fix(cli-tools): update cli-tools

[ppat-self-hosted-renovate-bot]

This PR contains the following updates:

Package	Update	Change	Pending
jdx/mise	minor	v2026.4.25 -> v2026.5.0	v2026.5.6 (+5)
starship/starship	patch	v1.25.0 -> v1.25.1

---

Release Notes

jdx/mise (jdx/mise)

v2026.5.0: : Conda graduates, smarter prereleases, and Windows POSIX tasks

Compare Source

Added

• (conda) Graduated the conda backend out of experimental (#​9544) by @​jdx.
• (deps) Added dart and flutter deps providers backed by pubspec.yaml / pubspec.lock (#​9505) by @​tjarvstrand.
• (task) sources entries can now be prefixed with ! to exclude paths, and a new sources_exclude field is supported; exclusions apply to freshness checks, task_source_files, and mise watch (#​9496) by @​jlarmstrongiv.
• (vfox) Added stat to the Lua file module so plugins can read file metadata (#​9497) by @​esteve.
• (registry) Added neo4j (#​9525), rustfs (#​9530), expert (#​9498), systemctl-tui (#​9521), codon (#​9538), yr (#​9542), betterleaks (#​9541), git-filter-repo (#​9550), umoci (#​9555), google-java-format (#​9488), an aqua backend for elixir-ls (#​9557), and enabled shellcheck on Windows (#​9487).

Fixed

• (backend) Stamp prerelease metadata via regex for backends that don't expose it upstream (#​9500) by @​jdx.
• (backend) Treat -nightly, -canary, -experimental, -insider, -edge as prereleases (#​9523) by @​jdx.
• (backend) Scope PEP 440 prerelease detection to Python backends (#​9558) by @​jdx.
• (backend) Honor dotnet.package_flags = "prerelease" and --prerelease for dotnet (#​9551) by @​jdx.
• (backend) Suppress repeated No versions found warnings for backends that support unresolved latest (#​9548) by @​jdx.
• (install) Don't warn for configured tools when version is passed via CLI (#​9522) by @​jdx.
• (install) Refresh latest before installing missing tools (#​9545) by @​jdx.
• (install) Don't cache nonexistent install paths (#​9553) by @​jdx.
• (lockfile) Don't propagate ad-hoc CLI overrides into the project lockfile (#​9562) by @​jdx.
• (plugin) Detect plugin types after cloning (#​9540) by @​risu729.
• (task) Convert PATH to MSYS Unix form when spawning POSIX shells on Windows (#​9547) by @​JamBalaya56562.
• (cargo) Apply install_env during cargo install (#​9502) by @​c22.
• (github) Skip attestations on non-default api_url (#​9486) by @​jdx.
• (github) Retry IP allow list errors without auth (#​9506) by @​risu729.
• (http) Update versions host tracking endpoint (#​9527) by @​jdx.
• (release) Pass --no-git-checks to aube publish (#​9483) by @​jdx.
• (copr) Drop epel-9 chroots since rust >= 1.91 is unavailable (#​9484) by @​jdx.

Changed

• (registry) Deny inline backend options in registry tool entries (#​9565) by @​risu729.
• (registry) Update entry for checkmake (#​9504) by @​eread.

Deprecated

• shorthands_file setting / MISE_SHORTHANDS_FILE is deprecated; warning starts in 2026.6.0, removal planned for 2026.12.0. Use [plugins] instead (#​9534) by @​risu729.

Documentation

• Document ghtkn as a GitHub credential_command (#​9546) by @​jdx.
• Clarify registry backend acceptance policy (#​9543, 7bbeebe) by @​jdx.
• Update mise watch docs to pitchfork.en.dev (#​9536) by @​risu729.
• Use bash in exec example for variable echoing (#​9567) by @​kuboon.

💚 Sponsor mise

mise is built by @​jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

v2026.4.28: : Remote tasks pinned by commit SHA

Compare Source

A small patch release: remote tasks pinned to a commit SHA no longer panic, and the Fedora COPR packaging pipeline picks up Dockerfile fixes again.

Fixed

• (task) Remote tasks referenced by commit SHA (a git:: source with ?ref=<40-char hex>) no longer crash mise with we map by name only and have no object-id in refspec from gix (#​9473) by @​jdx. gix-refspec parses any 40- or 64-char hex string as an ObjectId refspec, but gix::clone::fetch::util::find_custom_refname only handles name-based matches and expect()s on the result, so passing a bare SHA to prepare_clone.with_ref_name() triggered a hard process panic on every cache miss. Git::clone now detects SHA-shaped refs via a looks_like_sha heuristic, skips both the with_ref_name() and git clone -b paths (neither accepts bare SHAs), drops --depth 1 since shallow clones may not contain the requested object, and checks out the SHA after the clone via the existing CLI-backed update. Named branches and tags continue to use the existing fast paths. Closes #​9472.

