v2026.9.2: Packslip Backend, SSH Relay, and Reimagined Install Progress

This is a large release headlined by the new stable packslip: backend for installing tools from a vendor's own signed release manifest, a read-only GitHub SSH relay for remote onboarding, redesigned install progress for both terminals and CI logs, and a rebuilt dotfiles-tracking model for bootstrap. It also carries dozens of fixes across shims, tasks, brew, Go, npm, and the schema, plus two security fixes.

Highlights

• The packslip: backend is now generally available: install tools directly from a project's cryptographically signed release manifest, with signer pinning, trusted stampers, host-requirement checks, shell completions, and agent skills all driven from the same signed source.
• Install output was reimagined end to end. Interactive terminals get a live region with a fractional install-wide bar and permanent completion lines, while CI logs, pipes, and AI-agent terminals get a compact append-only reporter instead of thousands of scrolling rows.
• Bootstrap grows a read-only GitHub SSH relay and --from-git onboarding, an AUR package manager, and a rebuilt dotfiles-history model that tracks files through ordinary Git commits synchronized with an origin.

Added

• packslip: New packslip: backend installs tools from a vendor-published, signed release manifest (a sigstore bundle) that names every artifact with its digest, platform, format, and executables. The tool name is a pin, like a known_hosts entry: packslip:github.com/owner/repo accepts only a packslip signed by that repository's release workflow, and signature, log entry, statement, digest, and size are all verified before anything is unpacked. Custom hosts and monorepo tools are supported. The backend is no longer experimental. (#12778, #12811 by @jdx)

  [tools]
  "packslip:github.com/oxc-project/oxc/oxlint" = "latest"

• packslip: Signer pinning remembers, per project, the signer that signed the first accepted release in a pins.toml file (like SSH's known_hosts) and records the signer in mise.lock, so a later release signed by anyone else, or one that weakens provenance, is refused. mise packslip pins lists what is pinned and mise packslip forget <project> accepts an announced key rotation. (#12783 by @jdx)

• packslip: New packslip.stampers setting lets you require that a trusted host has stamped a version before mise offers or installs it (a scanning service, a mirror, or eventually the registry), with a per-tool trust = "vendor" override. (#12782 by @jdx)

• packslip: Declared host requirements (OS/glibc minimums, shared libraries, required commands) are checked before download; confirmed failures refuse the install, gaps mise cannot verify warn only, and ignore_requirements = true overrides hard failures. latest also resolves from verified vendor recommendations. (#12804, #12805 by @jdx)

• packslip: A tool's packslip can ship shell completions and agent skills. mise completion <shell> --tool <name> prints (or --install writes a version-aware stub for) completions for whichever version is active in the current directory, and mise skills ls / mise skills sync link a tool's Agent Skills into .claude/skills at the pinned version. Completions are also loaded automatically in activated shells. (#12779, #12780, #12848 by @jdx)

• install: Redesigned install progress. Interactive terminals now show a live region with an install-wide fractional bar, per-tool phase/elapsed/artifact rows, dependency-wait rows ("waiting for node@24.20.0"), and permanent completion lines written into scrollback. prune, uninstall, and upgrade removals reuse the same session, so pruning hundreds of versions no longer floods the screen. (#12906 by @jdx)

• install: CI logs, pipes, and AI-agent terminals (CLAUDECODE/AI_AGENT) get a compact append-only reporter: one permanent line per finished tool plus a periodic snapshot of the bar, active phases, transfer rates, and queue count, instead of hundreds of scrolling status rows. Resolver hosts and retry progress are surfaced too. (#12902, #12907 by @jdx)

• ssh: New mise ssh runs ordinary OpenSSH sessions with optional session-scoped, read-only GitHub access, and mise bootstrap remote --from-git onboards a remote host from a Git repo. The initiating machine keeps the credential and brokers authorized clone/fetch and REST reads over an SSH Unix-socket forward; no token is installed on the target. (#12830 by @jdx)

  mise ssh devbox --github-relay-read-only --github-relay-repo jdx/dotfiles

• bootstrap: mise bootstrap --from-git <GIT_URL> clones a repository-backed global config into $MISE_CONFIG_DIR so its config.toml, conf.d/, and tasks apply on the first bootstrap and stay active afterward. (#12715 by @jdx)

• bootstrap: New aur: package manager installs from the Arch User Repository via yay (preferred) or paru, with foreign-package status detection so repo packages with colliding names cannot satisfy an AUR request. Bootstrap can also declare packages as absent to remove them, and now reports which root declarations were selected. (#12718, #12716, #12770 by @jdx)

• bootstrap: Rebuilt dotfiles tracking. Files enrolled with mode = "track" stay in place while mise commits changes to a separate bare Git store with checkpoints, rollback/undo, and optional origin synchronization, including encryption of shared files before storage. (#12918 by @jdx)

