feat: rename `mise prepare` to `mise deps` and add package management by jdx · Pull Request #9056 · jdx/mise

jdx · 2026-04-11T18:29:25Z

Summary

Renames the experimental mise prepare command to mise deps, positioning it as a proper dependency management command
Adds mise deps add npm:react and mise deps remove npm:lodash subcommands for managing individual packages
Implements add/remove for all 4 JS package managers (npm, yarn, pnpm, bun)
mise deps (bare) defaults to mise deps install which is the previous mise prepare behavior
Renames all config ([prepare] -> [deps]), settings (show_prepare_stale -> show_deps_stale), flags (--no-prepare -> --no-deps), and state files (prepare-state.toml -> deps-state.toml)
No backwards compatibility needed since prepare was experimental

Test plan

🤖 Generated with Claude Code

Note

Medium Risk
Medium risk because this renames an end-to-end command/config surface (prepare→deps) and threads the new flag/state/schema through exec/run flows, which can break existing experimental users and monorepo provider discovery. Behavior is largely a rename plus new JS package add/remove execution, but touches multiple CLI entrypoints and config parsing.

Overview
Renames the experimental dependency workflow from mise prepare to mise deps. This updates CLI wiring, help/manpages, usage spec, interactive config editor UI, and all documentation references, including the skip flag rename from --no-prepare to --no-deps in mise exec/mise run.

Promotes deps into a first-class config surface. Config/schema/settings are renamed from [prepare] to [deps], status.show_prepare_stale to status.show_deps_stale, and the persisted freshness state file from .mise/prepare-state.toml to .mise/deps-state.toml, with corresponding engine/provider renames.

Adds package management subcommands. Introduces mise deps add and mise deps remove, parsing ecosystem:package specs, installing required tools first, and executing provider-specific commands (implemented for npm, yarn, pnpm, bun), while bare mise deps defaults to deps install. E2E tests are updated/added to cover listing/dry-run/explain, dependency ordering, tool-install-before-deps, and aliasing (dep and hidden prepare).

^{Reviewed by Cursor Bugbot for commit 9cb375e. Bugbot is set up for automated code reviews on this repo. Configure here.}

gemini-code-assist

Code Review

This pull request renames the experimental "prepare" feature to "deps" across the codebase and documentation, while introducing new subcommands for adding and removing dependencies. Feedback indicates that the current implementation of these subcommands ignores user-defined configurations and monorepo settings by using default provider instances. Furthermore, it is recommended to batch package operations for improved performance and to respect configured timeouts instead of hardcoding them.

gemini-code-assist · 2026-04-11T18:36:01Z

+pub fn create_provider(ecosystem: &str, project_root: &Path) -> Result<Box<dyn DepsProvider>> {
+    use providers::*;
+    use rule::DepsProviderConfig;
+
+    let config = DepsProviderConfig::default();
+    match ecosystem {
+        "npm" => Ok(Box::new(NpmDepsProvider::new(project_root, config))),
+        "yarn" => Ok(Box::new(YarnDepsProvider::new(project_root, config))),
+        "pnpm" => Ok(Box::new(PnpmDepsProvider::new(project_root, config))),
+        "bun" => Ok(Box::new(BunDepsProvider::new(project_root, config))),
+        "go" => Ok(Box::new(GoDepsProvider::new(project_root, config))),
+        "pip" => Ok(Box::new(PipDepsProvider::new(project_root, config))),
+        "poetry" => Ok(Box::new(PoetryDepsProvider::new(project_root, config))),
+        "uv" => Ok(Box::new(UvDepsProvider::new(project_root, config))),
+        "bundler" => Ok(Box::new(BundlerDepsProvider::new(project_root, config))),
+        "composer" => Ok(Box::new(ComposerDepsProvider::new(project_root, config))),
+        _ => bail!("unknown deps provider '{ecosystem}'"),
+    }
+}


create_provider initializes a provider with a default configuration (DepsProviderConfig::default()), which ignores any user-defined settings in mise.toml (such as custom env, dir, or timeout).

Additionally, in monorepos, this may cause add and remove operations to run in the project root instead of the specific subdirectory where the provider is configured. These commands should ideally use the DepsEngine to find and use the existing configured provider instance.

gemini-code-assist · 2026-04-11T18:36:02Z

+        for spec in &self.packages {
+            let (ecosystem, package) = parse_package_spec(spec)?;
+            let provider = crate::deps::create_provider(ecosystem, &project_root)?;
+
+            let cmd = provider.add_command(package, self.dev)?;
+            DepsEngine::execute_command(&cmd, &env, None)?;
+        }


The current implementation executes a separate command for each package in the list. For performance and to allow the package manager to perform better dependency resolution, it is recommended to batch packages of the same ecosystem into a single command (e.g., npm install pkg1 pkg2).

gemini-code-assist · 2026-04-11T18:36:02Z

+            let provider = crate::deps::create_provider(ecosystem, &project_root)?;
+
+            let cmd = provider.add_command(package, self.dev)?;
+            DepsEngine::execute_command(&cmd, &env, None)?;


The timeout for the command is hardcoded to None. It should respect the provider's configured timeout if one is specified in mise.toml.

Suggested change

DepsEngine::execute_command(&cmd, &env, None)?;

DepsEngine::execute_command(&cmd, &env, provider.timeout())?;

gemini-code-assist · 2026-04-11T18:36:02Z

+            let provider = crate::deps::create_provider(ecosystem, &project_root)?;
+
+            let cmd = provider.remove_command(package)?;
+            DepsEngine::execute_command(&cmd, &env, None)?;


The timeout for the command is hardcoded to None. It should respect the provider's configured timeout if one is specified in mise.toml.

