Update dependency jdx/mise to v2026.7.17

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise	uses-with	patch	2026.7.16 → 2026.7.17	v2026.8.1 (+2)

---

Release Notes

jdx/mise (jdx/mise)

v2026.7.17: : Monorepo Task Inference and Root Defaults

Compare Source

This release builds out mise's experimental monorepo task story: Node workspaces now infer project dependency graphs, import package scripts as first-class tasks, and can share configuration through root task defaults and upstream (^task) dependencies. It also adds per-tool control over idiomatic version files, a smoother dotfiles workflow, and a batch of fixes across shell activation, hook-env, Homebrew casks, Aqua, and Python uv environments.

Highlights

• Node monorepo workspaces gain end-to-end task support: inferred project dependency edges, imported package.json scripts as node:<package>#<script> tasks, root task defaults shared by task name, and experimental ^task upstream dependencies for "build upstream projects first" ordering.
• New optional = true task dependencies run when they match and are silently skipped when they don't, and idiomatic version files can now be disabled per tool so .nvmrc and package.json no longer fight over your Node version.
• A round of environment and shell fixes stops hook-env from reloading every prompt after unrelated file writes, keeps the fish cd hook working during compound commands, and fixes zsh activation under POSIX_IDENTIFIERS.

Added

• task: Node workspace packages now expose their package.json scripts as mise tasks without needing a mise.toml in every package. Scripts get stable IDs like node:@​scope/app#build plus monorepo path aliases such as //packages/app:build, run in their package root through the detected package manager (npm/pnpm/Yarn/Bun) with raw argument passthrough, and explicit tasks take precedence while keeping both names linked. (#​11466 by @​jdx)

• task: Node workspaces now infer project dependency edges by matching declared internal package names (dependencies, devDependencies, optionalDependencies, peerDependencies) to other discovered packages, surfaced through mise tasks graph. This is the graph that powers dependency-aware ordering. (#​11435 by @​jdx)

• task: experimental root task defaults via [monorepo.task_defaults.<name>] in the root mise.toml, applied by task name to both inferred and explicit workspace tasks. Task-local config and extends templates still win. (#​11473 by @​jdx)

  [monorepo.task_defaults.build]
  sources = ["src/**", "package.json"]
  outputs = ["dist/**"]
  cache = { enabled = true }
  
  [monorepo.task_defaults.test]
  env = { NODE_ENV = "test" }

• task: experimental ^task upstream dependency syntax so a task can require the same task in every upstream workspace project before it runs, expanding through the project graph (including transitive upstreams) and skipping projects that lack the task. Supported in depends only. (#​11476 by @​jdx)

  [monorepo.task_defaults.build]
  depends = ["^build"]

• task: optional dependencies via optional = true on structured task dependencies. Optional deps run all matches when present and are silently omitted when nothing matches, while invalid selectors still error. Works across depends, depends_post, and wait_for. (#​11471 by @​jdx)

• config: idiomatic_version_file_disable_files lets you disable individual idiomatic version files per tool using tool:filename pairs, so you can keep .nvmrc selecting Node while ignoring package.json devEngines, with pnpm still reading package.json. (#​11470 by @​jdx)

  mise settings add idiomatic_version_file_disable_files node:package.json

• dotfiles: mise bootstrap dotfiles add now applies captured entries by default (use --no-apply for capture-only workflows), moves real paths into the dotfiles source before linking, normalizes and sorts [dotfiles] entries, and reports config writes and concrete apply actions, with rollback on failure. (#​11451 by @​jdx)

Fixed

• hook-env: creating an unrelated file in a config-search ancestor directory no longer forces env._.source and full config reloads to re-run on every prompt indefinitely. Forced fast-path runs now always refresh the session. (#​11458 by @​Marukome0743)
• activate: the fish directory-change hook now stays active while commands run, so each cd in a compound command applies the matching mise environment immediately, matching Bash and Zsh behavior. (#​11478 by @​Marukome0743)
• activate: zsh activation now works with POSIX_IDENTIFIERS enabled; MISE_* changes are captured correctly instead of hitting a bad math expression error. (#​11467 by @​jdx)
• brew: Homebrew casks using the new command_wrapper artifacts and structured run lifecycle steps (for example Firefox and OrbStack) now install and reconcile correctly instead of failing on unknown metadata. (#​11472 by @​jdx)
• aqua: version overrides now match their version_prefix family before evaluating constraints, so packages with multiple tag families (like oxlint's oxlint_v and apps_v) resolve to the right override. Locked installs also parse the release tag from the download URL so prefix-scoped overrides apply. (#​11469, #​11482 by @​jdx)
• python: uv auto-venv now respects UV_PROJECT_ENVIRONMENT when selecting, creating, and activating the virtual environment (resolving relative paths from the workspace root), and folds the resolved path into env cache keys so alternate venv locations are honored. (#​11475 by @​Marukome0743)
• lockfile: shim resolution with explicit unified monorepo lockfiles ([monorepo] lockfile = true) no longer rescans every configured monorepo root per tool, removing repeated filesystem traversal on the hot path. (#​11468 by @​jdx)
• config: alias and bootstrap writers, aliased tool keys, and version arrays now preserve surrounding comments when rewriting mise.toml. (#​11453, #​11474, #​11454 by @​JamBalaya56562)
• self-update: when self-update is disabled and no packager instructions file exists (as on Homebrew and Arch installs), mise now shows a generic upgrade hint instead of reporting an out-of-date version with no follow-up advice. (#​11449 by @​JamBalaya56562)
• task: source metadata hashes now include mtime, improving change detection for task sources. (#​11455 by @​JamBalaya56562)

Documentation

• Updated the stephane-robert guide URL and external post dates. (#​11252 by @​Bartok9)

Full Changelog: jdx/mise@v2026.7.16...v2026.7.17

💚 Sponsor mise

mise is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-6715

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube