdx/mise/pull/14819) ([@​itochan](https://redirect.github.com/itochan))
- `curl https://mise.run | sh` no longer fails when `~/.config/curlrc` sets `write-out`. [#​14830](https://redirect.github.com/jdx/mise/pull/14830) ([@​jdx](https://redirect.github.com/jdx))
##### Dotfiles
- A `mode = "track"` entry declared in a `config.<env>.toml` stays tracked on machines that don't select that env. Before, those machines published a removal of the entry. [#​14815](https://redirect.github.com/jdx/mise/pull/14815) ([@​jdx](https://redirect.github.com/jdx))
- One saved enrollment under a parent directory that is now a symlink no longer stops automatic capture for all other tracked paths. It is reported as invalid instead. [#​14871](https://redirect.github.com/jdx/mise/pull/14871) ([@​jdx](https://redirect.github.com/jdx))
- The JSON schema now declares the keys of `[dotfile_groups.<name>.entries]`, so strict validators such as Tombi accept valid entries and report unknown keys. [#​14810](https://redirect.github.com/jdx/mise/pull/14810) ([@​jdx](https://redirect.github.com/jdx))
##### Other
- The aqua registry built into mise is now encoded the same way on every build, so builds of the same source are reproducible. [#​14809](https://redirect.github.com/jdx/mise/pull/14809) ([@​jdx](https://redirect.github.com/jdx))
#### Performance
- mise now checks `trusted_config_paths` after the cheaper trust rules and resolves each entry at most once per process. This speeds up `hook-env` when entries are on slow mounts such as autofs `/home` on macOS. [#​14875](https://redirect.github.com/jdx/mise/pull/14875) ([@​jdx](https://redirect.github.com/jdx))
#### Documentation
- The dotfiles docs now explain repo-only files, how existing repos fit in, undoing an accidental track, and what `add --no-apply`, `dot diff` and `exclude` do. [#​14829](https://redirect.github.com/jdx/mise/pull/14829), [#​14862](https://redirect.github.com/jdx/mise/pull/14862) ([@​jdx](https://redirect.github.com/jdx))
#### New Contributors
- [@​kwsantiago](https://redirect.github.com/kwsantiago) made their first contribution in [#​14822](https://redirect.github.com/jdx/mise/pull/14822)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.17...v2026.10.18>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.17`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.17): : Shell names in bootstrap login_shell, templated doctor checks, and a per-plugin vfox cache directory
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.15...vfox-v2026.10.17)
`bootstrap.user.login_shell` now accepts a shell name such as `fish` instead of a full path. `[doctor.checks]` can use templates, and vfox backend plugins get their own cache directory. This release also fixes PATH handling in zsh setups that deduplicate PATH, stale task cache hits, a pipx interpreter mix-up on macOS, and removes trust in the compromised eMudhra CA certificates.
It also includes the changes prepared for 2026.10.16, which was tagged but never published: relative and templated `write_targets` paths, version aliases from vfox backend plugins, keyring passwords for private PyPI indexes, `vfox-backend:` packslip plugin sources, and a change to where `find_up` starts (see Changed and Upgrading).
#### Added
- **`[bootstrap.user].login_shell` accepts a shell name.** A config shared across machines no longer needs to know where each system installs the shell. mise looks up the name when it checks or applies the setting, which happens after `bootstrap.packages` has installed the shell. It searches `PATH` first (never the mise shims directory), then common package-manager locations: `/opt/homebrew/bin`, `/usr/local/bin`, `/home/linuxbrew/.linuxbrew/bin`, `~/.linuxbrew/bin`, `/usr/bin` and `/bin`. If no executable is found, `mise bootstrap user apply` fails without changing `/etc/shells` or the account, and `status` reports `not installed`. `mise bootstrap user status` shows the path it found, and `--json` output has a new `resolved` field. Absolute paths work as before. [#​14770](https://redirect.github.com/jdx/mise/pull/14770) ([@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"brew:fish" = "latest"
[bootstrap.user]
login_shell = "fish"
```
- **Doctor checks support templates.** `run`, `description` and `hint` in `[doctor.checks.*]` are rendered with the template context of the config file that declares them, the same way hooks are. A check can now use a value from `[vars]` instead of hard-coding it. `dir` is not rendered. If a template fails, only that check reports `ERROR` and the other checks still run. Text that already contains `{{` or `{%` in these fields is now parsed as a template. [#​14771](https://redirect.github.com/jdx/mise/pull/14771) ([@​jdx](https://redirect.github.com/jdx))
```toml
[doctor.checks."project-a:env"]
description = "project-a has a .env file"
run = 'test -f {{ vars.repos_dir | quote }}/project-a/.env'
hint = "cp {{ vars.repos_dir }}/project-a/.env.example {{ vars.repos_dir }}/project-a/.env"
```
- **vfox plugins get `RUNTIME.cacheDirPath`.** This is a cache directory for each plugin at `$MISE_CACHE_DIR/plugins/<plugin-name>`. mise creates it before running any hook, and every hook of the plugin sees the same path. Unlike `pluginDirPath`, it is kept when the plugin is reinstalled. `mise cache clear` deletes it, so plugins must handle it being missing. It is `nil` when no cache directory is available. [#​14776](https://redirect.github.com/jdx/mise/pull/14776) ([@​jdx](https://redirect.github.com/jdx))
- **`settings.write_targets` accepts relative and templated paths.** Before, only absolute or `~/` paths worked, so dotfiles shared between machines with different `MISE_CONFIG_DIR` or `XDG_CONFIG_HOME` had to hardcode the config directory. Templates are now rendered, and a relative result is joined to the `config_root` of the settings file that declares it. For a global file that is `$HOME`, so the portable spelling uses the file's own directory. The resolved path must still be a global config file that mise loads. If a template fails to render, mise warns, and `mise use --global` fails with "must resolve to an absolute path" instead of writing to the default file. [#​14742](https://redirect.github.com/jdx/mise/pull/14742) ([@​jdx](https://redirect.github.com/jdx))
```toml
# ~/.config/mise/conf.d/settings.toml
[settings.write_targets]
tools = "{{ config_source | dirname }}/tools.toml"
```
- **vfox backend plugins can report version aliases.** `BackendListVersions` can return an `aliases` table, so a registry's moving names resolve to real versions. Before, `"mise-ghcup:ghc" = "recommended"` passed the literal string to the plugin, installed into `installs/.../recommended`, never followed the tag when it moved, and showed `recommended` in `mise ls` and the lockfile. Now `ghc@recommended` resolves to `9.10.3`, installs into `9.10.3/`, and the lockfile records `9.10.3`. Aliases you define in config still win. They are cached like the version list, and an expired cache still answers offline. Older mise versions ignore the `aliases` field, so plugins can adopt it right away. [#​14732](https://redirect.github.com/jdx/mise/pull/14732) ([@​jdx](https://redirect.github.com/jdx), [@​cprecioso](https://redirect.github.com/cprecioso))
```lua
return {
versions = { "9.8.4", "9.10.3", "9.14.1" },
aliases = { recommended = "9.10.3" },
}
```
- **`mise lock` and version listing work with a PyPI index that uses a keyring.** With an index such as Azure Artifacts and `artifacts-keyring`, `mise install` worked because uv read the password from its keyring provider, but mise's own requests sent no credentials and failed with `401 Unauthorized`. Set the new `pypi.keyring_provider` (`disabled` by default, or `subprocess`; env var `MISE_PYPI_KEYRING_PROVIDER`) and give the registry URL a username without a password. mise then runs `keyring get <url> <username>`, as uv does, and sends the result as HTTP Basic credentials when it lists versions and when `mise lock` reads a release's `requires-python`. The password is never written to the lockfile or the version cache. The `keyring` executable must be on `PATH`. If it is missing or has no entry, mise sends the request without credentials. [#​14733](https://redirect.github.com/jdx/mise/pull/14733) ([@​jdx](https://redirect.github.com/jdx))
```toml
[settings.pypi]
keyring_provider = "subprocess"
registry_url = "https://[email protected]/org/project/_packaging/feed/pypi/simple/{}/"
```
- **`vfox-backend:` works as a prefix for packslip plugin sources.** A vfox backend plugin can be installed from a signed packslip archive, both from the CLI and in `[plugins]`. Before, `mise plugins install vfox-backend:foo 'packslip:owner/repo#1.0.0'` failed with `packslip plugin sources require the vfox plugin type`. An explicit `asdf:` or `package:` prefix is still rejected, and the error now says "vfox or vfox-backend". The archive still declares `extensions.mise.plugin = "vfox"`. [#​14727](https://redirect.github.com/jdx/mise/pull/14727) ([@​jdx](https://redirect.github.com/jdx))
```sh
mise plugins install vfox-backend:my-backend 'packslip:your-org/my-backend#1.0.0'
```
- `mise bootstrap packages list` is now an alias for `status`, alongside `ls`. [#​14709](https://redirect.github.com/jdx/mise/pull/14709) ([@​himkt](https://redirect.github.com/himkt))
#### Changed
- **`find_up` in `env._.file` starts at the config root.** Every other relative path in a config resolves against the config root, but `find_up` started at the current directory. A relative `find_up` path now starts at the config root and walks up through its parents, which suits a monorepo whose root `.env` applies to every package. An absolute path starts at its own directory. A global config that wants to search from wherever mise runs can use `cwd`. The `env_file` setting still discovers dotenv files up from the current directory and is unchanged. See Upgrading. [#​14734](https://redirect.github.com/jdx/mise/pull/14734) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
```toml
# ~/.config/mise/config.toml
[env]
_.file = { path = "{{cwd}}/.env", find_up = true }
```
- **`allow_builds` approves only the packages it lists.** With the embedded aube installer, `allow_builds = ["re2"]` also ran the install scripts of every package on aube's bundled trusted-dependencies list, such as `dtrace-provider`. For a package list, mise now turns that default list off, so only the packages you name build. `allow_builds = true` and the default with no option are unchanged. This updates the embedded aube to 2.8.0. [#​14731](https://redirect.github.com/jdx/mise/pull/14731) ([@​jdx](https://redirect.github.com/jdx))
#### Fixed
- `exec()` in `[env]` values, and other commands mise runs with the pre-activation environment, can now find commands in a `_.path` directory that was already on `PATH` before activation, even if the shell deduplicates `PATH` (for example zsh with `typeset -U path PATH`). [#​14772](https://redirect.github.com/jdx/mise/pull/14772) ([@​jdx](https://redirect.github.com/jdx))
- With `task.source_freshness_hash_contents = true`, a task now re-runs when a source file is changed to content of the same size and its old mtime is restored (for example by `rsync -a`, `cp -p` or `touch -r`). On Unix, mise now also compares the file's ctime. Cache entries written by older versions are rehashed once. [#​14778](https://redirect.github.com/jdx/mise/pull/14778) ([@​jdx](https://redirect.github.com/jdx))
- On macOS, `pipx:` installs no longer fail when `aqua:aws/aws-cli` is in the toolset. Because macOS filesystems ignore case by default, mise's lookup for `python` matched aws-cli's executable `Python` shared library and passed it to uv as the interpreter. This lookup now requires the exact case. [#​14769](https://redirect.github.com/jdx/mise/pull/14769) ([@​jdx](https://redirect.github.com/jdx))
- An aqua registry template with an unterminated string literal now fails with an "unterminated string literal" error instead of hanging. Escaped quotes after backslashes are also detected correctly. [#​14752](https://redirect.github.com/jdx/mise/pull/14752) ([@​Huge](https://redirect.github.com/Huge), [@​jdx](https://redirect.github.com/jdx))
- The built-in npm backend no longer trusts the eight eMudhra intermediate CA certificates whose private keys were compromised. The fix comes from updating its bundled root certificates (`webpki-root-certs` 1.0.10, `rustls-webpki` 0.103.16). Builds that use the OS trust store are fixed by OS updates instead. [#​14781](https://redirect.github.com/jdx/mise/pull/14781) ([@​jdx](https://redirect.github.com/jdx))
- A `[bootstrap.compose]` project no longer reports drift on every run when a service uses a `service:` reference such as `network_mode: service:vpn`. Compose hashes the reference as written but stamps the container with the hash of the resolved `container:<id>`, so the two never matched. mise now pins these references (`network_mode`, `ipc`, `pid`, `volumes_from`) to the running container before it asks compose for the hash. This needs an explicit `files` list in the project's config. Projects without one hash as before. [#​14729](https://redirect.github.com/jdx/mise/pull/14729) ([@​jdx](https://redirect.github.com/jdx))
- vfox plugins now keep symlinks when they extract `.zip` archives returned by `PreInstall`. Before, entries such as `bin/npm -> ../lib/node_modules/npm/bin/npm-cli.js` became regular files holding the link target, and the tool failed with `No such file or directory`. Links that resolve outside the install directory are still rejected. The `http:` backend and tarballs were not affected. [#​14730](https://redirect.github.com/jdx/mise/pull/14730) ([@​jdx](https://redirect.github.com/jdx))
- `[daemons.<name>] task = "worker"` now finds a file task such as `.mise/tasks/worker.sh`, as `mise run worker` does. Before, it failed with `daemon srv runs unknown task "worker"` unless you wrote `worker.sh`. [#​14741](https://redirect.github.com/jdx/mise/pull/14741) ([@​jdx](https://redirect.github.com/jdx))
- On Windows, `mise self-update` no longer replaces the winget `mise-shim.exe` link with a copy. It updates the real `mise-shim.exe` next to the real `mise.exe`. Before, `mise reshim` kept warning that the shim was older than mise. [#​14737](https://redirect.github.com/jdx/mise/pull/14737) ([@​jdx](https://redirect.github.com/jdx))
- An inherited `[dotfiles]` entry turned off with only `enabled = false` no longer prints `no recognized operation (block, source, or line), ignoring entry` on every command. Other tables with no recognized operation, such as a misspelled `line`, still warn. [#​14726](https://redirect.github.com/jdx/mise/pull/14726) ([@​jdx](https://redirect.github.com/jdx), [@​ponko2](https://redirect.github.com/ponko2))
#### Upgrading
- **`find_up` in a global config:** a relative `find_up` entry in `env._.file` used to search from the current directory. It now searches from the config root, which is `~` for a global config, so it no longer finds project files. To keep the old behavior, put `{{cwd}}/` in front of the path. `find_up` was added in 2026.10.12.
#### Documentation
- The dotfiles docs now explain that a group entry with only `permissions` does not inherit the group's `mode`, so it deploys nothing. Removing `mode` from an entry that used to deploy a file leaves that file orphaned, and `--prune` deletes it. To deploy a file and set its permissions, use `{ mode = "copy", permissions = "0600" }`. [#​14768](https://redirect.github.com/jdx/mise/pull/14768) ([@​jdx](https://redirect.github.com/jdx))
#### New Contributors
- [@​Huge](https://redirect.github.com/Huge) made their first contribution in [#​14752](https://redirect.github.com/jdx/mise/pull/14752)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.15...v2026.10.17>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | patch | `v2026.10.8` → `v2026.10.15` |
---
### Release Notes
<details>
<summary>jdx/mise</summary>
### [`v2026.10.15`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.15): : Default minimum_release_age covers every backend, plus a PowerShell installer
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.14...vfox-v2026.10.15)
The default 24-hour `minimum_release_age` now applies to every backend. Many more backends report release dates, so the cooldown can actually hold new versions back, and mise warns when it installs a version it couldn't date. This release also adds a PowerShell installer for Windows, `read_json`/`read_yaml`/`read_toml` template functions, `dotnet@lts`/`dotnet@sts`, and new dotfiles options.
#### Changed
- **The default `minimum_release_age` applies to every backend.** The built-in 24h cooldown used to cover only backends that reported release dates (aqua, cargo, core, github, npm, pypi and others). asdf, vfox, conda, dotnet, `http:` and `s3:` tools had no cutoff at all. Now every backend gets the cooldown. A tool whose only version is less than 24h old now resolves to "no versions found", as aqua and github tools already did. To opt a tool out, add it to `minimum_release_age_excludes`. To turn the cooldown off, set `minimum_release_age = "0s"`. [#​14701](https://redirect.github.com/jdx/mise/pull/14701) ([@​jdx](https://redirect.github.com/jdx))
- **mise warns when it can't check a version's release date.** A version with no known date still passes the cutoff, but `mise install`, `mise upgrade` and `mise use` now print a one-time warning naming the version. Exact pins you wrote yourself don't trigger it. `mise env`, `mise ls`, `mise outdated` and `mise ls-remote` never print it. [#​14694](https://redirect.github.com/jdx/mise/pull/14694) ([@​jdx](https://redirect.github.com/jdx))
```
WARN asdf:[email protected] has no release date, so the ... cutoff cannot be checked and it is allowed (exclude it with minimum_release_age_excludes to silence this)
```
- **More backends report release dates, so the cooldown applies to them:**
- conda versions use the channel's earliest index timestamp. [#​14693](https://redirect.github.com/jdx/mise/pull/14693)
- aqua packages that take versions from git tags (`version_source: github_tag`, such as `aws/aws-cli`, `docker/cli` and `cockroachdb/cockroach`) are now dated. [#​14691](https://redirect.github.com/jdx/mise/pull/14691)
- dotnet dates come from Microsoft's releases index. deno and erlang dates come from their GitHub releases. [#​14692](https://redirect.github.com/jdx/mise/pull/14692)
- Every python version now has a date, and so do many more ruby versions (from ruby-lang.org, Maven Central for JRuby, and GitHub for TruffleRuby). Rust's `stable`, `beta` and `nightly` channels are dated too. With an explicit past cutoff, `rust@stable` resolves to the newest stable release that is old enough, and `beta`/`nightly` resolve to a dated build from before the cutoff. [#​14697](https://redirect.github.com/jdx/mise/pull/14697)
- The dart, flutter, nim, julia, nomad-pack, sentinel, tfc-agent, android-cli, cursor-agent and twg registry tools now report dates. [#​14698](https://redirect.github.com/jdx/mise/pull/14698)
All by [@​jdx](https://redirect.github.com/jdx).
- **Version lists for more backends come from the mise-versions host.** `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, `dotnet:` and `spm:` tools now list versions from mise-versions, like other registry tools, instead of going to their own source. So do http/s3 tools with a `version_list_url`. If you redirect a source, mise still lists from that source directly. That covers a custom npm registry or `npm.shell_out`, `pypi.registry_url`, a non-default `GOPROXY`, `cargo.registry_name`, a custom gem source, `dotnet.registry_url`, S3 endpoint overrides, and local listing options. conda always lists from its channel. The host cache TTL now follows the tool's `minimum_release_age`. To list everything from the source, set `MISE_USE_VERSIONS_HOST=0`. [#​14700](https://redirect.github.com/jdx/mise/pull/14700) ([@​jdx](https://redirect.github.com/jdx))
#### Added
- **PowerShell installer for Windows.** It's published with each release as `install.ps1` and served from mise.run at `/powershell` and `/pwsh`, so you pipe it into `iex` with `irm`. It works on PowerShell 5.1+ and doesn't need admin rights. It installs the newest release that is at least 24h old, or `MISE_VERSION` if set. The download is verified against `SHASUMS256.txt` from GitHub Releases. `mise.exe` and `mise-shim.exe` go into `~\.local\bin`, and that directory is added to your user `Path`. Re-running it upgrades an existing install. Options include `MISE_INSTALL_PATH`, `MISE_INSTALL_MODIFY_PATH=0`, `MISE_INSTALL_SHIMS_PATH=1` and `MISE_INSTALL_FROM_GITHUB=1`. See the "Installing mise" docs for the full command. [#​14660](https://redirect.github.com/jdx/mise/pull/14660) ([@​jdx](https://redirect.github.com/jdx), [@​lhs-12](https://redirect.github.com/lhs-12))
- **`read_json()`, `read_yaml()` and `read_toml()` template functions** parse a file so a template can use a value from it. This saves copying a version from `package.json` or `Pulumi.yaml` into `mise.toml` by hand. Relative paths resolve from the config file's directory. A missing key is an error unless you add `| default(value="...")`. Like `read_file()`, these functions need a trusted config, and they don't work in safe mode, `.miserc.toml` or OCI dotfile templates. [#​14705](https://redirect.github.com/jdx/mise/pull/14705) ([@​jdx](https://redirect.github.com/jdx), [@​edahlseng](https://redirect.github.com/edahlseng))
```toml
[tools]
node = "{{ read_json(path='package.json')['volta']['node'] }}"
pulumi = "{{ read_yaml(path='Pulumi.yaml')['requiredPulumiVersion'] }}"
```
- **`dotnet@lts` and `dotnet@sts`** resolve to the newest SDK in the current LTS or STS channel, using Microsoft's release index. Preview, go-live and end-of-life channels are skipped. A `lts` alias you define in `[tool_alias.dotnet.versions]` still takes precedence. Runtime-only installs still need an exact version. [#​14683](https://redirect.github.com/jdx/mise/pull/14683) ([@​jdx](https://redirect.github.com/jdx))
- **`mise bootstrap --prune-dotfiles`** removes dotfiles that are no longer deployed, the same way `mise dot apply --prune` does, so `mise bootstrap --upgrade --prune-dotfiles` handles everything in one run. The prune runs at the end of the dotfiles phase. It respects `--dry-run`, `--yes` and `--skip dotfiles`. Copies you edited are left in place. [#​14681](https://redirect.github.com/jdx/mise/pull/14681) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
- **`dotfiles.windows_symlinks`** (default `false`) makes `symlink` and `symlink-each` create real file symlinks on Windows. With it on, apply fails if Windows refuses to create a link, instead of silently copying. To create symlinks, Windows needs Developer Mode or an elevated shell. If you turn the setting back off, `mise dot unapply` needs `--force` on entries that still hold links. [#​14682](https://redirect.github.com/jdx/mise/pull/14682) ([@​jdx](https://redirect.github.com/jdx))
```toml
[settings.dotfiles]
windows_symlinks = true
```
- **`http:` tools can report release dates** with the new `version_date_expr` option. It maps versions to dates from the `version_list_url` response. Use `version_date_url` to read the dates from a different URL, and `version_date_next_expr` to follow paged listings (same host only). Dates can be RFC 3339, `YYYY-MM-DD` or HTTP dates. [#​14696](https://redirect.github.com/jdx/mise/pull/14696) ([@​jdx](https://redirect.github.com/jdx))
- **vfox plugins can report release dates.** An `Available` or `BackendListVersions` hook can return `created_at` (RFC 3339) for each version. Plain version strings still work. [#​14695](https://redirect.github.com/jdx/mise/pull/14695) ([@​jdx](https://redirect.github.com/jdx))
- `mise tasks -a` is a short alias for `mise tasks --all`. [#​14674](https://redirect.github.com/jdx/mise/pull/14674) ([@​williamsjokvist](https://redirect.github.com/williamsjokvist))
#### Fixed
- `mise fmt` no longer breaks multiline inline tables (TOML 1.1). It used to pull comments out of the table and drop indentation. Now it leaves these tables exactly as written. [#​14670](https://redirect.github.com/jdx/mise/pull/14670) ([@​jdx](https://redirect.github.com/jdx), [@​ponko2](https://redirect.github.com/ponko2))
- If one task's `dir` template fails to render, other task commands keep working. Before, every command failed, including `mise tasks validate`. Now `mise tasks validate` reports the broken task as `invalid-directory-template`, and only running that task fails. [#​14680](https://redirect.github.com/jdx/mise/pull/14680) ([@​jdx](https://redirect.github.com/jdx))
- aqua tools now find their binaries in macOS universal archives, such as fastfetch 2.70.0. [#​14665](https://redirect.github.com/jdx/mise/pull/14665) ([@​jdx](https://redirect.github.com/jdx))
- npm: lifecycle scripts approved by `allow_builds` now run even when `~/.npmrc` sets `ignore-scripts=true`. [#​14661](https://redirect.github.com/jdx/mise/pull/14661) ([@​jdx](https://redirect.github.com/jdx))
- npm: `mise lock` no longer fails when your aube config sets a different default lockfile, such as `pnpm-lock.yaml`. [#​14659](https://redirect.github.com/jdx/mise/pull/14659) ([@​jdx](https://redirect.github.com/jdx))
- `.7z` tool archives now extract when mise's data directory path contains `..`, for example in a localized mise setup. [#​14657](https://redirect.github.com/jdx/mise/pull/14657) ([@​jdx](https://redirect.github.com/jdx), [@​sevenc-nanashi](https://redirect.github.com/sevenc-nanashi))
- The `mise-shim.exe` in the Windows release now keeps its version tag, so `mise doctor` and `mise reshim --force` stop reporting it as outdated. The warning goes away after you update and run `mise reshim --force`. [#​14656](https://redirect.github.com/jdx/mise/pull/14656) ([@​jdx](https://redirect.github.com/jdx))
- On Windows, `symlink-each` dotfiles messages and dry-run previews now say the files were copied rather than symlinked. [#​14654](https://redirect.github.com/jdx/mise/pull/14654) ([@​jdx](https://redirect.github.com/jdx), [@​lhs-12](https://redirect.github.com/lhs-12))
- Rust: with a `RUSTUP_DIST_SERVER` mirror configured and GitHub unreachable, mise now lists the `stable`, `beta` and `nightly` channels instead of failing, so `rust@stable` installs through the mirror. [#​14662](https://redirect.github.com/jdx/mise/pull/14662) ([@​jdx](https://redirect.github.com/jdx))
- On Windows, `http:` installs of large archives no longer fail with "Access is denied" while antivirus is scanning the extracted files. mise now retries the final move for up to about a minute. [#​14703](https://redirect.github.com/jdx/mise/pull/14703) ([@​jdx](https://redirect.github.com/jdx))
#### Documentation
- New [mise.toml playground](https://mise.jdx.dev/configuration/playground.html): a schema-aware editor with hover help, completion and error checking. You can share a config as a link. Every `mise.toml` example in the docs now shows hover help on its keys. [#​14673](https://redirect.github.com/jdx/mise/pull/14673), [#​14686](https://redirect.github.com/jdx/mise/pull/14686) ([@​jdx](https://redirect.github.com/jdx))
- The [mise.toml reference](https://mise.jdx.dev/configuration/reference.html) is now a searchable key explorer grouped by topic. Each key shows its type, default and a real example. Nearly every key now has a description, and these also appear in `mise config explain`. [#​14687](https://redirect.github.com/jdx/mise/pull/14687), [#​14690](https://redirect.github.com/jdx/mise/pull/14690), [#​14688](https://redirect.github.com/jdx/mise/pull/14688) ([@​jdx](https://redirect.github.com/jdx))
- The fnox secrets page now covers setup, CI and migration. The dotnet page explains how private feeds authenticate. [#​14675](https://redirect.github.com/jdx/mise/pull/14675), [#​14679](https://redirect.github.com/jdx/mise/pull/14679) ([@​jdx](https://redirect.github.com/jdx))
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.14...v2026.10.15>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.14`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.14): : Global override config, mise config explain, and stricter tool option checks
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.13...vfox-v2026.10.14)
A global `config.override.toml` can now take precedence over project config, and `mise config explain` describes each key in a config file. Paranoid mode can be turned on per category, and in that mode dotenv files need their own content-bound trust. Installs now fail when a tool has an option its backend doesn't read, which affects existing configs (see Changed).
#### Added
- **Global override files.** `~/.config/mise/config.override.toml`, and `config.<env>.override.toml` for each `MISE_ENV`, rank above every project file, including `mise.local.toml` and `mise.<env>.toml`. This covers `[env]`, `[tools]`, `[settings]`, `[tasks]`, hooks and the other sections. Anything the override file doesn't set still comes from the project. mise never writes to these files by default. To write to one, pass `--override` to `use`, `unuse`, `set`, `unset`, `settings set|add|unset` or `config get|set`. A tool declared in an override file resolves from the global `mise.lock` and is exempt from the project's `--locked` check. If `MISE_GLOBAL_CONFIG_FILE` is set, override files are not loaded. `mise config ls` shows a `Tier` column and `mise doctor` labels the files. [#​14610](https://redirect.github.com/jdx/mise/pull/14610) ([@​jdx](https://redirect.github.com/jdx))
```toml
# ~/.config/mise/config.override.toml
[env]
AWS_PROFILE = "personal"
[tools]
node = "24"
```
- **`mise config explain [KEY]`** lists each key a config file sets, with its line number and its description from the schema. It flags unknown keys with a "did you mean" suggestion and marks deprecated keys. It reads the file as plain TOML, so it also works on a config mise refuses to load. Pass a key such as `tasks` to show only that section, `--json` for machine-readable output, and `--file`, `--global`, `--system` or `--override` to pick a file. [#​14642](https://redirect.github.com/jdx/mise/pull/14642) ([@​jdx](https://redirect.github.com/jdx))
- **Paranoid mode can be turned on per category.** `paranoid` now accepts a list of `config`, `env_files`, `plugins` and `provenance` in addition to `true`/`false`. `MISE_PARANOID=config,env_files` also works. `true` still turns on all four categories. An unknown category name is an error. [#​14609](https://redirect.github.com/jdx/mise/pull/14609) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
```toml
[settings]
paranoid = ["env_files"]
```
- **`env_file` takes several filenames**, for example `env_file = [".env", ".env.local"]` or `MISE_ENV_FILE=.env:.env.local`. The file nearest the current directory wins. Within one directory, a name later in the list wins. A single string still works. [#​14606](https://redirect.github.com/jdx/mise/pull/14606) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
- **A `find_up` entry in `env._.file` can search several names together.** Give one entry a `path` list, and mise searches directory by directory. The closest directory wins, then the later name within a directory. With two separate entries, a `.env.local` in a parent directory still overrides the project's `.env`. The docs now explain this difference and how `env_file` differs from `_.file`. [#​14620](https://redirect.github.com/jdx/mise/pull/14620), [#​14602](https://redirect.github.com/jdx/mise/pull/14602) ([@​jdx](https://redirect.github.com/jdx))
```toml
[env]
_.file = { path = [".env", ".env.local"], find_up = true }
```
- **`#MISE` headers in file tasks accept the same keys as `[tasks.<name>]`**, including `timeout`, `vars` and the `deny_*`/`allow_*` sandbox keys. Before, these keys were ignored with a warning. If one header value is invalid, mise warns and skips that key, and every other task still loads. An invalid `confirm` or `deny_*` value is still an error, so a typo can't remove a confirmation prompt or a sandbox restriction. Before, a template named with `extends` overrode a header's `silent`. Now the header's value wins. [#​14637](https://redirect.github.com/jdx/mise/pull/14637) ([@​jdx](https://redirect.github.com/jdx))
- **Interactive `mise.toml` reference** in the docs at [configuration/reference](https://mise.jdx.dev/configuration/reference.html). It lists every key with its type, choices and default, and you can filter keys and link to them directly. Plain Markdown copies are also published for agents. [#​14641](https://redirect.github.com/jdx/mise/pull/14641) ([@​jdx](https://redirect.github.com/jdx))
#### Changed
- **Installs fail on tool options the backend doesn't read.** Before, such options were silently ignored. A typo or a key meant for another backend now stops the install, and the error names the option: `cargo:eza: option 'asset_pattern' is not used by the cargo backend`. Keys under `platforms` are checked too. So far this applies to the cargo, conda, gem, github, gitlab, forgejo, go, http, npm, packslip, pipx, s3, spinel, spm and ubi backends. aqua, plugin and core-language tools are not checked. The npm backend accepts the `checksum` option that comes from a `packageManager` field in `package.json`. [#​14629](https://redirect.github.com/jdx/mise/pull/14629), [#​14655](https://redirect.github.com/jdx/mise/pull/14655) ([@​jdx](https://redirect.github.com/jdx))
- **Paranoid mode needs content-bound trust for env files.** In paranoid mode, files loaded through `_.file`, found by the `env_file` setting, or run by `_.source` each need their own trust. Editing one of these files revokes its trust. Before, trusting `mise.toml` also approved these files, and later edits went unchecked. Running `mise trust` with no path trusts the project's config and every env file it loads. The error names the file but prints none of its values. To exempt a file by path, add it to `trusted_config_paths` in your global config. With a category list, this check belongs to `env_files`. [#​14604](https://redirect.github.com/jdx/mise/pull/14604) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
- **More specific config error messages.**
- A warning about an unknown `mise.toml` key now gives the line and column, and suggests a close match, for example `mise.toml:5:1: settings.experimantal (did you mean experimental?)`. [#​14639](https://redirect.github.com/jdx/mise/pull/14639) ([@​jdx](https://redirect.github.com/jdx))
- A wrong value for a hook, a task `run`/`depends` entry or an `[env]` variable now says which forms are accepted, or names the unknown key. Before, the error was `data did not match any variant of untagged enum`. An unknown key in a `run` or `depends` table now gets a warning. Before, it was silently ignored. [#​14640](https://redirect.github.com/jdx/mise/pull/14640) ([@​jdx](https://redirect.github.com/jdx))
- **`[bootstrap.linux.firewall]` is validated on every OS.** macOS and Windows still skip the section at bootstrap time, but an invalid value such as `backend = "iptables"` is now an error there too. [#​14615](https://redirect.github.com/jdx/mise/pull/14615) ([@​jdx](https://redirect.github.com/jdx))
- **Editor schema updates.** Editors now flag unknown keys in most `[bootstrap]` tables and in `[dotfiles]` entries. The schema now documents launchd `keep_alive_on_failure` and `nice`, and dotfile `autosave` and `enabled`. It also accepts valid configs it used to reject: templated `login_shell`, `queue_directories` and `umask`, nested macOS defaults values, and `tools` on `[vars]` entries. On Windows, `[bootstrap.brew].adopt` no longer causes an unknown-field warning. [#​14616](https://redirect.github.com/jdx/mise/pull/14616), [#​14644](https://redirect.github.com/jdx/mise/pull/14644), [#​14613](https://redirect.github.com/jdx/mise/pull/14613) ([@​jdx](https://redirect.github.com/jdx))
- `mise dot status` and `mise dot sync` are faster with many tracked files. They start one git process per tracked file instead of three, which took about 10s down to 4s for 860 files. [#​14607](https://redirect.github.com/jdx/mise/pull/14607) ([@​waynehoover](https://redirect.github.com/waynehoover))
#### Fixed
- With an external rustup that keeps its proxies in a shared directory, such as pacman's `/usr/bin`, mise no longer puts that directory ahead of its own tools. Before, `mise exec -- node` could run the system Node. Only the Rust proxies are now exposed, through a directory that mise owns. [#​14597](https://redirect.github.com/jdx/mise/pull/14597) ([@​jdx](https://redirect.github.com/jdx))
- The cargo backend now honors `rename_exe`. Before, it ignored the option and installed the executable under its original name. [#​14626](https://redirect.github.com/jdx/mise/pull/14626) ([@​jdx](https://redirect.github.com/jdx))
- Locked `pypi:` installs through uv now pass the configured mise Python to `uv sync`. Before, mise passed an empty path, so uv could pick another interpreter and fail on `--no-build` tools such as `yamllint`. [#​14593](https://redirect.github.com/jdx/mise/pull/14593) ([@​jdx](https://redirect.github.com/jdx), [@​hollow](https://redirect.github.com/hollow))
- When the TLS root store or a CA file can't be loaded, the npm backend now reports an error instead of crashing mise with a core dump. [#​14595](https://redirect.github.com/jdx/mise/pull/14595) ([@​jdx](https://redirect.github.com/jdx))
- On fish, mise no longer recurses until fish hits its call stack limit after `mise implode`. [#​14594](https://redirect.github.com/jdx/mise/pull/14594) ([@​jdx](https://redirect.github.com/jdx), [@​thernstig](https://redirect.github.com/thernstig))
- `mise bootstrap` now finds Nix in `/nix/var/nix/profiles/default/bin` when a `pre-packages` hook installed it earlier in the same run, so `nix:` packages install. [#​14596](https://redirect.github.com/jdx/mise/pull/14596) ([@​jdx](https://redirect.github.com/jdx))
- `MISE_WATCH_FILES_GIT_REWRITTEN` is no longer set when HEAD stayed on the same commit, for example after `git checkout -b`, `git reset` or `git branch -m`. Before, format-on-edit hooks skipped files you had just edited. [#​14585](https://redirect.github.com/jdx/mise/pull/14585) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- Command wrapper templates can now use `config_root` and `config_source`. Relative paths in template functions resolve from the wrapper's config file instead of the current directory. [#​14628](https://redirect.github.com/jdx/mise/pull/14628) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
#### Upgrading
- **Unsupported tool options:** if an install now fails with `option '...' is not used by the ... backend`, remove the option or fix its spelling. `mise config explain tools` shows which keys mise doesn't recognize.