Suggested change

DepsEngine::execute_command(&cmd, &env, None)?;

DepsEngine::execute_command(&cmd, &env, provider.timeout())?;

greptile-apps · 2026-04-11T18:40:15Z

Greptile Summary

This PR renames the experimental prepare subsystem to deps across the entire codebase (CLI, config, state file, settings, docs, e2e tests) and adds mise deps add / mise deps remove subcommands backed by provider-specific implementations for npm, yarn, pnpm, and bun. Bare mise deps now defaults to mise deps install (the former mise prepare), and --no-prepare becomes --no-deps in mise exec / mise run.

Confidence Score: 5/5

Safe to merge; all remaining findings are P2 style/clarity concerns with no correctness or data-integrity impact.

No P0 or P1 issues were found. The rename is thorough (CLI, config, state file, settings, docs, tests). The new add/remove commands use correct package manager flags. The two P2 findings (misleading error for unknown ecosystems in create_provider, and the redundant validation in DepsOrdering::new) do not affect correctness at runtime.

src/deps/mod.rs (create_provider error message) and src/deps/deps_ordering.rs (dead validation path)

Important Files Changed

Filename	Overview
src/cli/deps/mod.rs	New entry point for `mise deps`; flattens `DepsInstall` args and defaults to install subcommand. `parse_package_spec` correctly handles scoped packages like `@types/react`.
src/cli/deps/add.rs	Implements `mise deps add ecosystem:package`; groups by ecosystem for batching and delegates execution to provider-specific commands. Toolset bootstrap pattern is consistent with install.rs.
src/cli/deps/remove.rs	Mirrors add.rs; delegates to provider `remove_command`. Structure is correct and consistent.
src/cli/deps/install.rs	Renamed from prepare.rs; adds `--list` and `--explain` modes alongside existing dry-run/force/only/skip flags. Logic is sound.
src/deps/mod.rs	Core types and `create_provider` helper. `build_provider` always returns `Some` for non-built-in names (creating a `CustomDepsProvider`), making the `ok_or_else` guard unreachable and producing a misleading error when an unrecognized ecosystem is passed to `add`/`remove`.
src/deps/engine.rs	Full engine with parallel execution, dependency ordering, and state persistence. Pre-filters unknown deps before `DepsOrdering::new`, which renders that module's validation redundant (but harmless).
src/deps/deps_ordering.rs	Thin wrapper around `DepsGraph` for Kahn's-algorithm scheduling. The unknown-dep bail is dead code in production since the engine always pre-filters, creating a confusing dual contract.
src/deps/providers/bun.rs	Handles both `bun.lockb` and `bun.lock` lockfile formats. Correct bun add (`bun add [--dev]`) and remove (`bun remove`) commands.
src/deps/state.rs	Renamed from `prepare-state.toml` to `deps-state.toml`. Blake3 hashing logic is unchanged and correct. `hash_dir_files` depth-3 cap is reasonable.
src/deps/rule.rs	Renamed config structs (`PrepareConfig` → `DepsConfig`). `serde(deny_unknown_fields)` on `DepsProviderConfig` will reject any future undocumented fields, which is good for schema hygiene.
src/cli/exec.rs	Renames `--no-prepare` to `--no-deps` and switches `PrepareEngine`/`PrepareOptions` to their deps equivalents. Clean rename, no logic changes.
src/cli/run.rs	Same rename pattern as exec.rs. Monorepo subdir config collection logic is preserved correctly.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["mise deps [subcommand]"] --> B{Subcommand?}
    B -->|"add ecosystem:pkg"| C["DepsAdd::run"]
    B -->|"remove ecosystem:pkg"| D["DepsRemove::run"]
    B -->|"install (default)"| E["DepsInstall::run"]

    C --> F["parse_package_spec()"]
    D --> F
    F --> G["create_provider(ecosystem)"]
    G --> H{Built-in?}
    H -->|"npm/yarn/pnpm/bun"| I["Typed Provider\n(add/remove_command)"]
    H -->|"unknown name"| J["CustomDepsProvider\n(bails on add/remove)"]
    I --> K["DepsEngine::execute_command()"]

    E --> L["DepsEngine::new()"]
    L --> M["discover_providers()"]
    M --> N{Has deps?}
    N -->|"yes"| O["ensure_experimental()"]
    N -->|"no"| P["(no-op)"]
    O --> Q["check_freshness()"]
    Q -->|"stale"| R{Has deps ordering?}
    R -->|"yes"| S["run_with_deps()\nKahn's algorithm"]
    R -->|"no"| T["run_parallel()"]
    S --> U["DepsState::save()\n.mise/deps-state.toml"]
    T --> U

    V["mise exec / mise run"] -->|"unless --no-deps"| L

_{Reviews (4): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

github-actions · 2026-04-11T19:04:18Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.17 x -- echo`	23.3 ± 0.3	22.4	26.5	1.00
`mise x -- echo`	23.8 ± 0.4	23.0	29.8	1.02 ± 0.02

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.17 env`	23.1 ± 0.5	22.4	29.5	1.00
`mise env`	23.4 ± 0.3	22.7	25.6	1.02 ± 0.02

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.17 hook-env`	23.8 ± 0.3	22.2	25.9	1.00
`mise hook-env`	24.4 ± 0.5	23.6	29.5	1.02 ± 0.03

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.17 ls`	21.2 ± 0.3	19.8	23.2	1.00
`mise ls`	21.7 ± 0.2	21.0	23.1	1.02 ± 0.02