• activate: New activate_shims = false (MISE_ACTIVATE_SHIMS=false) keeps tool shim directories off PATH during activation and hooks without changing your auto-install or lazy-tool settings. Command wrappers such as mr-boxington's cargo keep working. (#12926 by @jdx)

• core: Rust tools accept mr_boxington = true and mise use gains a repeatable --tool-option KEY=VALUE flag, so setting up the Cargo wrapper is a single command. (#12908 by @jdx)

  mise use --tool-option mr_boxington=true rust mr-boxington

• ruby: mise now reads Bundler's ruby file: ".ruby-version" form from a Gemfile (resolving the path next to the Gemfile), so projects that pin Ruby through a sibling file resolve correctly. (#12914 by @jdx)

• self-update: New global-only self_update.repository and self_update.api_url settings let organizations point manual updates, out-of-date hints, and automatic updates at a curated GitHub or GitHub Enterprise release mirror. Project config cannot redirect updates, and artifacts still pass the embedded-signature check. (#12735 by @jdx)

• backend: install_env is now applied when resolving and downloading tools, not just at build time. (#12777 by @rabadin)

• brew: mise can now evaluate ordinary third-party taps. (#12774 by @jdx)

Fixed

• shim: Lazy tool names now match on Windows, and mise-shim.exe resolves correctly through a symlinked mise.exe. (#12699 by @jdx, #12915 by @acooler15)
• activate: Paths are translated for the calling Windows POSIX shell, and PowerShell pipeline input is now forwarded. (#12736, #12925 by @jdx)
• nushell: The activation prelude preserves the PATH list type. (#12754 by @Junaid-PK)
• task: Task globs no longer loop on symlinks, sources accepts a single string, task status is preserved when the cache audit tracer fails, and POSIX shells no longer have PATH pre-converted (the shell already does it). (#12711, #12769 by @jdx, #12530 by @risu729, #12696 by @JamBalaya56562)
• npm: Global installs now work with pnpm 12. (#12717 by @jdx)
• go: Private modules resolve via Go, and loong64 uses the correct artifact architecture. (#12731 by @kejne, #12767 by @jdx)
• brew: A tapped install now explains why it found no API metadata, and all tap formula layouts are supported. brew-cask packages with auto_updates enabled are upgraded correctly. (#12645 by @Marukome0743, #12837 by @soodoh, #12857 by @himkt)
• github: Releases with no assets are omitted from the version list, and OAuth-refresh warnings are silenced during env export and shown only once when a refresh is rejected. (#12572 by @Marukome0743, #12855, #12911 by @jdx)
• config: Every newly added .tool-versions line is now terminated with a newline. (#12740 by @dylanpulver)
• env: Bootstrap shims for lazy tools are created when printing the env, and duplicate unset directives are removed from hook output. (#12726 by @hktitof, #12707 by @jdx)
• http: A failed download's partial file is flushed before giving up, and cache compression finishes before files are published. (#12823 by @Marukome0743, #12894 by @jdx)
• bootstrap: Tera templates render in hooks, tildes expand in managed file sources, and the relative config dir is pinned during reexec. (#12727, #12768, #12721 by @jdx)
• backend: Disabled plugins are excluded from shorthand resolution, and installed plugins are included in plugin completion. (#12927, #12720 by @jdx)
• rust: Incomplete rustup toolchains are reconciled. (#12771 by @jdx)
• oci/vfox/aqua: OCI reused tool layers preserve their paths, vfox preserves the tool name from legacy lockfiles, and aqua handles repository transfers in attestations. (#12749, #12745, #12766 by @jdx)
• sandbox: SYS_fork/SYS_vfork are omitted on aarch64. (#12807 by @jamescassell)
• dotfiles: A stale directory the deeper walk already removed is tolerated. (#12697 by @vladbisceanu)
• schema: Absent bootstrap packages, inline dotfile content, and missing built-in deps providers are now modeled. (#12785 by @nettlesh, #12738, #12739 by @risu729)
• lockfile: The deferred provenance baseline is dropped once auto-lock verifies the upgrade. (#12825 by @jdx)

Security

• http: URL replacements no longer forward authorization headers or URL credentials when an HTTPS origin is rewritten to HTTP; such credential-carrying downgrades are refused, and errors omit URLs so embedded credentials cannot leak through diagnostics. (#12879 by @jdx)
• self-update: Self-update now requires secure release sources. (#12737 by @jdx)

New Contributors

• @acooler15 made their first contribution in #12915
• @soodoh made their first contribution in #12837
• @jamescassell made their first contribution in #12807
• @nettlesh made their first contribution in #12785
• @Junaid-PK made their first contribution in #12754
• @kejne made their first contribution in #12731
• @dylanpulver made their first contribution in #12740
• @Svector-anu made their first contribution in #12714
• @vladbisceanu made their first contribution in #12697

Full Changelog: v2026.9.1...v2026.9.2

💚 Sponsor mise

mise is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.