- **Paranoid mode:** after upgrading, run `mise trust` in each project to approve its env files. Run it again after editing them. If you only want the env-file check, set `paranoid = ["env_files"]`.
- **Firewall config on macOS and Windows:** if a shared config has an invalid `[bootstrap.linux.firewall]` value, it now fails to load on macOS and Windows too. Correct the value.
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.13...v2026.10.14>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.13`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.13): : Untrusted project configs can no longer change settings
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.12...vfox-v2026.10.13)
mise now ignores `[settings]` in a project config until you trust it. This release also adds per-version-range backend options to the registry and template support for command wrappers and `[bootstrap.repos]`. It fixes several bugs in lockfiles, tasks and multi-version tool options.
#### Security
- **`[settings]` from untrusted project configs is ignored.** Before, a cloned repo's `mise.toml` could change settings as soon as mise found it, with no trust prompt. That included settings that redirect downloads or feed build commands, such as `node.mirror_url`, `python.pyenv_repo` and `ruby.precompiled_url`. These settings now apply only after `mise trust`, like `[env]`, `[hooks]` and `[tools]` options already did. Trusted projects, global and system config, environment variables and CLI flags work as before. Commands that trust the active config implicitly (`mise run`, `mise exec`, `mise install`) reload settings after trusting it, so the project's settings still apply to that same command. Settings files are now parsed once per load. [#​14538](https://redirect.github.com/jdx/mise/pull/14538), [#​14553](https://redirect.github.com/jdx/mise/pull/14553) ([@​jdx](https://redirect.github.com/jdx))
For example, if an untrusted repo sets `[settings.python] pyenv_repo` to its own URL, `mise settings get python.pyenv_repo` returns the default pyenv repository until you run `mise trust`.
- mise's own `zip` dependency moved to 9.x, which fixes GHSA-4684-h2q9-2vcp. Older versions applied Unix permissions through extracted symlinks without checking that the target stayed inside the destination. mise uses this code to extract downloaded `.zip` tool archives. [#​14577](https://redirect.github.com/jdx/mise/pull/14577) ([@​jdx](https://redirect.github.com/jdx))
#### Added
- **One registry backend can carry different options for each version range.** A registry entry can list the same backend more than once, each time with its own `min_version`/`max_version` and `options`. Tools whose release assets changed at some version can then stay on one backend. Two entries can't give the same version different options unless their `platforms` don't overlap. Table syntax such as `tool = { version = "1.4.0" }` now takes its registry defaults from the entry that version selects. Older mise releases apply only the first entry's options to every version. [#​14543](https://redirect.github.com/jdx/mise/pull/14543) ([@​jdx](https://redirect.github.com/jdx))
```toml
backends = [
{ full = "github:example/tool", min_version = "2.0.0", options = { asset_pattern = "tool-v2-*" } },
{ full = "github:example/tool", max_version = "2.0.0", options = { asset_pattern = "tool-*" } },
]
```
- **`mise ls-remote` lists every version range of a registry tool.** When a tool's backends serve different version ranges, mise now lists each range from the backend that serves it. Before, it listed only the first backend's range. For example, `mise ls-remote hk` now starts at 0.1.4 instead of 1.58.1. Explicit backends, overrides, `--all` and `--strict-metadata` behave as before. [#​14544](https://redirect.github.com/jdx/mise/pull/14544) ([@​jdx](https://redirect.github.com/jdx))
- **Command wrapper values render as templates.** `command`, `args` and `env` in `[wrappers]` can use `vars`, `env` and the usual template functions. `tools` and `config_root` are not available. A command that renders blank is an error. Use `{% raw %}` to keep literal braces, such as Docker's `{{.Names}}`. [#​14565](https://redirect.github.com/jdx/mise/pull/14565) ([@​jdx](https://redirect.github.com/jdx))
```toml
[wrappers.foo]
command = "foo-real"
args = ["--mode={{ vars.mode }}"]
env = { FOO_HOME = "{{ [xdg_data_home, 'foo'] | join_path }}" }
```
- **`[bootstrap.repos]` supports templated `url`/`ref` and clone options.** `url` and `ref` render from `[vars]` or the process environment. Values from a config's `[env]` table are not available. `filter`, `depth` and `submodules = true` are passed to the first `git clone` as `--filter`, `--depth` and `--recurse-submodules`. Existing checkouts are left as they are. `depth` can't be combined with a commit SHA or a `refs/…` ref. [#​14548](https://redirect.github.com/jdx/mise/pull/14548) ([@​jdx](https://redirect.github.com/jdx), [@​ovidiubuligan](https://redirect.github.com/ovidiubuligan))
```toml
[bootstrap.repos]
"~/src/large" = { url = "[email protected]:example/large.git", ref = "{{ vars.branch }}", filter = "blob:none", depth = 1 }
```
- **`{{ system_brew_prefix }}` template variable.** It resolves to the Homebrew prefix that `mise bootstrap` installs into: `/opt/homebrew` on macOS and `/home/linuxbrew/.linuxbrew` on Linux, or the value of `MISE_SYSTEM_BREW_PREFIX`. It does not detect a Homebrew install somewhere else. `[bootstrap.user].login_shell` now renders templates too, so `login_shell = "{{ system_brew_prefix }}/bin/zsh"` works. [#​14572](https://redirect.github.com/jdx/mise/pull/14572), [#​14570](https://redirect.github.com/jdx/mise/pull/14570) ([@​jdx](https://redirect.github.com/jdx))
- **vfox `PreInstall` hooks can return a `headers` table** next to `url` and `sha256`. Plugins can now download private or token-gated artifacts through the normal install path, which handles checksums, retries and lockfile URLs. Headers are sent only to the origin of `url`, are dropped on cross-origin redirects, are redacted in debug output and are never written to `mise.lock`. An explicit `Authorization` header overrides netrc and the automatic GitHub token. [#​14531](https://redirect.github.com/jdx/mise/pull/14531) ([@​jdx](https://redirect.github.com/jdx))
- **`mise doctor` reports a stale `mise-shim.exe` on Windows.** In `windows_shim_mode = "exe"`, shims are copies of the `mise-shim.exe` that sits beside `mise.exe`. If that template is older than mise, or has no version tag (every template built before this release), `mise doctor` reports it and `mise reshim` warns. To fix it, update mise with the package manager that installed it, or run `mise self-update`, and then run `mise reshim --force`. [#​14586](https://redirect.github.com/jdx/mise/pull/14586) ([@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **Lockfiles**
- Running `mise lock` on Windows now records `ruby` entries for Windows, Linux and macOS platforms. Before, it skipped them, and `mise install --locked` then failed. [#​14520](https://redirect.github.com/jdx/mise/pull/14520), [#​14529](https://redirect.github.com/jdx/mise/pull/14529) ([@​jdx](https://redirect.github.com/jdx))
- Commands that rewrite `mise.lock` without locking again, such as `mise link`, no longer delete other platforms' option variants (for example, per-platform `asset_pattern` entries). [#​14519](https://redirect.github.com/jdx/mise/pull/14519) ([@​jdx](https://redirect.github.com/jdx))
- A `mise link` for one version of a tool no longer makes `mise install --locked` fail for that tool's other versions. A link now bypasses the lockfile only when the requested version could select it. [#​14539](https://redirect.github.com/jdx/mise/pull/14539) ([@​jdx](https://redirect.github.com/jdx))
- `mise install --locked` for Java no longer fetches the mise-java catalog when `mise.lock` already has the download URL, so locked installs work in air-gapped or proxied environments. [#​14534](https://redirect.github.com/jdx/mise/pull/14534) ([@​jdx](https://redirect.github.com/jdx))
- **Tasks and shims**
- `mise run` no longer hangs when parallel tasks need to install the same tool. [#​14536](https://redirect.github.com/jdx/mise/pull/14536) ([@​jdx](https://redirect.github.com/jdx))
- Running `mise install` inside a task no longer removes the shims for that task's `lazy` tools. [#​14533](https://redirect.github.com/jdx/mise/pull/14533) ([@​jdx](https://redirect.github.com/jdx))
- Task hooks (such as `postinstall = { task = "setup" }`) and `watch_files` task hooks now run with mise even when a tool shim triggered them. Before, they could fail with errors like `jq: Unknown option --cd`. [#​14550](https://redirect.github.com/jdx/mise/pull/14550) ([@​jdx](https://redirect.github.com/jdx), [@​alitas](https://redirect.github.com/alitas))
- `mise watch` exits quietly with status 130 when you interrupt watchexec with Ctrl+C, instead of printing an error. [#​14541](https://redirect.github.com/jdx/mise/pull/14541) ([@​jdx](https://redirect.github.com/jdx))
- **Per-version tool options**
- When a `github:`, `gitlab:` or `forgejo:` tool lists several versions in config, each version now installs with its own options. Before, an option such as `rename_exe` set only on the first entry applied to every version. [#​14537](https://redirect.github.com/jdx/mise/pull/14537) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `vfox:` plugin hooks now receive only the options configured for the version they handle. [#​14562](https://redirect.github.com/jdx/mise/pull/14562) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `mise install` now restores `cargo`, `rustc` and the host's `rust-std` when they are missing from a Rust toolchain with the `minimal` or `default` profile. Before, mise reported such a toolchain as installed. [#​14525](https://redirect.github.com/jdx/mise/pull/14525) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562), [@​risu729](https://redirect.github.com/risu729))
- The uv, pip and poetry deps providers now run again after mise recreates a deleted venv in a later process. Before, the new venv stayed empty. [#​14532](https://redirect.github.com/jdx/mise/pull/14532) ([@​halms](https://redirect.github.com/halms))
- vfox plugins now report an error, instead of crashing mise, when the HTTP client can't be built (for example, when no CA certificates are installed). [#​14576](https://redirect.github.com/jdx/mise/pull/14576) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- MCP resource read errors now include the underlying cause, such as the untrusted-config message and its `mise trust` hint. [#​14566](https://redirect.github.com/jdx/mise/pull/14566) ([@​diogochaves](https://redirect.github.com/diogochaves))
#### Registry
- `xcsift` 1.7.0 and later installs from signed Packslip releases and now supports Linux x64 as well as macOS ARM64. [#​14540](https://redirect.github.com/jdx/mise/pull/14540) ([@​jdx](https://redirect.github.com/jdx))
- `protoc-gen-connect-go` 2.x now installs from the `/v2` Go module path, and 1.x versions keep working. [#​14545](https://redirect.github.com/jdx/mise/pull/14545) ([@​jdx](https://redirect.github.com/jdx))
- Added `rea` (`npm:rea-agents`). [#​14421](https://redirect.github.com/jdx/mise/pull/14421) ([@​phucisstupid](https://redirect.github.com/phucisstupid))
#### Documentation
- The docs now state that OpenTelemetry export and spinel installs require `experimental = true`. [#​14552](https://redirect.github.com/jdx/mise/pull/14552) ([@​ZainnQureshii](https://redirect.github.com/ZainnQureshii))
#### New Contributors
- [@​phucisstupid](https://redirect.github.com/phucisstupid) made their first contribution in [#​14421](https://redirect.github.com/jdx/mise/pull/14421)
- [@​diogochaves](https://redirect.github.com/diogochaves) made their first contribution in [#​14566](https://redirect.github.com/jdx/mise/pull/14566)
- [@​ZainnQureshii](https://redirect.github.com/ZainnQureshii) made their first contribution in [#​14552](https://redirect.github.com/jdx/mise/pull/14552)
- [@​fang2hou](https://redirect.github.com/fang2hou) made their first contribution in [#​14551](https://redirect.github.com/jdx/mise/pull/14551)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.12...v2026.10.13>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.12`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.12): : Per-tool Python runtimes for PyPI tools, Gradle workspace discovery, and env file find_up
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.11...vfox-v2026.10.12)
PyPI and pipx tools can now choose their own Python runtime, the workspace graph can read Gradle multi-module builds, and `env._.file` can search parent directories. When mise-versions is having an outage, GitHub lookups now retry on `api.github.com`, and `_.source` scripts no longer pick up `~/.bashrc` when mise is launched from an editor.
#### Added
- **Per-tool Python for `pypi:` tools.** Set `python` to a minor series or an exact version, and mise installs that runtime and passes it to uv or pipx for that tool only. The runtime stays private to the tool and does not become your shell's default Python. `mise lock` records the selected Python with the tool, and `mise prune` keeps any runtime that a retained tool environment still uses. You can't combine `python` with `--python`/`-p` in `uvx_args` or `pipx_args`. Tools that don't set `python` behave as before. [#​14479](https://redirect.github.com/jdx/mise/pull/14479) ([@​jdx](https://redirect.github.com/jdx))
```toml
[tools]
"pypi:black" = { version = "latest", python = "3.12" }
"pypi:ruff" = { version = "latest", python = "3.12.12" }
```
If you change a tool's `python`, mise installs a new environment instead of reusing the old one. If that install fails, the previous working environment is left untouched. [#​14504](https://redirect.github.com/jdx/mise/pull/14504) ([@​jdx](https://redirect.github.com/jdx))
- **Gradle workspace discovery.** `mise tasks graph` and `mise run --affected` now find projects listed by `include` in `settings.gradle` or `settings.gradle.kts`, using Groovy or Kotlin syntax. Project IDs follow Gradle paths: `:app` becomes `gradle::app`, and the root project is `gradle::`. Literal `project(":lib")` references in a project's top-level `dependencies {}` block become graph edges. mise reads the scripts as text and never runs Gradle. If an `include` is computed or conditional, a `projectDir` isn't a plain `file("...")` literal, or both settings files exist, mise reports an error that points to `[monorepo.projects."gradle:..."]` overrides. Editing the settings script marks every Gradle project as affected. Based on a prototype by [@​Jarvvski](https://redirect.github.com/Jarvvski). [#​14512](https://redirect.github.com/jdx/mise/pull/14512) ([@​jdx](https://redirect.github.com/jdx))
- **`find_up` for `env._.file`.** With `find_up = true`, mise looks for a relative path in the current directory and in every parent, so a global config can load each project's `.env` files. Files load from the root down, so values in closer files win. The default is `false`, and the option has no effect on absolute paths. [#​14497](https://redirect.github.com/jdx/mise/pull/14497) ([@​jdx](https://redirect.github.com/jdx))
```toml
# ~/.config/mise/config.toml
[env]
_.file = [
{ path = ".env", find_up = true },
{ path = ".env.local", find_up = true },
]
```
- **Detect git-rewritten files in `watch_files` hooks.** mise sets `MISE_WATCH_FILES_GIT_REWRITTEN=1` when every changed file was last written before git's most recent HEAD move (checkout, pull, rebase). Commits don't count as HEAD moves. Hooks such as format-on-edit can use this to skip files the user didn't edit. `git stash pop`/`apply` don't move HEAD, so mise doesn't detect them. [#​14511](https://redirect.github.com/jdx/mise/pull/14511) ([@​jdx](https://redirect.github.com/jdx))
```toml
[[watch_files]]
patterns = ["**/*.go"]
run = '[ -n "$MISE_WATCH_FILES_GIT_REWRITTEN" ] || { IFS=:; hk fix $MISE_WATCH_FILES_MODIFIED; }'
```
- **`.tera` sources inferred for dotfile group templates.** A `mode = "template"` entry in `[dotfile_groups]` no longer needs a `source` just to point at a `.tera` file. If the exact path doesn't exist, mise falls back to the same path with `.tera` added. An explicit `source` still takes precedence, and the `.tera` file is not also deployed under its suffixed name. [#​14502](https://redirect.github.com/jdx/mise/pull/14502) ([@​jdx](https://redirect.github.com/jdx))
- **`mise lock` warns about unsupported platforms.** If you name platforms with `lockfile_platforms` or `mise lock --platform`, mise prints a warning for each tool version that has no build for one of them, for example `[email protected].0 is not available for windows-x64; it will not install there`. The default platform set still only logs this at debug level, and the exit status is unchanged. [#​14500](https://redirect.github.com/jdx/mise/pull/14500) ([@​jdx](https://redirect.github.com/jdx))
- Registry: added `martin` (`github:maplibre/martin`). [#​14488](https://redirect.github.com/jdx/mise/pull/14488) ([@​ivan-ivkovic](https://redirect.github.com/ivan-ivkovic), [@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **GitHub lookups survive mise-versions outages.** If mise-versions times out, drops the connection, or returns `429` or `5xx`, mise now retries the lookup on `api.github.com`, using your GitHub token if one is set. This covers releases, tags, repository contents, attestations and `self-update`. A `404`, `403` or empty answer from mise-versions is still trusted and not retried, so normal use doesn't spend GitHub's anonymous rate limit. If both sources fail, the error shows both failures, and a previously cached version list is still used. [#​14501](https://redirect.github.com/jdx/mise/pull/14501) ([@​jdx](https://redirect.github.com/jdx))
- **`_.source` no longer loads `~/.bashrc`.** When mise's stdin was a socket and `SHLVL` was unset, which happens when an editor extension such as the VS Code mise extension starts it, bash sourced `~/.bashrc` before the script. That leaked variables into the environment and could drop the script's `PATH` entries. The script now runs with `--norc`. [#​14487](https://redirect.github.com/jdx/mise/pull/14487) ([@​pikeas](https://redirect.github.com/pikeas))
- **Each version entry uses its own options.** When a tool listed several versions, options set only on the first entry leaked into the later ones. For example, `prerelease = true` on a `latest` entry made a separate `"1"` entry resolve to a prerelease. [#​14476](https://redirect.github.com/jdx/mise/pull/14476) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562), [@​risu729](https://redirect.github.com/risu729))
- **Project overrides now work when a workspace provider fails.** Previously, if a provider couldn't read its manifest (for example, a malformed `go.work`), `mise tasks graph` and `mise run --affected` failed for the whole repo. Declaring a project in that provider's namespace under `[monorepo.projects]` now replaces the provider's output and clears its error. Providers with no declared projects still fail loudly. [#​14508](https://redirect.github.com/jdx/mise/pull/14508) ([@​jdx](https://redirect.github.com/jdx))
#### Documentation
- Explained why `mise activate` keeps shims on `PATH` [#​14493](https://redirect.github.com/jdx/mise/pull/14493) ([@​jdx](https://redirect.github.com/jdx)), and clarified the platform-specific mise cache paths for CI [#​14506](https://redirect.github.com/jdx/mise/pull/14506) ([@​zeitlinger](https://redirect.github.com/zeitlinger)).
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.11...v2026.10.12>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.11`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.11): : Much faster installs and far fewer GitHub API calls
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.10...vfox-v2026.10.11)
mise is much faster in this release and calls the GitHub API far less. Version lists, release tags, attestations and other public GitHub metadata now come from mise-versions, so everyday commands like `mise install`, `exec`, shims, `outdated`, `lock` and `self-update` are quicker and users without a GitHub token no longer run into the 60-requests-an-hour limit. Cached version lists are reused for longer, so repeat installs skip most lookups. It also adds `mise bootstrap --upgrade` and `mise env --paths`, and closes a trust gap in remote task files.
#### Speed and GitHub API usage
Cold-cache timings for v2026.10.10 versus v2026.10.11, measured with hyperfine on one Linux x64 machine with no GitHub token set:
| Command | v2026.10.10 | v2026.10.11 |
| ----------------------------------------------------- | ----------- | ----------- |
| `mise ls-remote python` | 961 ms | 93 ms |
| `mise install` (jq, ripgrep, fd, bat, gh, shellcheck) | 1.49 s | 1.08 s |
| `mise outdated` (same six tools installed) | 433 ms | 272 ms |
The install and `outdated` runs are noisy (±0.1–0.4s over 4 runs) and the install time includes downloads, so treat them as rough. Requests to `api.github.com` in a cold `mise install` of `github:` tools dropped from 2 to 0. Cold `mise outdated` made 8 network requests before and none now.
- **Public GitHub metadata comes from mise-versions.** With `use_versions_host` on (the default), release lists, `latest`, git tags (aqua `github_tag` packages, ubi and go), artifact attestations (including aqua's `predicate_type` filters) and the digest in the checksum-mismatch hint are read from mise-versions instead of `api.github.com`. GitHub is still asked directly for repositories mise-versions doesn't list when you have a token (the private-repository case), and in paranoid mode for attestations. The direct API is also used with `use_versions_host = false`, GitHub `url_replacements` and custom `api_url`s. [#​14460](https://redirect.github.com/jdx/mise/pull/14460), [#​14461](https://redirect.github.com/jdx/mise/pull/14461), [#​14469](https://redirect.github.com/jdx/mise/pull/14469), [#​14481](https://redirect.github.com/jdx/mise/pull/14481), [#​14477](https://redirect.github.com/jdx/mise/pull/14477), [#​14443](https://redirect.github.com/jdx/mise/pull/14443)
- Other requests also moved off the GitHub API:
- `mise x`, `mise exec`, shims and `hook-env` use mise-versions when they auto-install a tool. [#​14458](https://redirect.github.com/jdx/mise/pull/14458)
- `mise self-update` reads mise's releases from mise-versions and downloads the archive from github.com release downloads. Packslip and zipsign verification are unchanged. [#​14464](https://redirect.github.com/jdx/mise/pull/14464)
- `mise lock` downloads artifacts for provenance checks from github.com instead of the API asset endpoint. [#​14465](https://redirect.github.com/jdx/mise/pull/14465)
- Aqua registries hosted on GitHub are fetched from raw\.githubusercontent.com. [#​14470](https://redirect.github.com/jdx/mise/pull/14470)
- Ruby looks up the latest ruby-build release through mise-versions. [#​14471](https://redirect.github.com/jdx/mise/pull/14471)
- **Fewer version-list fetches.** `mise install`, `use` and `run` now reuse a cached version list for the tool's `minimum_release_age` window minus one hour, clamped to 1–24h. With the default 24h cutoff, that is 23h. `outdated`, `upgrade`, `ls-remote`, `lock` and `latest` still refresh after 1h. If you set `fetch_remote_versions_cache` yourself, your value applies to every command. [#​14484](https://redirect.github.com/jdx/mise/pull/14484), [#​14485](https://redirect.github.com/jdx/mise/pull/14485), [#​14457](https://redirect.github.com/jdx/mise/pull/14457)
- **Faster version resolution:**
- Multi-tool commands such as `mise outdated` can resolve many registry tools with one request to the mise-versions index. [#​14473](https://redirect.github.com/jdx/mise/pull/14473)
- `latest` is resolved without refetching the list. [#​14456](https://redirect.github.com/jdx/mise/pull/14456)
- Explicit backend args such as `aqua:jqlang/jq` reuse the registry tool's version list. [#​14459](https://redirect.github.com/jdx/mise/pull/14459)
- Release tags come from the versions host instead of being listed or guessed. [#​14442](https://redirect.github.com/jdx/mise/pull/14442)
- Packslip installs no longer re-download what resolution already verified. [#​14466](https://redirect.github.com/jdx/mise/pull/14466)
- Install tracking and the Python version list are served from static assets. [#​14441](https://redirect.github.com/jdx/mise/pull/14441)
- **Python version listing no longer clones pyenv.** `mise ls-remote python`, `outdated`, `upgrade` and fuzzy `mise use [email protected]` read the python-build definitions from mise-versions. A cold listing took about 960ms before and about 90ms now. pyenv is still cloned when mise compiles Python, when `python.pyenv_repo` points at a fork, when you're offline, or when `use_versions_host = false`. Some definitions that had no date before now have one, so they are held back by `minimum_release_age` until they are old enough. [#​14455](https://redirect.github.com/jdx/mise/pull/14455)
- `mise oci build` now requires root for `apt:` packages, as it already did for apk, and fails up front with a clear message. If apt-get still fails, the error now includes the last lines of dpkg's output. [#​14447](https://redirect.github.com/jdx/mise/pull/14447)
- Registry: `native-sdk` now installs from npm (`@native-sdk/cli`), so the `native` command works. It requires Node 24+. [#​14431](https://redirect.github.com/jdx/mise/pull/14431)
#### Security
- **Remote task files now need trust before their headers render.** A `mise.toml` with only `[tasks]` loads without trust. Before this fix, if one of those tasks set `file` to a remote URL, `mise tasks ls`, `mise tasks info` and `mise tasks validate` rendered the file's `#MISE` headers, so a template like `{{ exec(...) }}` ran without a trust prompt. Remote files now follow the same rule as local task includes: if the headers contain template syntax, the config that references them must be trusted first. Remote files with plain headers still list without trust, and braces in the script body need no trust. [#​14416](https://redirect.github.com/jdx/mise/pull/14416) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562), [@​risu729](https://redirect.github.com/risu729))
- Updated rustls to 0.23.46 to address a RustSec advisory. [#​14434](https://redirect.github.com/jdx/mise/pull/14434)
#### Added
- **`mise bootstrap --upgrade`** installs what is missing and then upgrades what is already installed, in a single run. In the packages phase it runs the same upgrade as `mise bootstrap packages upgrade`, and pins are respected. In the tools phase it runs `mise upgrade` without `--bump`, so configured version ranges hold. Both run before the matching post hooks and dependent services. `--dry-run` previews both steps and `--skip` works as before. It does not update mise itself, repositories or images, and it does not restart services. [#​14433](https://redirect.github.com/jdx/mise/pull/14433)
```sh
mise self-update --yes && mise bootstrap --upgrade
```
- **`mise env --paths`** prints the PATH entries mise manages, one per line and in PATH order: tool bin directories, `_.path` entries, and inherited directories that mise moves forward, such as `~/.cargo/bin`. This lets CI integrations export only mise's additions without diffing `PATH`. [#​14429](https://redirect.github.com/jdx/mise/pull/14429)
```console
$ mise env --paths
/home/me/.local/share/mise/installs/node/24.11.0/bin
/home/me/.cargo/bin
```
- **The install script downloads pinned versions from mise.jdx.dev.** `curl https://mise.run | MISE_VERSION=<version> sh` now tries mise.jdx.dev first and falls back to GitHub Releases if that download fails. Checksums for pinned versions still come only from GitHub's `SHASUMS256.txt`. If no checksum is found, the script refuses to install. `MISE_INSTALL_FROM_GITHUB=1` still uses GitHub only. [#​14446](https://redirect.github.com/jdx/mise/pull/14446)
- Registry: `gdal` installs the GDAL/OGR command-line tools from conda-forge (`conda:libgdal-core`). [#​14440](https://redirect.github.com/jdx/mise/pull/14440) ([@​ivan-ivkovic](https://redirect.github.com/ivan-ivkovic))
#### Fixed
- **A bare `mise upgrade` no longer installs lazy tools that have never been installed.** Naming the tool still installs it. A lazy tool that already has a version installed upgrades as before. A missing lazy tool is still installed if an upgraded tool depends on it. `mise outdated` now marks these tools as `[MISSING] (lazy)`, and the bare upgrade no longer looks up their versions. [#​14422](https://redirect.github.com/jdx/mise/pull/14422) ([@​ryanrhughes](https://redirect.github.com/ryanrhughes)), [#​14444](https://redirect.github.com/jdx/mise/pull/14444)
- Fixed false `stack limit reached` errors on the static musl builds, for example on Ubuntu 26.04. These errors broke aqua `version_filter` parsing and made shims such as kubectl's report "not a valid shim". [#​14450](https://redirect.github.com/jdx/mise/pull/14450)
- `mise lock --platform ...` run on Alpine or NixOS no longer records Node source builds for other platforms. Only an explicit `node.compile` or `all_compile = true` forces source builds for those targets. [#​14432](https://redirect.github.com/jdx/mise/pull/14432)
- `mise upgrade --bump` and hand-edited version pins no longer drop a pipx tool's locked uv dependency graph. Before, `mise install --locked` then failed on a fresh checkout. [#​14426](https://redirect.github.com/jdx/mise/pull/14426) ([@​wislertt](https://redirect.github.com/wislertt))
- Packslip prefixes such as `fnox@1` now skip releases this host can't install, the same way `latest` does. Each skipped release gets a warning, and if no match can
> [!IMPORTANT]
> ✂ PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | minor | `v2026.9.7` → `v2026.10.8` |
---
### Release Notes
<details>
<summary>jdx/mise</summary>
### [`v2026.10.8`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.8): : Stable `global` install link for IDEs
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.7...vfox-v2026.10.8)
Each tool's install directory now has a `global` link that follows your global config, which gives IDEs a path that doesn't change when you switch versions. This release also retries downloads whose response body drops partway through, fixes lockfile checks for release tags that contain `@`, and stops dotfiles history from rewriting files that haven't changed.
##### Added
- **`global` runtime symlink.** Each tool's install directory now has a `global` link to the version your global and system config select. Programs that can't run mise, such as IDEs, can point at this path and follow `mise use -g` changes. [#​14271](https://redirect.github.com/jdx/mise/pull/14271)
```text
~/.local/share/mise/installs/maven/
├── 3.9.13/
├── 3.9.16/
└── global -> ./3.9.16
```
The link is updated along with the other runtime symlinks (`latest`, `3`, ...), for example after `mise use -g`, `mise install` and `mise upgrade`. Project config and `MISE_*_VERSION` don't change it. If no global config selects the tool, mise removes the link. A real directory named `global` is left alone. The link is always on, and no setting turns it off.
##### Fixed
- HTTP requests now retry, up to `http_retries`, when the response body drops partway through. Before, only the request and headers were retried, so a version list or release page cut off mid-transfer failed with `error decoding response body`. This applies to text, JSON and byte requests, and to version lists read with `version_regex`. [#​14253](https://redirect.github.com/jdx/mise/pull/14253) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `mise install` no longer rejects lockfile entries whose release tag contains `@`, such as `[email protected].0`. `mise lock` writes these tags percent-encoded (`cli%400.46.0`), and the locked-URL check read that as version `400.46.0`. Re-running `mise lock` couldn't fix it. [#​14252](https://redirect.github.com/jdx/mise/pull/14252)
- Dotfiles history index rebuilds now skip checkpoint metadata files whose contents haven't changed. On large histories, rebuilds used to rewrite every file, which caused minutes of disk writes and made `mise dot save` fail with `another history operation is running`. [#​14249](https://redirect.github.com/jdx/mise/pull/14249)
- The JSON schema now accepts `outputs = { auto = false }` on tasks, so editors and linters such as tombi and Taplo no longer flag it. mise's behavior is unchanged: `auto = false` means the same as leaving `outputs` unset. [#​14265](https://redirect.github.com/jdx/mise/pull/14265) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
##### Documentation
- The dotfiles docs now open with a recommended setup, and the modes-and-keys reference table has been reorganized into three readable columns. [#​14267](https://redirect.github.com/jdx/mise/pull/14267)
##### Registry
- New aqua packages: [`runxhq/runx`](https://redirect.github.com/runxhq/runx) and [`takumin/passt-bin`](https://redirect.github.com/takumin/passt-bin).
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.7...v2026.10.8>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.7`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.7): : Background tool updates at the shell prompt, a verified download cache, and `mise upgrade --global`
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.6...vfox-v2026.10.7)
Tools with `auto_update` now update in the background from an activated shell, and a new `tool_update.global_auto` setting turns this on for every global tool. mise also keeps finished downloads in a content-addressed cache and checks them again before reusing them. This release also fixes `.env` parsing regressions from 2026.10.3 and a crash in `mise run`.
##### Added
- **Automatic updates at the shell prompt.** Before, `auto_update` only ran when a shim or `mise exec` launched a tool. With `mise activate`, tools run straight from `PATH`, so they were never updated. Now, when a check is due, `mise hook-env` starts the update in a detached background process. The prompt doesn't wait and nothing is printed. The next command after the update finishes uses the new version. The existing rules still apply: only global config counts, exact versions don't move, nothing updates offline, in CI or with `locked`, and `minimum_release_age` is honored. While the `tool-update` service is running, prompts leave updates to it. Failed background updates show up in `mise doctor`. [#​14239](https://redirect.github.com/jdx/mise/pull/14239)
- **`tool_update.global_auto`** turns on automatic updates for every tool in global config at once. It takes the same values as `auto_update`: `true` checks every `tool_update.check_duration` (24h by default), and a duration sets the interval. A tool's own `auto_update` takes precedence, so `auto_update = false` opts a tool out. Projects can't enable this setting. You can also set it with `MISE_TOOL_UPDATE_GLOBAL_AUTO`. `self_update.auto` now accepts an interval too, for example `self_update.auto = "1d"`. [#​14237](https://redirect.github.com/jdx/mise/pull/14237)
```toml
# ~/.config/mise/config.toml
[settings]
tool_update.global_auto = "12h"
[tools]
claude = "latest" # checked every 12h
node = { version = "24", auto_update = "6h" } # its own interval wins
python = { version = "3.13", auto_update = false } # opted out
```
- **`mise upgrade --global` and `mise outdated --global`** act only on the tool requests in global and system config, even inside a project that pins its own version or when `MISE_<TOOL>_VERSION` is set. The project's `mise.toml`, lockfile and `[env]` are not read or changed. `--bump` writes to the global config. `--global` can't be combined with `--local` or `--inactive`. A new "Self-updating tools" docs page explains how tools that update themselves, such as coding agents, can detect a mise install and update through mise instead of overwriting their own install. [#​14243](https://redirect.github.com/jdx/mise/pull/14243)
```sh
mise outdated --global claude --json
mise upgrade --global claude
```
- **Verified download cache.** Finished downloads are stored once in `$MISE_CACHE_DIR/downloads-cas` and hashed again before every reuse. A cached file that no longer matches is dropped and downloaded again. [#​14222](https://redirect.github.com/jdx/mise/pull/14222), [#​14242](https://redirect.github.com/jdx/mise/pull/14242)
- When the server sent an `ETag` or `Last-Modified` header, the next request for the same URL is conditional. On `304 Not Modified`, mise reuses the cached file without downloading it again. This applies to every download through mise's HTTP client.
- For tools with a pinned checksum (from tool options, `mise.lock` or a packslip digest), `http`, `github`, `aqua`, `packslip` and the precompiled core tools (Node, Go, Bun, Deno, Zig, Java, Python, Ruby, Erlang, Elixir, Swift) reuse the cached file without any network request. The file is hard-linked into place, so it doesn't use extra disk space.
- With `--locked` or `paranoid`, mise only uses the cache for downloads with a pinned checksum. This means a CI cache you restore can save downloads but can't change what gets installed. The CI guide now shows how to cache `~/.cache/mise/downloads-cas` instead of installed tools.
- `download_cache_max_size` sets the size limit (default `2GiB`, `0` for no limit). When the cache is full, the least recently used files are removed. `download_cache = false` (`MISE_DOWNLOAD_CACHE=0`) turns the cache off.