`xtasks/test/perf`

Command	mise-2026.4.17	mise	Variance
install (cached)	148ms	153ms	-3%
ls (cached)	79ms	80ms	-1%
bin-paths (cached)	84ms	85ms	-1%
task-ls (cached)	827ms	829ms	+0%

Renames the experimental `prepare` command to `deps` and adds subcommands for managing individual packages. This is the first step toward making mise an actual package manager. Changes: - Rename `src/prepare/` module to `src/deps/` with all types renamed (PrepareProvider -> DepsProvider, PrepareEngine -> DepsEngine, etc.) - Rename `[prepare]` config section to `[deps]` in mise.toml - Rename `--no-prepare` flag to `--no-deps` on run/exec - Rename `status.show_prepare_stale` setting to `status.show_deps_stale` - Add `mise deps` subcommand structure (install, add, remove) - `mise deps` (bare) defaults to install (previous prepare behavior) - `mise deps add npm:react` / `mise deps add -D npm:vitest` adds packages - `mise deps remove npm:lodash` removes packages - Implement add/remove for npm, yarn, pnpm, and bun providers - Add `create_provider()` for on-the-fly provider creation - Rename state file from `prepare-state.toml` to `deps-state.toml` - Update all docs, schema, e2e tests, and interactive config Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

- Batch packages by ecosystem into single commands (e.g., `npm install react lodash` instead of two separate calls) - Use configured provider settings (env, dir, timeout) from mise.toml instead of always using defaults - Pass provider timeout to execute_command instead of hardcoded None - Change add_command/remove_command trait to accept &[&str] for batching Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9cb375e. Configure here.}

cursor · 2026-04-19T05:32:36Z


        try {
-            mise prepare --list | Should -Match 'No prepare providers found'
+            mise prepare --list | Should -Match 'No deps providers found'


Windows e2e test still uses old command name

Low Severity

The Windows e2e test at line 23 still calls mise prepare --list instead of mise deps --list. While the rest of the test file was properly renamed from "prepare" to "deps", this command invocation was missed. It works today because prepare is a hidden alias, but the test is supposed to exercise the primary deps command path, not the backward-compatibility alias.

^{Reviewed by Cursor Bugbot for commit 9cb375e. Configure here.}

@risu729

### 🚀 Features - **(latest)** add --before flag to mise latest by @risu729 in [#9168](#9168) - **(npm)** add aube package manager support by @jdx in [#9256](#9256) - **(spm)** add filter_bins option to restrict built executables by @jdx in [#9253](#9253) - **(vfox)** support plugin-declared dependencies via metadata.lua by @ahemon in [#9051](#9051) - rename `mise prepare` to `mise deps` and add package management by @jdx in [#9056](#9056) ### 🐛 Bug Fixes - **(backend)** skip versions host for direct-source backends by @jdx in [#9245](#9245) - **(github)** route artifact attestation verification to custom api_url by @jdx in [#9254](#9254) - **(lockfile)** use unique temp file for atomic save to avoid concurrent rename race by @jdx in [#9250](#9250) - **(log)** drop noisy third-party debug/trace logs by @jdx in [#9248](#9248) - **(progress)** disable animated clx output in ci by @jdx in [#9249](#9249) - **(use)** honor --quiet and --silent flags by @jdx in [#9251](#9251) - **(vfox)** opt backend plugins out of --locked URL check by @jdx in [#9252](#9252) ### 📦 Registry - add aqua backend for bitwarden-secrets-manager by @msuzoagu in [#9255](#9255) ### New Contributors - @ahemon made their first contribution in [#9051](#9051) - @msuzoagu made their first contribution in [#9255](#9255)

## Summary - Move the deps freshness state file from `<project>/.mise/deps-state.toml` to `$MISE_STATE_DIR/deps/<hash>.toml`, keyed by a SipHash of the project root — same pattern used for `tracked-configs`. - Stops mise from writing inside the project tree, where the file could easily be committed or conflated with project config. - Docs updated in `docs/dev-tools/deps.md`. ## Why `deps` is brand new (landed in #9056, 2026.4.18) and the state file currently sits inside the project directory. That's awkward — it's per-machine state, but it lives where users keep versioned config. Moving it under `$MISE_STATE_DIR` matches how other per-project state (tracked/trusted/ignored configs, env cache, hook-env checks) is stored. ## Notes for reviewer - No migration needed: the feature is only a few days old, and the state is just a cache of blake3 hashes — on first run after upgrade, providers look stale and rehash. The user experience is one extra run, no breakage. - The pre-commit prettier step flagged two unrelated files on `main` (`docs/backend-plugin-development.md`, `docs/url-replacements.md`) where prettier wants to collapse GitHub's `> [!WARNING]` callout syntax onto a single line — that would actually break the GitHub alert rendering, so I left them alone. I used `HK_SKIP_STEPS=prettier` for this commit; all other lint steps (cargo-check, cargo-fmt, markdownlint, shellcheck, taplo, shfmt, schema, etc.) passed. ## Test plan - [ ] Run `mise deps` in a project; confirm `$MISE_STATE_DIR/deps/<hash>.toml` is created and `.mise/deps-state.toml` is not. - [ ] Re-run `mise deps`; confirm providers report fresh (hashes matched from state dir). - [ ] Modify a source file; confirm provider reports stale. *This PR was generated by an AI coding assistant.*  --- > [!NOTE] > **Medium Risk** > Changes where deps freshness state is read/written, which can cause all providers to appear stale once after upgrade or create unexpected state collisions if hashing/scoping is wrong; otherwise it’s cache-only state with limited blast radius. > > **Overview** > Deps freshness state is no longer written to `<project>/.mise/deps-state.toml`; it is now persisted under `$MISE_STATE_DIR/deps/<hash>.toml`, where `<hash>` is derived from the project root path. > > `DepsState` now computes its storage path via `dirs::STATE` and `hash_to_str(project_root)`, keeping state per-project without touching the repo tree, and the docs are updated to reflect the new location. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e007c55. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

