mise-en-place

Experimental daemons can now run container images with Docker or Podman, and named preset ports can get their own port per worktree. This release also adds position = "append" for env._.path, an extra_ca_certs setting for TLS-inspecting proxies, and a registry_index option for locking pypi: tools. It fixes several lockfile, PyPI, Homebrew and task issues.

Added

• Container images as daemons (experimental). A custom daemon with an image key runs through docker run or podman run. It supports ports, readiness checks, depends, the proxy and mise daemons logs, just like other daemons. Every port is published on 127.0.0.1 only. Containers are named per project and worktree, so two checkouts never clash, and a stale container left behind by a killed run is removed before the next start. runtime = "auto" (the default) uses docker if it is on PATH, otherwise podman. You can set MISE_CONTAINER_RUNTIME to use any Docker-compatible CLI. data_mount bind-mounts a per-checkout data directory, and ready_cmd can use {{ runtime }}, {{ container }} and port placeholders. Limitations: mise does not pull or build images or start the Docker/Podman service, only TCP ports are supported, and starting a container daemon on Windows fails. #15182 (@jdx)

  [daemons.cockroach]
  image = "cockroachdb/cockroach:v25.1.0"
  command = ["start-single-node", "--insecure"]
  port = { auto = true, base = 26257 }
  ports.http = { container = 8080, auto = true, base = 27000 }
  data_mount = "/cockroach/cockroach-data"
  ready_cmd = "{{ runtime }} exec {{ container }} cockroach sql --insecure -e 'select 1'"
  

• Per-worktree named ports for daemon presets. Named preset ports such as http_port on cockroachdb or monitor_port on nats now accept { auto = true, base, stride }, just like the primary port. Each linked worktree adds its slot to the port's own base. Before, these ports were either fixed or offset from the preset default. When base is omitted, it defaults to the preset's port. Integer overrides still work as before. mise now reports a load error if an auto named port collides with another daemon's port in the same project. #15181 (@jdx)

  [daemons.cockroach]
  preset = "cockroachdb"
  version = "26"
  port = { auto = true, base = 26258 }
  ports.http_port = { auto = true, base = 27000 }
  

• position = "append" for env._.path. Appended entries go after tool paths and before the inherited PATH. This lets directories like ~/bin or ~/.cargo/bin stop shadowing tools that mise installs. The default is still "prepend". #15158 (@jdx, @Mossop)

  [env]
  _.path = [
    "bin",
    { path = ["~/bin", "~/.cargo/bin"], position = "append" },
  ]
  

• extra_ca_certs setting. extra_ca_certs (MISE_EXTRA_CA_CERTS) points to a PEM bundle that mise trusts in addition to its usual roots, on every platform. Use it when you're behind a traffic-inspecting proxy such as Socket Firewall. It covers mise's own HTTP requests: downloads, version lookups, GitHub API calls, attestation checks and vfox plugins. Programs that mise runs, such as git and uv, keep using their own certificate settings. You can set it only in the environment or in global config. The path must be absolute or start with ~/. If the bundle is unusable, mise warns and keeps its usual roots. #15171 (@jdx, @abjectnotfound)

  MISE_EXTRA_CA_CERTS=/etc/ssl/proxy-ca.pem mise install
  

• registry_index for pypi: tools. Set registry_index = "priority" to search a per-tool registry_url before PyPI when locking. This works for registries that host only your own packages, such as Gitea/Forgejo, pypiserver or a static index. The tool always comes from the registry, and only packages the registry doesn't have fall back to PyPI. The default, "default", keeps the current behavior: the registry replaces PyPI. #15157 (@jdx)

  [tools]
  "pypi:black" = { version = "25.9.0", registry_url = "<your-registry>/api/packages/org/pypi/simple/{}/", registry_index = "priority" }
  

• secret() in merge = "missing" dotfile entries. Tera templates in these entries can now call secret(). mise asks only for the secrets of keys missing from the target, so you can add a key to a private config later without entering the existing ones again. mise dot status and mise dot diff never read or prompt for a secret. Enforced merge = true entries still can't use secret(). #15168 (@jdx, @thernstig)