- **`npm:` packages that install no executables now trigger a warning.** For example, `mise use npm:lodash` used to succeed silently even though it created no shims. The install still succeeds. [#​14246](https://redirect.github.com/jdx/mise/pull/14246)
##### Fixed
- **`.env` parsing regressions from 2026.10.3**, affecting `[env] _.file` and the `env_file` setting:
- Backslashes in single-quoted values are literal again, so Windows paths like `'\\fileserver\share'` and `'C:\temp\'` load correctly. To embed a single quote, use double quotes. [#​14228](https://redirect.github.com/jdx/mise/pull/14228)
- Quoted and unquoted parts placed next to each other are joined again, as in shell. For example, `A='it'\''s'` gives `it's` and `B=a'b c'd` gives `ab cd`. These lines used to cause syntax errors that dropped the rest of the file. Quotes inside an unquoted value are now removed, so JSON that needs to keep its quotes must be single-quoted (`CONFIG='{"debug": true}'`). A quote with no matching closing quote on the same line stays literal, so `NAME=O'Brien` reads as written. [#​14231](https://redirect.github.com/jdx/mise/pull/14231)
- `mise run` no longer crashes now and then with `called Option::unwrap() on a None value` when it reads the tool list while it's being reloaded after an install. [#​14240](https://redirect.github.com/jdx/mise/pull/14240)
- On Windows with `core.autocrlf=true`, `mise bootstrap repos status` no longer reports freshly cloned repos as dirty. [#​14225](https://redirect.github.com/jdx/mise/pull/14225)
- On Windows, `mise dot apply` can now repoint a `mode = "symlink"` dotfile whose target is a directory junction after its `source` changes. It used to fail with `os error 5`. [#​14226](https://redirect.github.com/jdx/mise/pull/14226)
- `history.describe_command` now works for files tracked through a variant (such as `home@work/...`), including files added or removed inside variant directories. Encrypted files are still left out of the diff. [#​14194](https://redirect.github.com/jdx/mise/pull/14194) ([@​oppegard](https://redirect.github.com/oppegard))
- `mise doctor` now shows the `dotfiles:` section, including the history `repo:` and `origin:`, when `history.enabled = false`. `mise doctor --json` adds `dotfiles.history_enabled` and `dotfiles.tracking_error`. [#​14244](https://redirect.github.com/jdx/mise/pull/14244)
- `mise lock` now applies aqua registry version prefixes (such as Codex's `rust-` prefix) before it chooses version overrides. Before, platform entries like `windows-x64` were skipped. When several prefix families match, mise now warns and skips the entry instead of picking one arbitrarily. [#​14218](https://redirect.github.com/jdx/mise/pull/14218) ([@​nettlesh](https://redirect.github.com/nettlesh))
- The rustup profile aliases `m`, `d`, `c` and the empty value are now treated like `minimal`, `default` and `complete`. With `profile = "d"`, `mise install` now restores missing components like clippy and rustfmt. Unknown profile names now fail with rustup's list of valid names. [#​14220](https://redirect.github.com/jdx/mise/pull/14220) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- The cargo backend now takes the same rust-state lock as the rust plugin when `CARGO_HOME`/`RUSTUP_HOME` are set through the `rust.cargo_home`/`rust.rustup_home` settings or `MISE_CARGO_HOME`/`MISE_RUSTUP_HOME` in `[env]`. Before, parallel source-build installs could race and fail. [#​14219](https://redirect.github.com/jdx/mise/pull/14219) ([@​wislertt](https://redirect.github.com/wislertt))
- The hint to enable `self_update.auto` now appears on every `mise version` and `mise self-update` run, not just the first time. It stops once you enable auto-update or run `mise settings add disable_hints auto_update`. [#​14233](https://redirect.github.com/jdx/mise/pull/14233)
- The JSON schema now matches what mise accepts, so editors and linters like tombi and Taplo report the right errors ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562)):
- Task arrays can contain `{ task = ... }` and `{ tasks = [...] }` entries. [#​14229](https://redirect.github.com/jdx/mise/pull/14229)
- `depends`, `depends_post` and `wait_for` accept a single table, and empty nested lists like `depends = [[]]` are rejected. [#​14236](https://redirect.github.com/jdx/mise/pull/14236)
- `[env]` entries that combine `value` with `required = true` or a help string, and `{ required = false }` with no value, are rejected. [#​14247](https://redirect.github.com/jdx/mise/pull/14247)
##### Deprecated
- `always_keep_download` is deprecated because downloads are now kept in the download cache. It will warn starting in 2026.11.0 and will be removed in 2027.11.0. [#​14222](https://redirect.github.com/jdx/mise/pull/14222)
##### Documentation
- The automatic tool updates docs now explain that `minimum_release_age` (24h by default) plus the check interval can delay an update by 24 to 48 hours after a release. You can set `minimum_release_age` per tool. Docs and hints now use the shorter `mise settings KEY=VALUE` form. [#​14235](https://redirect.github.com/jdx/mise/pull/14235)
##### New Contributors
- [@​wislertt](https://redirect.github.com/wislertt) made their first contribution in [#​14219](https://redirect.github.com/jdx/mise/pull/14219)
- [@​oppegard](https://redirect.github.com/oppegard) made their first contribution in [#​14194](https://redirect.github.com/jdx/mise/pull/14194)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.6...v2026.10.7>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.6`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.6): : Per-machine [vars] prompts, local config includes, and working-tree changes in --affected
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.5...vfox-v2026.10.6)
`[vars]` entries can now ask once per machine and remember the answer, `include` accepts local files, and `mise run --affected` now counts uncommitted work and no longer needs `experimental = true`. On a fresh machine, `mise bootstrap` can install git and ssh before it clones. The release also fixes several dotfiles history issues and stops lazy tools from triggering remote version lookups when something else launches.
##### Added
- **Per-machine `[vars]` prompts.** Give a var a `prompt`, plus either a `default` or `required`. mise asks for it once and saves the answer in `$MISE_STATE_DIR/vars.toml`, outside your config and dotfiles history. Templates, tasks and tools then read it as usual. One shared dotfiles setup can use this to set a different Git identity on each machine. [#​14190](https://redirect.github.com/jdx/mise/pull/14190)
```toml
[vars.git_name]
default = "Ada Lovelace"
prompt = "Git author name"
[vars.git_email]
required = "Run mise vars prompt to set git_email"
prompt = "Git email"
```
```sh
mise vars # list every var and where its value comes from
mise vars prompt # ask for every unanswered prompt var (or name some)
mise vars git_name=Ada # save a value without a prompt
mise vars unset git_name # forget a saved value
mise bootstrap --prompt-vars # prompt during a bootstrap run, e.g. with --adopt
```
Only `mise vars prompt` and `mise bootstrap --prompt-vars` ever ask. Everything else uses the saved answer, then the `default`. Precedence, highest first: the process environment, a value from a higher-precedence config file, the saved answer, the `default`. Answers are keyed by var name, so projects that use the same name share one answer on a machine. `prompt` is not allowed in `[env]`.
- **Local paths in `include`.** `include` in `mise.toml` now accepts local TOML files, not just `git::` and `oci::` references. A path can be relative to the including file or absolute. Local files merge the same way as remote ones, ranking just below the including file. They are read on every load, so edits apply immediately and invalidate the cached env. Paranoid mode rejects local includes, and safe mode still skips all includes in project config. [#​14178](https://redirect.github.com/jdx/mise/pull/14178)
```toml
include = ["./config/tools.toml", "/etc/mise/team.toml"]
```
- **`mise bootstrap` installs git and ssh before cloning.** `mise bootstrap --from` and `--adopt` used to fail with a spawn error when git was missing. Now mise checks for git, and for ssh when the URL is `ssh://` or `user@host:path`, and offers to install whatever is missing with the host package manager. Supported managers are apt, dnf, pacman, apk, zypper, Homebrew, scoop and winget. `--yes` accepts the offer without asking, and `--dry-run` only reports what is missing. [#​14188](https://redirect.github.com/jdx/mise/pull/14188)
- **`mise dot save --re-encrypt`.** After you change `[history.encryption] recipients`, a normal save leaves some encrypted files under their old keys: manual-save entries the save doesn't name, and other-platform variants. Add `--re-encrypt` to re-encrypt every saved file in the new checkpoint to the current recipients. It never captures unsaved edits. If this machine can't unlock some of the files, nothing is saved and the error lists all of them. [#​14210](https://redirect.github.com/jdx/mise/pull/14210)
- **`mise dot status` shows unsaved changes.** It now lists tracked paths that changed since the latest checkpoint. Unsaved edits were previously invisible there when the watcher was stopped or an entry used `--no-autosave`. `--json` reports these paths as `history.unsaved`. The value is `null` when they can't be determined, for example with no checkpoint yet or with encrypted files this machine can't compare without prompting. [#​14209](https://redirect.github.com/jdx/mise/pull/14209)
##### Changed
- **`mise run --affected` now counts working-tree changes, and the workspace graph is no longer experimental.** Besides the committed `base...head` range, `--affected` now also counts staged and unstaged edits and untracked files that aren't ignored. You can narrow it with `--affected-committed`, `--affected-uncommitted` and `--affected-untracked`, which can be combined (environment variables: `MISE_AFFECTED_*`). Working-tree changes only count when the head is your current checkout. To get the old committed-only selection, for example in a CI job that writes untracked files before it runs, use `--affected-committed`. `--affected`, `mise tasks graph`, `[monorepo.task_defaults]`, `[monorepo.projects]` and `task.auto_infer` no longer require `experimental = true`. [#​14214](https://redirect.github.com/jdx/mise/pull/14214)
```sh
mise run --affected build # committed + uncommitted + untracked
mise run --affected --affected-uncommitted --affected-untracked build # only what you haven't committed yet
mise run --affected --affected-committed build # committed range only, as before
```
- **Credential checks for dotfiles.** Files with names ending in `.example`, `.sample` or `.template` no longer match the credential name rules. The content scan before publishing still checks them. Once you approve a file for plaintext tracking, mise no longer warns about it on every save. [#​14204](https://redirect.github.com/jdx/mise/pull/14204)
- **`mise dot track` only asks about plaintext at a terminal.** Before saving a credential-named file in plaintext, it now asks only when both stdin and stderr are terminals. Previously, a piped line, such as the next entry in a `while read` loop, could be taken as the answer. Scripts need `--allow-plaintext` or `--encrypt`. [#​14205](https://redirect.github.com/jdx/mise/pull/14205)
##### Fixed
- **Lazy tools no longer trigger remote lookups for other lazy tools.** Previously, mise looked up versions for configured lazy tools that weren't installed, even though they weren't being launched. With a cold cache and no network, launching one tool waited on each lookup and could print "Failed to resolve tool version list" warnings. In one offline test a launch took 41 seconds. This no longer happens in these cases:
- the update that runs before an `auto_update` tool launches ([#​14195](https://redirect.github.com/jdx/mise/pull/14195))
- after `mise x` or a shim installs a new version ([#​14197](https://redirect.github.com/jdx/mise/pull/14197))
- the first launch of a lazy tool through its shim ([#​14201](https://redirect.github.com/jdx/mise/pull/14201))
`mise install`, `mise upgrade` and `mise use` still resolve everything.
- **`Too many open files` with parallel `npm:` installs.** Parallel installs could fail under macOS's default launchd soft limit of 256, for example when mise was started from a LaunchAgent. On Unix, mise now raises its soft open-file limit at startup toward the hard limit, up to 10240, and never lowers it. [#​14174](https://redirect.github.com/jdx/mise/pull/14174), [#​14216](https://redirect.github.com/jdx/mise/pull/14216)
- **`go:` tools with an untidy `go.mod`.** Tools whose published `go.mod` is missing a requirement now install, for example `go:tailscale.com/cmd/tailscale`. mise now passes `-mod=mod` to `go install` instead of `-mod=readonly`. A project's `GOFLAGS=-mod=vendor` still doesn't affect these installs. [#​14180](https://redirect.github.com/jdx/mise/pull/14180) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- **Config at the filesystem root.** A config file at `/`, such as `/mise.toml` in a Docker image, made `mise install` and `mise exec` panic. It now works. [#​14182](https://redirect.github.com/jdx/mise/pull/14182)
- **.NET installs.** Installing a .NET SDK no longer fails with "was not found in `dotnet --list-sdks` output" when another mise-managed SDK comes before the shims on `PATH`. The post-install check now runs the new SDK's `dotnet` directly. [#​14189](https://redirect.github.com/jdx/mise/pull/14189)
- **Shims and directories.** Shims and `mise which` no longer resolve a bin name to a directory in another tool's bin path. Previously, `hunk`'s `skills/` directory blocked `npm:skills` with "Permission denied". [#​14193](https://redirect.github.com/jdx/mise/pull/14193)
- **`mise oci build` and multiple versions.** A tool pinned to several versions is now written to the embedded `/etc/mise/config.toml` as a single array, in resolution order. Previously each version got its own duplicate key, which made the config unreadable inside the container. [#​14200](https://redirect.github.com/jdx/mise/pull/14200) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- **Encrypted files a sync can't unlock.** `mise bootstrap --adopt`, `mise dot pull` and `mise dot sync` now list every encrypted file they can't unlock in one error, instead of stopping at the first one. Damaged files still stop the sync immediately. [#​14208](https://redirect.github.com/jdx/mise/pull/14208)
- **Rollback and undo messages.** `mise dot rollback <path>` now names the checkpoint that saved the restored version, which matches `mise dot history --path`. Rollback and undo also name both checkpoints they record: the result, and the one holding the state before the operation. Previously, rollback could name a checkpoint that `history --path` didn't list. What gets restored is unchanged. [#​14207](https://redirect.github.com/jdx/mise/pull/14207), [#​14211](https://redirect.github.com/jdx/mise/pull/14211)
- **`mise dot status` on adopted machines.** On a machine that adopted a shared setup, it no longer prints "nothing configured in \[dotfiles]" while history tracks entries. [#​14206](https://redirect.github.com/jdx/mise/pull/14206)
##### New Contributors
- [@​jovial-liu](https://redirect.github.com/jovial-liu) made their first contribution in [#​14184](https://redirect.github.com/jdx/mise/pull/14184)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.10.5...v2026.10.6>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.5`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.5): : Java defaults to Temurin, per-machine and local-only dotfile history, packslip workflow pinning
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.4...vfox-v2026.10.5)
Java versions without a vendor prefix now install Eclipse Temurin builds. Dotfiles gain per-machine and local-only history, a `merge = "missing"` mode, and a secret check before `mise dot sync` publishes anything. Packslip tools can be pinned to the workflow that signs their releases. Several features documented as experimental now actually require `experimental = true`. The rest of the release is fixes across tasks, shims, config loading, bootstrap and backends.
##### Breaking Changes
- **`java@21`, `java@lts` and `java@latest` now install Temurin.** The default of `java.shorthand_vendor` changes from `openjdk` to `temurin`. The jdk.java.net OpenJDK builds stop at the next feature release, so `java@21` was stuck on 21.0.2 from January 2024. Vendor-prefixed requests (`openjdk-21`, `corretto-21`, ...) are not affected. Installed OpenJDK versions keep working, and `mise upgrade` offers the Temurin build. Shorthand versions now include Temurin's build suffix (for example `21.0.12+101.0.LTS`). Temurin has no builds of Java 9, 10 or 12–15, so use `openjdk-12` and similar for those. [#​14146](https://redirect.github.com/jdx/mise/pull/14146)
- **Lockfiles:** existing shorthand lock entries record `shorthand_vendor = "openjdk"`. Without that setting, `mise install --locked` fails with `java@21 is not in the lockfile`. Either keep OpenJDK:
```toml
[settings]
java.shorthand_vendor = "openjdk"
# or per project: java = "openjdk-21"
```
or switch to Temurin with `mise lock --bump java` and commit the result.
- **Some experimental features now require `experimental = true`** (or `MISE_EXPERIMENTAL=1`) when you use them. Config that only mentions them still loads. [#​14114](https://redirect.github.com/jdx/mise/pull/14114)
- Running a task with a `git::` remote `file`, including through `mise run --dry-run`, `mise watch`, or as a dependency. Commands that only inspect tasks (`tasks ls`, `tasks info`, `tasks deps`, `generate task-docs`) show the task from its TOML and warn once that the file wasn't fetched. These were documented as experimental but were missing the check in the codebase.
- `git::` and `oci::` entries in `task_config.includes`. These are skipped with a warning.
- OpenTelemetry export of `mise run` when an OTLP endpoint is set.
- Installing `spinel:` tools.
- **`mise.local.toml` now overrides `mise.<env>.toml` in the same directory**, as the docs already said. Before, the committed environment file won in project directories, and also in `~/.config/mise` when the walk up from the cwd reached it. Within each directory the order is now, highest first: `mise.<env>.local.toml`, `mise.local.toml`, `mise.<env>.toml`, `mise.toml`. If you relied on the environment file winning, move those keys into `mise.<env>.local.toml`. [#​14148](https://redirect.github.com/jdx/mise/pull/14148)
- **MCP:** in the `mise://tasks` resource, `env` is now an array of env directive strings, the same format as `mise tasks ls --json`. It was always an empty object before. [#​14111](https://redirect.github.com/jdx/mise/pull/14111)
- **`mise settings set` and `add` refuse writes that would have no effect.** This covers early-init settings (`env`, `ceiling_paths`, `env_conf_d`, ...) written to a config file, and global-only settings (`yes`, `paranoid`, `trusted_config_paths`, ...) written with `--local`. The error says where the setting has to go: `miserc.toml`, the global config, or the `MISE_*` variable. [#​14126](https://redirect.github.com/jdx/mise/pull/14126)
##### Added
##### Dotfiles
- **Per-machine tracked files.** Some files describe the machine, such as a monitor layout. Use `variants = [{ machine = true }]` or `mise dot track --machine` to keep a separate history for each machine. Sync pushes every machine's version to the origin but never applies one machine's version on another. Each machine gets a generated name, which you can set with `[history] machine = "desk"`. A machine variant must be the entry's only variant and can't be combined with `encrypt`. Upgrade every machine that shares a setup before using it. [#​14062](https://redirect.github.com/jdx/mise/pull/14062)
```toml
[dotfiles]
"~/.config/hypr/monitors.lua" = { mode = "track", variants = [{ machine = true }] }
```
- **`mode = "track-local"`** (or `mise dot track --local`) keeps a file's history in a separate store on this machine, with no origin. The file never reaches the shared manifest, a commit or a push. Commands that name a path use the history that holds it. Use `mise dot --local history` or `mise dot --local undo` to work with the local history directly. `save`, `capture` and `watch` cover both histories. [#​14082](https://redirect.github.com/jdx/mise/pull/14082)
- **`merge = "missing"`** sets only the keys the target file doesn't have yet. Values an app writes itself, such as the model picked with `/model` in Codex or Claude Code, are left alone. Works with TOML, YAML and JSON. [#​14081](https://redirect.github.com/jdx/mise/pull/14081)
```toml
[dotfiles]
"~/.codex/config.toml/shared" = { merge = true }
"~/.codex/config.toml/defaults" = { source = "codex/defaults.toml", merge = "missing" }
```
- Merge entries can leave out `source`. mise then reads the target's path under `dotfiles.root`. Switching an entry from `symlink` to `merge` now replaces a link that points at the merge source with a writable copy, so the app's own keys survive. [#​14076](https://redirect.github.com/jdx/mise/pull/14076)
- **`mise dot sync` refuses to publish saved versions that look like secrets.** It checks for provider tokens, private key blocks, and `*_KEY`/`*_TOKEN`/`*_SECRET`/`*_PASSWORD` assignments. Only versions the origin doesn't have yet are checked. The error names the file, line and version, never the value. `--allow-plaintext-history` skips the check. [#​14171](https://redirect.github.com/jdx/mise/pull/14171)
- `mise bootstrap --adopt <url> --take-remote-all` takes the repository's version of every file that differs, in one step. Combined with `--replace-history`, it also adopts the repository on a machine that already has history of its own. [#​14065](https://redirect.github.com/jdx/mise/pull/14065)
- `mise doctor` shows the dotfiles history repo path and the connected origin (URL, branch, sync mode), in both text and `--json` output. [#​14173](https://redirect.github.com/jdx/mise/pull/14173)
##### Bootstrap
- `[bootstrap.files]` and `[bootstrap.directories]` accept the same `os` selector as packages. Entries that don't match the host are skipped completely. [#​14058](https://redirect.github.com/jdx/mise/pull/14058)
```toml
[bootstrap.files."/etc/docker/daemon.json"]
os = "linux"
source = "./files/docker-daemon.json"
```
- `fish = "auto"` in `[bootstrap.mise_shell_activate]` writes a block that runs `mise activate fish` in interactive shells and `--shims` everywhere else. [#​14172](https://redirect.github.com/jdx/mise/pull/14172)
- `[bootstrap]` is now allowed in config includes. It merges below the including file, so a shared baseline can declare packages, hooks and services, and the project still wins on any key it sets itself. [#​14176](https://redirect.github.com/jdx/mise/pull/14176)
- Systemd units accept `state = "absent"`, which stops, disables and deletes the matching mise-managed service and timer. `mise bootstrap unapply` now also removes the units an environment added. [#​14139](https://redirect.github.com/jdx/mise/pull/14139)
##### Tools and backends
- **Packslip `workflow` option.** It accepts only releases signed by the named GitHub Actions workflow on tags. It takes one workflow or a list, and an entry can name a ref (`release.yml@refs/heads/main`). It can't be combined with `pubkey`, `identity`, `identity_prefix` or `issuer`. [#​14075](https://redirect.github.com/jdx/mise/pull/14075), [#​14093](https://redirect.github.com/jdx/mise/pull/14093)
```toml
[tools]
"packslip:github.com/aubepkg/aube" = { version = "latest", workflow = ["release-plz.yml", "release.yml"] }
```
- Registry entries for dagu, timoni, helmfile, fnox, hk, usage, communique, mr-boxington, pitchfork, aube and worktrunk are now pinned to the workflow that signs their releases. A `workflow` or `pubkey` you set yourself replaces the registry pin. [#​14092](https://redirect.github.com/jdx/mise/pull/14092), [#​14091](https://redirect.github.com/jdx/mise/pull/14091), [#​14073](https://redirect.github.com/jdx/mise/pull/14073) ([@​max-sixty](https://redirect.github.com/max-sixty))
- **MCP `install_tool` is implemented.** It installs the requested version, or the configured version, or latest, and returns the resolved version and install path. `install_tool` and `run_task` now refuse to act on untrusted config instead of trusting it on the client's behalf. [#​14111](https://redirect.github.com/jdx/mise/pull/14111)
- `mise installs migrate` no longer fails on installs it can't reinstall, such as withdrawn releases, signer changes or no network. It moves them into the identity layout as they are and leaves a link at the old path. It also handles lockfile-suffixed `~aube~`/`~uv~` directories correctly. [#​14079](https://redirect.github.com/jdx/mise/pull/14079)
- Registry: `mprocs` is renamed to `dekit` to match upstream, and `mprocs` stays as an alias. From v0.10.0 the binary is `dekit`. [#​14169](https://redirect.github.com/jdx/mise/pull/14169)
##### Changed
- Dotfile operations you can undo no longer ask for confirmation after showing their plan. This covers `dot pull`, `dot track`, `undo`, `rollback`, `connect` and `bootstrap --adopt`. Destructive ones still ask, such as `--replace-history`, `dot recover --keep-current` and `implode`. `--yes` and `MISE_YES` are still accepted. [#​14077](https://redirect.github.com/jdx/mise/pull/14077), [#​14071](https://redirect.github.com/jdx/mise/pull/14071), [#​14067](https://redirect.github.com/jdx/mise/pull/14067)
- Safe mode (`MISE_SAFE=1`) now ignores a project's `[bootstrap]`, `[dotfiles]` and `[dotfile_groups]`. Before, an untrusted repo could link files into `$HOME` or clone repositories. Global and system config still apply. [#​14110](https://redirect.github.com/jdx/mise/pull/14110)
- Node downloads are checked against the GPG signature for every version that publishes one. Before, only versions starting with `2` were checked. Set `node.gpg_verify = false` for mirrors without signatures. [#​14132](https://redirect.github.com/jdx/mise/pull/14132)
- `mise generate github-action` now uses `actions/checkout@v7` and `jdx/mise-action@v5` and no longer sets `MISE_EXPERIMENTAL`. `mise generate devcontainer` now adds `"postCreateCommand": "mise install"`. [#​14145](https://redirect.github.com/jdx/mise/pull/14145)
##### Deprecated
- `task.cache.stats_report`, `sops.age_recipients` and `plugin_autoupdate_last_check_duration` never had any effect. Setting one now prints a warning, and they will be removed in 2027.10.5. [#​14112](https://redirect.github.com/jdx/mise/pull/14112)
- `mise bootstrap launchd|systemd|macos-defaults`, the old `--only`/`--skip` part names (`launchd`, `systemd`, `defaults`, `shell`) and `mise direnv` now print a warning that names the replacement. They will be removed in 2027.10.4. [#​14113](https://redirect.github.com/jdx/mise/pull/14113)
##### Fixed
##### Tasks
- A raw or interactive task with `cache` enabled is now skipped when its sources are fresh and its cache key hasn't changed. Before, it ran every time. [#​14121](https://redirect.github.com/jdx/mise/pull/14121)
- A typo in `sources` that matches no files now prints a warning. `mise tasks deps <task>` now shows `depends_post` tasks. Scripts in `$MISE_CONFIG_DIR/tasks` load even without a global config file. [#​14122](https://redirect.github.com/jdx/mise/pull/14122)
- `mise run ./script` resolves relative to the current directory. [#​14120](https://redirect.github.com/jdx/mise/pull/14120)
- Script extensions are stripped only from file task names. [#​14159](https://redirect.github.com/jdx/mise/pull/14159)
- Requests to the remote task cache include the mbx-cache headers. [#​14147](https://redirect.github.com/jdx/mise/pull/14147)
- `mise generate task-stubs` skips hidden and global tasks. [#​14127](https://redirect.github.com/jdx/mise/pull/14127)
##### Shims and exec
- Shims, `mise x` and `mise env` no longer look up remote versions for lazy tools that aren't installed. With 20 lazy tools and no network, running an installed tool went from about 42s to 0.09s. [#​14063](https://redirect.github.com/jdx/mise/pull/14063)
- On Unix, a system wrapper that execs the same command name can no longer send an unconfigured shim into an endless loop. [#​14088](https://redirect.github.com/jdx/mise/pull/14088)
- Windows lazy shim names now match regardless of letter case. [#​14090](https://redirect.github.com/jdx/mise/pull/14090)
- `mise x [email protected]` installs the exact version when the version list times out, instead of failing with "couldn't exec process". [#​14164](https://redirect.github.com/jdx/mise/pull/14164)
- `mise doctor` recognizes a `mise` entry in the dedicated shims dir. [#​14069](https://redirect.github.com/jdx/mise/pull/14069)
##### Config, settings and CLI
- With an environment active and no `config.toml` yet, `mise use -g` creates `config.toml` instead of writing into `config.<env>.toml`. [#​14179](https://redirect.github.com/jdx/mise/pull/14179)
- Booleans set through `mise config set --type bool` and boolean settings accept `yes`/`no`/`1`/`0`. For `env.*` and other keys that aren't settings, only `true` and `false` become booleans, and anything else is stored as written. `mise latest tool@prefix:X` works, and `--log-level warn` is accepted. `mise doctor` prints the full chain when config fails to load. [#​14125](https://redirect.github.com/jdx/mise/pull/14125)
- Help output uses the command name you typed. [#​14123](https://redirect.github.com/jdx/mise/pull/14123)
- `mise edit` no longer overwrites an existing config when there is no terminal. [#​14124](https://redirect.github.com/jdx/mise/pull/14124)
- `.monorepo` markers are verified in paranoid mode. [#​14105](https://redirect.github.com/jdx/mise/pull/14105)
- Bad input now gives an error instead of a panic, in places including `mise config ls` and `mise prune` with an invalid tool version, the `--monorepo` flags, and `mise plugins uninstall --purge`. [#​14118](https://redirect.github.com/jdx/mise/pull/14118), [#​14094](https://redirect.github.com/jdx/mise/pull/14094) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562)), [#​14103](https://redirect.github.com/jdx/mise/pull/14103) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562)), [#​14116](https://redirect.github.com/jdx/mise/pull/14116), [#​14117](https://redirect.github.com/jdx/mise/pull/14117)
- `mise env --redacted` honors `redact = false` exclusions. `watch_files` hooks don't run in safe mode or with `--no-hooks`. [#​14109](https://redirect.github.com/jdx/mise/pull/14109), [#​14108](https://redirect.github.com/jdx/mise/pull/14108)
- `mise watch` passes watchexec flags through to watchexec. [#​14115](https://redirect.github.com/jdx/mise/pull/14115)
- Error and warning hints point at current commands, for example the PATH advice from `bootstrap remote` and the watchexec install hint. [#​14142](https://redirect.github.com/jdx/mise/pull/14142)
- If stderr can't be written to during a migration, mise no longer aborts. [#​14158](https://redirect.github.com/jdx/mise/pull/14158) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- When the default cache and temp directories overlap (the Windows default), temp files now go to `<temp>/mise-tmp`, so `mise cache clear` no longer deletes files that are still in use. [#​14134](https://redirect.github.com/jdx/mise/pull/14134)
##### Bootstrap and dotfiles
- `mise bootstrap` keeps writing the shell activation block into a startup file that is only tracked. [#​14135](https://redirect.github.com/jdx/mise/pull/14135)
- If one package manager fails, the others still run. [#​14138](https://redirect.github.com/jdx/mise/pull/14138)
- The firewall section is skipped on systems that don't support it. [#​14137](https://redirect.github.com/jdx/mise/pull/14137)
- Dry runs show hooks that use `exec()`. [#​14136](https://redirect.github.com/jdx/mise/pull/14136)
- Pulling onto a machine with no history now saves the files it replaces first, so `mise dot undo` restores them. `--replace-history` no longer fails on its first attempt. [#​14065](https://redirect.github.com/jdx/mise/pull/14065)
- `mise dot pull` says so when incoming history changes no files on this machine. [#​14066](https://redirect.github.com/jdx/mise/pull/14066)
##### Backends and plugins
- `mise install cargo:...` no longer uses an inactive `cargo-binstall` shim. It falls back to native binstall or `cargo install`. [#​14070](https://redirect.github.com/jdx/mise/pull/14070)
- With `npm.shell_out`, a mise shim from another data dir can no longer be run as `npm` and fork until the machine runs out of memory. [#​14084](https://redirect.github.com/jdx/mise/pull/14084) (originally found and fixed by [@​tfournet](https://redirect.github.com/tfournet))
- Java: changing `java.shorthand_vendor` takes effect without waiting for the cache to expire. Inline `java[release_type=ea]` is respected when listing and resolving versions. [#​14131](https://redirect.github.com/jdx/mise/pull/14131)
- Ruby precompiled URLs expand `{os}` and `{arch}` correctly. [#​14133](https://redirect.github.com/jdx/mise/pull/14133)
- `ls-remote` respects `disable_backends`. [#​14130](https://redirect.github.com/jdx/mise/pull/14130)
- SPM uses a custom `api_url` for cloning and skips lockfile URLs. [#​14129](https://redirect.github.com/jdx/mise/pull/14129)
- GitHub assets are size-checked even when there is no checksum. GitLab release lookups percent-encode the tag. [#​14128](https://redirect.github.com/jdx/mise/pull/14128), [#​14102](https://redirect.github.com/jdx/mise/pull/14102) ([@​thespags](https://redirect.github.com/thespags))
- Brew infers the formula version from the GitHub release tag path, and detaches a DMG left attached by an interrupted install. [#​14165](https://redirect.github.com/jdx/mise/pull/14165) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562)), [#​14177](https://redirect.github.com/jdx/mise/pull/14177)
- `git::` plugins install from a subdirectory, and `[plugins]` entries compare those sources correctly. Packslip entries in `[plugins]` install as vfox plugins. [#​14140](https://redirect.github.com/jdx/mise/pull/14140), [#​14150](https://redirect.github.com/jdx/mise/pull/14150) ([@​onokonem](https://redirect.github.com/onokonem)), [#​14141](https://redirect.github.com/jdx/mise/pull/14141)
- vfox: an env plugin with no source no longer makes every command fail. Embedded plugin files are found relative to the manifest directory. [#​14119](https://redirect.github.com/jdx/mise/pull/14119), [#​14167](https://redirect.github.com/jdx/mise/pull/14167)
##### Daemons and sandbox
- On Windows, deferred daemon commands are quoted for cmd.exe. Argv and Windows readiness probes run in the tool environment. [#​14055](https://redirect.github.com/jdx/mise/pull/14055), [#​14080](https://redirect.github.com/jdx/mise/pull/14080) ([@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- `--deny-env` clears inherited variables on Windows. On macOS, `allow_net` is rejected instead of writing invalid sandbox rules. [#​14107](https://redirect.github.com/jdx/mise/pull/14107), [#​14106](https://redirect.github.com/jdx/mise/pull/14106)
##### Security
- Remote task cache keys store env, `[vars]` and task arg values as `blake3:` digests instead of plaintext, so secret values are no longer uploaded. Existing cache entries miss once after upgrading. [#​14104](https://redirect.github.com/jdx/mise/pull/14104)
- URL credentials are redacted from HTTP debug logs and from npm Git-source and SSH diagnostics. [#​14155](https://redirect.github.com/jdx/mise/pull/14155), [#​14057](https://redirect.github.com/jdx/mise/pull/14057), [#​14064](https://redirect.github.com/jdx/mise/pull/14064)
##### Documentation
- The documentation site, CLI help and settings descriptions have been restructured and rewritten, and moved pages still resolve. [#​14097](https://redirect.github.com/jdx/mise/pull/14097), [#​14098](https://redirect.github.com/jdx/mise/pull/14098), [#​14096](https://redirect.github.com/jdx/mise/pull/14096), [#​14163](https://redirect.github.com/jdx/mise/pull/14163)
##### New Contributors
- [@​onokonem](https://redirect.github.com/onokonem) made their first contribution in [#​14150](https://redirect.github.com/jdx/mise/pull/14150)
- [@​max-sixty](https://redirect.github.com/max-sixty) made their first contribution in [#​14073](https://redirect.github.com/jdx/mise/pull/14073)
**Full Changelog**: <https://github.com/jdx/mise/compare/vfox-v2026.10.4...v2026.10.5>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.10.4`](https://redirect.github.com/jdx/mise/releases/tag/v2026.10.4): : Task-scoped fnox secrets, automatic global tool updates, and an opt-in identity install layout
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.10.3...vfox-v2026.10.4)
This release adds experimental task-scoped secrets backed by fnox, automatic updates for global tools, and an experimental opt-in install layout that names installations by what they contain. It also adds dotfile `merge` entries, `headers` auth for the `http:` backend, npm installs from git, and a set of prune, install and lockfile fixes.
##### Added
##### Secrets (experimental)
These need `mise settings experimental=true` and fnox 1.39.0 or newer. They are refused in safe mode.
- **`[secrets.fnox]` and `mise secrets ls`.** A project can name fnox as its secrets source in its own `mise.toml`. `mise secrets ls` lists key names and metadata but never values. `-J` prints JSON. Global, system and home-level `[secrets]` config is ignored, and `mise doctor` reports it. [#​13967](https://redirect.github.com/jdx/mise/pull/13967)
- **Tasks get only the secrets they list.** Add `secrets = [...]` to a task, or `#MISE secrets=[...]` in a file task header. Only that task gets the values, only while it runs, and they are redacted from its output. Dependencies, hooks, `mise env`, hook-env and shims get nothing. A task without grants never calls fnox. Tasks that list secrets need a trusted config, aren't artifact-cached, and ignore `--raw` unless the task sets `raw` or `interactive`. Hooks, `watch_files`, daemons and `mise bootstrap` can't run them, and remote or global-config tasks can't list secrets. [#​13974](https://redirect.github.com/jdx/mise/pull/13974)
```toml
min_version = "2026.10.4" # older mise rejects `secrets` on a task
[secrets.fnox]
profile = "prod"
[tasks.deploy]
depends = ["build"] # build receives nothing
secrets = ["DEPLOY_KEY", "DATABASE_URL"]
run = "./deploy.sh"
```
- **One-off grants from the command line.** `--secrets KEY[,KEY]` and `--secrets-all` work on `mise run`, `mise tasks run` and `mise x`. For `mise run`, only the tasks named on the command line get them, not their dependencies. `mise x` gets nothing unless you pass a flag, and it can't receive file secrets. Flags placed after the task name go to the task, and mise warns when that happens. [#​13975](https://redirect.github.com/jdx/mise/pull/13975)
```sh
mise run --secrets STRIPE_KEY deploy
mise x --secrets GH_TOKEN -- gh release list
```
- **`{{ secrets.X }}` in task env values.** A task can build an env var from a secret, for example `env.PGURL = "postgres://app:{{ secrets.DB_PASSWORD }}@db/app"`. The reference counts as the grant. References are rejected in `run`, `[env]`, `[vars]` and other fields. [#​13978](https://redirect.github.com/jdx/mise/pull/13978)
- **fnox daemon cache.** If the project's fnox config enables the daemon and it's running, an interactive run reads cached values over its socket without starting an fnox process. mise never starts the daemon itself. CI, non-TTY runs and Windows always use the fnox CLI. [#​13979](https://redirect.github.com/jdx/mise/pull/13979)
##### Automatic global tool updates
- **`auto_update` for global tools.** Set `auto_update` on a tool in your global config. When a shim or `mise x` is about to run that tool and its check interval is due, mise upgrades it within the configured range and then runs the new version. `true` uses the new `tool_update.check_duration` setting (default 24h), and a duration string sets that tool's own interval (minimum 1h). [#​14026](https://redirect.github.com/jdx/mise/pull/14026)
- Exact pins never update.