@bishopmatthew

* fix(progress): disable animated clx output in ci (jdx#9249) ## Summary - Compute the clx progress UI decision once from settings, stderr, force-progress, and CI state. - Keep text output as the default in CI even when stderr looks interactive because a CI runner allocated a PTY. - Store the resulting `use_progress_ui` decision on `MultiProgressReport` so later call sites reuse the same mode decision. ## Why Some CI systems expose stderr as a TTY so tools keep colors enabled, but their log capture strips cursor-control sequences. Animated progress frames can then become thousands of near-duplicate log rows. This keeps local interactive progress intact while making CI output quieter. ## Validation - `cargo fmt --check` - `cargo check -p mise` - pre-commit hook suite during commit, including `cargo check --all-features`, `cargo fmt --all -- --check`, `taplo`, `actionlint`, `markdownlint`, and schema validation  --- > [!NOTE] > **Low Risk** > Low risk: changes only adjust progress UI enablement logic to prefer plain text in CI, with minimal behavioral impact outside CI unless CI detection is incorrect. > > **Overview** > Disables clx’s animated progress UI when `settings.ci` is true, even if stderr appears interactive, to avoid CI logs being flooded by spinner frames. > > Refactors `MultiProgressReport` to compute and store a single `use_progress_ui` flag during initialization (including logging `ci`) and uses that flag when selecting `ProgressReport` vs text-based reports and when creating the header job. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 13548a6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * fix(lockfile): use unique temp file for atomic save to avoid concurrent rename race (jdx#9250) ## Problem `Lockfile::save` writes to a fixed `mise.lock.tmp` path, then renames it over the real lockfile. When two mise processes update the same lockfile concurrently, the second rename finds no source file and fails with `No such file or directory (os error 2)`, surfaced as `failed to update lockfiles`. This reproduces reliably via [`hk`](https://github.com/jdx/hk): its linter runner spawns multiple linters in parallel. If more than one linter's bin is missing, each invocation triggers `install_missing_bin` → `rebuild_shims_and_runtime_symlinks` → `update_lockfiles` → `save`. Two mise processes then race on the same `mise.lock.tmp`: 1. Both write `mise.lock.tmp` (second clobbers first — harmless, contents are the same). 2. Process A renames `mise.lock.tmp` → `mise.lock`. 3. Process B renames `mise.lock.tmp` → `mise.lock` → **ENOENT** (source already moved). Caught in the wild during parallel `cargo-machete` + `cargo-msrv` auto-install in CI: ``` cargo-machete – mise [email protected] ✓ installed cargo-machete – mise ERROR failed to update lockfiles cargo-machete – mise ERROR No such file or directory (os error 2) cargo-machete – mise ERROR cargo-binstall failed cargo-machete – mise ERROR Failed to install cargo:[email protected]: cargo-binstall exited with non-zero status: exit code 1 ``` The fixed-path temp pattern was introduced in jdx#8589 (`fix(lockfile): Resolve symlink when updating lockfiles`). ## Fix Switch to `tempfile::NamedTempFile::with_prefix_in(parent)` + `persist(target)`, matching the pattern already used in `src/http.rs`. Each save gets a random temp name, so concurrent writers never collide on the temp path. Persist remains atomic and same-filesystem. Precedent in the codebase: `src/backend/conda.rs` already uses `dest.with_extension(format!("tmp.{}", std::process::id()))` for the same reason. `src/backend/s3.rs` still has a similar fixed-`.tmp` pattern — worth a follow-up but out of scope here. ## Test Added `test_concurrent_save_no_enoent` which spawns 8 threads × 20 saves against the same lockfile and asserts none of them return ENOENT. The test fails on `main` and passes with the fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Changes the lockfile persistence path and retry behavior during atomic writes, which could affect correctness/permissions of `mise.lock` updates across platforms. Scope is localized to `Lockfile::save` and is covered by new concurrency and permission regression tests. > > **Overview** > Prevents concurrent `Lockfile::save` calls from failing with `ENOENT` by replacing the fixed `mise.lock.tmp` rename flow with a uniquely named `tempfile::NamedTempFile` written alongside the target and atomically `persist`ed. > > Adds helpers to *preserve existing file permissions* on Unix and to *retry persist on Windows* for transient `PermissionDenied`, plus regression tests for concurrent saves and Unix permission preservation. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 49120aa. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * feat(latest): add --before flag to mise latest (jdx#9168) ## Summary Adds `--before <BEFORE>` to `mise latest` so one-off latest-version lookups can be constrained by release date. - Parses `--before` with the existing duration/date parser, supporting absolute dates such as `2024-06-01` and relative durations such as `90d` or `1y`. - Passes the parsed CLI cutoff into the current `Backend::latest_version(config, query, before_date)` API, keeping fallback precedence centralized in the backend: CLI flag > backend/tool options > config tool options > global `install_before`. - Conflicts `--before` with `--installed`, because installed-version lookup does not use release metadata. - Regenerates CLI usage docs, manpage output, and Fig completion metadata. - Extends the npm `install_before` e2e coverage for CLI filtering, CLI override of global `MISE_INSTALL_BEFORE`, CLI override of per-tool `install_before`, and relative duration parsing. - Removes the stale e2e prerequisite that required `npm` on the runner `PATH` before `mise use node`; the test now exercises the same mise dependency environment the npm backend uses. ## Test plan - [x] `cargo fmt --check` - [x] `git diff --check` - [x] `cargo test --bin mise latest_version_tests` - [x] `mise run render:usage` - [x] `mise run test:e2e e2e/backend/test_npm_install_before` - [x] `mise run lint-fix` * fix(use): honor --quiet and --silent flags (jdx#9251) ## Summary - `mise use` was printing `mise <path> tools: ...