test(deps): update dependency mise to v2026.4.27 (main)

[renovate]

This PR contains the following updates:

Package	Update	Change
mise	patch	2026.4.25 → 2026.4.27

---

Release Notes

jdx/mise (mise)

v2026.4.27: : npm install args, smarter watch, and a macOS shim recursion fix

Compare Source

A focused release: more control over how npm-backed tools get installed, smarter mise watch that follows task dependencies, and a fix for a nasty macOS shim recursion that could lock up a shell during mise up --bump.

Added

• (backend) New npm_args, pnpm_args, bun_args, and aube_args tool options on the npm backend (#​9109) by @​risu729. Each one is forwarded to the matching package manager when it's the active settings.npm.package_manager, mirroring the pipx backend's style. The args are also recorded in the lockfile and at install time:

  [tools]
  "npm:npm" = { version = "latest", aube_args = "--reporter append-only" }
  "npm:tiny" = { version = "latest", pnpm_args = "--loglevel=warn" }

• (env) External vfox environment plugins now get ctx.config_root in their MiseEnv / MisePath hooks (#​9465) by @​hisaac. This matches what built-in directives like _.file already see, so plugins (e.g. mise-xcode) can resolve user-supplied relative paths against the project root regardless of the shell's cwd. watch_files returned from a plugin are now also absolutized against config_root instead of current_dir().

• (task) mise watch now follows the task graph and watches the sources of each chosen task's dependencies as well as its own (#​9437) by @​43081j. Pass --skip-deps (or set skip_deps) to restore the previous "task sources only" behavior. Explicit --glob overrides still win.

• (release) scripts/gen-aqua-changelog.sh now diffs the previous tag's registry.yaml against the current one and emits New Packages / Updated Packages sections in the release PR, instead of dumping the aqua-registry release tags rolled into the release (#​9471) by @​jdx. This restores the pre-#​9043 behavior for the merged-registry world.

Fixed

• (backend) When _list_remote_versions returned an empty list (invalid module path, throttling, etc.) the empty result was cached as if it were authoritative, poisoning both the on-disk cache file and the in-memory OnceCell for up to an hour (#​9444) by @​c22. The cache is now cleared in both places when the list comes back empty, so the next call re-fetches.

• (shims) Fixed an infinite shim recursion on macOS reported in #​9462 where mise up --bump against npm packages would loop mise -> npm shim -> mise -> npm shim -> ... and sometimes crash the session (#​9468) by @​jdx. The trigger was a case-mismatched $HOME in PATH (/Users/Olfway/... vs. /Users/olfway/...) — the shims-stripping in Backend::dependency_env compared byte-equal, so on case-insensitive APFS/HFS+ volumes it was a no-op and npm re-resolved to the mise shim. A new file::paths_eq does case-insensitive compares on macOS/Windows and byte-equal on Linux, and is now used everywhere mise asks "is this PATH entry the shims directory?" — including path_env_without_shims, which_no_shims, PathEnv partitioning, cli::exec program resolution, and the doctor's shims_on_path check (which had been silently reporting no for affected users).

• (task) Under deny_env = true on Linux, every env var was being stripped from the child process — including the PATH / HOME / USER / SHELL / TERM / LANG that filter_env and the docs say should pass through (#​9467) by @​jdx, fixing #​9466. apply_sandbox() was calling Command::env_clear() after the task executor populated explicit envs via .envs(filtered_env), wiping both. The Linux branch now snapshots the explicit envs before clearing and re-applies them; macOS already did this. A new path_test task in e2e/sandbox/test_sandbox_task guards against regressions.

New Contributors

• @​43081j made their first contribution in #​9437
• @​hisaac made their first contribution in #​9465

Full Changelog: jdx/mise@v2026.4.26...v2026.4.27

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.