- It never runs offline, in CI, with `locked = true`, from tasks or hook-env, or from project configs.
- If an update fails, mise warns and runs the installed version. The failure shows in `mise doctor`.
```toml
# ~/.config/mise/config.toml
[tools]
claude = { version = "latest", auto_update = true }
node = { version = "22", auto_update = "6h" } # newest 22.x, never 23
```
- **Background `tool-update` service.** A built-in bootstrap service checks `auto_update` tools hourly, so launches don't wait for downloads and tools run directly from PATH under activation also stay current. It installs a systemd user unit, LaunchAgent or scheduled task. [#​14040](https://redirect.github.com/jdx/mise/pull/14040)
```toml
[bootstrap.services.mise-tool-update]
builtin = "tool-update"
```
##### Identity install layout (experimental, opt-in)
- **`install_layout = "identity"`.** With `experimental = true`, each installation lives in `installs/<label>-<hash>/`. The hash covers the canonical backend, version, platform and install-affecting options. `installs/<tool>/<version>` becomes a link to that directory, a real junction on Windows. As a result: [#​13951](https://redirect.github.com/jdx/mise/pull/13951)
- `age` and `aqua:FiloSottile/age` share one installation.
- Variants of one version with different options can exist side by side.
- Windows IDEs can follow the version links.
Existing installs keep working and aren't moved. Nothing changes unless you set this. `MISE_INSTALL_LAYOUT=identity` also turns it on. See the new install layout docs.
- On Windows, identity-layout installations go into the shorter `%LOCALAPPDATA%\mise\i\`, while version links stay in `installs\`. `MISE_INSTALL_STORE_DIR` sets the location on any platform. [#​13952](https://redirect.github.com/jdx/mise/pull/13952)
- `mise installs ls` lists installations as `selected`, `pinned` or `shared`. `mise installs select <dir>` chooses which installation requests without a lockfile use. When several installations match and none is selected, mise lists them instead of guessing. [#​13953](https://redirect.github.com/jdx/mise/pull/13953)
- `mise installs migrate [--dry-run] [TOOL[@VERSION]]` reinstalls legacy installations into the new layout and leaves a link at the old path. If a run is interrupted, the next run recovers it. [#​13955](https://redirect.github.com/jdx/mise/pull/13955)
- In the layout, `mise backends switch` installs the new backend's version and points the link at it. `mise where` and the other commands now resolve versions named on the command line the same way, and `mise where` lists variants instead of picking one. [#​13957](https://redirect.github.com/jdx/mise/pull/13957)
- `mise prune` handles templated tool versions such as `node = "{{ vars.node }}"`. It uses snapshots of what each project last rendered and keeps installs when it isn't sure they are unused. [#​14025](https://redirect.github.com/jdx/mise/pull/14025)
##### Other additions
- **Dotfile `merge` entries.** A `merge = true` entry sets only the keys from its source in a JSON, TOML or YAML file, and leaves keys added by the application (Codex, Claude Code, etc.) alone. TOML and YAML keep comments and formatting. `mise dot status` and `mise dot diff` only report drift in those keys. A target that doesn't parse is never overwritten. [#​14012](https://redirect.github.com/jdx/mise/pull/14012)
```toml
[dotfiles]
"~/.codex/config.toml/shared" = { source = "codex/shared.toml", merge = true }
```
- **`headers` for the `http:` backend.** You can now authenticate with bearer tokens or API keys, for example to download OCI blobs from `ghcr.io`. Values are templates. Headers are sent with downloads, `version_list_url` and `checksum_url` requests, and dropped on cross-host redirects unless the host is listed in `headers_forward`. Changing a token doesn't trigger a reinstall. [#​14022](https://redirect.github.com/jdx/mise/pull/14022)
```toml
[tools."http:polaris"]
version = "0.9.2"
headers = { Authorization = "Bearer {{ env.GITHUB_TOKEN | b64_encode }}" }
```
- **npm packages from git.** `git+` URLs and `github:`, `gitlab:` and `bitbucket:` specs now install. The version is a git ref, and `latest` is the default branch. [#​14044](https://redirect.github.com/jdx/mise/pull/14044)
```sh
mise use 'npm:github:owner/[email protected]'
```
- **`settings.write_targets`.** Sends new global `[tools]`, `[bootstrap.packages]` and `[dotfiles]` entries to separate `conf.d` files. Existing entries are updated where they're already declared. [#​14018](https://redirect.github.com/jdx/mise/pull/14018)
```toml
[settings.write_targets]
tools = "~/.config/mise/conf.d/10-tools.toml"
dotfiles = "~/.config/mise/conf.d/30-dotfiles.toml"
```
- **`prune.exclude`** (or `MISE_PRUNE_EXCLUDE`) lists tools that `mise prune`, `mise ls --prunable` and upgrade pruning never remove. Short and full names both work, e.g. `node` or `aqua:BurntSushi/ripgrep`. [#​14030](https://redirect.github.com/jdx/mise/pull/14030)
- **`lockfile_auto_prune = false`** keeps lockfile entries for tools missing from the active config. This is useful when profiles share one lockfile. The default (`tr
> [!IMPORTANT]
> ✂ PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `6f81e89` → `2c2dff7` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | digest | `5a5a84b` → `74935e7` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
# Why
Re-implementation of #714 on top of #715.
# How
Prompt:
> add new error for pg code 55P03, use PR 714 as reference but a new error class
# Test Plan
CI
# Why
While reviewing #714, noticed that it was probably better if these knex/postgres-specific errors live in their package rather than the root package.
This is a breaking change but one that is detectable via tsc so within the scope of what's allowed via minor version bump.
# How
Have claude move them. Prompt:
> move knex-specific entity errors into the entity-database-adapter-knex package. no need for backwards
compatibility
# Test Plan
CI
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `718f745` → `6f81e89` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) | [`10.4.0` → `10.5.1`](https://renovatebot.com/diffs/npm/ip-address/10.4.0/10.5.1) |  |  |
---
### ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
[CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910) / [GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc)
<details>
<summary>More information</summary>
#### Details
##### Summary
No classifier on `Address6` recognizes the NAT64 local-use range `64:ff9b:1::/48` (RFC 8215). `isPrivate()`, `isLoopback()`, `isLinkLocal()` and their siblings all return `false` for every address in it, so an internal IPv4 destination written through a local-use NAT64 prefix (`64:ff9b:1:7f00:0:100::` for `127.0.0.1`, `64:ff9b:1:a9fe:a9:fe00::` for `169.254.169.254`) reads as an ordinary global address. `getType()` names the range `'NAT64 (local-use)'`, so the library knows what the address is and classifies it as nothing.
An application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.
##### Details
The fix for GHSA-22jq-vg5j-6vgg (10.2.1) classifies IPv4-mapped (`::ffff:0:0/96`) and NAT64 well-known (`64:ff9b::/96`) addresses by their embedded IPv4 address: `embeddedIPv4()` in `src/ipv6.ts` decodes the trailing 32 bits and every special-use classifier delegates to the resulting `Address4`. Those are the only two ranges `embeddedIPv4()` handles.
The local-use range differs in kind from the well-known prefix, which is why extending the decoder does not fix it. RFC 8215 reserves `64:ff9b:1::/48` so an operator can carve their own NAT64 prefix out of it, of any length RFC 6052 allows (`/48`, `/56`, `/64`, or `/96`). Where the IPv4 address sits depends on that choice: `127.0.0.1` is `64:ff9b:1:7f00:0:100::` under a `/48` prefix and `64:ff9b:1::7f00:1` under a `/96` prefix, and each of those decodes to a different address under the other prefix length. There is no single embedded IPv4 address for the library to classify by.
What is well-defined is the range as a whole. The IANA IPv6 Special-Purpose Address Registry lists `64:ff9b:1::/48` as not globally reachable, and Python's `ipaddress` module reports `is_private` as `True` and `is_global` as `False` for every address in it. `isPrivate()` covered ULA (`fc00::/7`) plus the decoded mapped and well-known cases, and nothing in the local-use range.
##### Affected versions
`>= 10.2.0, <= 10.5.0`. The `is*` classification API was extended to `Address6` in 10.2.0; releases before it do not expose the method and are not affected through this vector.
##### Impact
Every address in `64:ff9b:1::/48` parses successfully, `isValid()` is `true`, and no classifier catches it. Which internal target is reached depends on the NAT64 prefix deployed on the server's network; the well-known prefix column is the patched control from GHSA-22jq-vg5j-6vgg.
| Internal target | Well-known form | Classified | Local-use form (`/48` prefix) | Classified |
|---|---|---|---|---|
| `127.0.0.1` | `64:ff9b::7f00:1` | loopback | `64:ff9b:1:7f00:0:100::` | nothing |
| `10.0.0.1` | `64:ff9b::a00:1` | private | `64:ff9b:1:a00:0:100::` | nothing |
| `169.254.169.254` | `64:ff9b::a9fe:a9fe` | link-local | `64:ff9b:1:a9fe:a9:fe00::` | nothing |
| `192.168.1.1` | `64:ff9b::c0a8:101` | private | `64:ff9b:1:c0a8:1:100::` | nothing |
##### Reachability
Reaching an internal host through one of these addresses requires that the server's network run a NAT64 translator on a prefix inside `64:ff9b:1::/48` and that the attacker guess or know the prefix length. That is the same precondition the well-known prefix carries (a translator on `64:ff9b::/96`), with the additional constraint that the prefix is operator-chosen rather than fixed. The severity reflects that precondition.
##### Proof of concept
`npm i [email protected]`, then:
```js
const { Address6 } = require('ip-address');
// A guard of the shape the library documents.
function isBlocked(host) {
const a = new Address6(host);
return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();
}
for (const h of ['64:ff9b::7f00:1', '64:ff9b:1:7f00:0:100::', '64:ff9b:1::7f00:1']) {
console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', new Address6(h).getType());
}
```
On affected versions:
```
BLOCK 64:ff9b::7f00:1 -> getType() NAT64 (well-known)
ALLOW 64:ff9b:1:7f00:0:100:: -> getType() NAT64 (local-use)
ALLOW 64:ff9b:1::7f00:1 -> getType() NAT64 (local-use)
```
##### Remediation
Upgrade to the patched release. In the fix, `isPrivate()` returns `true` for every address in `64:ff9b:1::/48`, alongside ULA and the decoded mapped and well-known cases. The range is reported private as a whole rather than by a decoded IPv4 address, for the reason given above; `toAddress4Nat64(prefix)` remains the way to decode an address under a known deployment prefix. `isLoopback()` and `isLinkLocal()` are unchanged for this range, since without the prefix length the library cannot know which IPv4 address is embedded.
If you cannot upgrade immediately, test the range directly:
```js
const NAT64_LOCAL_USE = new Address6('64:ff9b:1::/48');
const localUse = new Address6(host).isHostInSubnet(NAT64_LOCAL_USE);
```
##### A note on SSRF defense
These methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the *resolved* IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.
#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N`
#### References
- [https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910)
- [https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8](https://redirect.github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8)
- [https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.5.1)
- [https://github.com/advisories/GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc)
This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>beaugunderson/ip-address (ip-address)</summary>
### [`v10.5.1`](https://redirect.github.com/beaugunderson/ip-address/compare/v10.5.0...38b02d73cfc0724f9ad61c65b6328e116eac03ec)
[Compare Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.5.0...v10.5.1)
### [`v10.5.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.5.0)
[Compare Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.4.0...v10.5.0)
##### What's Changed
- Honor the fromURL graceful-failure contract for non-IPv6 hosts by [@​beaugunderson](https://redirect.github.com/beaugunderson) in [#​218](https://redirect.github.com/beaugunderson/ip-address/pull/218)
- Correct the documentation where it disagreed with the library by [@​beaugunderson](https://redirect.github.com/beaugunderson) in [#​219](https://redirect.github.com/beaugunderson/ip-address/pull/219)
**Full Changelog**: <https://github.com/beaugunderson/ip-address/compare/v10.4.0...v10.5.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | digest | `86c951e` → `5a5a84b` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `8a1efc5` → `718f745` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `298e5b3` → `8a1efc5` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | digest | `4ef4dbc` → `86c951e` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [jdx/mise](https://redirect.github.com/jdx/mise) | patch | `v2026.9.2` → `v2026.9.7` |
---
### Release Notes
<details>
<summary>jdx/mise (jdx/mise)</summary>
### [`v2026.9.7`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.7): : Lockfile revision 2 with npm and Python dependency graphs, dotfile conflict inspection
[Compare Source](https://redirect.github.com/jdx/mise/compare/v2026.9.6...v2026.9.7)
This release introduces `mise.lock` revision 2, which records complete transitive dependency graphs for npm tools (via embedded aube) and Python tools (via uv) in native sidecar files, and adds `mise bootstrap dotfiles conflicts` for inspecting dotfile sync conflicts before resolving them. It also lets dotfile templates consume bootstrap secrets, stops `minimum_release_age` from rejecting versions already committed to a lockfile, and closes a security gap in `history.describe_command`.
##### Added
- **lock:** Lockfile revision 2 records the full dependency graph of npm tools installed by embedded aube and of `pypi:` tools installed by uv, then replays it with a strict frozen install so two projects on the same top-level version can still receive their own reviewed transitive graph. Graphs live in native sidecar files (`uv.lock` / `aube-lock.yaml` plus a manifest) under `.mise/locks/<backend-tool>/<version>/`, referenced from `mise.lock` by relative path and SHA-256 digest, so the lockfile itself stays small. Commit the sidecar directory with `mise.lock`. New lockfiles use revision 2; existing revision 0 and 1 files keep their format until you run `mise lock --upgrade`. `mise lock --bump <tool>` refreshes a tool's transitive graph even when its top-level version is unchanged, ordinary `mise install` validates and accepts hand-edited sidecars, and `mise install --locked` rejects digest mismatches until you run `mise lock`. Python graph locking requires uv 0.12.10 or newer and published wheels for the target platform; Git sources, standalone pipx installs, and free-form `uvx_args`/`pipx_args` stay version-only. ([#​13131](https://redirect.github.com/jdx/mise/pull/13131), [#​13146](https://redirect.github.com/jdx/mise/pull/13146) by [@​jdx](https://redirect.github.com/jdx))
```sh
mise lock --upgrade # move an existing lockfile to revision 2 and resolve graphs
mise install --locked # replay the recorded graphs
mise lock --bump pypi:black # refresh Black's dependencies without changing its version
```
- **pypi:** `pypi:` is now the preferred name for the Python CLI backend; `pipx:` remains fully supported as an alias with no warnings, and settings accept both `pypi.*` and `pipx.*` names. The two spellings are distinct tool identities (`pypi-black` vs `pipx-black` install directories and lock entries), so switching spelling creates a new installation. ([#​13146](https://redirect.github.com/jdx/mise/pull/13146) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `mise bootstrap dotfiles conflicts [PATH...]` shows a read-only comparison of the saved local and fetched remote versions of a conflicted dotfile so you can decide between `--take-remote` and `--keep-local` with full context. The default output is a unified diff including file-mode changes; `--difftool` opens the configured Git `diff.tool` (falling back to `merge.tool`) and `--tool <name>` picks one explicitly. Encrypted contents are decrypted only into private temporary files, and inspection never modifies either side or marks the conflict resolved. Bootstrap secrets are also now resolved from the same composed config maps as dotfile discovery, so root-scoped dotfile templates can use secrets declared by their bootstrap root. ([#​13144](https://redirect.github.com/jdx/mise/pull/13144) by [@​jdx](https://redirect.github.com/jdx))
```sh
mise bootstrap dotfiles conflicts ~/.config/mise/config.toml
mise bootstrap dotfiles conflicts --difftool ~/.config/mise/config.toml
```
- **dotfiles:** Dotfile templates (`mode = "template"`) can reference `[bootstrap.secrets]` values with `{{ secret(name="...") }}`, matching managed bootstrap file templates. Dotfiles commands that render templates (`add`, `apply`, `diff`, `edit`, `status`, `unapply`) accept `--prompt-secrets`; without an available value, rendering fails closed. A full `mise bootstrap` run preflights dotfile templates before making changes, `mise bootstrap status` reports secrets used only by dotfiles, and textual diffs redact resolved secret values. ([#​13140](https://redirect.github.com/jdx/mise/pull/13140) by [@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.secrets]
api_token = "EXAMPLE_API_TOKEN"
[dotfiles."~/.config/example/credentials"]
source = "dotfiles/credentials.tmpl"
mode = "template"
```
##### Fixed
- **lock:** Installing from a committed `mise.lock` no longer fails when the locked release is younger than `minimum_release_age`. The cutoff still applies when resolving unlocked fuzzy requests and when generating or bumping a lockfile, and `npm:`/`pypi:` still forward it to unpinned transitive dependencies, but a reviewed lock entry now reproduces immediately in CI instead of waiting for the release to cool. ([#​13128](https://redirect.github.com/jdx/mise/pull/13128) by [@​jdx](https://redirect.github.com/jdx))
- **config:** A `.python-version` (or other idiomatic version file) containing `system` selects the system interpreter without printing the mise-specific `@system` deprecation warning, matching the existing `.tool-versions` exception. Explicit `python@system` requests from mise configuration or command arguments still warn. ([#​13132](https://redirect.github.com/jdx/mise/pull/13132) by [@​jdx](https://redirect.github.com/jdx))
- **npm:** Embedded aube is updated to 2.2.16, fixing the Bun checksum install regression and ensuring local npm tarballs keep their manifest package name. ([#​13145](https://redirect.github.com/jdx/mise/pull/13145) by [@​jdx](https://redirect.github.com/jdx))
- **registry:** The `mc` shorthand uses `aqua:minio/mc` again now that the upstream Aqua registry entry is restored, with `asdf:mise-plugins/mise-mc` kept as the fallback. ([#​13124](https://redirect.github.com/jdx/mise/pull/13124) by [@​jdx](https://redirect.github.com/jdx))
##### Security
- **history:** `history.describe_command` is now global-only. Previously an implicitly trusted project could set it and have a later dotfiles history checkpoint execute the project-controlled command with unencrypted tracked-file diffs. The setting is honored only from system/global configuration or `MISE_HISTORY_DESCRIBE_COMMAND`; project values are ignored with a warning. ([#​13134](https://redirect.github.com/jdx/mise/pull/13134) by [@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci build` now renders dotfile templates with a restricted engine: `secret()` is rejected and the `env` context, `get_env()`, `exec()`, and `read_file()` are unavailable, so ambient credentials cannot be baked into a publishable image layer. ([#​13140](https://redirect.github.com/jdx/mise/pull/13140) by [@​jdx](https://redirect.github.com/jdx))
##### Breaking Changes
- **Lockfile revision 2 is not readable by older mise versions.** Newly created lockfiles use revision 2, and existing files switch only when you run `mise lock --upgrade`. Upgrade collaborators and CI to this release before committing a revision 2 `mise.lock`, and commit the `.mise/locks/` (or `.config/mise/locks/`) sidecar directory alongside it. Revision 2 `--locked` installs fail if a recorded graph is missing or its digest does not match. If you gitignore `mise.local.lock`, also ignore its matching sidecar subdirectory (for example `.mise/locks/mise.local/`).
- **`history.describe_command` in project configuration is ignored.** Move it to `~/.config/mise/config.toml` or set `MISE_HISTORY_DESCRIBE_COMMAND`.
- **`mise oci build` dotfile templates** can no longer call `secret()`, `get_env()`, `exec()`, or `read_file()` or read the `env` context.
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.9.6...v2026.9.7>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.9.6`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.6): : Project daemons, mise doctor project, and vfox backend tool discovery
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.5...v2026.9.6)
This release adds experimental project daemons backed by pitchfork, a `mise doctor project` command for project-declared diagnostic checks, and tool discovery from vfox backend plugins in `mise search`. It also changes the HTTP backend's default install layout so uninstall and prune reclaim disk space, speeds up warm `lockfile_mode = "generate"` installs and repeated OCI builds, and fixes a batch of nushell, monorepo, lockfile, brew, and Windows bootstrap issues.
#### Highlights
- **Services next to tools:** `[daemons]` declares background processes and PostgreSQL/Redis presets in `mise.toml`, managed through `mise daemons` and optionally started when you enter the project. `[doctor.checks.<name>]` lets projects declare their own environment probes for `mise doctor project`.
- **Discovery and output:** `mise search`, shell completion, and interactive `mise use` now include tools published by installed vfox backend plugins, and `settings.truncate` / `--no-truncate` disable terminal-width truncation (automatically when a coding agent is detected).
- **Storage and speed:** HTTP tools now extract into their own install directory by default (opt back into deduplication with `shared_extraction = true`), warm generate-mode installs skip needless lockfile rewrites, and OCI builds share a local tool-layer cache.
#### Added
- **daemons:** New experimental `[daemons]` section and `mise daemons` command family (`start`, `stop`, `restart`, `ls`, `status`, `logs`, `tui`) manage project background processes with pitchfork. PostgreSQL and Redis presets install the database as a tool (participating in lockfiles), supply connection environment variables and readiness checks, and keep project data across stop/start. Daemons with `auto = ["start", "stop"]` start when entering the project from an activated Bash, Zsh, or Fish shell and are released when the last shell session leaves. Requires `experimental = true` and pitchfork 2.25.0 or later; database presets are Unix-only and PostgreSQL uses loopback trust authentication intended for local development. ([#​13085](https://redirect.github.com/jdx/mise/pull/13085) by [@​jdx](https://redirect.github.com/jdx))
```toml
[settings]
experimental = true
[daemons]
postgres = "18"
redis = "8"
[daemons.web]
run = "npm run dev"
port = 3000
auto = ["start", "stop"]
```
- **doctor:** `mise doctor project` runs checks declared in `[doctor.checks.<name>]` with the project's environment and installed tools, reporting PASS/FAIL/error/skipped per check in text or `--json`. Checks support `description`, `hint`, `timeout` (default `10s`), `dir`, `shell`, and `os` selectors, run concurrently under the `jobs` limit, and exit nonzero when any check fails. Ordinary `mise doctor` does not run them, and hints are never executed. A follow-up aligned `dir` resolution with task conventions (config root for project configs including `~/mise.toml`, `~/` expansion), fixed head-of-line blocking when one probe hangs, and kept `nohup mise doctor project` alive on SIGHUP. ([#​13062](https://redirect.github.com/jdx/mise/pull/13062), [#​13089](https://redirect.github.com/jdx/mise/pull/13089) by [@​jdx](https://redirect.github.com/jdx))
```toml
[doctor.checks.openssl]
description = "OpenSSL development files are discoverable"
run = "pkg-config --exists openssl"
hint = "Run `mise bootstrap packages apply` to install the declared build dependencies."
timeout = "5s"
os = ["linux", "macos"]
```
- **vfox:** Tools provided by installed vfox backend plugins now appear in `mise search`, shell completion, and interactive `mise use`, namespaced as `<plugin>:<tool>`. Plugins can implement `BackendListTools` for a finite catalog and/or `BackendSearchTools` for query-driven discovery in large ecosystems; a prefixed query like `npm:eslint` is routed only to that plugin. Results are cached, slow plugins fall back to stale cache, and existing plugins need no changes. `mise registry` remains registry-only. ([#​13111](https://redirect.github.com/jdx/mise/pull/13111) by [@​jdx](https://redirect.github.com/jdx))
- **cli:** New `settings.truncate` (and `MISE_TRUNCATE`, default `true`) controls terminal-width shortening of table cells and task metadata. `mise ls`, `mise config ls`, and `mise bootstrap dotfiles status` gain `--truncate` / `--no-truncate`, and output is kept complete automatically when a known coding agent is detected. ([#​13112](https://redirect.github.com/jdx/mise/pull/13112) by [@​jdx](https://redirect.github.com/jdx))
```sh
mise bootstrap dotfiles status --no-truncate
```
- **bootstrap:** `[bootstrap.macos.dock]` gains `apps`, an ordered list of pinned application paths. Status compares identity and order (ignoring Dock-added metadata), apply adds, removes, and reorders application tiles while preserving other tiles and `persistent-others`, and an empty list removes all application tiles. Paths must be absolute or home-relative `.app` bundles. ([#​13075](https://redirect.github.com/jdx/mise/pull/13075) by [@​azohra](https://redirect.github.com/azohra))
```toml
[bootstrap.macos.dock]
apps = [
"/System/Applications/Utilities/Terminal.app",
"/Applications/Firefox.app",
]
```
- **bootstrap:** `mise bootstrap packages where brew:<formula>` prints an installed formula's stable `opt` root (for example `/opt/homebrew/opt/unzip`), so scripts can put keg-only executables on PATH without hardcoding the Homebrew prefix or Cellar version. Missing installs exit nonzero with empty stdout. ([#​13083](https://redirect.github.com/jdx/mise/pull/13083) by [@​himkt](https://redirect.github.com/himkt))
- **dotfiles:** Destination `variants` can omit `source` when every variant sets a `target`; the entry key is then resolved as a relative path under `settings.dotfiles.root` instead of next to `mise.toml`. Parent traversal is rejected. ([#​13087](https://redirect.github.com/jdx/mise/pull/13087) by [@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles."vscode/settings.json"]
mode = "copy"
variants = [
{ os = "macos", target = "~/Library/Application Support/Code/User/settings.json" },
{ os = "linux", target = "~/.config/Code/User/settings.json" },
]
```
- **fmt:** `mise fmt` now sorts lists whose order has no meaning: `redactions` lexically, and task `sources`/`outputs`, `task_templates` sources/outputs, `task_config.global_inputs`, and `input_groups` by reach (`@group:` references, then globs, then literal paths). Lists containing `!` exclusions, entries starting with template syntax, or comments are left untouched, and precedence-sensitive lists such as `env_file`, `tools.*`, `includes`, and `depends` are never sorted. ([#​13058](https://redirect.github.com/jdx/mise/pull/13058) by [@​jrandolf](https://redirect.github.com/jrandolf))
- **oci:** `mise oci build` gains `--no-cache` to bypass the new local tool-layer cache; entries live under each tool's cache directory and are removed by `mise cache clear TOOL`. ([#​13056](https://redirect.github.com/jdx/mise/pull/13056) by [@​jdx](https://redirect.github.com/jdx))
#### Changed
- **http:** New `http:` installations extract directly into their own install directory, so `mise uninstall` and `mise prune` now remove their files instead of leaving payloads in `$MISE_DATA_DIR/http-tarballs/`. Set `shared_extraction = true` on a tool to keep the previous deduplicated symlink layout. Existing symlinked installs keep working; `mise install --force <tool>` migrates one to independent files without disturbing other installs that share the content. Legacy `http-tarballs` entries are not reclaimed automatically. Shared raw and compressed binary caches now also include the executable filename in their key, so differently named tools no longer reuse the wrong filename. ([#​13059](https://redirect.github.com/jdx/mise/pull/13059) by [@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci push --no-cache` now bypasses both the remote registry cache and the local tool-layer cache. ([#​13056](https://redirect.github.com/jdx/mise/pull/13056) by [@​jdx](https://redirect.github.com/jdx))
- **registry:** `postgres`, `redis`, and `mongodb` now prefer `conda:` backends, installing prebuilt conda-forge binaries in seconds instead of compiling through vfox; vfox and asdf remain as fallbacks. `conda:redis-server` covers Linux and macOS only. ([#​13061](https://redirect.github.com/jdx/mise/pull/13061) by [@​jdx](https://redirect.github.com/jdx))
#### Performance
- **lockfile:** Warm `mise install` runs in `lockfile_mode = "generate"` skip scheduling work for tools whose artifact metadata is already reusable, and skip rebuilding, serializing, and staging the lockfile entirely when nothing was installed and the on-disk lock already matches (preserving comments in the file). Explicit `mise lock`, forced provenance verification, upgrades, and new platforms still regenerate. ([#​13101](https://redirect.github.com/jdx/mise/pull/13101), [#​13103](https://redirect.github.com/jdx/mise/pull/13103) by [@​jdx](https://redirect.github.com/jdx))
- **oci:** `mise oci push --from BASE` no longer downloads base layers when the base and target live in the same repository, and `oci build`, `oci run`, and `oci push` share a local cache of packaged tool layers keyed on file contents, so repeated builds with overlapping tools skip tar and gzip work. ([#​13055](https://redirect.github.com/jdx/mise/pull/13055), [#​13056](https://redirect.github.com/jdx/mise/pull/13056) by [@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **nushell:** `mise activate nu` no longer throws `env_variable_not_found` on every prompt or `cd` when a variable to hide is absent from the current scope; `hide-env` is now wrapped in `try`, matching the no-op behavior of other shells. ([#​13071](https://redirect.github.com/jdx/mise/pull/13071) by [@​i-api](https://redirect.github.com/i-api))
- **task:** Task-level tools are now auto-installed for tasks referenced from `run` entries, including names rendered at runtime, right before they execute; `--skip-tools` is honored and install failures are reported as task failures without blocking siblings. ([#​13086](https://redirect.github.com/jdx/mise/pull/13086) by [@​jdx](https://redirect.github.com/jdx))
- **config:** `[monorepo]` settings are now merged across same-directory config layers (base plus `mise.<env>.toml` overlays): omitted fields are inherited, an overlay's `config_roots` replaces the base list, and `monorepo_root = false` in an overlay disables the root and its descendant trust. ([#​13084](https://redirect.github.com/jdx/mise/pull/13084) by [@​jdx](https://redirect.github.com/jdx))
- **lockfile:** Runtime tool requests such as `mise which hk --tool hk@latest` now use the lockfile belonging to the config that effectively defines the tool, instead of merging project and global pins and reporting a false "multiple resolutions" ambiguity or selecting an overridden pin. `mise which --tool` warns when a lower-precedence config has a matching pin the effective config lacks. ([#​13042](https://redirect.github.com/jdx/mise/pull/13042) by [@​nettlesh](https://redirect.github.com/nettlesh))
- **lockfile:** Complete lockfile generation for Packslip tools skips platforms with no published artifact while still writing supported targets, and a verified Packslip signer may now replace legacy `github-attestations` metadata on upgrade instead of being rejected as a provenance downgrade. ([#​13102](https://redirect.github.com/jdx/mise/pull/13102), [#​13105](https://redirect.github.com/jdx/mise/pull/13105) by [@​jdx](https://redirect.github.com/jdx))
- **upgrade:** `mise upgrade` now detects updates between letter-suffixed versions such as tmux `3.7b` to `3.7c`; `sub-N` aliases keep resolving numeric components as before. ([#​13119](https://redirect.github.com/jdx/mise/pull/13119) by [@​jdx](https://redirect.github.com/jdx))
- **brew:** Formulae that are keg-only solely because macOS ships them (such as `brew:zip` and `brew:unzip`) are now linked into `<prefix>/bin` on Linux, matching Homebrew. Kegs installed by earlier mise versions stay unlinked until the next `mise bootstrap packages upgrade` or a reinstall. ([#​13108](https://redirect.github.com/jdx/mise/pull/13108) by [@​lil-lon](https://redirect.github.com/lil-lon))
- **brew-cask:** Tap casks with `preflight_steps` or `postflight_steps` no longer fail during metadata extraction; declarative `run` steps are captured as structured steps and executed by mise, with support for `must_succeed = false`. ([#​13060](https://redirect.github.com/jdx/mise/pull/13060) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `mise bootstrap remote` on Windows now finds `ssh.exe` and `tar.exe` on PATH instead of failing with `required command 'ssh' not found`. ([#​13117](https://redirect.github.com/jdx/mise/pull/13117) by [@​JamBalaya56562](https://redirect.github.com/JamBalaya56562))
- **bootstrap:** macOS defaults status explains type mismatches, showing for example `2 (real; expected integer)` instead of two identical-looking values marked `differs`. ([#​13096](https://redirect.github.com/jdx/mise/pull/13096) by [@​jdx](https://redirect.github.com/jdx))
- **dotfiles:** `mise bootstrap dotfiles track` honors the global `yes` setting for confirmations, and warns when tracking a symlink whose resolved source is not itself tracked, suggesting the command to enroll it. ([#​13072](https://redirect.github.com/jdx/mise/pull/13072) by [@​nettlesh](https://redirect.github.com/nettlesh), [#​13095](https://redirect.github.com/jdx/mise/pull/13095) by [@​jdx](https://redirect.github.com/jdx))
- **schema:** The JSON schema now models Git directory `manifest` dotfile entries, restricting explicit modes to `copy` or `symlink-each` and rejecting combinations with inline content or file-edit fields. ([#​12741](https://redirect.github.com/jdx/mise/pull/12741) by [@​risu729](https://redirect.github.com/risu729))
- **asdf:** `mise asdf install` and `mise asdf reshim` no longer re-enter the full CLI dispatch, avoiding stack overflows on small-stack Linux environments; `asdf install` now follows the same implicit config trust as `mise install`. Bash completions are regenerated for the updated usage-rs word-break handling. ([#​13114](https://redirect.github.com/jdx/mise/pull/13114) by [@​jdx](https://redirect.github.com/jdx))
#### Registry
- Added `mpv` (`conda:mpv`, Linux and macOS) ([#​13049](https://redirect.github.com/jdx/mise/pull/13049) by [@​i-api](https://redirect.github.com/i-api)), `agent-browser` (`aqua:vercel-labs/agent-browser`) ([#​13088](https://redirect.github.com/jdx/mise/pull/13088) by [@​3w36zj6](https://redirect.github.com/3w36zj6)), and `himalaya` (`github:pimalaya/himalaya`) ([#​13091](https://redirect.github.com/jdx/mise/pull/13091) by [@​i-api](https://redirect.github.com/i-api)).
- `editorconfig-checker` installs again after 4.0.1 renamed its assets and executable; the shorthand now uses the GitHub backend. ([#​13098](https://redirect.github.com/jdx/mise/pull/13098) by [@​jdx](https://redirect.github.com/jdx))
- `mc` installs from MinIO's GitHub releases instead of the retired Aqua download URL that returned HTTP 410. ([#​13113](https://redirect.github.com/jdx/mise/pull/13113) by [@​jdx](https://redirect.github.com/jdx))
#### Documentation
- The docs landing page gains interactive diagrams for project environment switching, bootstrap machine resources, tool configuration precedence, artifact cache execution, and tracked dotfile synchronization. ([#​13065](https://redirect.github.com/jdx/mise/pull/13065), [#​13066](https://redirect.github.com/jdx/mise/pull/13066), [#​13067](https://redirect.github.com/jdx/mise/pull/13067), [#​13068](https://redirect.github.com/jdx/mise/pull/13068), [#​13069](https://redirect.github.com/jdx/mise/pull/13069) by [@​jdx](https://redirect.github.com/jdx))
- The task-running guide is reorganized around finding and running tasks, passing arguments, then controlling execution. ([#​13077](https://redirect.github.com/jdx/mise/pull/13077) by [@​azohra](https://redirect.github.com/azohra))
#### New Contributors
- [@​lil-lon](https://redirect.github.com/lil-lon) made their first contribution in [#​13108](https://redirect.github.com/jdx/mise/pull/13108)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.9.5...v2026.9.6>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.9.5`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.5): : macOS defaults, per-platform dotfiles, and complete lockfiles
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.4...vfox-v2026.9.5)
This release deepens macOS bootstrap support with current-host and nested defaults, lets dotfiles and tasks adapt to the platform and to parsed arguments, and adds an opt-in trial of complete lockfile generation. It also carries a batch of install progress, self-update, brew-cask, and sandbox fixes.