` via `miseprintln!` (unconditional stdout), so `--quiet` and `--silent` had no effect on it. - Switch the "tools:", "removed:", and "would update" messages to `info!` so they route through the logger and get suppressed when those flags raise the log level to `error`. Fixes jdx#9152 ## Test plan - [x] `mise use [email protected]` — still prints `mise <path> tools: [email protected]` - [x] `mise use -q [email protected]` — silent - [x] `mise use --silent [email protected]` — silent - [x] `mise use -n [email protected]` — still prints `would update ...` - [x] `mise use -qn [email protected]` — silent - [x] `mise use --remove tiny` — still prints `removed: ...` - [x] `mise use -q --remove tiny` — silent 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: only gates `mise use` success/dry-run status messages behind the existing `Settings::quiet` flag, without changing install/remove behavior or config writes. > > **Overview** > `mise use` now respects the global `--quiet` setting by suppressing its post-action status output (the “would update…”, “tools: …”, and “removed: …” messages) when quiet mode is enabled. > > Behavior for installs/removals, dry-run exit codes, and config saving is unchanged; only user-facing messaging is conditionally skipped. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9a8fcc0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * fix(vfox): opt backend plugins out of --locked URL check (jdx#9252) ## Summary - Custom Lua backend plugins (those using `BackendInstall` instead of a `PreInstall` hook) have no way to surface a download URL to mise. As a result, `mise lock` writes a version-only entry and `mise install --locked` then fails with `No lockfile URL found`. - Override `supports_lockfile_url` on `VfoxBackend` to return `false` when the plugin is a backend plugin. Same semantics as asdf / cargo / npm / pipx: when the backend can't provide a URL, the pinned version is the lock. Reported by @bishopmatthew in [jdx#7308](jdx#7308 (comment)). ## Test plan - [ ] Added `--locked --dry-run` assertion with a version-only lockfile entry to `e2e/backend/test_vfox_backend_npm`. - [ ] `mise run lint-fix` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: narrows the `--locked` URL validation for vfox *backend* plugins only, plus adds an e2e regression test. Main risk is allowing locked installs to proceed without per-platform URLs for these plugins, matching their current lockfile capabilities. > > **Overview** > Fixes `mise install --locked` for vfox custom backend plugins by making `VfoxBackend::supports_lockfile_url()` return `false` when the plugin is a backend plugin, so version-only lockfile entries no longer fail with "No lockfile URL found". > > Adds an e2e assertion in `test_vfox_backend_npm` that `--locked --dry-run` succeeds with a version-only `mise.lock` entry for `vfox-npm:prettier`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 63ba299. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * feat(spm): add filter_bins option to restrict built executables (jdx#9253) ## Summary - Adds a `filter_bins` tool option to the `spm` backend so users can restrict which executable products are built and linked - Filters before `swift build` runs, so unwanted products are never compiled (not just hidden from `PATH`) - Accepts either a TOML array (`filter_bins = ["swiftly"]`) or a comma-separated string (`filter_bins = "swiftly"`) — the naming matches the existing `filter_bins` option on the github backend - Returns a clear error if any listed name does not match an executable product in the package Closes jdx#9148 The motivating example is [`swiftlang/swiftly`](https://github.com/swiftlang/swiftly), which ships both `swiftly` and `test-swiftly` products. Without this option, mise builds and links both. ```toml [tools] "spm:swiftlang/swiftly" = { version = "latest", filter_bins = ["swiftly"] } ``` When unset, the existing behavior (build and link every executable product) is preserved. ## Test plan - [x] Added unit tests for `parse_filter_bins` (string, array, empty, whitespace-only) and `filter_executables` (passthrough, restrict+preserve-order, error on missing name) - [x] `cargo test backend::spm` — all 8 tests pass - [x] `mise run test:unit` — all 712 unit tests pass - [x] `mise run lint-fix` — clean - [ ] Manual verification with an actual Swift package that has multiple executable products 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Changes SPM install behavior to optionally filter and error on unknown executable names, which could impact tool installation when configured. Default behavior is preserved when `filter_bins` is unset. > > **Overview** > Adds a new SPM tool option, `filter_bins`, to restrict which Swift executable products are built and symlinked into `bin/` during installation. > > The backend now parses `filter_bins` from either a TOML array or comma-separated string, validates the requested executables exist, preserves the package-declared order when filtering, and fails fast with a clear error on unknown names. Documentation and unit tests were added to cover parsing, passthrough, ordering, and error cases. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fa0a09a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * fix(github): route artifact attestation verification to custom api_url (jdx#9254) ## Summary - When a github backend tool is configured with a custom `api_url` (e.g. a GitHub Enterprise Server instance like `https://github.enterprise.com/api/v3`), artifact downloads correctly hit the GHES API, but attestation verification was still dispatched to `api.github.com` — causing `401 Unauthorized` because the GHES token isn't valid there. - Bumps `sigstore-verification` to 0.2.6 (which adds [`verify_github_attestation_with_base_url`](jdx/sigstore-verification#45) and `GitHubSource::with_base_url`) and switches all three call sites in `src/backend/github.rs` to the new variants so the attestations API is queried against the same host that served the release. ## Motivation Reported in jdx#9176 — user configured `api_url = \"https://github.enterprise.com/api/v3\"` and `MISE_GITHUB_ENTERPRISE_TOKEN`, saw the download succeed, then the `[2/3] verify GitHub artifact attestations` step failed against `api.github.com` with a dotcom-only 401. ## Test plan - [x] `cargo build` clean. - [x] `mise run test:unit` — 708 passed. - [x] `mise run lint` clean. - [ ] Manual verification against a GHES instance with artifact attestations (no instance available in CI). Closes jdx#9176  --- > [!NOTE] > **Medium Risk** > Changes the GitHub attestation verification path and underlying `sigstore-verification` dependency, which affects supply-chain verification behavior and could cause new verification failures if the base URL is misconfigured. > > **Overview** > Ensures GitHub artifact attestation detection/verification uses the configured `api_url` (e.g., GitHub Enterprise) instead of implicitly querying `api.github.com`, by switching to `GitHubSource::with_base_url` and `verify_github_attestation_with_base_url` at all GitHub backend call sites. > > Bumps `sigstore-verification` from `0.2.5` to `0.2.6` to pick up the new base-URL-aware APIs. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09ff8c3. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * registry: add aqua backend for bitwarden-secrets-manager (jdx#9255) # Summary This PR adds/updates the _bitwarden-secrets-manager_ shorthand to point to the _aqua:bitwarden/sdk-sm_ backend. ## Context Currently, mise registry points bitwarden-secrets-manager to a legacy asdf plugin. However, the bitwarden/sdk-sm repository now has a verified, stable aqua definition that provides the bws (Bitwarden Secrets) CLI across all major platforms (Darwin/Linux/Windows). ### Changes - Added `full = "aqua:bitwarden/sdk-sm"` to `registry/bitwarden-secrets-manager.toml`. - Verified that the bws binary is correctly mapped and executable via the aqua backend. ### Verification I have tested this locally using: 1. `aqua exec -- argd test bitwarden/sdk-sm` (Success) 2. `mise use aqua:bitwarden/sdk-sm` (Success) 3. `./target/debug/mise registry | grep bitwarden-secrets-manager` (Success) 4. `./target/debug/mise install bitwarden-secrets-manager@latest` (Success) 5. `./target/debug/mise exec bitwarden-secrets-manager -- bws --version` (Success) ### Impact This move aligns with mise’s preference for the aqua backend over asdf plugins for better security (checksum/SLSA verification) and a faster installation experience. * feat(vfox): support plugin-declared dependencies via metadata.lua (jdx#9051) ## Summary Allow vfox/Lua plugins to declare tool dependencies directly in `metadata.lua` via a new `depends` field: ```lua PLUGIN.depends = {"node", "python"} ``` This surfaces dependencies through the `Backend` trait's `get_dependencies()` method so mise resolves installation order automatically — removing the need for users to manually add `depends = [...]` on every tool entry in their config. ### Motivation Currently, users of vfox backend plugins must repeat dependency declarations in their `mise.toml` for every tool that needs another tool installed first. For example, a plugin ecosystem where 10+ tools all depend on `node` requires `depends = ["node"]` on each entry. With this change, the plugin author declares it once and all users benefit. Closes jdx#8774 ### Changes - **`crates/vfox/src/metadata.rs`**: Added `depends: Vec<String>` field to `Metadata` struct, parsed from the Lua table (defaults to empty when omitted — fully backward compatible) - **`src/backend/vfox.rs`**: `VfoxBackend` now overrides `get_dependencies()` to read from plugin metadata. Dependencies are cached via `OnceLock` and loaded synchronously from the plugin directory. Gracefully returns empty deps if the plugin isn't installed yet. - Updated snapshot for the new field in `Metadata`'s `Debug` output ### Plugin author usage ```lua -- metadata.lua PLUGIN = {} PLUGIN.name = "my-tool" PLUGIN.version = "1.0.0" PLUGIN.depends = {"node", "python"} ``` User-specified `depends` in `mise.toml` still works and is additive — this just provides a plugin-level default. ## Test plan - [x] Unit tests for metadata parsing with and without `depends` field - [x] Existing vfox test suite passes (66 tests) - [x] `cargo check` passes for the full workspace - [x] `cargo clippy -p vfox` clean - [ ] CI validation --------- Co-authored-by: Arthur Hemon <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: jdx <[email protected]> * feat: rename `mise prepare` to `mise deps` and add package management (jdx#9056) ## Summary - Renames the experimental `mise prepare` command to `mise deps`, positioning it as a proper dependency management command - Adds `mise deps add npm:react` and `mise deps remove npm:lodash` subcommands for managing individual packages - Implements add/remove for all 4 JS package managers (npm, yarn, pnpm, bun) - `mise deps` (bare) defaults to `mise deps install` which is the previous `mise prepare` behavior - Renames all config (`[prepare]` -> `[deps]`), settings (`show_prepare_stale` -> `show_deps_stale`), flags (`--no-prepare` -> `--no-deps`), and state files (`prepare-state.toml` -> `deps-state.toml`) - No backwards compatibility needed since prepare was experimental ## Test plan - [ ] `cargo build` compiles cleanly - [ ] `mise run lint` passes - [ ] `mise deps --help` shows subcommands (add, install, remove) - [ ] `mise dep --help` alias works - [ ] `mise deps add npm:react` installs react via npm - [ ] `mise deps add -D npm:vitest` installs as devDependency - [ ] `mise deps remove npm:lodash` uninstalls via npm - [ ] `mise deps` (bare) runs all configured providers - [ ] `mise deps install --dry-run` shows what would run - [ ] `mise run --no-deps` skips auto deps - [ ] e2e tests: `mise run test:e2e test_deps test_deps_depends test_deps_tool_install` 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Medium risk because this renames an end-to-end command/config surface (`prepare`→`deps`) and threads the new flag/state/schema through exec/run flows, which can break existing experimental users and monorepo provider discovery. Behavior is largely a rename plus new JS package add/remove execution, but touches multiple CLI entrypoints and config parsing. > > **Overview** > **Renames the experimental dependency workflow from `mise prepare` to `mise deps`.