• Danger Swift libraries. The danger-swift registry entry now uses Danger's official installer, so libDanger and the Swift modules are installed with the executable. You still need to install Node and Danger JS separately. #15120 (@Mostafa-Ashraf97)

Fixed

• Lockfiles
  • mise upgrade now updates every lock entry of a tool that is declared in more than one config file, such as config.toml and a conf.d fragment. Before, the old entry stayed in the lockfile and mise outdated kept offering the same upgrade. #15164 (@jdx, @eliebleton-manomano)
  • http: tools with a file:// URL and no checksum install and lock again under the default lockfile_mode = "generate". mise now hashes the local file directly. #15180 (@jdx, @hcrosse)
  • mise install no longer exits 1 when a git task include can't be loaded, for example a private repository in CI. It warns and leaves the lockfile unchanged. An explicit mise lock still fails. #15166 (@jdx)
• PyPI / pipx
  • mise lock now locks a pypi: tool's dependency graph with the selected Python, even when that Python isn't on PATH. If a per-tool python isn't installed yet, uv may download it for resolution only, unless offline is set. #15153 (@jdx)
  • Tools from registries that publish no upload times can now have their dependency graph locked when minimum_release_age is set. Dependencies still respect the cutoff. #15159 (@jdx)
  • Repos that lock the same tool and dependencies on different days now share one install instead of each creating its own copy. Each affected tool gets one new install the first time you install it after upgrading. #15179 (@jdx, @tecnobrat)
• Homebrew
  • Source builds of tap formulae whose post_install uses Homebrew's MachO no longer fail. These steps are skipped with a warning. #15152 (@jdx)
  • install_symlink with a relative source, such as bin.install_symlink "foo" => "bar", now resolves against the target directory, as Homebrew does, instead of failing with different prefix. #15173 (@waynehoover)
  • Cask postflight hooks that use staged_path can now access the binary payload. This fixes installs such as brew-cask:dynatrace-oss/tap/dtctl. #14837 (@azohra)
• Tasks
  • A remote file task (one whose file is an HTTP URL) with its own env no longer fails with exit 127 when it runs as a sub-task or dependency. #15178 (@jdx)
  • mise now accepts comments in turbo.json, which is parsed as JSONC, and in global.json, which still rejects trailing commas. Before, a commented turbo.json printed a warning on every run and its task suggestions were dropped, and a commented global.json broke dotnet version detection. #15141 (@jdx)
• mise prune no longer removes tool versions that tasks still need when those tasks come from task_config.includes files, default task directories, or executable scripts with #MISE tools=.... #15156 (@jdx)
• latest for gem: tools no longer resolves to a RubyGems prerelease such as 4.1.0.beta3. To get prereleases, request one explicitly or set MISE_PRERELEASES=1. #15143 (@dennmart)
• When the active version doesn't provide a shim's executable, the error now names that version and the config that set it, and lists the installed versions that do provide it. Before, mise said "No version is set" and suggested switching versions with mise use -g. #15165 (@jdx, @mzagaja)
• mise upgrade and mise outdated no longer say "All tools are up to date" when a version lookup fails. They now list the tools they could not check. #15171 (@jdx, @abjectnotfound)

Changed

• Homebrew formulae are now resolved from the bulk formula.json index, with caching for tap metadata and cask evaluations. In one large setup, warm mise bootstrap packages upgrade --dry-run dropped from about 7.7s to 3.7s, and status from about 4.0s to 1.5s. The first run on a machine downloads the index once. #15183 (@waynehoover)

Deprecated

• lockfile_mode = "merge" is deprecated in favor of the default generate mode. Nothing changes yet. mise will start warning in 2027.4.0, and the mode will be removed in 2027.10.0. To migrate, delete the lockfile_mode = "merge" line (or unset MISE_LOCKFILE_MODE=merge). #15184 (@jdx)

Documentation

• The dotfiles docs now show how to use profile variants to apply an entry only when several environments are active. #15154 (@jdx, @miroslavkrysl)

New Contributors

• @nurazon59 made their first contribution in #15167
• @Mostafa-Ashraf97 made their first contribution in #15120
• @dennmart made their first contribution in #15143

Full Changelog: https://github.com/jdx/mise/compare/v2026.10.23...v2026.10.24

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.