#### Added
- **bootstrap:** New `[[bootstrap.macos.defaults_entries]]` blocks let you set macOS preferences explicitly with `domain`, `key`, `value`, and an optional `host` (`any` by default, or `current`), covering preferences normally written via `defaults -currentHost` while keeping the existing `[bootstrap.macos.defaults]` shorthand. Entries also accept an optional `path` to patch a nested dictionary value without replacing its siblings, preserving property-list types and creating missing parents. ([#​12983](https://redirect.github.com/jdx/mise/pull/12983) by [@​azohra](https://redirect.github.com/azohra), [#​12984](https://redirect.github.com/jdx/mise/pull/12984) by [@​azohra](https://redirect.github.com/azohra))
```toml
[[bootstrap.macos.defaults_entries]]
domain = "com.apple.dock"
key = "autohide"
value = true
host = "current"
```
- **bootstrap:** More friendly macOS preferences: Finder folder sorting and default cloud save location, Dock autohide delay and timing (integers or floats), and keyboard automatic capitalization and spelling correction, all using snake\_case names consistent with the existing sections. ([#​13032](https://redirect.github.com/jdx/mise/pull/13032) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** `[bootstrap.files]` and `[bootstrap.directories]` entries gain `phase = "pre-packages"` so repository definitions, apt sources, and signing keys can be applied before package installation instead of only afterward. Existing declarations default to `"post-packages"`. ([#​13052](https://redirect.github.com/jdx/mise/pull/13052) by [@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.files."/etc/apt/sources.list.d/vendor.sources"]
source = "./files/vendor.sources"
phase = "pre-packages"
```
- **bootstrap:** Ordinary `[bootstrap.files]` templates can now reference resolved `[vars]` values, alongside the existing `config_root`, `target`, and `secret()` helpers. ([#​13033](https://redirect.github.com/jdx/mise/pull/13033) by [@​nettlesh](https://redirect.github.com/nettlesh))
- **dotfiles:** A single dotfiles source can deploy to different destinations per operating system, architecture, or mise profile using `variants` with an optional `target`. This works for `copy`, `symlink`, `symlink-each`, and `template` modes. ([#​13050](https://redirect.github.com/jdx/mise/pull/13050) by [@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles.settings]
source = "dotfiles/vscode/settings.json"
mode = "copy"
variants = [
{ os = "macos", target = "~/Library/Application Support/Code/User/settings.json" },
{ os = "linux", target = "~/.config/Code/User/settings.json" },
]
```
- **task:** Task `sources` and `outputs` can now use `{{usage.*}}` templates, resolved per invocation from parsed arguments and flags before freshness and artifact-cache checks run, so different argument values track freshness independently. ([#​13051](https://redirect.github.com/jdx/mise/pull/13051) by [@​jdx](https://redirect.github.com/jdx))
- **brew-cask:** Casks with structured `set_permissions` preflight/postflight steps now install correctly (for example `brew-cask:blender`), running an unprivileged `chmod` over resolved staged or appdir paths instead of failing with an unsupported step-type error. ([#​13043](https://redirect.github.com/jdx/mise/pull/13043) by [@​azohra](https://redirect.github.com/azohra))
- **lock:** Opt-in trial of complete lockfile generation via `lockfile_mode = "generate"` (or `MISE_LOCKFILE_MODE=generate`). The default remains incremental `merge`. Generate mode rebuilds lockfiles from current requests while treating the previous file as an immutable baseline, reusing unchanged artifacts and publishing through staged atomic writes so failures or concurrent edits do not clobber a good lockfile. This mode records only cryptographically verified provenance per target platform; `provenance_verified` is no longer treated as a trust signal. ([#​13031](https://redirect.github.com/jdx/mise/pull/13031) by [@​jdx](https://redirect.github.com/jdx))
- **self-update:** New `disable_update_warning` setting (`MISE_DISABLE_UPDATE_WARNING`) suppresses "newer mise available" notices in `mise version`, `mise --version`, and `mise doctor`. Explicit self-update and automatic updates are unaffected. ([#​13028](https://redirect.github.com/jdx/mise/pull/13028) by [@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **install:** Interactive installs no longer leave a permanent line for every resolved, skipped, or already-installed tool; live progress shows what is happening while the final summary lists what changed (for example `installed 1 tool in 1.1s: [email protected]`). `mise upgrade` no longer duplicates its old to new version list. ([#​13030](https://redirect.github.com/jdx/mise/pull/13030) by [@​jdx](https://redirect.github.com/jdx))
- **install:** Long non-TTY installs no longer flood CI logs with a snapshot every three seconds. The heartbeat now scales to roughly 10% of elapsed time, clamped between 3 seconds and 1 minute. ([#​13036](https://redirect.github.com/jdx/mise/pull/13036) by [@​jdx](https://redirect.github.com/jdx))
- **self-update:** On 32-bit ARM, `mise self-update` now selects the correct `linux-armv7` archive instead of requesting a missing `linux-arm` one and falling back to an ARM64 binary that failed signature verification. A missing archive now fails asset selection rather than picking the wrong architecture. ([#​13023](https://redirect.github.com/jdx/mise/pull/13023) by [@​jdx](https://redirect.github.com/jdx))
- **self-update:** npm installs now ship the instructions file that redirects update guidance to the package manager, so they no longer advertise `mise self-update`. ([#​13028](https://redirect.github.com/jdx/mise/pull/13028) by [@​jdx](https://redirect.github.com/jdx))
- **brew-cask:** `mise bootstrap packages upgrade` no longer replaces the bundle of a running self-updating app (for example Chrome), which could strand helper processes and blank out tabs. Such apps are skipped while running and left to update themselves. ([#​13041](https://redirect.github.com/jdx/mise/pull/13041) by [@​azohra](https://redirect.github.com/azohra))
- **brew-cask:** The cask metadata fetch error no longer includes stale advice about installing with `brew` and a broken documentation anchor; it now gives a short, accurate message. ([#​12800](https://redirect.github.com/jdx/mise/pull/12800) by [@​Marukome0743](https://redirect.github.com/Marukome0743))
- **bootstrap:** `mise bootstrap dotfiles origin set <url>` now uses the repository's own default branch when `--branch` is omitted, so repositories on `master` connect correctly instead of publishing a second root branch. A missing requested branch is now reported clearly rather than mistaken for an empty repository. ([#​13037](https://redirect.github.com/jdx/mise/pull/13037) by [@​Dhaulagiri](https://redirect.github.com/Dhaulagiri))
- **dotfiles:** History watcher locks now live alongside the history store in the state directory instead of being hashed into the cache directory, so a launchd watcher and an interactive shell using different cache directories coordinate correctly and `dotfiles status` no longer misreports `declared-not-running`. Existing watchers must be stopped and restarted with the updated binary. ([#​13038](https://redirect.github.com/jdx/mise/pull/13038) by [@​ascarter](https://redirect.github.com/ascarter))
- **sandbox:** The macOS Seatbelt profile now allows `file-read-metadata` on the ancestors of readable paths, fixing `Operation not permitted` failures when a portable Ruby resolves its own executable during third-party tap evaluation. Symlinked data directories and allow-listed paths are also handled. ([#​13039](https://redirect.github.com/jdx/mise/pull/13039) by [@​Marukome0743](https://redirect.github.com/Marukome0743))
#### Registry
- Added `clipboard` ([github:Slackadays/Clipboard](https://redirect.github.com/Slackadays/Clipboard)) by [@​i-api](https://redirect.github.com/i-api) in [#​13044](https://redirect.github.com/jdx/mise/pull/13044)
#### New Contributors
- [@​Dhaulagiri](https://redirect.github.com/Dhaulagiri) made their first contribution in [#​13037](https://redirect.github.com/jdx/mise/pull/13037)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.9.4...v2026.9.5>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.9.4`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.4): : Nix Bootstrap, Environment Selectors, and Man Pages
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.3...vfox-v2026.9.4)
This release expands the bootstrap package model with Nix support and environment selectors, teaches packslip tools to ship man pages, and adds a task-scoped quiet setting. It also carries a wide batch of packslip, bootstrap, and cross-platform fixes plus a major speedup to dotfiles history rebuilds.
#### Added
- **bootstrap:** Nix is now a built-in `[bootstrap.packages]` manager on Linux and macOS. Declare packages with the `nix:` prefix and apply them through your normal Nix profile; the manager supports use, apply, status JSON, and targeted upgrades while leaving Nix sources, caches, trust, and profile rollback under Nix control. This also adds `mise bootstrap packages export --format nix` to emit a deterministic NixOS module from your `nix:` declarations and `packages use --no-install` to record declarations without touching package managers. ([#​13013](https://redirect.github.com/jdx/mise/pull/13013) by [@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"nix:ripgrep" = "latest"
```
- **bootstrap:** `[bootstrap.packages]` entries gain an `env` selector (a single environment or a list), so a package is only enabled when one of its listed mise environments is active via `-E` or `MISE_ENV`. When both `os` and `env` are set, both must match. Packages for inactive environments stay declared and are protected from pruning. ([#​12956](https://redirect.github.com/jdx/mise/pull/12956) by [@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"brew:postgresql" = { version = "latest", env = ["dev", "test"] }
```
- **packslip:** Packslip-installed tools can now ship man pages declared as static `man` resources, alongside completions and agent skills. While a tool version is active, mise prepends its man root to `MANPATH` and keeps system and caller-defined paths visible, so `man <tool>` works. Existing installs need to be reinstalled to pick up man pages. ([#​13012](https://redirect.github.com/jdx/mise/pull/13012) by [@​jdx](https://redirect.github.com/jdx))
- **task:** New `task.quiet` setting (and `MISE_TASK_QUIET`) suppresses mise's own task messages, prefixes, and command-echo headers without hiding task output or affecting other commands. The bundled `output = "quiet"` mode is deprecated in favor of explicit output style plus this setting; removal is scheduled for 2027.9.3. ([#​12980](https://redirect.github.com/jdx/mise/pull/12980) by [@​jdx](https://redirect.github.com/jdx))
#### Fixed
- **install:** A lazy tool whose `depends` target is also lazy now installs correctly on first use through a shim, `mise x`, or a task; mise installs the provider together with its still-missing configured dependencies instead of failing the preflight. ([#​12997](https://redirect.github.com/jdx/mise/pull/12997) by [@​balintant](https://redirect.github.com/balintant))
- **backend:** 32-bit ARM resolution now uses Go's canonical `arm` architecture name for Aqua (so registry replacements apply), and automatic GitHub release asset selection no longer picks a generic `source.tar.gz` when no published binary targets the host. ([#​13004](https://redirect.github.com/jdx/mise/pull/13004) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** Homebrew bottles with hard-linked Mach-O executables are now signed correctly on macOS. Every hard-link alias is tracked and included in the signing list after relocation, fixing cases like fish where an aliased binary was killed with SIGKILL after a successful install. ([#​12988](https://redirect.github.com/jdx/mise/pull/12988) by [@​nettlesh](https://redirect.github.com/nettlesh))
- **packslip:** `mise lock --platform` now verifies the signed release manifest and records the correct URL, checksum, size, and signer for each requested target platform (including Windows x64), so locked installs work across platforms. ([#​13002](https://redirect.github.com/jdx/mise/pull/13002) by [@​jdx](https://redirect.github.com/jdx))
- **packslip:** On glibc Linux, an artifact's `glibc_min` is now honored during selection: when the GNU build requires a newer glibc than the host, mise falls back to a matching static musl build if one exists. ([#​13009](https://redirect.github.com/jdx/mise/pull/13009) by [@​jdx](https://redirect.github.com/jdx))
- **packslip:** Windows installs now link shims with the correct `.exe` filename, while Unix keeps extensionless names. ([#​13006](https://redirect.github.com/jdx/mise/pull/13006) by [@​jdx](https://redirect.github.com/jdx))
- **packslip:** Activated man roots are now scoped to Packslip-backed tool versions, and the caller's original `MANPATH` is included in the environment-cache identity so one cached process cannot serve another caller's `MANPATH`. ([#​13016](https://redirect.github.com/jdx/mise/pull/13016) by [@​jdx](https://redirect.github.com/jdx))
- **prune:** `mise prune` no longer exits successfully without pruning when it cannot show a confirmation prompt; it now fails with guidance to pass `--yes` or set `MISE_YES=1`. Follow-up prunes from commands like `mise unuse` still leave installs in place when nobody can answer. ([#​13003](https://redirect.github.com/jdx/mise/pull/13003) by [@​jdx](https://redirect.github.com/jdx))
- **generate:** `mise generate tool-stub` now respects a stub's top-level `os` selector when deciding whether to write a Windows `.cmd` launcher, so a linux/macos-only stub no longer produces a launcher even with `--lock`. ([#​13008](https://redirect.github.com/jdx/mise/pull/13008) by [@​jdx](https://redirect.github.com/jdx))
- **dotfiles:** History path filters resolve correctly when `HOME` is a symlink, so aliased, canonical, and tilde paths address the same history entry and `show latest`/`diff` no longer report a missing checkpoint. ([#​12982](https://redirect.github.com/jdx/mise/pull/12982) by [@​azohra](https://redirect.github.com/azohra))
- **brew:** The published crate now includes the tap formula and cask metadata shims, fixing `cargo install --locked mise` builds from crates.io. ([#​13001](https://redirect.github.com/jdx/mise/pull/13001) by [@​jdx](https://redirect.github.com/jdx))
#### Changed
- **bootstrap:** `[bootstrap].config_roots` and the `mise bootstrap config-roots` command are now deprecated (hidden from help and removed from public docs), with removal scheduled for mise 2027.3.3. Existing configurations keep working during the compatibility window but emit a warning directing users to global or system bootstrap configuration. ([#​13010](https://redirect.github.com/jdx/mise/pull/13010) by [@​jdx](https://redirect.github.com/jdx))
- **registry:** Added basecamp to the registry. ([#​13024](https://redirect.github.com/jdx/mise/pull/13024))
#### Performance
- **history:** Dotfiles history index rebuilds are dramatically faster, reconstructing checkpoint metadata in-process with gix instead of spawning Git per checkpoint. On an 80-checkpoint, 44-file reproducer this cut a rebuild from roughly 26-28 seconds and thousands of Git processes down to under a second. Removed annotations are now correctly dropped after a rebuild, and SHA-256 history repositories are supported. ([#​13011](https://redirect.github.com/jdx/mise/pull/13011) by [@​jdx](https://redirect.github.com/jdx))
#### Deprecated
- The task `output = "quiet"` mode (use `task.quiet` instead; removal in 2027.9.3) ([#​12980](https://redirect.github.com/jdx/mise/pull/12980)).
- `[bootstrap].config_roots` and `mise bootstrap config-roots` (removal in mise 2027.3.3) ([#​13010](https://redirect.github.com/jdx/mise/pull/13010)).
#### New Contributors
- [@​balintant](https://redirect.github.com/balintant) made their first contribution in [#​12997](https://redirect.github.com/jdx/mise/pull/12997)
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.9.3...v2026.9.4>
#### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
### [`v2026.9.3`](https://redirect.github.com/jdx/mise/releases/tag/v2026.9.3): : Winget bootstrap, signed vfox plugins, and faster inline commands
[Compare Source](https://redirect.github.com/jdx/mise/compare/vfox-v2026.9.2...vfox-v2026.9.3)
This release brings Windows bootstrap into the package-manager era with WinGet support, extends the packslip signing model to vfox plugins, and speeds up simple tasks by skipping the shell on Unix. It also carries a batch of bootstrap, sandbox, and Windows ARM64 fixes.
##### Added
- **bootstrap:** WinGet is now a built-in `[bootstrap.packages]` manager on Windows, so `mise bootstrap packages` can check status, install, and upgrade apps by exact package ID. It supports version pins, source refresh, and automatic source-agreement acceptance. Scoop, Chocolatey, and package removal remain future work. ([#​12928](https://redirect.github.com/jdx/mise/pull/12928) by [@​jdx](https://redirect.github.com/jdx))
```toml
[bootstrap.packages]
"winget:Microsoft.PowerShell" = "latest"
```
- **vfox:** External vfox plugins can now be installed from signed packslip archives instead of a Git clone, reusing the packslip backend's release selection, signature verification, digest checks, and signer pins. This is aimed at non-registry plugins; registry defaults and embedded plugins are unchanged. ([#​12948](https://redirect.github.com/jdx/mise/pull/12948) by [@​jdx](https://redirect.github.com/jdx))
```sh
mise plugins install vfox:bfs 'packslip:mise-plugins/vfox-bfs#0.1.0'
```
- **bootstrap:** Dotfile line edits gain `position = "prepend"` to insert a managed line at the top of a file instead of appending (the default). An existing exact match is left in place, and unrelated bytes, CRLF endings, and a UTF-8 BOM are preserved. ([#​12941](https://redirect.github.com/jdx/mise/pull/12941) by [@​jdx](https://redirect.github.com/jdx))
```toml
[dotfiles]
"/etc/zshrc/zdotdir" = { line = 'ZDOTDIR=$HOME/.config/zsh/', position = "prepend" }
```
- **bootstrap:** macOS bootstrap `defaults` now support nested TOML arrays and tables (for example Dock `persistent-apps`), reading and writing preferences through Core Foundation so booleans, numbers, strings, arrays, and dictionaries keep their plist types. Collections apply as whole-value replacements; datetimes and binary plist data are still skipped with a warning. ([#​12947](https://redirect.github.com/jdx/mise/pull/12947) by [@​jdx](https://redirect.github.com/jdx))
##### Changed
- **bootstrap:** Adopting global configuration or a shared dotfile-history setup repository is now spelled `mise bootstrap --adopt` (and `mise bootstrap remote --adopt`), separate from `mise bootstrap --from` for running a bootstrap project. The dotfiles, history, setup, and services guides were reorganized to lead with usable examples. The previous `--from-git` spelling still works as a hidden alias but warns and is scheduled for removal in mise 2026.10.0. ([#​12953](https://redirect.github.com/jdx/mise/pull/12953) by [@​jdx](https://redirect.github.com/jdx))
##### Fixed
- **github:** Git operations (clones, fetches, submodules) that GitHub now challenges with HTTP 401 on public repositories can authenticate using mise's existing GitHub token sources via a command-scoped `github.com` HTTPS credential helper. Tokens are kept out of command arguments and URLs, and Enterprise hosts are out of scope. ([#​12945](https://redirect.github.com/jdx/mise/pull/12945) by [@​jdx](https://redirect.github.com/jdx))
- **config:** The default inline task shell is now `sh -o errexit -c` so shells that consume the argument right after `-c` (such as FreeBSD sh) run your command instead of trying to execute `-o`. ([#​12949](https://redirect.github.com/jdx/mise/pull/12949) by [@​jdx](https://redirect.github.com/jdx))
- **windows:** Fixed two Windows ARM64 issues: stale command-wrapper shims (like a leftover `cargo.exe`) that caused recursive `.exe`/`.cmd` dispatch after shim-mode changes are now pruned, and Aqua ARM64 emulation candidates apply the registry's `amd64` replacement so tools like LuaLS resolve their published `win32-x64` assets. ([#​12931](https://redirect.github.com/jdx/mise/pull/12931) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** Bootstrap no longer aborts on Arch when `pacman -Q` prints a file advisory for a missing package that shares its name with a directory in the current working directory (for example a `fish/` folder in a dotfiles checkout). ([#​12932](https://redirect.github.com/jdx/mise/pull/12932) by [@​nettlesh](https://redirect.github.com/nettlesh))
- **sandbox:** Read-restricted macOS Seatbelt profiles now allow metadata-only access to `/private`, fixing startup failures for load-relative binaries like Ruby 4.0.6 when run under `/private/tmp`. Directory listings and descendant reads stay denied. ([#​12940](https://redirect.github.com/jdx/mise/pull/12940) by [@​jdx](https://redirect.github.com/jdx))
- **bootstrap:** The macOS notification helper is now built and Developer ID-signed at release time and spawned with a start handshake, so short `dotfiles sync` runs no longer race the helper and macOS accepts it. Unsigned source builds (such as Homebrew) disable notifications and warn during origin setup. ([#​12946](https://redirect.github.com/jdx/mise/pull/12946) by [@​jdx](https://redirect.github.com/jdx))
- **vfox:** vfox install phases now flow through the active install progress reporter, mapping noisy download, checksum, attestation, and extraction lines into concise phases instead of scrolling log output. ([#​12944](https://redirect.github.com/jdx/mise/pull/12944) by [@​jdx](https://redirect.github.com/jdx))
- **java:** The `java -version` banner shown during install verification now stays inside the interactive install progress row instead of printing to the terminal. ([#​12943](https://redirect.github.com/jdx/mise/pull/12943) by [@​jdx](https://redirect.github.com/jdx))
- **version:** The auto-update hint from `mise version` now uses the `mise settings auto_update=true` syntax to match the rest of `mise settings`. ([#​12957](https://redirect.github.com/jdx/mise/pull/12957) by [@​jdx](https://redirect.github.com/jdx))
##### Performance
- On Unix, plain inline commands (like `node build.js`) now run directly when a conservative planner deems them safe, skipping the shell wrapper. Anything involving shell syntax, quoting, expansion, builtins, ambiguous PATH lookup, explicit shell settings, or sandboxed/audited tasks still uses the shell, and Windows is unchanged. In a microbenchmark of short commands this cut about 11% off elapsed time. ([#​12950](https://redirect.github.com/jdx/mise/pull/12950) by [@​jdx](https://redirect.github.com/jdx))
##### Registry
- Added cargo-deny, kingfisher, nushell, shellharden, sherif, and tauri-cli. ([#​12938](https://redirect.github.com/jdx/mise/pull/12938) by [@​jrandolf](https://redirect.github.com/jrandolf))
##### Documentation
- Restored the prominent project name and pronunciation on the homepage. ([#​12936](https://redirect.github.com/jdx/mise/pull/12936) by [@​jdx](https://redirect.github.com/jdx))
- Dropped the "you need Git installed" prerequisite from the install docs. ([#​12958](https://redirect.github.com/jdx/mise/pull/12958) by [@​jdx](https://redirect.github.com/jdx))
**Full Changelog**: <https://github.com/jdx/mise/compare/v2026.9.2...v2026.9.3>
##### 💚 Sponsor mise
mise is built and maintained by [@​jdx](https://redirect.github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work.
If mise saves you or your team time, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep mise fast, free, and independent.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@jest/globals](https://redirect.github.com/jestjs/jest) ([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest-globals)) | [`30.4.1` → `30.5.1`](https://renovatebot.com/diffs/npm/@jest%2fglobals/30.4.1/30.5.1) |  |  |
| [jest](https://jestjs.io/) ([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest)) | [`30.4.2` → `30.5.1`](https://renovatebot.com/diffs/npm/jest/30.4.2/30.5.1) |  |  |
---
### Release Notes
<details>
<summary>jestjs/jest (@​jest/globals)</summary>
### [`v30.5.1`](https://redirect.github.com/jestjs/jest/blob/HEAD/CHANGELOG.md#3051)
[Compare Source](https://redirect.github.com/jestjs/jest/compare/v30.5.0...v30.5.1)
##### Fixes
- `[jest-config]` Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of `--projects` when no root config is passed ([#​16411](https://redirect.github.com/jestjs/jest/pull/16411))
- `[jest-config, jest-types]` Stop accepting `reporters`, `coverageReporters`, `workerIdleMemoryLimit`, `cwd` and `runnerOptions` in a project config - they were silently ignored, and now warn like the other global-only options ([#​16411](https://redirect.github.com/jestjs/jest/pull/16411))
- `[jest-config, jest-validate]` Warn about `maxWorkers` and `coverageThreshold` in a project config instead of dropping them without a word ([#​16411](https://redirect.github.com/jestjs/jest/pull/16411))
- `[jest-resolve]` Match `moduleNameMapper` patterns against the specifier as written again (reverting [#​16390](https://redirect.github.com/jestjs/jest/pull/16390)) ([#​16417](https://redirect.github.com/jestjs/jest/pull/16417))
- `[jest-runtime]` Resolve package `imports` specifiers like `#dep` under ESM again ([#​16413](https://redirect.github.com/jestjs/jest/pull/16413))
##### Chore & Maintenance
- `[jest-util]` Name the `testEnvironmentOptions.globalsCleanup` option and link the docs from the `JEST-01` deprecation warning, and document the option's modes ([#​16404](https://redirect.github.com/jestjs/jest/pull/16404))
### [`v30.5.0`](https://redirect.github.com/jestjs/jest/blob/HEAD/CHANGELOG.md#3050)
[Compare Source](https://redirect.github.com/jestjs/jest/compare/v30.4.1...v30.5.0)
##### Features
- `[@jest/expect-utils, jest-mock]` Add `mockFn.whenCalledWith(...args)` for configuring return values per argument list, with first-class asymmetric-matcher support ([#​16053](https://redirect.github.com/jestjs/jest/pull/16053))
- `[@jest/expect-utils]` Export `AsymmetricMatcher` and `FunctionParameters` types (previously private to `expect`) ([#​16053](https://redirect.github.com/jestjs/jest/pull/16053))
- `[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types]` `--collectTests` now expands `test.each`/`describe.each` cases and reports per-status counts (skipped/todo via the new `wouldRun` flag for selected tests) plus a summary line that match a real run, including under `--testNamePattern` and `.only`/`fdescribe` focus on both the circus and jasmine2 runners ([#​16259](https://redirect.github.com/jestjs/jest/pull/16259))
- `[jest-circus, jest-environment, jest-runtime, jest-types]` Add describe-level retries via `jest.retryTimes(..., {entireDescribe: true})` ([#​16322](https://redirect.github.com/jestjs/jest/pull/16322))
- `[jest-circus, jest-message-util, jest-reporters, jest-types]` Add `retryMessages` to `AssertionResult` and export `formatErrorStack`, so the retry log renders nested `cause` and `AggregateError` sections with code frames instead of serialized `[cause]:`/`[errors]:` markers ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-circus, jest-types]` Add `unhandledErrorsDetailed` to `Circus.RunResult`, so an unhandled rejection reports its `cause` chain and `AggregateError` entries with code frames instead of a pre-serialized stack ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-haste-map]` Replace `NodeWatcher` and `FSEventsWatcher` with `@parcel/watcher` for the non-watchman watch path ([#​16188](https://redirect.github.com/jestjs/jest/pull/16188))
- `[jest-resolve]` Bump `unrs-resolver` to 1.12.1, remove `jest-pnp-resolver` and unnecessary checks ([#​15721](https://redirect.github.com/jestjs/jest/pull/15721))
- `[jest-resolve]` Honor Node's `--preserve-symlinks` / `NODE_PRESERVE_SYMLINKS` in the default resolver by passing `symlinks: false` to `unrs-resolver` ([#​16260](https://redirect.github.com/jestjs/jest/pull/16260))
- `[jest-runtime]` Apply automocking and manual `__mocks__` files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic `import()` and `require()` of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Route `process.getBuiltinModule` through the sandbox, so it returns the sandbox `process` and the hooked `node:module` instead of the host's ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Throw an actionable error from `module.register()` and `module.registerHooks()` inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Throw `ERR_SOURCE_PHASE_NOT_DEFINED` with an actionable message for `import source` and `import.source()`, instead of failing at instantiation with V8's bare "Source phase import object is not defined" ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first ([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Set `import.meta.main` to `true` in the test file and `false` in every module it loads, matching Node 24+ ([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Resolve the `module-sync` export condition, so a package that exposes its ESM entry point for `require()` loads the same file Node would ([#​16336](https://redirect.github.com/jestjs/jest/pull/16336))
- `[jest-snapshot]` Add external snapshot paths to custom reporter failure details ([#​16374](https://redirect.github.com/jestjs/jest/pull/16374))
##### Fixes
- `[jest-console, jest-reporters]` `CustomConsole` now buffers console output so `TestResult.console` is populated for reporters when `verbose` is enabled, while `GitHubActionsReporter` avoids replaying buffered output in verbose mode ([#​16155](https://redirect.github.com/jestjs/jest/pull/16155))
- `[expect, jest-message-util, jest-pattern, jest-regex-util, jest-util]` Revert `node:` protocol imports to restore webpack/browser-bundle compatibility ([#​16167](https://redirect.github.com/jestjs/jest/pull/16167))
- `[expect]` Widen `toMatchObject` and `objectContaining` parameter type from `Record<string, unknown>` to `object` so class instances are accepted ([#​16196](https://redirect.github.com/jestjs/jest/pull/16196))
- `[jest-circus]` Call a generator test body with the shared test context, so `this` matches what a regular test function receives ([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus]` Capture the error listeners of the parent process instead of the in-sandbox `process`, so listeners registered before the test file survive teardown and sandbox listeners no longer leak onto the parent ([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus]` Clear `currentlyRunningTest` after skipped and todo tests ([#​16342](https://redirect.github.com/jestjs/jest/pull/16342))
- `[jest-circus]` Prevent late `done()` callbacks from affecting later test or hook invocations ([#​16343](https://redirect.github.com/jestjs/jest/pull/16343))
- `[jest-circus, jest-jasmine2]` Honor `--expand` when formatting `node:assert` failures, instead of always collapsing the diff ([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus, jest-jasmine2, jest-message-util]` Serialize the inner errors of an `AggregateError` into `failureMessages`, `retryReasons` and `unhandledErrors`, so `--json` output and reporter annotations include them ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-circus, jest-snapshot]` Keep snapshot state and counts correct when a test retries ([#​16344](https://redirect.github.com/jestjs/jest/pull/16344))
- `[@jest/create-cache-key-function]` Include the caller support flags in the generated key, so a transformer that emits ESM or CJS based on them no longer shares one cache entry between the two ([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[@jest/create-cache-key-function]` Include the stringified project config in the generated key, so editing a transformer's own settings invalidates what it cached ([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[@jest/transform]` Include the caller support flags in a transform's cache key, so a file transformed both as ESM and as CJS no longer serves one shape's output for the other ([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[jest-config]` Add missing `findRelatedTests`, `outputFile`, and `replname` entries to `ValidConfig` so they no longer trigger spurious "Unknown option" warnings ([#​16224](https://redirect.github.com/jestjs/jest/pull/16224))
- `[jest-config]` Use `--config` for the global config when multiple `--projects` are specified ([#​16273](https://redirect.github.com/jestjs/jest/pull/16273))
- `[jest-core]` Serialize `bigint` values in `--json` and `--outputFile` output as their literal form (`4n`), instead of failing the run with `TypeError: Do not know how to serialize a BigInt` ([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-core]` Do not report a `CustomGC` async resource (used by N-API addons such as napi-rs for per-isolate GC bookkeeping) as an open handle, since it is `napi_unref`'d by the addon and can never keep the event loop alive ([#​16379](https://redirect.github.com/jestjs/jest/pull/16379))
- `[jest-each]` Keep a `$&`, `` $` ``, `$'` or `$$` inside a `%p` param value out of the replacement, so the title shows the value instead of the text around it ([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-each]` Interpolate a `bigint` into a `%j` title as its literal form (`"4n"`) at any depth, instead of throwing `TypeError: Do not know how to serialize a BigInt` while collecting the tests ([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-environment, jest-runtime]` Bind `sandboxInjectedGlobals` to the right values when `injectGlobals` is `false`, instead of shifting every one of them by a position ([#​16377](https://redirect.github.com/jestjs/jest/pull/16377))
- `[jest-environment-node, jest-util]` Only warn about a conflicting `globalsCleanup` mode when one was explicitly configured, and follow the mode that is actually in effect ([#​16323](https://redirect.github.com/jestjs/jest/pull/16323))
- `[jest-environment-node, jest-util]` Stop resolving lazy globals when setting up an environment, so Node 26's builtin module globals are no longer loaded (and no longer emit their deprecation warnings) for every test file ([#​16324](https://redirect.github.com/jestjs/jest/pull/16324))
- `[jest-haste-map]` Keep watch mode alive when an outside process briefly makes a file unreadable on Windows, instead of tearing the watcher down on `EPERM` ([#​16295](https://redirect.github.com/jestjs/jest/pull/16295))
- `[jest-haste-map]` Keep indexing when an outside process holds a file open on Windows, instead of failing the whole crawl on `EPERM` ([#​16358](https://redirect.github.com/jestjs/jest/pull/16358))
- `[jest-haste-map]` Keep a duplicated manual mock resolving when the file it pointed at is deleted in watch mode ([#​16360](https://redirect.github.com/jestjs/jest/pull/16360))
- `[jest-haste-map]` Shut the worker farm down when a duplicate manual mock aborts the build under `throwOnModuleCollision` ([#​16354](https://redirect.github.com/jestjs/jest/pull/16354))
- `[jest-haste-map]` Attach the watchman client's `error` listener before the first command, so a watchman failure falls back to the node crawler instead of crashing on an unhandled `error` event, and always end the client ([#​16355](https://redirect.github.com/jestjs/jest/pull/16355))
- `[jest-haste-map]` Stop delivering watch events after `WatchmanWatcher` is closed, and route its warnings through the configured console ([#​16355](https://redirect.github.com/jestjs/jest/pull/16355))
- `[jest-haste-map]` Restore the nested `duplicates` index correctly in `ModuleMap.fromJSON`, so a haste collision reported inside a test worker raises `DuplicateHasteCandidatesError` instead of a `TypeError` ([#​16353](https://redirect.github.com/jestjs/jest/pull/16353))
- `[jest-haste-map]` Match watched files on a full extension, so `moduleFileExtensions: ['js']` no longer accepts `foo.mjs` ([#​16352](https://redirect.github.com/jestjs/jest/pull/16352))
- `[jest-haste-map]` Delimit the fields that make up the haste map cache key, so two different option sets cannot hash to the same cache file ([#​16352](https://redirect.github.com/jestjs/jest/pull/16352))
- `[jest-message-util]` Print the inner errors of an `AggregateError` thrown inside a test ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Indent nested `cause` and `AggregateError` sections of a test failure by one level per depth, so the nesting is legible instead of rendering flat ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Color stack traces line by line so blank lines stay blank ([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Detect Jest's own frames without assuming the checkout directory's name, and cover `@jest/*` packages, so stack traces and code frames point at user code ([#​16326](https://redirect.github.com/jestjs/jest/pull/16326))
- `[jest-mock]` `mockResolvedValue` / `mockRejectedValue` now see all overload return types, so a Promise-returning overload survives even when a later overload returns a non-Promise (e.g. `pg.Client['end']`) ([#​16237](https://redirect.github.com/jestjs/jest/pull/16237))
- `[@jest-environment/jsdom-abstract]` Make `@types/jsdom` a peer dependency ([#​16166](https://redirect.github.com/jestjs/jest/pull/16166))
- `[jest-mock]` Remove the leftover own accessor descriptor when restoring a `spyOn` of an inherited getter or setter, so the instance keeps reflecting the prototype ([#​16226](https://redirect.github.com/jestjs/jest/pull/16226))
- `[jest-resolve]` Include `extensionsToTreatAsEsm` in the `shouldLoadAsEsm` cache key, so projects with different extension lists don't read each other's answers ([#​16369](https://redirect.github.com/jestjs/jest/pull/16369))
- `[jest-resolve]` Make `getModuleIDAsync` build and cache `data:` URI module IDs the same way as `getModuleID` ([#​16370](https://redirect.github.com/jestjs/jest/pull/16370))
- `[jest-resolve]` Keep the `node:` prefix when resolving a core module asynchronously, so a builtin that only exists prefixed (`node:sea`, `node:sqlite`, `node:test`, `node:test/reporters`) resolves instead of failing as a missing bare package ([#​16388](https://redirect.github.com/jestjs/jest/pull/16388))
- `[jest-resolve]` Look up manual mocks for `node:` protocol specifiers under the unprefixed name they are stored as ([#​16388](https://redirect.github.com/jestjs/jest/pull/16388))
- `[jest-resolve]` Apply `moduleNameMapper` consistently to both spellings of core module specifiers (`fs` vs `node:fs`) ([#​16390](https://redirect.github.com/jestjs/jest/pull/16390))
- `[jest-resolve]` Keep virtual and ordinary mock module IDs isolated across test files ([#​16296](https://redirect.github.com/jestjs/jest/pull/16296))
- `[jest-resolve]` Guard missing `require.resolve.paths` ([#​16052](https://redirect.github.com/jestjs/jest/pull/16052))
- `[jest-resolve, jest-config, jest-runner]` Support a user resolver written as an ES module ([#​16332](https://redirect.github.com/jestjs/jest/pull/16332))
- `[jest-resolve, jest-runtime]` Throw the CJS parse error for ESM syntax in a `"type": "commonjs"` package or a `.cjs` file instead of loading it as ESM, matching Node ([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[@jest/source-map]` Keep source map sources that name a scheme, such as `webpack:///`, instead of resolving them into a path that does not exist ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[@jest/source-map]` Look up `--testLocationInResults` positions at the right column, and keep a mapping to the first column instead of discarding it ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[@jest/source-map]` Warn when a source map cannot be parsed, instead of silently leaving its frames untranslated ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runner, @jest/source-map]` Keep a source-mapped stack for an error thrown after the test environment was torn down ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runtime, @jest/source-map]` Keep source maps past teardown and past the next test file's `install`, so a stack from a file no earlier stack mentioned still points at the original source ([#​16330](https://redirect.github.com/jestjs/jest/pull/16330))
- `[jest-runtime]` Report that no coverage was collected when `getAllV8CoverageInfoCopy` is called after `teardown`, instead of returning an empty result ([#​16385](https://redirect.github.com/jestjs/jest/pull/16385))
- `[jest-runtime]` Cache a CJS module's parsed exports before walking its re-exports, so two modules that re-export each other no longer overflow the stack when imported from ESM ([#​16363](https://redirect.github.com/jestjs/jest/pull/16363))
- `[jest-runtime]` Keep a re-exported ES module's parse failure from marking the re-exporting CommonJS file as ESM, so `module.exports = require('./dep.mjs')` loads instead of failing with `module is not defined` ([#​16363](https://redirect.github.com/jestjs/jest/pull/16363))
- `[jest-runtime]` Scope module mocks instantiated inside `jest.isolateModules`/`isolateModulesAsync` to that block, so a mock first imported there no longer outlives it - matching how CommonJS mocks already behave ([#​16365](https://redirect.github.com/jestjs/jest/pull/16365))
- `[jest-runtime]` Suspend module isolation while generating an automock, so loading the real module to read its shape no longer populates the isolated registry ([#​16365](https://redirect.github.com/jestjs/jest/pull/16365))
- `[jest-runtime]` Check a cached ES module's status before `require()` returns it, so a module whose evaluation threw rethrows that error and one left linked by a failed sibling is evaluated instead of returning uninitialized bindings ([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Report the original `ERR_REQUIRE_ASYNC_MODULE` when a `require()` of a top-level-await graph is retried, instead of a spurious "concurrent `import()`" error ([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Throw the evaluation error when another caller's `import()` of the same module failed while we awaited it, instead of resolving with the errored module ([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Mark the result of `require()`ing an ES module that has a default export with `__esModule: true` through a live-binding facade, and serve the same object from `require.cache`, matching Node ([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Provide a CommonJS module's exports under the `'module.exports'` named export when imported from ESM, matching Node 23+ ([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Give the test file itself a non-null `require.main` ([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Populate `module.children` with the modules a file loads, matching Node ([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[jest-runtime]` Provide `import.meta.resolve` and `import.meta.jest` in `data:` URI modules, accept any-case mediatype parameters, and use Node's error codes for invalid `data:` URIs ([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[jest-runtime]` Key ES modules by full URL, so query and fragment suffixes create the same module instances as Node and show up in `import.meta.url` ([#​16375](https://redirect.github.com/jestjs/jest/pull/16375))
- `[jest-runtime]` Share modules between overlapping graphs when a CommonJS module `require()`s an ES module mid-load, instead of evaluating shared dependencies twice ([#​16375](https://redirect.github.com/jestjs/jest/pull/16375))
- `[jest-runtime]` Throw `ERR_REQUIRE_CYCLE_MODULE` like Node when a CommonJS module `require()`s an ES module that is still being loaded, instead of evaluating the module a second time ([#​16366](https://redirect.github.com/jestjs/jest/pull/16366))
- `[jest-runtime]` Key builtin modules in the ESM registry by one canonical specifier ([#​16341](https://redirect.github.com/jestjs/jest/pull/16341))
- `[jest-runtime]` `import.meta.resolve()` for a builtin uses its `node:` specifier ([#​16341](https://redirect.github.com/jestjs/jest/pull/16341))
- `[jest-runtime]` Fall back to native ESM when a `.js` file contains ESM syntax but has no `"type":"module"` marker ([#​16152](https://redirect.github.com/jestjs/jest/pull/16152))
- `[jest-runtime]` Allow `require()` of ESM-marked files on Node < 24.9 via transform fallback ([#​16244](https://redirect.github.com/jestjs/jest/pull/16244))
- `[jest-runtime, @jest/transform]` Surface actionable `ERR_REQUIRE_ESM` error for files with untransformed ESM syntax instead of the generic "unexpected token" message ([#​16244](https://redirect.github.com/jestjs/jest/pull/16244))
- `[jest-runtime]` Support older test environments whose `moduleMocker` does not implement `clearMocksOnScope` ([#​16169](https://redirect.github.com/jestjs/jest/pull/16169))
- `[jest-runtime]` Apply `jest.unstable_mockModule` when the mocked file itself is `require()`d, not only when it is imported as a dependency ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Apply `jest.unstable_mockModule` to statically imported `data:` URIs on Node 24.9+, matching dynamic `import()` ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Run an async `jest.unstable_mockModule` factory once per module instead of twice, and fail the import instead of crashing the worker when the factory rejects ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Hide a `require(esm)` module that failed to evaluate from `require.cache`, as Node does, instead of exposing a namespace with uninitialized bindings ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Strip the byte-order mark when importing a JSON module, matching `require()` and Node ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Throw `ERR_REQUIRE_ASYNC_MODULE` when `require(esm)` runs under an async-only custom resolver, instead of silently resolving with the default resolver ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Parse imported JSON modules with the test realm's `JSON`, so their objects pass `instanceof Object` inside the test like `require()`d JSON does ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Accept every `file:` URL string in the sandboxed `module.createRequire`, including one with a `localhost` authority, as Node does ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Point at `{virtual: true}` when `jest.mock` or `jest.unstable_mockModule` is given a module that cannot be resolved ([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-reporters]` Fix coverage report table formatting in CI/GitHub Actions environments where `process.stdout.columns` is undefined by falling back to the `COLUMNS` env var or `80` columns in CI, preserving existing behaviour in other non-TTY environments ([#​16227](https://redirect.github.com/jestjs/jest/pull/16227))
- `[jest-runtime]` Support CJS-in-ESM exports via `"module.exports"` named exports ([#​16277](https://redirect.github.com/jestjs/jest/pull/16277))
- `[jest-snapshot]` Keep a skipped or failed test's hinted snapshots, instead of reporting them obsolete ([#​16348](https://redirect.github.com/jestjs/jest/pull/16348))
- `[jest-util]` Stop `globsToMatcher` reusing a cached matcher compiled with different picomatch options, and keep its `dot: true` default when `dot` is passed as `undefined` ([#​16381](https://redirect.github.com/jestjs/jest/pull/16381))
- `[pretty-format]` Move the `react-is` aliases into the `@jest` scope, so they cannot be shadowed by unrelated packages published under the alias names ([#​16333](https://redirect.github.com/jestjs/jest/pull/16333))
##### Chore & Maintenance
- `[docs]` Document the intentional divergences from Node's module system in the ECMAScript Modules page ([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[docs]` Note deprecation of `react-test-renderer` in React Native tutorial and `pretty-format` README ([#​16294](https://redirect.github.com/jestjs/jest/pull/16294))
- `[docs]` Use `@testing-library/react-native` in the React Native tutorial instead of the deprecated `react-test-renderer` ([#​16318](https://redirect.github.com/jestjs/jest/pull/16318))
- `[babel-jest, @jest/transform]` Update `babel-plugin-istanbul` to v8 ([#​16049](https://redirect.github.com/jestjs/jest/pull/16049))
- `[jest-config, @jest/reporters, jest-runtime]` Update `glob` to v13 ([#​16397](https://redirect.github.com/jestjs/jest/pull/16397))
- `[jest-haste-map]` Refactor massive class into multiple files ([#​16180](https://redirect.github.com/jestjs/jest/pull/16180))
- `[jest-haste-map]` Drop `walker` dependency; replace hand-rolled directory recursion in the JS crawler and watcher startup with `fdir` ([#​16187](https://redirect.github.com/jestjs/jest/pull/16187))
- `[jest-haste-map]` Reuse cached metadata for files whose haste name is a known duplicate, instead of re-reading and re-parsing them on every startup ([#​16351](https://redirect.github.com/jestjs/jest/pull/16351))
- `[jest-haste-map]` Cache the watchman socket path and replace the `watchman --version` probe with `get-sockname`, so warm runs spawn no watchman processes ([#​16386](https://redirect.github.com/jestjs/jest/pull/16386))
- `[jest-resolve]` Store the per-directory package-type lookup in the cache it reads, so it actually memoizes ([#​16369](https://redirect.github.com/jestjs/jest/pull/16369))
- `[jest-resolve, jest-runtime]` Cut repeated work on the resolution hot path: hoist the platform-extension list to construction, memoize `isCoreModule` and the options cache-key serialization, skip mapper preparation when no `moduleNameMapper` is configured, run each mapper regex once, and stop re-parsing `NODE_OPTIONS` on every default-resolver call ([#​16371](https://redirect.github.com/jestjs/jest/pull/16371))
- `[jest-resolve]` Cut warm resolution cost to about a third: reuse one `unrs-resolver` factory per options shape instead of cloning per resolution, compose the factory cache key from per-array cached strings instead of serializing options, and stop constructing an `Error` for misses that `findNodeModule` swallows; add a `__benchmarks__` suite for the default resolver ([#​16373](https://redirect.github.com/jestjs/jest/pull/16373))
- `[jest-runner, @jest/source-map]` Replace `source-map-support` with an implementation in `@jest/source-map` ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-snapshot]` Load babel, semver and synckit lazily, so requiring the package (which every test process does through `@jest/expect`) no longer loads \~200 modules that only writing inline snapshots needs ([#​16387](https://redirect.github.com/jestjs/jest/pull/16387))
- `[jest-runtime]` Reduce per-require overhead: skip module ID resolution when no mock can apply, answer core modules before probing for a manual mock, share one `require.cache` proxy across modules, and cache empty files ([#​16376](https://redirect.github.com/jestjs/jest/pull/16376))
- `[@jest/source-map]` Deprecate `getCallsite` in favour of `SourceMapSupport#getCallsite` ([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runtime]` Avoid magical `null` value in ESM loader ([#​16160](https://redirect.github.com/jestjs/jest/pull/16160))
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
# Why
Count queries reported their result through the load event, so a `COUNT(*)` returning 8k looked like we loaded 8k entities.
# How
Give counts their own event (`logDataManagerCountEvent`) so the count number stops being read as entities loaded. Breaking: `IEntityMetricsAdapter` implementers need to add the method; I'm happy to go for another path, non-breaking change if you prefer, but this felt more fundamentally correct
<img width="480" height="240" alt="giphy" src="https://github.com/user-attachments/assets/4630fefc-cca4-42ca-afc4-22b9919df4a8" />
# Test Plan
CI. Updated the metrics unit test to check the counts route to the new event.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| redis | digest | `234c902` → `c88d347` |
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "before 9am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/expo/entity).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
# Why
A bug exists where the ts-mockito extension entity aware matcher would report map equality even when the maps were of different lengths (assuming shorter map had all the same elements as first part of longer map).
# How
Fix by preemptively checking length. Also fix recursive call to use `isEqualWithEntityAware` in case nested objects need it.
# Test Plan
Run updated test.
# Why
The stub adapters were doing a simple `:` join, so it was possible for two rows to collide in the stub adapter during tests, if value has the delimiter.
# How
Fix is to use JSON.stringify so that only truly same rows map to the same thing.
# Test Plan
Run new tests.
# Why
Just a comment update to make it clearer that IEntityMetricsAdapter implementations must not throw since it'll cause adverse effects for the library.
In a follow-up, it may be good to defend against this, but it's not a straightforward fix.
# How
Update comment.
# Test Plan
Proofread.
# Why
`pick` was calling `object.hasOwnProperty(prop)`, but if the object had a property `hasOwnProperty`, it'd be used.
# How
Fix is to use the Object prototype's method.
# Test Plan
Run added test.
# Why
The bug is that if the column in the current entity that contains the referenced entity's `id` is an empty string, the load method would erroneously return null. This correct the behavior to correctly try to load the entity by ID, which correctly fails since the field is invalid.
# How
Fix check.
# Test Plan
Add new test.
# Why
Typescript enums come in two flavors: https://www.typescriptlang.org/docs/handbook/enums.html
Previously, the validation here only worked for string enums.
# How
Update logic to make it work for both string and numeric enums.
# Test Plan
Run new test.
# Why
#601 exposed another validation gap in assumptions made about cache keys. We need certain assumptions to be true, namely:
- delimiter is nonzero-length (otherwise issue #601 fixes still would exist)
- delimiter doesn't include escape character (otherwise escape breaks)
- ttlSecondsPositive and negative are positive integers
- cacheKeyVersionsToInvalidateFn returns > 0 versions (otherwise silently doesn't invalidate)
# How
Add validation.
# Test Plan
Add test.
# Why
In places where a rule list is dynamically composed, it's likely possible for this list to be empty. Due to the way it's written, it would erroneously allow in this case.
# How
Add check for case and skip.
# Test Plan
Add test.
# Why
There is a bug in self-referential (or transitively-self-referential) cascade cycle detection.
From claude:
```
In AuthorizationResultBasedDeleteMutator:
- deleteInternalAsync (line 802) runs the authorize check, calls
processEntityDeletionForInboundEdgesAsync, runs validators/triggers, deletes the row, and schedules
invalidation callbacks and afterCommit triggers.
- The cycle guard is at the top of processEntityDeletionForInboundEdgesAsync (line 932) — if
(processedEntityIdentifiers.has(entity.getUniqueIdentifier())) return;.
Trace a cycle (A↔B cascade-delete):
1. deleteInternalAsync(A, visited=∅) → runs authorize+triggers+DB delete for A →
processEntityDeletionForInboundEdgesAsync(A, visited=∅), marks A visited, finds B, calls
deleteInternalAsync(B, visited={A}).
2. deleteInternalAsync(B, visited={A}) → runs authorize+triggers+DB delete for B →
processEntityDeletionForInboundEdgesAsync(B, visited={A}), marks B visited, finds A, calls deleteInternalAsync(A,
visited={A,B}).
3. deleteInternalAsync(A, visited={A,B}) → runs authorize+triggers+DB delete for A again → only when it gets into
processEntityDeletionForInboundEdgesAsync does the visited check finally short-circuit.
So beforeDelete/afterDelete/beforeAll/afterAll, the database delete, the post-commit invalidation, and
afterCommit triggers all fire twice for A. The DB delete is idempotent (row's already gone) but triggers
with side effects (emit events, write audit rows, etc.) double-fire.
```
# How
Fix is to move cycle detection to to of `deleteInternalAsync`, thus guarding all checks for already-run entities.
# Test Plan
- Run new test
- Existing test was passing due a stale entity being passed into deleter. The why is a bit nuanced. Here's claude:
```
The original test setup
const categoryA = await CategoryEntity.creator(viewerContext).createAsync();
const categoryB = await CategoryEntity.creator(viewerContext)
.setField('parent_category_id', categoryA.getID())
.createAsync();
await CategoryEntity.updater(categoryA)
.setField('parent_category_id', categoryB.getID())
.updateAsync();
After these three statements, the database state is:
- A: {id: uuidA, parent_category_id: uuidB} (after update)
- B: {id: uuidB, parent_category_id: uuidA}
But the local variable categoryA still holds the original entity instance from line 1, where
parent_category_id was null. updateAsync() returns a new entity, but that return value is discarded — the
local categoryA was never rebound. So categoryA.getAllDatabaseFields() in the test returns {id: uuidA,
parent_category_id: null}.
Why the test passed before the fix
When the test calls CategoryEntity.deleter(categoryA).deleteAsync(), the outermost mutator's this.entity
is the stale categoryA (with parent_category_id = null).
Trace through the OLD cycle behavior for CASCADE_DELETE_INVALIDATE_CACHE_ONLY (so skipDatabaseDeletion =
true on cascade calls):
1. Outer A mutator runs. this.entity = stale A. Traverses inbound edges of A, finds B.
2. Middle B mutator runs (cascade). this.entity = freshly-loaded B from DB (correct fields). Traverses
inbound edges of B, finds A → cascades to A again.
3. Inner A mutator runs (cycle re-entry). this.entity = freshly-loaded A from DB, with parent_category_id
= uuidB (the post-update value).
3. Under the OLD code, the cycle guard at the top of processEntityDeletionForInboundEdgesAsync stops the
traversal from recursing further, but the inner deleteInternalAsync still runs validators, triggers, and
registers a post-commit invalidation callback using this freshly-loaded A's fields.
After commit, the post-commit invalidation callbacks fire:
- Outer A registers invalidation for {id: uuidA, parent_category_id: null} → invalidates (id, uuidA) only
(null isn't a cache key).
- Middle B registers invalidation for {id: uuidB, parent_category_id: uuidA} → invalidates (id, uuidB) and
(parent_category_id, uuidA).
- Inner A registers invalidation for {id: uuidA, parent_category_id: uuidB} → invalidates (id, uuidA) and
(parent_category_id, uuidB).
The test asserts that (parent_category_id, uuidB) is invalidated, and it was — because of the inner A's
fresh-loaded fields. The OLD bug (running deletion side effects twice) was accidentally compensating for
the stale entity reference held by the test.
Why the test failed after the fix
With the cycle guard moved to the top of deleteInternalAsync, the inner A call returns immediately without
registering any invalidation. Only the outer A's invalidation runs, with the stale parent_category_id =
null, so (parent_category_id, uuidB) is never invalidated → still HIT → assertion fails.
This isn't a regression in real-world usage. In real code, callers don't keep stale references after
updating, because:
- The idiomatic pattern is const x = await Entity.updater(x)...updateAsync() (rebinding).
- Non-cycle deletions of stale references already produced incomplete invalidation in the OLD code — the
cascade re-load only happened to "rescue" the cycle path.
After the fix, cycle and non-cycle paths behave consistently: the entity instance the caller hands to
deleter() is the source of truth for what gets invalidated.
The test edit
const initialCategoryA = await CategoryEntity.creator(viewerContext).createAsync();
const categoryB = await CategoryEntity.creator(viewerContext)
.setField('parent_category_id', initialCategoryA.getID())
.createAsync();
const categoryA = await CategoryEntity.updater(initialCategoryA)
.setField('parent_category_id', categoryB.getID())
.updateAsync();
categoryA now binds to the return value of updateAsync(), so it carries the post-update fields. The cycle
behavior remains under test — the assertion that both (parent_category_id, uuidA) and (parent_category_id,
uuidB) are MISS still verifies that the cascade correctly invalidated B's and A's cache keys. The fix to
the test reflects correct API usage, and the cycle handling is independently confirmed by the new fires
delete-side-effects exactly once per entity in a cycle test.
```
# Why
In the same way that `processEntityDeletionForInboundEdgesAsync` has detection for reference cycles, this preemptive check utility method needs the same detection mechanism.
# How
Add the same detection mechanism as `processedEntityIdentifiers`
# Test Plan
Add test case for this that fails before change, succeeds after.
# Why
One way memory can grow unbounded within a single request is via transactional dataloaders. If a single request executes N transactions, each one accumulates it's own dataloader state.
Though this has the same semantics as regular dataloaders (which belong to companion provider which is scoped to request by application and discarded after response is sent), they can accumulate more.
# How
The fix is to clear the transactional dataloader at the end of the transaction (or nested transaction), no matter whether the transaction succeeded or rolled-back.
# Test Plan
Add test for condition.
# Why
Please describe the motivation for this PR, and link to relevant GitHub issues, forums posts, or feature requests.
# How
How did you build this feature or fix this bug?
# Test Plan
Please describe how you tested this change and how a reviewer could reproduce your test, especially if this PR does not include automated tests!
# Why
Similar to #601, it was possible for a misconfigured application to have collisions in cache keys for secondary caches. Because they likely share the same redis instance at the application level, these keys need similar treatment for separating them logically from normal loader keys plus consistent delimiter escaping.
# How
Hoist final key creation from application level to library level and apply consistent delimiter escaping and namespacing.
# Test Plan
Run new test.
# Why
Since cache key construction function is application-supplyable, there's potential that it doesn't escape properly, causing potential cache collisions.
# How
Change the API to only allow specifying the delimiter, and hoist code into the package to handle delimiter escape.
# Test Plan
Run new test to ensure no collisions on something that would've previously collided.
# Why
There's nothing preventing two entity classes from sharing the same class name. While not common in practice, this preemptively defends against the issue of collisions in companion maps.
Secondarily, table data coordinators could collide, even if they have different flavors of database and cache adapters. Since those are used to construct the coordinator, include their flavors in the map key.
# How
Update key generation code.
# Test Plan
Run new tests.
# Why
ViewerScopedEntityMutatorFactory existed to make both the loader and mutator patterns more aligned. But it doesn't make as much sense for mutators since for update and delete, the viewerContext used is the one from the entity being updated/deleted instead of the one for the viewer scoped factory. So, in practice the one from the factory was only being used for create mutations.
The simplest change is to just remove the ViewerScopedEntityMutatorFactory to reduce confusion.
# How
Remove class.
# Test Plan
CI
# Why
oxfmt/oxlint has near parity with prettier/eslint but is about 10x faster (10s -> 1s).
This uses `oxlint-config-universe` equivalent of `eslint-config-universe` as the base. There are known differences between eslint and oxlint, documented in the readme of `oxlint-config-universe`.
The missing rules which we can live without temporarily in exchange for the speedups:
- `naming-convention` (async suffix, PascalCase, UPPER_CASE)
- `no-restricted-properties` (.only/.skip)
- `no-restricted-exports` (no default exports)
- `tsdoc/syntax`
- object-shorthand
- no-dupe-args, no-octal, no-octal-escape
- n/no-deprecated-api
I've created a task to track: #567.
# How
Have claude convert. Use `oxlint-config-universe` and manually audit resulting config against old eslint config. Note down known differences in #567.
In stacked PR, use oxfmt for import ordering as suggested by readme in `oxlint-config-universe`
# Test Plan
`yarn lint`
# Why
Noticed that this could throw a TypeError if the decoded JSON wasn't an object:
> TypeError: Cannot use 'in' operator to search for 'id' in blah
# How
Add check that this is an object type ahead of using `in` operator.
# Test Plan
Add new tests for this, run them.
# Why
This argument was unused, remove it.
# How
Was checking whether EntityInvalidationUtils was the same instance (or same behaviorally) across multiple entities backed by the same table (share a config, different TSelectedFields). Being able to remove this arg proves it since the other args aren't entity-type-specific and are only configuration-specitic.
# Test Plan
`yarn tsc`
# Why
Noticed while using these methods in the Expo server application that they were missing docblocks due to vscode preferring the docblock for the overload over the object property.
# How
This adds overload-specific docblocks to ensure they are present in vscode, and since they're overload-specific they are more accurate as well.
# Test Plan
`yarn tsc`
Mise can manage yarn versions, but the free renovate doesn't know to use
that configuration. After this commit, the yarn version is set by the
packageManager field in the root package.json file, and downloaded by
corepack in all environments.
# Why
Asked claude to do an API usability review and it noted that forcing the user to context-switch between entity fields and database fields for SQLFragments was an unfortunate pattern.
# How
This PR provides a SQLFragment helper, `entityField<TFields>('fieldName')` which does the conversion for the user so they don't need to look up the underlying database field.
Secondarily, this provides type safety to ensure SQLFragments for one entity aren't used for SQLFragments of another entity (unless types overlap via shared config).
# Test Plan
Add feature and tests and examples.
# Why
Asked claude to do a security review of entity-database-adapter-knex and renaming `raw` to `unsafeRaw` was one suggestion.
# How
Rename.
# Test Plan
`yarn tsc`
# Why
This bug was subtle but important, and can be demonstrated best by looking at the new test case added `performs forward pagination with descending order`.
The bug was that cursor comparison must be derived from both direction but also ASC/DESC of the order bys.
Example:
```
obj1(t=1)
obj2(t=2)
obj3(t=3)
obj4(t=4)
> loadPage(first: 2, orderBy: t DESC)
obj4
obj3
> loadPage(first: 2, orderBy: t DESC, after: obj3)
```
the issue is that the cursor comparison for this second load would be:
```
(t) > (obj3.t)
```
which yields only obj4, which is incorrect.
# How
The fix is to determine cursor comparator by both the order by direction and the pagination direction, thus making the cursor from the example above:
```
(t) < (obj3.t)
```
The second part of this is to require all orderBys to have the same ordering for pagination, otherwise this new assumption breaks since cursor comparison then would be unable to be done with a single comparator. While there are ways we can handle different order by directions, we'd have to not use a cursor which adds a massive amount of complexity.
A small other fix was to set the `id` tiebreaker column order to the same as the other orders.
# Test Plan
Add new test case.
# Why
There's a bug in where clause construction, which used SQLFragmentHelpers.and: https://github.com/expo/entity/blob/main/packages/entity-database-adapter-knex/src/internal/EntityKnexDataManager.ts#L303
The bug is that given something like:
```
where: sql`account_id = ${accountId}`,
searchWhere: sql`something ILIKE term OR similarity(term, ...) OR ...`
```
it would produce
```
WHERE account_id = ${accountId} AND something ILIKE term OR similarity(term, ...) OR ...
```
which has the incorrect parentheses and therefore incorrect precedence.
This exposed more bugs in the precedence in `or`, `and`, `join`, etc methods.
# How
The fix is multifold:
- Make the public `join` method only be used for comma-separation joining. Rename it to `joinWithCommaSeparator`.
- Wrap each group in `or` and `and` in parentheses to ensure correct precedence.
```
> SQLFragment.or(sql`account_id = ${accountId}`, sql`app_id = ${appId}`
sql`(account_id = ${accountId}) OR (app_id = ${appId})`
```
# Test Plan
Run existing tests to ensure nothing breaks, update unit tests and inspect output SQL statements to ensure they are correct parentheses. Especially the `builds complex queries with multiple helpers` test case.
# Why
In a decent number of tests in the Expo server application, it's useful to test pagination from a specific point. It may also be useful for production code in an thus far unbeknownst way.
To do this, one must be able to generate the cursor given an entity. This PR adds such a method.
# How
Add the method that creates a cursor.
# Test Plan
Run the new test.
# Why
When testing this downstream, I noticed that it was allowed in types to specify first & before / last & after which aren't supported in the pagination.
# How
Fix the types by being explicit about the other fields.
# Test Plan
`yarn tsc`
# Why
#468 added nulls support for regular order bys, but explicitly disabled it for search pagination due to it adding quite a lot of complexity. It also fixed a bug where using a nullable field in pagination in general would break the cursor condition and omit rows (any tuple containing NULL would be dropped due to postgres behavior).
But applications still need to be able to search fields that are nullable, they just need to provide a mechanism for dictating how to cast them as non-nullable. This PR provides such a mechanism.
# How
Allow the user to specify a function to craft the search field SQLFragment from nullable fields. This is required to be a somewhat awkward shape since the library needs to retain control over the field name due to table aliasing in the cursor.
# Test Plan
Run new tests.
# Why
When these were installed extension functions, we could get away without the `TMViewerContext2` technique. But now that these are loader methods on the `PostgresEntity` subclass, we need this again (it's the same as Entity and ReadonlyEntity).
This type allows the typechecker to behave correctly when a subclass of ViewerContext is used.
# How
Add generic the same as ReadonlyEntity/Entity.
# Test Plan
`yarn tsc` in application that uses ViewerContext subclass and knexLoader.
# Why
Now that `loadManyBySQL` supports all the features of this method (including raw order by), deprecate it.
# How
Mark as deprecated in docblock.
# Test Plan
`yarn tsc`
# Why
#457 added a new mechanism for specifying ORDER BY clauses using SQLFragment that aligns a lot better with the loader APIs than having separate `orderByRaw`/`orderByFragment` fields in the query modifiers.
# How
Replace all with the new consistent order by in order field, update code to handle that.
One neat side-effect is that we no longer need the hard-to-follow direction-specific ordering in deep methods like `buildTrigramExactMatchPriority` since now we can have those just produce a SQLFragment and reverse the ordering the same as all the other pagination methods.
# Test Plan
Run all tests.
# Why
Small change to the debug method for SQLFragment. Noticed claude made it a `get toDebugString`, which doesn't quite fit within the patterns in this repo.
# How
Rename to `getDebugString()` method for consistency.
# Test Plan
`yarn tsc`
# Why
One missing piece from pagination is the ability to order by a SQL fragment. This is useful for cases like needing to apply postgres transforms or coalescing to the columns in the order by clause.
Note that this, in combination with `loadBySQL` will completely replace the need for `loadManyByRawWhereClause` (including it's orderByRaw variant), as well as `orderByFragment` in the new pagination code, which is done in a PR upstack.
# How
Make order by specifications either be able to use SQLFragment to specify the field selection but not the ASC/DESC since the framework still needs to retain control of those for pagination purposes.
# Test Plan
Run new added tests.
# Why
The one downside of using id-based cursor pagination and subqueries (added in #422, #431) is that it risks the row referenced by the cursor being deleted between pagination requests. It's an edge case though to be clear. Encoding the full cursor alleviates this, but has it's own downsides since trigram similarity isn't encodable and neither are things like Date objects. It is still preferable to use ID-based cursors for all pagination.
But it becomes the library's responsibility to explicitly document what the behavior is when a row referenced by the cursor is no longer present. This PR does this.
# How
When the cursor row is no longer present, the tuple evaluates to `NULL`, which produces a empty page.
The alternative to this behavior is to run an id check query ahead of the pagination query, and throw an error if it doesn't exist, or even return the first page of data if it doesn't exist. Both of these are less optimal since they cause unexpected behavior during results consumption.
So we keep the behavior as is and explicitly document it.
# Test Plan
Run new tests.
# Why
Did a brief audit of `any` casts in the library and removed ones that are no longer needed or could be replaced with a better concrete type.
# How
Grep for `as any`, fix.
# Test Plan
`yarn tsc`
# Why
As part of #451, claude noticed that we used both american and british english variants of "adapter"/"adaptor". This makes them consistent by making them all "adapter".
# How
Update name. Technically this is a breaking change but the nature of the library allows `tsc` to catch it in all application code that uses the library.
# Test Plan
`yarn tsc`
# Why
Asked claude to audit the docblocks for incorrect or missing info. This is what it mentioned as being good improvements.
# How
Update docblocks.
# Test Plan
Proofread.
# Why
In #410 we split out `EntityLoaderUtils` into two classes:
- EntityInvalidationUtils - functions for invalidating entity caches from application code when underlying data is mutated outside of the entity framework
- EntityConstructorUtils - functions for constructing and authorizing entities.
Originally, these were both public due to them being the same class. Now, with them separated, we can better restrict access to entity construction which should only be done within the framework itself.
# How
Make constructor utils private everywhere except EntityLoaderFactory, which is deep enough in the abstraction that it's not immediately usable by top-level entity APIs (static methods on Entity/ReadonlyEntity, loader classes).
# Test Plan
`yarn tsc`, CI
# Why
Part 4 of #441. This reverts the test changes to use the better pattern, though both work equivalently and are both tested.
# How
Update tests.
# Test Plan
Run tests
# Why
Part 3 of the refactor from #441.
This reverts the codemod back to use the `BlahEntity.knexLoader(vc)` syntax.
# How
`git revert`
# Test Plan
Run the tests in codemod.
# Why
This is part 2 of the refactor described in #441.
It adds subclasses of Entity and ReadonlyEntity that supply the static `knexLoader` methods to keep the ergonomics of the extension but without the monkey-patching.
# How
Add subclasses, add test.
# Test Plan
Run test.
# Why
Asked claude extended thinking to analyze the `installExtensions` monkey-patching strategy we went with in #410 and compare it to other typescript ORM libraries.
It said essentially that it was ok, but most modern libraries choose not to do it that way, and instead recommended "free functions" (TIL about that term) to instantiate the loaders. (`knexLoader(BlahEntity, vc)`)
Working with it even more, I came up with an even better method on top of free functions to keep the `BlahEntity.knexLoader(vc)` syntax. The strategy is to:
1. Convert to free functions (this PR).
2. Add `PostgresEntity`/`ReadonlyPostgresEntity` subclasses that application entities can extend that implement the static extension methods.
3. Revert the codemod change from this PR to keep the codemod to prefer the `BlahEntity.knexLoader(vc)` syntax since most applications should use the subclasses (though it's not strictly necessary if they prefer the free function at callsites).
4. Revert the codemod in the integration tests to express better syntax pattern.
# How
Claude did most of this, but broadly speaking the strategy is to have the free functions, and then instead of patching the prototypes/classes for singleton caching, use a WeakMap where the core package singleton is the key and the value is the new knex-specific object.
# Test Plan
Run all tests.
# Why
When testing an upgrade to this package in the Expo server application, noticed that this was a minor annoyance since TSelectedFields has a default in all other public API methods.
# How
Add default to be consistent.
# Test Plan
`yarn tsc`
# Why
Currently, the Entity pagination system allows clients to request arbitrarily large page sizes using the `first` or `last` parameters in pagination queries. This can lead to:
- Performance degradation when clients request excessively large pages
- Potential memory issues on the server
- Unpredictable query response times
- Difficulty in capacity planning and resource allocation
By adding configurable max page size limits, we can:
- Protect backend services from resource exhaustion
- Ensure predictable performance characteristics
- Provide better control over API usage patterns
- Maintain backward compatibility (no limit by default)
# How
The implementation adds a `paginationMaxPageSize` configuration option to the PostgresEntityDatabaseAdapterProvider that flows through the adapter hierarchy:
1. **Configuration Interface**: Added `PostgresEntityDatabaseAdapterConfiguration` with an optional `paginationMaxPageSize` field
2. **Provider Level**: `PostgresEntityDatabaseAdapterProvider` constructor now accepts the configuration object
3. **Adapter Level**:
- `BasePostgresEntityDatabaseAdapter` defines a `paginationMaxPageSize` getter (defaults to `undefined`)
- `PostgresEntityDatabaseAdapter` overrides it to return the configured value
4. **Validation**: `EntityKnexDataManager.loadPageAsync` validates `first`/`last` parameters against the max page size before executing queries
The validation throws descriptive errors when limits are exceeded:
- `"first must not exceed maximum page size of {limit}"`
- `"last must not exceed maximum page size of {limit}"`
Usage example:
```typescript
const provider = new PostgresEntityDatabaseAdapterProvider({
paginationMaxPageSize: 100
});
```
# Test Plan
Added comprehensive unit tests in `EntityKnexDataManager-test.ts`.
# Why
This PR adds search capabilities to the existing cursor-based pagination system added in #422 which only supported orderBy ordering.
This adds:
1. Case-insensitive pattern matching (ILIKE) - Useful for basic text search across entity fields
2. Trigram similarity search - Provides fuzzy matching capabilities for more advanced search use cases like handling typos or finding similar text
This enables building user-facing search features while maintaining the benefits of cursor-based pagination (stable results, efficient queries).