** This updates CLI wiring, help/manpages, usage spec, interactive config editor UI, and all documentation references, including the skip flag rename from `--no-prepare` to `--no-deps` in `mise exec`/`mise run`. > > **Promotes deps into a first-class config surface.** Config/schema/settings are renamed from `[prepare]` to `[deps]`, `status.show_prepare_stale` to `status.show_deps_stale`, and the persisted freshness state file from `.mise/prepare-state.toml` to `.mise/deps-state.toml`, with corresponding engine/provider renames. > > **Adds package management subcommands.** Introduces `mise deps add` and `mise deps remove`, parsing `ecosystem:package` specs, installing required tools first, and executing provider-specific commands (implemented for `npm`, `yarn`, `pnpm`, `bun`), while bare `mise deps` defaults to `deps install`. E2E tests are updated/added to cover listing/dry-run/explain, dependency ordering, tool-install-before-deps, and aliasing (`dep` and hidden `prepare`). > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9cb375e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat(npm): add aube package manager support (jdx#9256) ## Summary - Add `npm.package_manager = "auto"` as the default, with `auto` preferring installed `aube` and falling back to `npm`. - Add explicit `npm.package_manager = "aube"` support for npm backend installs using `aube add --global` into mise-managed install/bin directories. - Make auto-selection consider the active install/exec toolset, so `mise x node aube npm:<pkg>` uses the requested `aube` instead of falling back to npm. - Resolve Windows bin paths from the created install layout, so aube-installed packages keep using `install_path/bin` even when aube is not discoverable later. - Normalize `.npmrc` path values to forward slashes and unit-test aube's minute-based `minimumReleaseAge` conversion. - Regenerate the settings schema and document the new npm backend behavior. - Add an e2e test that starts with `mise x node aube npm:cowsay`, verifies aube-specific install artifacts (`global-aube` and `aube-lock.yaml`), and executes `cowsay`. ## Validation - `cargo test -q backend::npm::tests` - `mise run test:e2e e2e/backend/test_npm_aube` - `cargo check -q --all-features` - `mise run render:schema` - `mise run lint-fix` *This PR was generated by an AI coding assistant.* * chore: release 2026.4.18 (jdx#9246) ### 🚀 Features - **(latest)** add --before flag to mise latest by @risu729 in [jdx#9168](jdx#9168) - **(npm)** add aube package manager support by @jdx in [jdx#9256](jdx#9256) - **(spm)** add filter_bins option to restrict built executables by @jdx in [jdx#9253](jdx#9253) - **(vfox)** support plugin-declared dependencies via metadata.lua by @ahemon in [jdx#9051](jdx#9051) - rename `mise prepare` to `mise deps` and add package management by @jdx in [jdx#9056](jdx#9056) ### 🐛 Bug Fixes - **(backend)** skip versions host for direct-source backends by @jdx in [jdx#9245](jdx#9245) - **(github)** route artifact attestation verification to custom api_url by @jdx in [jdx#9254](jdx#9254) - **(lockfile)** use unique temp file for atomic save to avoid concurrent rename race by @jdx in [jdx#9250](jdx#9250) - **(log)** drop noisy third-party debug/trace logs by @jdx in [jdx#9248](jdx#9248) - **(progress)** disable animated clx output in ci by @jdx in [jdx#9249](jdx#9249) - **(use)** honor --quiet and --silent flags by @jdx in [jdx#9251](jdx#9251) - **(vfox)** opt backend plugins out of --locked URL check by @jdx in [jdx#9252](jdx#9252) ### 📦 Registry - add aqua backend for bitwarden-secrets-manager by @msuzoagu in [jdx#9255](jdx#9255) ### New Contributors - @ahemon made their first contribution in [jdx#9051](jdx#9051) - @msuzoagu made their first contribution in [jdx#9255](jdx#9255) * fix(vfox): use github token for lua http requests (jdx#9257) ## Summary - pass mise's resolved GitHub token into vfox plugin runtimes - add default GitHub auth headers in the vfox Lua HTTP bridge for GitHub API requests - preserve explicit plugin-provided Authorization headers and avoid auth on GitHub release asset hosts ## Root Cause Embedded vfox plugins such as `vfox-neovim` call `api.github.com` through the Lua HTTP module. Those requests did not receive mise's configured GitHub token, so rate-limited users could hit `HTTP 403` while installing Neovim even when mise itself knew how to resolve a GitHub token. ## Validation - `cargo fmt --check` - `cargo test -p vfox lua_mod::http` - `cargo check -p mise` - `MISE_LOG_HTTP=1 cargo run -q -p mise -- ls-remote neovim | sed -n '1,20p'`  --- > [!NOTE] > **Medium Risk** > Touches outbound HTTP behavior by automatically adding `Authorization` headers for certain GitHub hosts, which could affect plugin networking and token exposure if host matching is wrong. Scope is limited and includes tests plus explicit opt-out when plugins already set `Authorization` and for GitHub release asset hosts. > > **Overview** > Ensures embedded vfox plugins can authenticate GitHub API calls by threading mise’s resolved GitHub token into the vfox Lua runtime and having the Lua `http` bridge auto-attach GitHub auth headers. > > The Lua HTTP module now conditionally adds `Authorization: Bearer …` (and `x-github-api-version` for `api.github.com`) when a token is available, while **preserving explicit plugin-provided `Authorization`** and **skipping GitHub release asset hosts**; behavior is covered by new unit tests. