~/.config/mise/conf.d/*.toml not treated as global config

[michal-grzelak]

Problem

Since few days, whenever I open terminal I get this warning:

mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons
mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons
mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons

Content of /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml (this is my config managed by chezmoi, that I not touch manually):

# MANAGED BY CHEZMOI! EDIT ONLY WITH: chezmoi edit

[tools]
node = "latest"
python = "latest"
go = "latest"
rust = "latest"
uv = "latest"
bun = "latest"

[settings]
verbose = false
yes = true
experimental = true
disable_backends = ["asdf"]

[hooks]
# automatically run `mise i` when entering a project with mise.toml
enter = "mise i -q"

I thought that configs in conf.d dir are global and suspect that mise doesn't handle /var/home correctly. /var/home is the standard dir in Fedora Atomic system (I use Ublue Aurora, which is Fedora Kinoite spin). /var/home is symlinked to /home on those systems. This creates another problem in mise that I described on discord. I will post it on github discussions after this issue is resolved, maybe it is connected and will be solved with this issue.

Output of mise dr:

mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons
version: 2026.6.10 linux-x64 (2026-06-14)
activated: yes
shims_on_path: no
self_update_available: no

build_info:
  Target: x86_64-unknown-linux-gnu
  Features: default, native-tls, self_update
  Built: Sun, 14 Jun 2026 22:59:39 +0000
  Rust Version: rustc 1.96.0 (ac68faa20 2026-05-25) (Homebrew)
  Profile: release

shell:
  /home/linuxbrew/.linuxbrew/bin/fish
  fish, version 4.7.1

aqua:
  baked in registry: aquaproj/aqua-registry@3671967a551902d4f8cd74085405ec214d173315
  baked in registry tools: 2220

dirs:
  cache: ~/.cache/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  /var~/.config/mise/conf.d/externally-managed.toml
  /var~/.config/mise/mise.toml

env_files:
  (none)

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  conda
  core
  dotnet
  forgejo
  gem
  github
  gitlab
  go
  npm
  pipx
  pkgx
  spm
  http
  s3
  ubi
  vfox

plugins:

toolset:
  aqua:FiloSottile/age@1.3.1
  aqua:astral-sh/uv@0.11.20
  aqua:pnpm/pnpm@11.5.3
  core:bun@1.3.14
  core:go@1.26.4
  core:node@26.3.0
  core:python@3.14.6
  core:rust@1.96.0
  github:jdx/fnox@1.25.1

path:
  ~/.local/share/mise/installs/age/latest/age
  ~/.local/share/mise/installs/fnox/latest
  ~/.local/share/mise/installs/node/latest/bin
  ~/.local/share/mise/installs/pnpm/latest
  ~/.local/share/mise/installs/python/latest/bin
  ~/.local/share/mise/installs/go/1.26.4/bin
  ~/.cargo/bin
  ~/.local/share/mise/installs/uv/latest/uv-x86_64-unknown-linux-musl
  ~/.local/share/mise/installs/bun/latest/bin
  /home/linuxbrew/.linuxbrew/bin
  /home/linuxbrew/.linuxbrew/sbin
  ~/.local/bin
  /usr/lib64/ccache
  /usr/local/bin
  /usr/bin
  /bin
  /usr/local/sbin

env_vars:
  MISE_SHELL=fish
  MISE_FISH_AUTO_ACTIVATE=0
mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons
mise WARN  yes in non-global config /var/home/mgrzelak/.config/mise/conf.d/externally-managed.toml is ignored for security reasons

settings:
  disable_backends  ["asdf"] /var~/.config/mise/conf.d/externally-managed.toml
  experimental      true     /var~/.config/mise/conf.d/externally-managed.toml
  verbose           false    /var~/.config/mise/conf.d/externally-managed.toml

No problems found

[JamBalaya56562]

This has been fixed in #10597, which was merged. It'll ship in the next release.

The root cause was exactly what you suspected: on Fedora Atomic / ostree the shell's PWD prefix (/var/home/...) differs from mise's $HOME-derived path (/home/...) because /home is a symlink to /var/home. mise already deduped the two forms of the path when loading config, but the security gate that decides whether a file is "global" used raw string equality, so the conf.d/*.toml files were judged non-global and global-only settings (like yes) were stripped — hence the ignored for security reasons warning.

The fix makes the global/system membership check symlink-aware (canonicalizing via the same desymlink_path helper the dedupe path already uses), with a raw-equality fast path so there's no extra filesystem cost on systems without a symlinked home.

Once the next release is out, please upgrade and confirm the warning is gone. And feel free to open the related /var/home issue you mentioned from Discord — if it's a separate path-canonicalization problem it may need its own fix.

This comment was generated by an AI coding assistant.