# How
The implementation introduces a unified PaginationSpecification that supports three strategies:
1. Standard pagination - The existing orderBy-based pagination
2. ILIKE search - Pattern matching with automatic wildcard escaping
3. Trigram search - PostgreSQL trigram similarity with configurable threshold
Key implementation details:
- Search terms are properly parameterized to prevent SQL injection
- ILIKE special characters (%, _, \) are escaped to prevent pattern injection
- Results maintain stable cursor-based pagination with proper ordering:
- ILIKE: Ordered by search fields, then ID
- Trigram: Ordered by exact match priority, similarity score, optional extra fields, then ID
# Test Plan
The PR includes comprehensive test coverage:
- Unit tests for both AuthorizationResultBasedKnexEntityLoader and
EnforcingKnexEntityLoader
- Integration tests covering:
- Forward/backward pagination with search
- Multi-field search
- Case-insensitive matching
- Trigram similarity with various thresholds
- Cursor stability across pages
- Edge cases (empty results, special characters)
- Combined with WHERE clauses
- Security validation ensuring proper escaping and parameterization
All existing tests pass, confirming backward compatibility for standard pagination when using the new API.
# Why
Noticed this was mis-typed in a later PR, hoisted into this one.
# How
Update type of EntityConfiguration.idField to be `TIDField`, which is the most correct and precise type for the field. This will help later on when adding pagination ID field stuff.
The other changes to tests are fixes since these previously were underspecified and changing the field type exposed these missing types. (claude informed me of this)
# Test Plan
`yarn tsc`
# Why
Noticed while creating an upcoming pagination PR that loaders should use `TSelectedFields` for `orderBy` clauses. This was an accidental omission when the selected fields concept was added.
Succinctly, one should only be able to order entities by their fields rather than by all their underlying table's fields.
# How
Create new orderBy clause type that lives at the loader level. It is fully compatible (subset or equal to) the database orderBy clause, so calling the data manager methods directly with the arguments is by design.
# Test Plan
`yarn tsc`
# Why
As of moving raw and conjunction loading into the `entity-database-adapter-knex` package, the stub database adapater is no longer as useful in applications that use the package (it used to support conjunction loading synthetically for unit tests).
# How
This PR adds a new package, `entity-database-adapter-knex-testing-utils` that provides what StubDatabaseAdapter used to be (it has conjunction loading).
The idea is that applications that use `entity-database-adapter-knex` will use this package for their stub database needs and unit test companion provider.
# Test Plan
Full test coverage.
# Why
This commits the claude prompts I have been using to pair program with claude while building this stack.
I also noticed that claude loved to add `test.skip` to make things pass, which now is disallowed as of this PR.
# How
Commit the file.
# Test Plan
yarn lint
# Why
Part 3 of #407.
# How
This is the main PR of the stack. It creates a mechanism for "installing" the extension methods on required objects, and then installs them and tests them.
The goal is to make it better self-contained about what is core in the library and guaranteed to be efficient (dataloader'd and cached) and what is not (raw SQL and SQLFragment loads in a future PR).
This is becoming more critical in a time of agentic coding where having a discrete set of loaders that can be linted separately and instruct agents to run `EXPLAIN ANALYZE` in raw cases.
# Test Plan
Full test coverage.
# Why
This is a long stack, but the goal is to make a place to put postgres-specific loading logic to avoid polluting the core dataloader-based library with logic specific to knex/postgres. And potentially even postgres-specific mutation logic but that's way down the road.
The best place for this stuff is in the `entity-database-adapter-knex` library. Therefore, the strategy is (in PR order):
1. Move existing knex/postgres-specific loader methods to a new loader, `knexLoader`. I'm also open to calling this a "Postgres Loader" since the `entity-database-adapter-knex` package already uses postgres-specific queries (and more are added here since this stack eventually produces raw queries) within knex even though technically knex is database agnostic.
1. Move knex-specific logic out of EntityDataManager, move it to its own EntityKnexDataManager.
1. Move these two now-separated pieces into the `entity-database-adapter-knex` package. This requires creating a "plugin" system for database adapters, where when they are included their methods are added to the prototype so that seamless loading continues to work.
1. Add a codemod for these three pieces.
1. Add the first new feature to entity loading, load by tagged template string, which creates a better/safer way to express raw queries for loading entities.
Future other things that could be added here (after thorough thought on authorization) are:
- Pagination
- Create, update, delete by tagged template string
- Batch creation
- Upsert (maybe)
# For Reviewers
The most critical things to assess are:
- "install" method in #410
- sql tagged template API usability in #414
# How
This is part 1. It refactors the loaders by moving `loadManyByFieldEqualityConjunctionAsync`, `loadFirstByFieldEqualityConjunctionAsync`, and `loadManyByRawWhereClauseAsync` to a separate loader.
The new pattern for these is:
```
await PostgresTestEntity.knexLoader(vc1).loadManyByRawWhereClauseAsync(...)
```
# Test Plan
This has full coverage in new tests.
# Why
One other set of rules we've found useful in the Expo application for expressing complex privacy logic is a boolean any/all rule that composes an array of rules.
This PR upstreams these rules.
# How
Add rules and tests.
# Test Plan
Run tests.
# Why
One other rule we've found useful in the Expo application is a simple predicate rule based on an entity field.
This PR upstreams this rule.
# How
Add rule and test.
# Test Plan
Run test.
# Why
Found this to be useful in the Expo backend application. The use case is that one may wish to permit access for the mostly-programmatic step of nullification of a field in an entity, whether or not any of the other privacy policy rules in the policy allow.
For example, let's say a user creates a build on organization X. Their user ID may be recorded in a foreign key field on the build so that the application can query all builds for that user. But then the user loses access to organization X. Then, they want to delete their user. This will do a cascade set null on the builds initiated by the user, but the user no longer has permission to update those builds via the normal organization membership permission rules, so this explicit allow-if-cascade-rule is used.
# How
Add a generic rule for use in applications.
# Test Plan
Add test.
# Why
Since this library uses conventional commits to generate changelogs, we want to validate that the PR title is in a valid conventional commit format.
Closes ENG-15958.
# How
Add lint action.
# Test Plan
This only runs once committed to main so we'll need to commit this and then try it out.
I audited the action code at a glance.
Why
===
es6-error uses Object.defineProperty calls to set name, message, and stack on every error instantiation. Modern Node.js (14+) supports native Error subclassing, making this overhead unnecessary.
How
===
- Remove es6-error dependency
- Use native Error class with static blocks to set the prototype name once per class rather than per instance
- Use abstract getters for state and code in the base class, with concrete implementations in subclasses returning narrowed literal types (e.g., `get state(): EntityErrorState.PERMANENT`)
- Pass cause to Error constructor options instead of manually setting it
Abstract getters were chosen over prototype assignment because:
- They use standard TypeScript/JavaScript patterns that are self-documenting
- They don't require `declare` statements to satisfy TypeScript
- They allow narrowed return types (e.g., `EntityErrorState.PERMANENT` instead of `EntityErrorState`)
The name property is set on the prototype via static initializer because Error.prototype.name is conventionally a prototype property, and this matches how native error subclasses like TypeError work.
Benchmark shows ~1.9x faster error instantiation:
- es6-error: ~213k ops/sec
- native: ~400k ops/sec
Test Plan
===
yarn tsc passes. All tests pass
Why
===
The map().filter() pattern creates an intermediate array with null values
that are immediately discarded. For an entity with 8 fields, this allocates
an 8-element array where ~25% of values are null, only to filter them out.
Benchmarks show inlining as a for loop is 1.8x faster:
- map().filter(): 7.0M ops/sec
- for loop: 12.7M ops/sec
How
===
Replace two instances of `.map(...).filter(x => x !== null)` with for...of
loops that conditionally push to the result array. This is the same pattern
used elsewhere in the codebase (e.g., successfulResults, failedResults in
entityUtils.ts).
Test Plan
=========
All existing tests pass (362/362). Behavior is identical.
Co-authored-by: Will Schurman 🦦 <[email protected]>
Why
===
The previous implementation used Set + Object.entries + Object.fromEntries
which created intermediate data structures. Benchmarks showed this was 5.6x
slower than direct property access for typical usage (2 props from medium
entity: 1.8M vs 10.1M ops/sec).
How
===
Replace the Set-based filtering approach with a simple for...of loop that
directly accesses and copies properties. This avoids:
- Creating an intermediate Set
- Object.entries() array allocation
- Object.fromEntries() reconstruction
Use hasOwnProperty() instead of `in` operator to match the original semantics
(Object.entries only returns own properties) and avoid edge cases with
inherited properties like "toString".
Test Plan
=========
All existing tests pass. The function is semantically identical - it still
returns a new object with only the specified own properties.
# Why
For a while in Expo application code, we've used beforeDelete triggers to approximate beforeDelete validators, but we finally found a need to separate them out. Due to the nature of validators (no side-effects) vs triggers (side-effectful), there can be a need to manually run validators but not triggers. One such need is ahead of batch deletion, to ensure that an object and it's related objects can be deleted and retain any constraints implemented in validator logic.
Closes ENG-18066.
# How
Split out definition to be more similar to triggers, update tests.
# Test Plan
Add new test for these, ensure that they are called appropriately.
# Why
#311 updated the errors for postgres, but the conditions in the stub adapters preempted those errors in test code, so their behavior diverged. This PR makes the stub adapters behave more similarly to Postgres adapter.
# How
Return more similar results in not-found cases. See inline comments.
# Test Plan
`yarn tsc`. Also the tests in entity-example test this.
# Why
Technically upper-case UUIDs are valid according to https://datatracker.ietf.org/doc/html/rfc4122.
But the way entity is written expects case sensitivity due to them being treated as simple strings. For example, this would be the expected behavior:
```
const entities = await TestEntity.loader(vc).loadManyByFieldEqualingAsync('id', ['018EBFDA-DC80-782D-A891-22A0AA057D52']);
=> Map(['018EBFDA-DC80-782D-A891-22A0AA057D52', TestEntity[...]])
```
The issue is that Postgres stores them in a case-insensitive manner (which is correct according to the UUID spec). So in actuality, the above code would theoretically do something like:
```
const entities = await TestEntity.loader(vc).loadManyByFieldEqualingAsync('id', ['018EBFDA-DC80-782D-A891-22A0AA057D52']);
=> Map(['018ebfda-dc80-782d-a891-22a0aa057d52', TestEntity[...]])
```
(it actually fails due to this change of case further up in the stack at https://github.com/expo/entity/blob/077d53cd86d4c54132ea2ebcc59d1d75e2b507d0/packages/entity/src/EntityDatabaseAdapter.ts#L182, but the reason is the same: postgres transforms to lower case under-the-hood)
This results in breaking invariants the framework provides (all keys in === all keys out).
This PR solves this problem by just enforcing UUID casing in fields to match what Postgres already does to avoid this issue.
Ref: WWW-37
# How
I first tried a field normalization approach in #309, but this also had the same problem: the fields in !== fields out. Unless we were to invert the normalization on the way out, but that comes with a lot of added complexity.
So this is the solution I propose: just don't allow any upper-case characters in the UUIDs. This is technically not UUID spec compliant since we no longer accept all technically valid UUIDs.
# Test Plan
Run the test.
# Why
In other repositories at Expo we have this lint disallow rule to avoid accidental skips like this. This PR adds the same rule.
# How
1. Add rule.
2. Fix violation.
# Test Plan
`yarn lint`
Before this commit, for projects with `"type": "module"`, anything
exported from a file `export default` was not resolvable from the barrel
file as a named export.
After this change, the interface of the index is unchanged, but ESM
projects can use it.
To test this, the entity-example package is given `"type": "module"`,
and changed to run with `node --experimental-transform-types`. Its
imports from other packages do not need to change. The other
integration tests passing are evidence that commonjs modules also do not
need to change their imports.
This commit also adds an eslint rule to enforce this standard.
# Why
Noticed in this stack that a few more places could use the `@internal` typedoc annotation to prevent it from polluting the public docs.
# How
Add annotation to internal constructs.
# Test Plan
Inspect docs manually (`yarn typedoc`, open html file)
# Why
This is a retry of #98. It has become more important in Expo's server application due to more things running within transactions. When it was written previously, relatively few things were transactional.
The idea is that within a transaction, subsequent reads should be able to be cached locally (dataloader) as long as the local cache is kept consistent (not in the cache adapter though).
# How
The way this is done is to keep a dataloader map (dataloader per-entity like we do for the top-level loads) per-transaction as well. Then, when in a transaction, instead of going directly to the database, go through the transaction's dataloader before hitting the database. This way loads within the transaction are coalesced and cached locally.
Invalidation becomes more complex though.
- We still only want to invalidate the non-transactional dataloader/cache at the end of the transaction (as late as possible for least chance of race condition) for all changed entities. This didn't change.
- As for when to invalidate the transactional dataloaders, we need to think about this like database sub-transaction visibility, but only in the sense that we don't want inconsistent reads. Put another way, any load in or out of any transaction or nested transaction needs to be consistent with what is in the database, so any time the loaded value would change if it went directly do the database we must also invalidate the cache.
- This is further complicated by the fact that postgres doesn't have real subtransactions (see #194 for more discussion) and subtransactions weren't an entity feature for the first attempt at this. This means that it's hard to test the case where a nested transaction is isolated from the parent transaction for uncommitted reads or the inverse.
- The way I came up with achieving this is to just to over-invalidate: clear all the dataloaders in the transaction recursively starting from the outermost transaction. And do this clearing right after the mutation and at the end of the sub-transaction and at the end of the transaction (recursively).
# Test Plan
Run new tests.
# Why
Noticed that this (major) dependency of entity has been updated. The [changelog](https://github.com/graphql/dataloader/blob/main/CHANGELOG.md) doesn't indicate anything breaking.
# How
Upgrade.
# Test Plan
Rely upon full test coverage for compatibility.
# Why
Step 2 of #201.
This PR abstracts out (genericizes) the load key and load value interfaces for batched/cached loading in preparation for composite field loading.
# How
Accomplishing this requires a number of things:
1. A set of interfaces for the keys and load values to be used to load entity field objects.
2. A concrete implementation of that interface for the current use case (single fieldName, fieldValue(s)).
3. Data structure changes in the adapters and data manager to handle the new key type not being comparable via `===`. (see base PR for new map data structure for using these objects as keys).
4. Updates to the test matchers to know how to compare the serializable holder objects.
# Test Plan
Update a number of tests and add a few new tests. This has full coverage.
# Why
This adds the utility classes needed for composite field loading as described in #201.
# How
This adds a few concepts:
- `areSetsEqual` - simple utility for checking set equality
- `SerializableKeyMap` - a map where keys must be of a custom interface for checking equality.
# Test Plan
Add new tests, run them. Full coverage.
* Add global mutation trigger field to EntityCompanionProvider
* Add globalMutationTrigger to additional test cases
* merge mutation triggers outside of EntityMutator
* Exclude triggers with empty arrays
Why
---
Currently the UUIDField type supports only UUIDv1-5 and to use a newer UUID version we need to use StringField.
How
---
Manually implemented UUID validation, adding support for versions 6, 7, and 8. Also added support for the "max" UUID, which is now part of the spec.
Test Plan
---
Added a UUIDv7 value (from https://uuid7.com/) to test cases.
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
## Project Overview
This is Entity, a privacy-aware data layer for defining, caching, and authorizing access to application data models.
## Essential Development Commands
### Dependencies
-`yarn add` - Add a dependency. Run this only if necessary and ask before running.
### Building and Linting
-`yarn tsc` - Typecheck the code
-`yarn lint` - Run oxlint on source code
-`yarn format` - Format code with oxfmt
-`yarn format-check` - Check formatting without writing
-`yarn ctix` - Build barrel index.ts files
### Testing
-`yarn test` - Run unit tests
-`yarn integration` - Run integration tests against dockerized environment
### Commit messages
- All PRs use conventional commits for their titles: https://www.conventionalcommits.org/
## Code conventions
- Backwards compatibility is a non-goal of refactorings of this library. Consumers rely upon typescript to know what needs to be migrated, so all breaking changes should be detectable via running typescript post-entity-version-upgrade in a consumer application that makes use of this package.
- Do not use jest's `test.skip`
- Prefer not to use dynamic imports for now
- Whenever technically correct, use typescript types for something instead of `any`
- Prefer American English spellings of words over British English. For example, prefer "Adapter" over "Adaptor".
- declare runtime dependencies imported by published packages ([#717](https://github.com/expo/entity/issues/717)) ([3c96f3b](https://github.com/expo/entity/commit/3c96f3b9ea2b097c979447354f0abe35ed5e8d57))
- add ID-based and field-based knex database loaders for use with locking modifiers ([#706](https://github.com/expo/entity/issues/706)) ([e87e2a3](https://github.com/expo/entity/commit/e87e2a3a28f4279f5911bfd0189964b94a2ced7f))
- only throw EntityDatabaseAdapterPaginationCursorInvalidError from cursor decoding logic ([#537](https://github.com/expo/entity/issues/537)) ([e3cee07](https://github.com/expo/entity/commit/e3cee07091af8d1e6c5bb2d82f13e837c7658ea9))
- remove unused arg from EntityInvalidationUtils ([#536](https://github.com/expo/entity/issues/536)) ([0a1d1b5](https://github.com/expo/entity/commit/0a1d1b5972c15c932f5c31015f2519163f882f83))
- **deps:** update dependency graphql to v16.13.1 ([#510](https://github.com/expo/entity/issues/510)) ([1a8535f](https://github.com/expo/entity/commit/1a8535f983f38aaa462a8d587e2f62f5fab1043c))
### Features
- update the SQLExpression and SQLFragmentHelpers APIs ([#516](https://github.com/expo/entity/issues/516)) ([112d4dc](https://github.com/expo/entity/commit/112d4dc9b379da5317ff6acaf1d2e9bd597128a6))
- Add SQLExpression class that supports fluent comparison method API ([#506](https://github.com/expo/entity/issues/506)) ([535b681](https://github.com/expo/entity/commit/535b6811e08578aba1aadb095f3e401cfe7eaa26))
- **deps:** update dependency @koa/router to v15.3.1 ([#497](https://github.com/expo/entity/issues/497)) ([72b3c80](https://github.com/expo/entity/commit/72b3c80d12a1afa3c5593bcf6d7ad233c3524341))
### Features
- add support to SQLFragment for `= ANY(?)` ([#498](https://github.com/expo/entity/issues/498)) ([b931daa](https://github.com/expo/entity/commit/b931daa9a082cdb33f4559d6d32e1655f0459b79))
- escape all matching portions of parts of cacher cache keys ([#486](https://github.com/expo/entity/issues/486)) ([21f2f6f](https://github.com/expo/entity/commit/21f2f6f461ee771e8b1c1b22dbaf9b275094c0db))
- fix some security review suggestions ([#485](https://github.com/expo/entity/issues/485)) ([e263bd2](https://github.com/expo/entity/commit/e263bd218cda579365766d0918c4961304bd1d9f))
- Add default for TSelectedFields for application-instantiated types ([#438](https://github.com/expo/entity/issues/438)) ([3d4aa0e](https://github.com/expo/entity/commit/3d4aa0e9efa519a36f3db69bd8f117a993c100fa))
- Apply same viewer context subclass type mechanism to knexLoader and related methods ([#472](https://github.com/expo/entity/issues/472)) ([018a40b](https://github.com/expo/entity/commit/018a40bc01d579ffbf88f308e641921e6fc39097))
- correct discriminated union type for forward/backward pagination ([#474](https://github.com/expo/entity/issues/474)) ([90ae6e2](https://github.com/expo/entity/commit/90ae6e299bda26ac9a80d83e83334d4152c022dd))
- correct pagination behavior for standard pagination with descending ordering clauses ([#477](https://github.com/expo/entity/issues/477)) ([e32c4c2](https://github.com/expo/entity/commit/e32c4c2bcc05f225a556f95c90f1ee0f4e24de74))
- **deps:** update dependency @apollo/server to v5.4.0 [security] ([#420](https://github.com/expo/entity/issues/420)) ([cd81c5a](https://github.com/expo/entity/commit/cd81c5a5b6be43ef60248eeea4031a883dd1eae8))
- **deps:** update dependency @koa/bodyparser to v6.1.0 ([#405](https://github.com/expo/entity/issues/405)) ([2dda22d](https://github.com/expo/entity/commit/2dda22d761f87851e3fcccc8443597daf8ac42e8))
- **deps:** update dependency @koa/router to v15.3.0 ([#406](https://github.com/expo/entity/issues/406)) ([9e88cf6](https://github.com/expo/entity/commit/9e88cf6aab76902c65994d28de8dab73f1267021))
- **deps:** update dependency graphql to v16.13.0 ([#479](https://github.com/expo/entity/issues/479)) ([976e2c3](https://github.com/expo/entity/commit/976e2c33867da71a2920d050c4086e2af8f6d54d))
- **deps:** update dependency koa to v3.1.2 [security] ([#484](https://github.com/expo/entity/issues/484)) ([b258dad](https://github.com/expo/entity/commit/b258dad2ed69c473f04d57d26910eab2032d142c))
- eliminate some unnecessary any casts ([#448](https://github.com/expo/entity/issues/448)) ([cc78029](https://github.com/expo/entity/commit/cc78029117c14510b0934b5e0d19876a45570f8d))
- explicitly document behavior when cursor entity no longer exists ([#453](https://github.com/expo/entity/issues/453)) ([4dc156c](https://github.com/expo/entity/commit/4dc156c7a8dc50bc9e2802be133b9e258b289f54)), closes [#422](https://github.com/expo/entity/issues/422) [#431](https://github.com/expo/entity/issues/431)
- move EntityPrivacyUtils back into core package ([#429](https://github.com/expo/entity/issues/429)) ([56ec27d](https://github.com/expo/entity/commit/56ec27d5f201d83930a2cc05dfc380a054bff1e1))
- pass in augmentable classes to installation ([#437](https://github.com/expo/entity/issues/437)) ([f5c728b](https://github.com/expo/entity/commit/f5c728be565e01c0a8ace9ef51f6de8f49184dab)), closes [/github.com/expo/entity/pull/410#pullrequestreview-3765893898](https://github.com//github.com/expo/entity/pull/410/issues/pullrequestreview-3765893898)
- refactor install method to instead be free functions ([#441](https://github.com/expo/entity/issues/441)) ([51d632d](https://github.com/expo/entity/commit/51d632da1619dc039d5c41ce6533f63254ec4337)), closes [#410](https://github.com/expo/entity/issues/410)
- Reorganize constructionUtils to make non-public ([#454](https://github.com/expo/entity/issues/454)) ([d9377a2](https://github.com/expo/entity/commit/d9377a290b7e0c6803f9e83537eddb7204bc9320)), closes [#410](https://github.com/expo/entity/issues/410)
- revert change to codemod now that Entity.knexLoader is supported again via subclass ([#443](https://github.com/expo/entity/issues/443)) ([ed6b2e0](https://github.com/expo/entity/commit/ed6b2e05539c77ee2abd2c6da74e2a451967d06e)), closes [#441](https://github.com/expo/entity/issues/441)
- Type idField in EntityConfiguration as TIDField ([#425](https://github.com/expo/entity/issues/425)) ([be40bcf](https://github.com/expo/entity/commit/be40bcffa6e7db9b7ad75e1a80bbb48ff417c6c5))
- update integration test to use BlahEntity.knexLoader syntax ([#444](https://github.com/expo/entity/issues/444)) ([457f58a](https://github.com/expo/entity/commit/457f58ad2c4e1cf09f3132f3b9af5008ba0290c7)), closes [#441](https://github.com/expo/entity/issues/441)
- Use TSelectedFields for knex loader order by method ([#424](https://github.com/expo/entity/issues/424)) ([a9d09f4](https://github.com/expo/entity/commit/a9d09f42b67378d06133bcfb5b99c9afb17aac0d))
### Features
- Add authorization action to EntityPrivacyPolicyRuleEvaluationContext ([#464](https://github.com/expo/entity/issues/464)) ([e71ae5f](https://github.com/expo/entity/commit/e71ae5fcbae95096e0d6a42a8c960896ab83ccfb))
- Add ilike and trigram similarity search to pagination ([#431](https://github.com/expo/entity/issues/431)) ([f72cbca](https://github.com/expo/entity/commit/f72cbcaf5a722e6bb8299644ec32b07f1d3362a9)), closes [#422](https://github.com/expo/entity/issues/422)
- add method to get pagination cursor for single entity ([#475](https://github.com/expo/entity/issues/475)) ([898f71c](https://github.com/expo/entity/commit/898f71ce082c2593585575b60bd6ef2546717124))
- Add paginated loader to entity-database-adapter-knex ([#422](https://github.com/expo/entity/issues/422)) ([58deffd](https://github.com/expo/entity/commit/58deffd426b0214073ede608cd47c04db2596d60))
- Add pagination max page size configuration ([#436](https://github.com/expo/entity/issues/436)) ([3ec4b5f](https://github.com/expo/entity/commit/3ec4b5f0cd53bf18d6bcfa27dd29b70d3f4d5f19))
- Add raw sqlfragment orderBy capability for pagination ([#457](https://github.com/expo/entity/issues/457)) ([0615ffa](https://github.com/expo/entity/commit/0615ffacffbe9e903a9bf03b171c102f0554b992))
- add support for nulls ordering in order by clauses ([#468](https://github.com/expo/entity/issues/468)) ([6c0838d](https://github.com/expo/entity/commit/6c0838dc577a3b6190e3551ee834925d7bd53bc6))
- support nullable search fields with postgres transforms ([#470](https://github.com/expo/entity/issues/470)) ([53b0604](https://github.com/expo/entity/commit/53b0604152b8ca5ad9fc616d18478f93473c7eb0))
- **deps:** pin dependency @apollo/server to 4.12.2 ([#330](https://github.com/expo/entity/issues/330)) ([7038912](https://github.com/expo/entity/commit/7038912ca5e5b203ebbca4b46bda5612e7660eac))
- **deps:** pin dependency @koa/bodyparser to 6.0.0 ([#339](https://github.com/expo/entity/issues/339)) ([9f93926](https://github.com/expo/entity/commit/9f939269cf843059ec0ac729d470db074730348e))
- **deps:** pin dependency koa to 2.16.3 ([#331](https://github.com/expo/entity/issues/331)) ([ce55922](https://github.com/expo/entity/commit/ce55922e3ec6692a9ea4847427dc475902174830))
- Inline map().filter() loops in EntityLoaderUtils ([#369](https://github.com/expo/entity/issues/369)) ([ea6c128](https://github.com/expo/entity/commit/ea6c128d9c8fc21484645796f79e1aa8839dd395))
- run tsc during tests CI job ([#373](https://github.com/expo/entity/issues/373)) ([1cc57ed](https://github.com/expo/entity/commit/1cc57eddce72663cff17a5102afa6c3e8248aee4))
### Features
- synthetically set cascading set-null fields to null during canViewerDeleteAsync evaluation ([#376](https://github.com/expo/entity/issues/376)) ([544bb7c](https://github.com/expo/entity/commit/544bb7c3f2f41419cb3b779f7e3d968e09455fa0))
- switch local cache to an interface ([#322](https://github.com/expo/entity/issues/322)) ([c453726](https://github.com/expo/entity/commit/c4537262d810ea01e519f9aec6ae5b17a54ce936))
- add default for TSelectedFields in PrivacyPolicyTestUtils Case ([#316](https://github.com/expo/entity/issues/316)) ([2f9d487](https://github.com/expo/entity/commit/2f9d4873aaefe891920c25a41088f7c467da6113))
- make in memory and stub database adapters behave more similarly to sql ([#315](https://github.com/expo/entity/issues/315)) ([0f53c24](https://github.com/expo/entity/commit/0f53c24faff8a994906e630d7f17d67d89ff5b0f)), closes [#311](https://github.com/expo/entity/issues/311)
- add readonly modifier to partitionArray utility method ([#307](https://github.com/expo/entity/issues/307)) ([077d53c](https://github.com/expo/entity/commit/077d53cd86d4c54132ea2ebcc59d1d75e2b507d0))
- validate that UUID field is lower-case ([#310](https://github.com/expo/entity/issues/310)) ([949f00d](https://github.com/expo/entity/commit/949f00d93b52e405188b9b23e23ae59ce1c546de)), closes [/github.com/expo/entity/blob/077d53cd86d4c54132ea2ebcc59d1d75e2b507d0/packages/entity/src/EntityDatabaseAdapter.ts#L182](https://github.com//github.com/expo/entity/blob/077d53cd86d4c54132ea2ebcc59d1d75e2b507d0/packages/entity/src/EntityDatabaseAdapter.ts/issues/L182) [#309](https://github.com/expo/entity/issues/309)
### Features
- add more documentation to entity errors ([#312](https://github.com/expo/entity/issues/312)) ([4c3fd17](https://github.com/expo/entity/commit/4c3fd175a91cf3107b1ac413e39e52e051a9dc4b))
- throw specific errors for database adapter issues ([#311](https://github.com/expo/entity/issues/311)) ([f6639f9](https://github.com/expo/entity/commit/f6639f9def4ac20b628dd48fdca8d7cf61b6347b))
- add support for Buffer fields ([#305](https://github.com/expo/entity/issues/305)) ([31b52a5](https://github.com/expo/entity/commit/31b52a5f75842f4810f66c12ad03a10d9192f889))
- allow manual specification of cascadingDeleteCause in delete mutator factory method ([#306](https://github.com/expo/entity/issues/306)) ([4a3eda2](https://github.com/expo/entity/commit/4a3eda209fa747ee093ca3053b3196bf9a52193d))
- add ability to define a custom cache key invalidation version supplier ([#290](https://github.com/expo/entity/issues/290)) ([a3ab61b](https://github.com/expo/entity/commit/a3ab61bfa8d2eab3bbd9c703c5e483184bb67f13))
- add createOrGetExistingAsync and createWithUniqueConstraintRecoveryAsync utility methods ([#291](https://github.com/expo/entity/issues/291)) ([78bc264](https://github.com/expo/entity/commit/78bc264b3328692b4b6722388a57d298f02e65c5))
- introduce transactional dataloader mode and fix global transaction ID generation ([#289](https://github.com/expo/entity/issues/289)) ([d3e89bd](https://github.com/expo/entity/commit/d3e89bdd82e6df5c5b35522bc3574fd9e1cfddff))
- fix metrics for dataloader waterfall logging ([#267](https://github.com/expo/entity/issues/267)) ([1d95eba](https://github.com/expo/entity/commit/1d95eba1f9efb67164c3affc917c9b2514e1529f))
- move source of truth of loader docblocks to enforcing loader since it is not the default loader ([#264](https://github.com/expo/entity/issues/264)) ([aa56b70](https://github.com/expo/entity/commit/aa56b705db115cf760125208eb2d3585a3794e58))
- add composite field loading and caching ([#272](https://github.com/expo/entity/issues/272)) ([f0aa0da](https://github.com/expo/entity/commit/f0aa0dafebdb56418cbd22dda437233d850db3e7))
- add some utility classes and methods in preparation for composite keys ([#269](https://github.com/expo/entity/issues/269)) ([ad41af1](https://github.com/expo/entity/commit/ad41af1c826fb267f5e463771107c85802578a19)), closes [#201](https://github.com/expo/entity/issues/201)
- change entity id field generic to field name and derive type where necessary ([#278](https://github.com/expo/entity/issues/278)) ([b7e524c](https://github.com/expo/entity/commit/b7e524c41892797608d0b884410b8d520a80a9ef))
- enforce explicit id field cache property ([#276](https://github.com/expo/entity/issues/276)) ([1da5cc0](https://github.com/expo/entity/commit/1da5cc01e1affc3b3338a0ab2050504b5853ac6f))
- invalidate n+/-1 cacheKeyVersion for entities for push safety ([#275](https://github.com/expo/entity/issues/275)) ([d9c1852](https://github.com/expo/entity/commit/d9c1852706f98f0761ff24ddd244e4ed2beca580))
- feat!: Default all loaders and mutators to enforcing (#256) ([a976e76](https://github.com/expo/entity/commit/a976e765098bca27049585e43a3bed5c71b9ac6b)), closes [#256](https://github.com/expo/entity/issues/256)
### Features
- Create codemod for v0.40.0 -> v0.41.0 ([#260](https://github.com/expo/entity/issues/260)) ([4a2b61f](https://github.com/expo/entity/commit/4a2b61f2bd8edfc19109ef4c8ac780eaf0f7795c))
- add function to get authorization results for canViewerUpdateAsync/canViewerDeleteAsync ([#249](https://github.com/expo/entity/issues/249)) ([27a358d](https://github.com/expo/entity/commit/27a358d259503aa8d7d7413bfc1e52e0974dc626))
- make using non-enforcing entity loader explicit ([#238](https://github.com/expo/entity/issues/238)) ([2edc7af](https://github.com/expo/entity/commit/2edc7af7e20c362688ff2ee674fa2245205d6de4))
### Bug Fixes
- always reload entity after update since cascading changes may have changed it since commit ([#233](https://github.com/expo/entity/issues/233)) ([7c3c985](https://github.com/expo/entity/commit/7c3c9854a4dd91d4b73ebdb18bdeadea8b63f4c7))
- constrain entity fields type to string-keyed object ([#235](https://github.com/expo/entity/issues/235)) ([7e2cea1](https://github.com/expo/entity/commit/7e2cea16973a0ae1917f867cd25d6ef7c8eaecef))
- disallow keys of JS Object prototype for safety ([#236](https://github.com/expo/entity/issues/236)) ([05726d4](https://github.com/expo/entity/commit/05726d45fa9b91a6b25ddbc9c7e3e097b02097ca))