• (copr) The copr-publish workflow no longer pins a stale ghcr.io/jdx/mise:copr image digest, and docker.yml now rebuilds the :copr image whenever packaging/copr/Dockerfile changes on main (#​9451) by @​bestagi. Previously the workflow kept hitting ModuleNotFoundError: No module named 'rich' even after #​9421 switched copr-cli to dnf install, because the hardcoded digest still pointed at the old pip-installed image.

New Contributors

• @​bestagi made their first contribution in #​9451

Full Changelog: jdx/mise@v2026.4.27...v2026.4.28

v2026.4.27: : npm install args, smarter watch, and a macOS shim recursion fix

Compare Source

A focused release: more control over how npm-backed tools get installed, smarter mise watch that follows task dependencies, and a fix for a nasty macOS shim recursion that could lock up a shell during mise up --bump.

Added

• (backend) New npm_args, pnpm_args, bun_args, and aube_args tool options on the npm backend (#​9109) by @​risu729. Each one is forwarded to the matching package manager when it's the active settings.npm.package_manager, mirroring the pipx backend's style. The args are also recorded in the lockfile and at install time:

  [tools]
  "npm:npm" = { version = "latest", aube_args = "--reporter append-only" }
  "npm:tiny" = { version = "latest", pnpm_args = "--loglevel=warn" }

• (env) External vfox environment plugins now get ctx.config_root in their MiseEnv / MisePath hooks (#​9465) by @​hisaac. This matches what built-in directives like _.file already see, so plugins (e.g. mise-xcode) can resolve user-supplied relative paths against the project root regardless of the shell's cwd. watch_files returned from a plugin are now also absolutized against config_root instead of current_dir().

• (task) mise watch now follows the task graph and watches the sources of each chosen task's dependencies as well as its own (#​9437) by @​43081j. Pass --skip-deps (or set skip_deps) to restore the previous "task sources only" behavior. Explicit --glob overrides still win.

• (release) scripts/gen-aqua-changelog.sh now diffs the previous tag's registry.yaml against the current one and emits New Packages / Updated Packages sections in the release PR, instead of dumping the aqua-registry release tags rolled into the release (#​9471) by @​jdx. This restores the pre-#​9043 behavior for the merged-registry world.

Fixed

• (backend) When _list_remote_versions returned an empty list (invalid module path, throttling, etc.) the empty result was cached as if it were authoritative, poisoning both the on-disk cache file and the in-memory OnceCell for up to an hour (#​9444) by @​c22. The cache is now cleared in both places when the list comes back empty, so the next call re-fetches.

• (shims) Fixed an infinite shim recursion on macOS reported in #​9462 where mise up --bump against npm packages would loop mise -> npm shim -> mise -> npm shim -> ... and sometimes crash the session (#​9468) by @​jdx. The trigger was a case-mismatched $HOME in PATH (/Users/Olfway/... vs. /Users/olfway/...) — the shims-stripping in Backend::dependency_env compared byte-equal, so on case-insensitive APFS/HFS+ volumes it was a no-op and npm re-resolved to the mise shim. A new file::paths_eq does case-insensitive compares on macOS/Windows and byte-equal on Linux, and is now used everywhere mise asks "is this PATH entry the shims directory?" — including path_env_without_shims, which_no_shims, PathEnv partitioning, cli::exec program resolution, and the doctor's shims_on_path check (which had been silently reporting no for affected users).

• (task) Under deny_env = true on Linux, every env var was being stripped from the child process — including the PATH / HOME / USER / SHELL / TERM / LANG that filter_env and the docs say should pass through (#​9467) by @​jdx, fixing #​9466. apply_sandbox() was calling Command::env_clear() after the task executor populated explicit envs via .envs(filtered_env), wiping both. The Linux branch now snapshots the explicit envs before clearing and re-applies them; macOS already did this. A new path_test task in e2e/sandbox/test_sandbox_task guards against regressions.

New Contributors

• @​43081j made their first contribution in #​9437
• @​hisaac made their first contribution in #​9465

Full Changelog: jdx/mise@v2026.4.26...v2026.4.27

starship/starship (starship/starship)

v1.25.1

Compare Source

Bug Fixes

• git: improve bare repository detection (#​7421) (27079d7)
• presets: Update no-nerd-font to be up-to-date (#​7440) (65fb647)
• python: align python_binary schema with argument support (#​7415) (3ec9b5c)

---

Configuration

📅 Schedule: Branch creation - "before 10am on Tuesday" in timezone US/Eastern, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.