### Features
- Add global mutation trigger field to EntityCompanionProvider ([#215](https://github.com/expo/entity/issues/215)) ([6569486](https://github.com/expo/entity/commit/6569486ecddf2fd33c626f634c761e06636b1730))
- add previousValue to privacy policy context for updates ([#232](https://github.com/expo/entity/issues/232)) ([af495a9](https://github.com/expo/entity/commit/af495a9a856a5042f00cfd150348e415139cb85e))
- Add StrictEnumField with better validation ([#222](https://github.com/expo/entity/issues/222)) ([8753252](https://github.com/expo/entity/commit/87532525d090b3a67f1cedd95ac990f7dcb3ab5d))
- make canViewerDeleteAsync recursive ([#224](https://github.com/expo/entity/issues/224)) ([60fc9a4](https://github.com/expo/entity/commit/60fc9a4c4b587b866f2f5a1b3bd22145bc77e6e9))
- Use uuid v7 in stub database adapter ([#234](https://github.com/expo/entity/issues/234)) ([1e8ea64](https://github.com/expo/entity/commit/1e8ea64017430a2ce5ea197678bd78713ad77ecd))
- move entity loader utils into their own object ([#239](https://github.com/expo/entity/issues/239))([93905be](https://github.com/expo/entity/commit/93905be81cf74c5626ca19358794261c17223f95))
- remove unused field from redis configuration ([#213](https://github.com/expo/entity/issues/213)) ([503a2fb](https://github.com/expo/entity/commit/503a2fb6a8d57f6a09f6da99daf5ab92fc3e7945))
### Features
- add ability to specify knex transaction config ([#207](https://github.com/expo/entity/issues/207)) ([2069a0d](https://github.com/expo/entity/commit/2069a0d9fd1d8f7d090a71a90a758b2429ea5dd3))
- add example of redis mget batching using @expo/batcher ([#199](https://github.com/expo/entity/issues/199)) ([684f91b](https://github.com/expo/entity/commit/684f91b1f270851dbe331df2e2620664eea17266))
- change redis cache adapter to use redis-like interface ([#200](https://github.com/expo/entity/issues/200)) ([e381f5b](https://github.com/expo/entity/commit/e381f5b2acfc17dcade2cf6e8506fa1c1c255e73))
* update ioredis to v5, make it a devDependency of the cache packages ([#172](https://github.com/expo/entity/issues/172)) ([9fcfbf7](https://github.com/expo/entity/commit/9fcfbf746a61554cefedf7fb0f1a3a9056b58ffe))
- update ioredis to v5, make it a devDependency of the cache packages ([#172](https://github.com/expo/entity/issues/172)) ([9fcfbf7](https://github.com/expo/entity/commit/9fcfbf746a61554cefedf7fb0f1a3a9056b58ffe))
* add composed cache to index ([#166](https://github.com/expo/entity/issues/166)) ([5c82edc](https://github.com/expo/entity/commit/5c82edcd9f26854878d29950a05852e117bbd723))
- add composed cache to index ([#166](https://github.com/expo/entity/issues/166)) ([5c82edc](https://github.com/expo/entity/commit/5c82edcd9f26854878d29950a05852e117bbd723))
* Move data transforming responsibilities to the CacheAdapter instead of the ReadThroughEntityCache. Affects any classes extending the EntityCacheAdapter and relying on the transformation behavior of the ReadThroughEntityCache. ([#153](https://github.com/expo/entity/pull/153))
- Move data transforming responsibilities to the CacheAdapter instead of the ReadThroughEntityCache. Affects any classes extending the EntityCacheAdapter and relying on the transformation behavior of the ReadThroughEntityCache. ([#153](https://github.com/expo/entity/pull/153))
* Upgrade knex to 1.x in `@expo/entity-database-adapter-knex` ([#150](https://github.com/expo/entity/issues/150)) ([e1b0ee5](https://github.com/expo/entity/commit/e1b0ee528175646239d88aa71ffce73983eeb52f))
- Upgrade knex to 1.x in `@expo/entity-database-adapter-knex` ([#150](https://github.com/expo/entity/issues/150)) ([e1b0ee5](https://github.com/expo/entity/commit/e1b0ee528175646239d88aa71ffce73983eeb52f))
* separate post-commit invalidation callbacks from trigger and user callbacks ([#144](https://github.com/expo/entity/issues/144)) ([efa131e](https://github.com/expo/entity/commit/efa131ef29532accf0e51b6d867ffe15a27b4c90))
- separate post-commit invalidation callbacks from trigger and user callbacks ([#144](https://github.com/expo/entity/issues/144)) ([efa131e](https://github.com/expo/entity/commit/efa131ef29532accf0e51b6d867ffe15a27b4c90))
### Features
* add cascading deletion info ([#145](https://github.com/expo/entity/issues/145)) ([3727191](https://github.com/expo/entity/commit/372719176742d3ead6b7cbca29cb66b09b3fe09c))
- add cascading deletion info ([#145](https://github.com/expo/entity/issues/145)) ([3727191](https://github.com/expo/entity/commit/372719176742d3ead6b7cbca29cb66b09b3fe09c))
* add IP support ([#138](https://github.com/expo/entity/issues/138)) ([1405a91](https://github.com/expo/entity/commit/1405a9126ee3a56c3e2a38bf3b697283744f5b5d))
- add IP support ([#138](https://github.com/expo/entity/issues/138)) ([1405a91](https://github.com/expo/entity/commit/1405a9126ee3a56c3e2a38bf3b697283744f5b5d))
* expose describeFieldTestCase for use in other packages ([#139](https://github.com/expo/entity/issues/139)) ([1220477](https://github.com/expo/entity/commit/1220477aa331349b482ad015b44f76fa2bda7b90))
* upgrade TypeScript to 4.4 ([#134](https://github.com/expo/entity/issues/134)) ([7612392](https://github.com/expo/entity/commit/7612392dbfd9778d25c465c1626c372d75a6d05a))
* use better QueryContext types for transactional triggers and validators ([#136](https://github.com/expo/entity/issues/136)) ([5c7efe1](https://github.com/expo/entity/commit/5c7efe1678424ff907687e9327175bdc2538c3e0))
- expose describeFieldTestCase for use in other packages ([#139](https://github.com/expo/entity/issues/139)) ([1220477](https://github.com/expo/entity/commit/1220477aa331349b482ad015b44f76fa2bda7b90))
- upgrade TypeScript to 4.4 ([#134](https://github.com/expo/entity/issues/134)) ([7612392](https://github.com/expo/entity/commit/7612392dbfd9778d25c465c1626c372d75a6d05a))
- use better QueryContext types for transactional triggers and validators ([#136](https://github.com/expo/entity/issues/136)) ([5c7efe1](https://github.com/expo/entity/commit/5c7efe1678424ff907687e9327175bdc2538c3e0))
* allow null field values in loadManyByFieldEqualityConjunctionAsync ([#130](https://github.com/expo/entity/issues/130)) ([2f37dc6](https://github.com/expo/entity/commit/2f37dc6a37d368b12b3c8375e04f0777fd448797))
- allow null field values in loadManyByFieldEqualityConjunctionAsync ([#130](https://github.com/expo/entity/issues/130)) ([2f37dc6](https://github.com/expo/entity/commit/2f37dc6a37d368b12b3c8375e04f0777fd448797))
* upgrade ioredis, knex, and pg ([#125](https://github.com/expo/entity/issues/125)) ([7c43edf](https://github.com/expo/entity/commit/7c43edf3de37e8af13e2a99bd44f03f54803d9b9))
* upgrade some other packages to fix dependabot alerts ([#126](https://github.com/expo/entity/issues/126)) ([226bffe](https://github.com/expo/entity/commit/226bffe0a95d7b8a3e9e9d46aebdb0edf1eeec1a))
* use column name instead of field name for redis cache key ([#124](https://github.com/expo/entity/issues/124)) ([d78f452](https://github.com/expo/entity/commit/d78f452bb3ac5527069813a03f5b2264375bd8ab))
- upgrade ioredis, knex, and pg ([#125](https://github.com/expo/entity/issues/125)) ([7c43edf](https://github.com/expo/entity/commit/7c43edf3de37e8af13e2a99bd44f03f54803d9b9))
- upgrade some other packages to fix dependabot alerts ([#126](https://github.com/expo/entity/issues/126)) ([226bffe](https://github.com/expo/entity/commit/226bffe0a95d7b8a3e9e9d46aebdb0edf1eeec1a))
- use column name instead of field name for redis cache key ([#124](https://github.com/expo/entity/issues/124)) ([d78f452](https://github.com/expo/entity/commit/d78f452bb3ac5527069813a03f5b2264375bd8ab))
* mutation validator and trigger cyclic import structure ([#118](https://github.com/expo/entity/issues/118)) ([b11dbc0](https://github.com/expo/entity/commit/b11dbc087ba5ad13c748032698dd73279b7960b0))
- mutation validator and trigger cyclic import structure ([#118](https://github.com/expo/entity/issues/118)) ([b11dbc0](https://github.com/expo/entity/commit/b11dbc087ba5ad13c748032698dd73279b7960b0))
### Features
* add mutation type to validator and trigger execute functions ([#119](https://github.com/expo/entity/issues/119)) ([ef40fa5](https://github.com/expo/entity/commit/ef40fa5e9cdf53e25e78a9423c698e6d1c9737af))
- add mutation type to validator and trigger execute functions ([#119](https://github.com/expo/entity/issues/119)) ([ef40fa5](https://github.com/expo/entity/commit/ef40fa5e9cdf53e25e78a9423c698e6d1c9737af))
* allow undefined value for all fields ([#114](https://github.com/expo/entity/issues/114)) ([022e0e9](https://github.com/expo/entity/commit/022e0e9b88a5e84e0c1bc6c8810c850beb05f0cf))
- allow undefined value for all fields ([#114](https://github.com/expo/entity/issues/114)) ([022e0e9](https://github.com/expo/entity/commit/022e0e9b88a5e84e0c1bc6c8810c850beb05f0cf))
### Features
* add basic field type runtime validators ([#113](https://github.com/expo/entity/issues/113)) ([6c4d4b0](https://github.com/expo/entity/commit/6c4d4b03b5404dd776a12c5eb6f0af77a8c964f8))
- add basic field type runtime validators ([#113](https://github.com/expo/entity/issues/113)) ([6c4d4b0](https://github.com/expo/entity/commit/6c4d4b03b5404dd776a12c5eb6f0af77a8c964f8))
* move runInTransaction to ViewerContext ([#108](https://github.com/expo/entity/issues/108)) ([b7309e1](https://github.com/expo/entity/commit/b7309e18a2dd780b64cd306d566de1f12bf8df3a))
* remove cache and database adaptor flavor enums ([#109](https://github.com/expo/entity/issues/109)) ([72a77f8](https://github.com/expo/entity/commit/72a77f8b6893a4b76d3b1cce16659bdf3ce473ee))
- move runInTransaction to ViewerContext ([#108](https://github.com/expo/entity/issues/108)) ([b7309e1](https://github.com/expo/entity/commit/b7309e18a2dd780b64cd306d566de1f12bf8df3a))
- remove cache and database adaptor flavor enums ([#109](https://github.com/expo/entity/issues/109)) ([72a77f8](https://github.com/expo/entity/commit/72a77f8b6893a4b76d3b1cce16659bdf3ce473ee))
### Features
* better typing on filterMap for use with predicates ([#106](https://github.com/expo/entity/issues/106)) ([01b3bfe](https://github.com/expo/entity/commit/01b3bfef7c6da55e7d89d8cccb52a0050187aee8))
- better typing on filterMap for use with predicates ([#106](https://github.com/expo/entity/issues/106)) ([01b3bfe](https://github.com/expo/entity/commit/01b3bfef7c6da55e7d89d8cccb52a0050187aee8))
* add type generic default in test utils ([#104](https://github.com/expo/entity/issues/104)) ([fe2917e](https://github.com/expo/entity/commit/fe2917e6b5af808f166aa354d476e168c41e6d21))
* remove any cast from EntityLoader ([#100](https://github.com/expo/entity/issues/100)) ([b8e07f9](https://github.com/expo/entity/commit/b8e07f9ddc4077768980c000d61f5ddcc824e2e3))
- add type generic default in test utils ([#104](https://github.com/expo/entity/issues/104)) ([fe2917e](https://github.com/expo/entity/commit/fe2917e6b5af808f166aa354d476e168c41e6d21))
- remove any cast from EntityLoader ([#100](https://github.com/expo/entity/issues/100)) ([b8e07f9](https://github.com/expo/entity/commit/b8e07f9ddc4077768980c000d61f5ddcc824e2e3))
* add ability to invalidate an entity manually ([#91](https://github.com/expo/entity/issues/91)) ([d1a6f13](https://github.com/expo/entity/commit/d1a6f1339648942f12b3fb605eb329aefe5cdd63))
- add ability to invalidate an entity manually ([#91](https://github.com/expo/entity/issues/91)) ([d1a6f13](https://github.com/expo/entity/commit/d1a6f1339648942f12b3fb605eb329aefe5cdd63))
* correct type of runInTransactionAsync ([#81](https://github.com/expo/entity/issues/81)) ([f98f7d1](https://github.com/expo/entity/commit/f98f7d14b6149a496a7a3e97dd63d89b2842cc26))
- correct type of runInTransactionAsync ([#81](https://github.com/expo/entity/issues/81)) ([f98f7d1](https://github.com/expo/entity/commit/f98f7d14b6149a496a7a3e97dd63d89b2842cc26))
* fix incorrect loader types for field selecitons ([#72](https://github.com/expo/entity/issues/72)) ([cd2df8d](https://github.com/expo/entity/commit/cd2df8da4b81bcd4769e950d3124c18886df2816))
* fix index export for EntityMutationTrigger and EntityMutationValidator ([#73](https://github.com/expo/entity/issues/73)) ([7e829f3](https://github.com/expo/entity/commit/7e829f30fde0bd343cb8a584ccda5530cf61ec33))
* move cache invalidation to after transaction commit ([#77](https://github.com/expo/entity/issues/77)) ([dbc3c81](https://github.com/expo/entity/commit/dbc3c81b359a668b5134189ce6de49b5893bb5e7))
- fix incorrect loader types for field selecitons ([#72](https://github.com/expo/entity/issues/72)) ([cd2df8d](https://github.com/expo/entity/commit/cd2df8da4b81bcd4769e950d3124c18886df2816))
- fix index export for EntityMutationTrigger and EntityMutationValidator ([#73](https://github.com/expo/entity/issues/73)) ([7e829f3](https://github.com/expo/entity/commit/7e829f30fde0bd343cb8a584ccda5530cf61ec33))
- move cache invalidation to after transaction commit ([#77](https://github.com/expo/entity/issues/77)) ([dbc3c81](https://github.com/expo/entity/commit/dbc3c81b359a668b5134189ce6de49b5893bb5e7))
* ensure transitive deletion triggers are run for CASCADE_DELETE_INVALIDATE_CACHE ([#66](https://github.com/expo/entity/issues/66)) ([5744c51](https://github.com/expo/entity/commit/5744c51e6b3178bd9f229f3f465b683bb4474c8a))
* separate out EntityMutationValidator ([#68](https://github.com/expo/entity/issues/68)) ([547a1ef](https://github.com/expo/entity/commit/547a1efcecd17cc085702d1a3e9888ce5b644b13))
* update setField to correct typing ([#62](https://github.com/expo/entity/issues/62)) ([7a77afc](https://github.com/expo/entity/commit/7a77afc83ea732c9b062a5d6865eff9d3131d015))
- ensure transitive deletion triggers are run for CASCADE_DELETE_INVALIDATE_CACHE ([#66](https://github.com/expo/entity/issues/66)) ([5744c51](https://github.com/expo/entity/commit/5744c51e6b3178bd9f229f3f465b683bb4474c8a))
- separate out EntityMutationValidator ([#68](https://github.com/expo/entity/issues/68)) ([547a1ef](https://github.com/expo/entity/commit/547a1efcecd17cc085702d1a3e9888ce5b644b13))
- update setField to correct typing ([#62](https://github.com/expo/entity/issues/62)) ([7a77afc](https://github.com/expo/entity/commit/7a77afc83ea732c9b062a5d6865eff9d3131d015))
* correct some typing issues and exports ([#57](https://github.com/expo/entity/issues/57)) ([e91cfba](https://github.com/expo/entity/commit/e91cfba99321c2c4da2078aafd8627cbf0ceca50))
- correct some typing issues and exports ([#57](https://github.com/expo/entity/issues/57)) ([e91cfba](https://github.com/expo/entity/commit/e91cfba99321c2c4da2078aafd8627cbf0ceca50))
# 0.5.0 (2020-07-01)
### Bug Fixes
* support number ID field generation in StubDatabaseAdapter ([#43](https://github.com/expo/entity/issues/43)) ([60cc0fb](https://github.com/expo/entity/commit/60cc0fbda460c3ada1f5244a2780f90382fe3ebd))
* upgrade Apollo server for security advisory ([#38](https://github.com/expo/entity/issues/38)) ([d25c1e1](https://github.com/expo/entity/commit/d25c1e142d52385725593f4f155d1795697ab490))
- support number ID field generation in StubDatabaseAdapter ([#43](https://github.com/expo/entity/issues/43)) ([60cc0fb](https://github.com/expo/entity/commit/60cc0fbda460c3ada1f5244a2780f90382fe3ebd))
- upgrade Apollo server for security advisory ([#38](https://github.com/expo/entity/issues/38)) ([d25c1e1](https://github.com/expo/entity/commit/d25c1e142d52385725593f4f155d1795697ab490))
### Features
* add two fan out methods to association loader ([#52](https://github.com/expo/entity/issues/52)) ([89cfb3d](https://github.com/expo/entity/commit/89cfb3d5a01d4da90f64acc52ae1b839ba348a35))
* support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
- add two fan out methods to association loader ([#52](https://github.com/expo/entity/issues/52)) ([89cfb3d](https://github.com/expo/entity/commit/89cfb3d5a01d4da90f64acc52ae1b839ba348a35))
- support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
@@ -71,6 +67,7 @@ async function get_photo_page(viewer: ViewerContext): string {
## Use Case
Entity is not limited in where it can or should be used, but was designed for use in a [Koa](https://koajs.com/)-like environment with a request and response. At Expo, we use Entity in the following manner:
1. A request comes into Koa router
1. Middleware initializes the Entity framework for the request
1. A `ViewerContext` is created identifying the individual making the request.
@@ -78,11 +75,23 @@ Entity is not limited in where it can or should be used, but was designed for us
Note: The entity framework instance should not be shared across multiple requests since it contains a unique memoized [Dataloader](https://github.com/graphql/dataloader#class-dataloader). A long-lived instance is prone to data synchronization issues, especially when the application is scaled horizontally and multiple shared caches would exist for the same data.
## Contributing
We control development tooling versions using [mise-en-place](https://mise.jdx.dev). If you have it installed, then:
- Running `mise run ci` will run all tests that our CI environment will run.
- Running `mise t` will show a list of mise tasks you can run with `mise run <name>`.
- Running `mise en .` will enter a shell environment which includes node and yarn.
If you don't have `mise` installed, [you can install it](https://mise.jdx.dev/installing-mise.html#https-mise-run) as easily as running `curl https://mise.run/zsh | sh`.
- escape all matching portions of parts of cacher cache keys ([#486](https://github.com/expo/entity/issues/486)) ([21f2f6f](https://github.com/expo/entity/commit/21f2f6f461ee771e8b1c1b22dbaf9b275094c0db))
- switch local cache to an interface ([#322](https://github.com/expo/entity/issues/322)) ([c453726](https://github.com/expo/entity/commit/c4537262d810ea01e519f9aec6ae5b17a54ce936))
- add composite field loading and caching ([#272](https://github.com/expo/entity/issues/272)) ([f0aa0da](https://github.com/expo/entity/commit/f0aa0dafebdb56418cbd22dda437233d850db3e7))
- change entity id field generic to field name and derive type where necessary ([#278](https://github.com/expo/entity/issues/278)) ([b7e524c](https://github.com/expo/entity/commit/b7e524c41892797608d0b884410b8d520a80a9ef))
- feat!: Default all loaders and mutators to enforcing (#256) ([a976e76](https://github.com/expo/entity/commit/a976e765098bca27049585e43a3bed5c71b9ac6b)), closes [#256](https://github.com/expo/entity/issues/256)
- constrain entity fields type to string-keyed object ([#235](https://github.com/expo/entity/issues/235)) ([7e2cea1](https://github.com/expo/entity/commit/7e2cea16973a0ae1917f867cd25d6ef7c8eaecef))
- escape all matching portions of parts of cacher cache keys ([#486](https://github.com/expo/entity/issues/486)) ([21f2f6f](https://github.com/expo/entity/commit/21f2f6f461ee771e8b1c1b22dbaf9b275094c0db))
- eliminate some unnecessary any casts ([#448](https://github.com/expo/entity/issues/448)) ([cc78029](https://github.com/expo/entity/commit/cc78029117c14510b0934b5e0d19876a45570f8d))
- add support for Buffer fields ([#305](https://github.com/expo/entity/issues/305)) ([31b52a5](https://github.com/expo/entity/commit/31b52a5f75842f4810f66c12ad03a10d9192f889))
- add ability to define a custom cache key invalidation version supplier ([#290](https://github.com/expo/entity/issues/290)) ([a3ab61b](https://github.com/expo/entity/commit/a3ab61bfa8d2eab3bbd9c703c5e483184bb67f13))
- add composite field loading and caching ([#272](https://github.com/expo/entity/issues/272)) ([f0aa0da](https://github.com/expo/entity/commit/f0aa0dafebdb56418cbd22dda437233d850db3e7))
- change entity id field generic to field name and derive type where necessary ([#278](https://github.com/expo/entity/issues/278)) ([b7e524c](https://github.com/expo/entity/commit/b7e524c41892797608d0b884410b8d520a80a9ef))
- feat!: Default all loaders and mutators to enforcing (#256) ([a976e76](https://github.com/expo/entity/commit/a976e765098bca27049585e43a3bed5c71b9ac6b)), closes [#256](https://github.com/expo/entity/issues/256)
- constrain entity fields type to string-keyed object ([#235](https://github.com/expo/entity/issues/235)) ([7e2cea1](https://github.com/expo/entity/commit/7e2cea16973a0ae1917f867cd25d6ef7c8eaecef))
- remove unused field from redis configuration ([#213](https://github.com/expo/entity/issues/213)) ([503a2fb](https://github.com/expo/entity/commit/503a2fb6a8d57f6a09f6da99daf5ab92fc3e7945))
- add example of redis mget batching using @expo/batcher ([#199](https://github.com/expo/entity/issues/199)) ([684f91b](https://github.com/expo/entity/commit/684f91b1f270851dbe331df2e2620664eea17266))
- change redis cache adapter to use redis-like interface ([#200](https://github.com/expo/entity/issues/200)) ([e381f5b](https://github.com/expo/entity/commit/e381f5b2acfc17dcade2cf6e8506fa1c1c255e73))
* update ioredis to v5, make it a devDependency of the cache packages ([#172](https://github.com/expo/entity/issues/172)) ([9fcfbf7](https://github.com/expo/entity/commit/9fcfbf746a61554cefedf7fb0f1a3a9056b58ffe))
- update ioredis to v5, make it a devDependency of the cache packages ([#172](https://github.com/expo/entity/issues/172)) ([9fcfbf7](https://github.com/expo/entity/commit/9fcfbf746a61554cefedf7fb0f1a3a9056b58ffe))
* upgrade ioredis, knex, and pg ([#125](https://github.com/expo/entity/issues/125)) ([7c43edf](https://github.com/expo/entity/commit/7c43edf3de37e8af13e2a99bd44f03f54803d9b9))
* use column name instead of field name for redis cache key ([#124](https://github.com/expo/entity/issues/124)) ([d78f452](https://github.com/expo/entity/commit/d78f452bb3ac5527069813a03f5b2264375bd8ab))
- upgrade ioredis, knex, and pg ([#125](https://github.com/expo/entity/issues/125)) ([7c43edf](https://github.com/expo/entity/commit/7c43edf3de37e8af13e2a99bd44f03f54803d9b9))
- use column name instead of field name for redis cache key ([#124](https://github.com/expo/entity/issues/124)) ([d78f452](https://github.com/expo/entity/commit/d78f452bb3ac5527069813a03f5b2264375bd8ab))
**Note:** Version bump only for package @expo/entity-cache-adapter-redis
# 0.5.0 (2020-07-01)
### Features
* support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
- support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
`GenericRedisCacheContext.invalidationConfig.cacheKeyVersionsToInvalidateFn returned an empty list for cacheKeyVersion ${this.entityConfiguration.cacheKeyVersion}; this would silently disable invalidation`,
- refactor install method to instead be free functions ([#441](https://github.com/expo/entity/issues/441)) ([51d632d](https://github.com/expo/entity/commit/51d632da1619dc039d5c41ce6533f63254ec4337)), closes [#410](https://github.com/expo/entity/issues/410)
- revert change to codemod now that Entity.knexLoader is supported again via subclass ([#443](https://github.com/expo/entity/issues/443)) ([ed6b2e0](https://github.com/expo/entity/commit/ed6b2e05539c77ee2abd2c6da74e2a451967d06e)), closes [#441](https://github.com/expo/entity/issues/441)
A package containing jscodeshift codemods for @expo/entity upgrades.
Codemods are transformations that run on your codebase programmatically. This allows for a large amount of changes to be applied without having to manually go through every file.
## Usage
These should be used via the [jscodeshift CLI](https://github.com/facebook/jscodeshift?tab=readme-ov-file#usage-cli).
- declare runtime dependencies imported by published packages ([#717](https://github.com/expo/entity/issues/717)) ([3c96f3b](https://github.com/expo/entity/commit/3c96f3b9ea2b097c979447354f0abe35ed5e8d57))
- move EntityPrivacyUtils back into core package ([#429](https://github.com/expo/entity/issues/429)) ([56ec27d](https://github.com/expo/entity/commit/56ec27d5f201d83930a2cc05dfc380a054bff1e1))
- pass in augmentable classes to installation ([#437](https://github.com/expo/entity/issues/437)) ([f5c728b](https://github.com/expo/entity/commit/f5c728be565e01c0a8ace9ef51f6de8f49184dab)), closes [/github.com/expo/entity/pull/410#pullrequestreview-3765893898](https://github.com//github.com/expo/entity/pull/410/issues/pullrequestreview-3765893898)
- refactor install method to instead be free functions ([#441](https://github.com/expo/entity/issues/441)) ([51d632d](https://github.com/expo/entity/commit/51d632da1619dc039d5c41ce6533f63254ec4337)), closes [#410](https://github.com/expo/entity/issues/410)
- Add raw sqlfragment orderBy capability for pagination ([#457](https://github.com/expo/entity/issues/457)) ([0615ffa](https://github.com/expo/entity/commit/0615ffacffbe9e903a9bf03b171c102f0554b992))
- add support for nulls ordering in order by clauses ([#468](https://github.com/expo/entity/issues/468)) ([6c0838d](https://github.com/expo/entity/commit/6c0838dc577a3b6190e3551ee834925d7bd53bc6))
- declare runtime dependencies imported by published packages ([#717](https://github.com/expo/entity/issues/717)) ([3c96f3b](https://github.com/expo/entity/commit/3c96f3b9ea2b097c979447354f0abe35ed5e8d57))
- add ID-based and field-based knex database loaders for use with locking modifiers ([#706](https://github.com/expo/entity/issues/706)) ([e87e2a3](https://github.com/expo/entity/commit/e87e2a3a28f4279f5911bfd0189964b94a2ced7f))
- only throw EntityDatabaseAdapterPaginationCursorInvalidError from cursor decoding logic ([#537](https://github.com/expo/entity/issues/537)) ([e3cee07](https://github.com/expo/entity/commit/e3cee07091af8d1e6c5bb2d82f13e837c7658ea9))
- update the SQLExpression and SQLFragmentHelpers APIs ([#516](https://github.com/expo/entity/issues/516)) ([112d4dc](https://github.com/expo/entity/commit/112d4dc9b379da5317ff6acaf1d2e9bd597128a6))
- Add SQLExpression class that supports fluent comparison method API ([#506](https://github.com/expo/entity/issues/506)) ([535b681](https://github.com/expo/entity/commit/535b6811e08578aba1aadb095f3e401cfe7eaa26))
- add support to SQLFragment for `= ANY(?)` ([#498](https://github.com/expo/entity/issues/498)) ([b931daa](https://github.com/expo/entity/commit/b931daa9a082cdb33f4559d6d32e1655f0459b79))
- Add default for TSelectedFields for application-instantiated types ([#438](https://github.com/expo/entity/issues/438)) ([3d4aa0e](https://github.com/expo/entity/commit/3d4aa0e9efa519a36f3db69bd8f117a993c100fa))
- Apply same viewer context subclass type mechanism to knexLoader and related methods ([#472](https://github.com/expo/entity/issues/472)) ([018a40b](https://github.com/expo/entity/commit/018a40bc01d579ffbf88f308e641921e6fc39097))
- correct discriminated union type for forward/backward pagination ([#474](https://github.com/expo/entity/issues/474)) ([90ae6e2](https://github.com/expo/entity/commit/90ae6e299bda26ac9a80d83e83334d4152c022dd))
- correct pagination behavior for standard pagination with descending ordering clauses ([#477](https://github.com/expo/entity/issues/477)) ([e32c4c2](https://github.com/expo/entity/commit/e32c4c2bcc05f225a556f95c90f1ee0f4e24de74))
- eliminate some unnecessary any casts ([#448](https://github.com/expo/entity/issues/448)) ([cc78029](https://github.com/expo/entity/commit/cc78029117c14510b0934b5e0d19876a45570f8d))
- explicitly document behavior when cursor entity no longer exists ([#453](https://github.com/expo/entity/issues/453)) ([4dc156c](https://github.com/expo/entity/commit/4dc156c7a8dc50bc9e2802be133b9e258b289f54)), closes [#422](https://github.com/expo/entity/issues/422) [#431](https://github.com/expo/entity/issues/431)
- move EntityPrivacyUtils back into core package ([#429](https://github.com/expo/entity/issues/429)) ([56ec27d](https://github.com/expo/entity/commit/56ec27d5f201d83930a2cc05dfc380a054bff1e1))
- pass in augmentable classes to installation ([#437](https://github.com/expo/entity/issues/437)) ([f5c728b](https://github.com/expo/entity/commit/f5c728be565e01c0a8ace9ef51f6de8f49184dab)), closes [/github.com/expo/entity/pull/410#pullrequestreview-3765893898](https://github.com//github.com/expo/entity/pull/410/issues/pullrequestreview-3765893898)
- refactor install method to instead be free functions ([#441](https://github.com/expo/entity/issues/441)) ([51d632d](https://github.com/expo/entity/commit/51d632da1619dc039d5c41ce6533f63254ec4337)), closes [#410](https://github.com/expo/entity/issues/410)
- update integration test to use BlahEntity.knexLoader syntax ([#444](https://github.com/expo/entity/issues/444)) ([457f58a](https://github.com/expo/entity/commit/457f58ad2c4e1cf09f3132f3b9af5008ba0290c7)), closes [#441](https://github.com/expo/entity/issues/441)
- Use TSelectedFields for knex loader order by method ([#424](https://github.com/expo/entity/issues/424)) ([a9d09f4](https://github.com/expo/entity/commit/a9d09f42b67378d06133bcfb5b99c9afb17aac0d))
- Add ilike and trigram similarity search to pagination ([#431](https://github.com/expo/entity/issues/431)) ([f72cbca](https://github.com/expo/entity/commit/f72cbcaf5a722e6bb8299644ec32b07f1d3362a9)), closes [#422](https://github.com/expo/entity/issues/422)
- add method to get pagination cursor for single entity ([#475](https://github.com/expo/entity/issues/475)) ([898f71c](https://github.com/expo/entity/commit/898f71ce082c2593585575b60bd6ef2546717124))
- Add paginated loader to entity-database-adapter-knex ([#422](https://github.com/expo/entity/issues/422)) ([58deffd](https://github.com/expo/entity/commit/58deffd426b0214073ede608cd47c04db2596d60))
- Add pagination max page size configuration ([#436](https://github.com/expo/entity/issues/436)) ([3ec4b5f](https://github.com/expo/entity/commit/3ec4b5f0cd53bf18d6bcfa27dd29b70d3f4d5f19))
- Add raw sqlfragment orderBy capability for pagination ([#457](https://github.com/expo/entity/issues/457)) ([0615ffa](https://github.com/expo/entity/commit/0615ffacffbe9e903a9bf03b171c102f0554b992))
- add support for nulls ordering in order by clauses ([#468](https://github.com/expo/entity/issues/468)) ([6c0838d](https://github.com/expo/entity/commit/6c0838dc577a3b6190e3551ee834925d7bd53bc6))
- support nullable search fields with postgres transforms ([#470](https://github.com/expo/entity/issues/470)) ([53b0604](https://github.com/expo/entity/commit/53b0604152b8ca5ad9fc616d18478f93473c7eb0))
- throw specific errors for database adapter issues ([#311](https://github.com/expo/entity/issues/311)) ([f6639f9](https://github.com/expo/entity/commit/f6639f9def4ac20b628dd48fdca8d7cf61b6347b))
- add support for Buffer fields ([#305](https://github.com/expo/entity/issues/305)) ([31b52a5](https://github.com/expo/entity/commit/31b52a5f75842f4810f66c12ad03a10d9192f889))
- introduce transactional dataloader mode and fix global transaction ID generation ([#289](https://github.com/expo/entity/issues/289)) ([d3e89bd](https://github.com/expo/entity/commit/d3e89bdd82e6df5c5b35522bc3574fd9e1cfddff))
- add composite field loading and caching ([#272](https://github.com/expo/entity/issues/272)) ([f0aa0da](https://github.com/expo/entity/commit/f0aa0dafebdb56418cbd22dda437233d850db3e7))
- change entity id field generic to field name and derive type where necessary ([#278](https://github.com/expo/entity/issues/278)) ([b7e524c](https://github.com/expo/entity/commit/b7e524c41892797608d0b884410b8d520a80a9ef))
- enforce explicit id field cache property ([#276](https://github.com/expo/entity/issues/276)) ([1da5cc0](https://github.com/expo/entity/commit/1da5cc01e1affc3b3338a0ab2050504b5853ac6f))
- feat!: Default all loaders and mutators to enforcing (#256) ([a976e76](https://github.com/expo/entity/commit/a976e765098bca27049585e43a3bed5c71b9ac6b)), closes [#256](https://github.com/expo/entity/issues/256)
- constrain entity fields type to string-keyed object ([#235](https://github.com/expo/entity/issues/235)) ([7e2cea1](https://github.com/expo/entity/commit/7e2cea16973a0ae1917f867cd25d6ef7c8eaecef))
* Upgrade knex to 1.x in `@expo/entity-database-adapter-knex` ([#150](https://github.com/expo/entity/issues/150)) ([e1b0ee5](https://github.com/expo/entity/commit/e1b0ee528175646239d88aa71ffce73983eeb52f))
- Upgrade knex to 1.x in `@expo/entity-database-adapter-knex` ([#150](https://github.com/expo/entity/issues/150)) ([e1b0ee5](https://github.com/expo/entity/commit/e1b0ee528175646239d88aa71ffce73983eeb52f))
* allow null field values in loadManyByFieldEqualityConjunctionAsync ([#130](https://github.com/expo/entity/issues/130)) ([2f37dc6](https://github.com/expo/entity/commit/2f37dc6a37d368b12b3c8375e04f0777fd448797))
- allow null field values in loadManyByFieldEqualityConjunctionAsync ([#130](https://github.com/expo/entity/issues/130)) ([2f37dc6](https://github.com/expo/entity/commit/2f37dc6a37d368b12b3c8375e04f0777fd448797))
* add basic field type runtime validators ([#113](https://github.com/expo/entity/issues/113)) ([6c4d4b0](https://github.com/expo/entity/commit/6c4d4b03b5404dd776a12c5eb6f0af77a8c964f8))
- add basic field type runtime validators ([#113](https://github.com/expo/entity/issues/113)) ([6c4d4b0](https://github.com/expo/entity/commit/6c4d4b03b5404dd776a12c5eb6f0af77a8c964f8))
* fix index export for EntityMutationTrigger and EntityMutationValidator ([#73](https://github.com/expo/entity/issues/73)) ([7e829f3](https://github.com/expo/entity/commit/7e829f30fde0bd343cb8a584ccda5530cf61ec33))
* move cache invalidation to after transaction commit ([#77](https://github.com/expo/entity/issues/77)) ([dbc3c81](https://github.com/expo/entity/commit/dbc3c81b359a668b5134189ce6de49b5893bb5e7))
- fix index export for EntityMutationTrigger and EntityMutationValidator ([#73](https://github.com/expo/entity/issues/73)) ([7e829f3](https://github.com/expo/entity/commit/7e829f30fde0bd343cb8a584ccda5530cf61ec33))
- move cache invalidation to after transaction commit ([#77](https://github.com/expo/entity/issues/77)) ([dbc3c81](https://github.com/expo/entity/commit/dbc3c81b359a668b5134189ce6de49b5893bb5e7))
* separate out EntityMutationValidator ([#68](https://github.com/expo/entity/issues/68)) ([547a1ef](https://github.com/expo/entity/commit/547a1efcecd17cc085702d1a3e9888ce5b644b13))
- separate out EntityMutationValidator ([#68](https://github.com/expo/entity/issues/68)) ([547a1ef](https://github.com/expo/entity/commit/547a1efcecd17cc085702d1a3e9888ce5b644b13))
* correct some typing issues and exports ([#57](https://github.com/expo/entity/issues/57)) ([e91cfba](https://github.com/expo/entity/commit/e91cfba99321c2c4da2078aafd8627cbf0ceca50))
- correct some typing issues and exports ([#57](https://github.com/expo/entity/issues/57)) ([e91cfba](https://github.com/expo/entity/commit/e91cfba99321c2c4da2078aafd8627cbf0ceca50))
# 0.5.0 (2020-07-01)
### Features
* support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
- support entity fields subset of db fields ([#49](https://github.com/expo/entity/issues/49)) ([4e40b2e](https://github.com/expo/entity/commit/4e40b2e521407e521d236978ec3b3b56db3990be))
Loaded 100 of 407 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Will Schurman