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f4d9320. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * fix(cli): retrieve token from github helper for `self-update` command (jdx#9259) The `mise self-update` command now retrieves the GitHub API token via an internal helper rather than directly from environment variables. This ensures the token is fetched from the supported sources listed at https://mise.jdx.dev/dev-tools/github-tokens.html. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * chore: bump communique to 1.0.1 (jdx#9264) ## Summary - Bump communique from 0.1.9 to 1.0.1 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: this only updates the pinned `communique` devtool binary/version and its platform checksums/URLs in `mise.lock`, with no application/runtime code changes. > > **Overview** > Bumps the pinned `communique` tool in `mise.lock` from `0.1.9` to `1.0.1`, updating the associated per-platform download URLs, asset IDs, and checksums so `mise` installs the new release. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3ff3610. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> * docs: add aube hero banner (jdx#9265) ## Summary Adds a compact homepage hero banner that promotes aube as a new en.dev tool by @jdx. The banner links to https://aube.en.dev/ and notes that aube is currently in beta. ## Validation - `mise run docs:build` - commit hook suite via `hk`  --- > [!NOTE] > **Low Risk** > Low risk since changes are limited to docs theme markup/CSS and add no backend or data-handling logic. > > **Overview** > Adds a new homepage hero banner in `docs/.vitepress/theme/Layout.vue` promoting `aube` (linking to `https://aube.en.dev/`) with kicker/message text. > > Includes new styling for the banner (hover + dark-mode variants) and small responsive tweaks to center the banner and adjust message font size on mobile. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e1eb309. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * docs: add en.dev footer (jdx#9267) ## Summary - Add a custom VitePress footer matching the aube.en.dev footer style. - Keep the visible brand mention to a single `en.dev` by using `MIT License · Copyright © YEAR · en.dev`. - Disable the built-in VitePress footer so only the custom footer renders. ## Validation - `mise run docs:build` - commit hook: `hk` lint suite  --- > [!NOTE] > **Low Risk** > Low risk: documentation theme-only changes that affect site layout/styling but not runtime logic beyond the docs build. > > **Overview** > Replaces the built-in VitePress footer with a custom `EndevFooter` component that renders `MIT License · Copyright © YEAR · en.dev` (with logo/link) at the bottom of the docs layout. > > Updates the docs theme layout to inject the new footer via `#layout-bottom`, and adds accompanying CSS styles for the new footer elements in `custom.css`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4678b11. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * docs: implement landing page design (jdx#9266) ## Summary - implement the exported landing-page design on the VitePress homepage - replace the default home feature cards with the hero, metaphor, feature menu, pantry ticker, comparison, quickstart, and CTA sections - keep every pantry ticker item in the same serif font ## Validation - npm run docs:build - pre-commit hook via git commit, including prettier, cargo-fmt, cargo-check, shellcheck, shfmt, pkl, taplo, lua-check, stylua, actionlint, markdownlint, and schema This PR was generated by an AI coding assistant.  --- > [!NOTE] > **Low Risk** > Low risk since changes are limited to VitePress homepage markup/styling plus a small clipboard-copy UX tweak; main risk is visual/layout regressions across breakpoints or browsers. > > **Overview** > Replaces the VitePress homepage hero + default feature cards with a new designed landing experience: updated hero copy/CTA, a terminal-style workflow preview, and a new long-form homepage (`docs/index.md`) with metaphor, feature menu, scrolling “pantry” ticker, aube promo, tabbed quickstart recipe, and final CTA. > > Updates theme styling to support the new layout (new `landing-*` and terminal styles, revised hero grid/breakpoints, and smaller feature-card rounding), and improves the install command copy interaction by switching to a button with a `navigator.clipboard` path plus a textarea fallback and clearer “copy/copied” state. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 818c9d2. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * chore(deps): lock file maintenance (jdx#9268) This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (in timezone America/Chicago) - Branch creation - "before 4am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: jdx <[email protected]> Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> Co-authored-by: Taku Kodama <[email protected]> Co-authored-by: MUA <[email protected]> Co-authored-by: ahemon <[email protected]> Co-authored-by: Arthur Hemon <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: mise-en-dev <[email protected]> Co-authored-by: Kentaro Suzuki <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: richardthe3rd <[email protected]>

gemini-code-assist Bot reviewed Apr 11, 2026

View reviewed changes

greptile-apps Bot reviewed Apr 11, 2026

View reviewed changes

Comment thread src/cli/deps/add.rs

cursor Bot reviewed Apr 11, 2026

View reviewed changes

Comment thread src/deps/mod.rs Outdated

jdx and others added 4 commits April 19, 2026 05:21

[autofix.ci] apply automated fixes

4bdc409

fix(deps): preserve prepare alias

9cb375e

jdx force-pushed the feat/deps-command branch from 0101ed4 to 9cb375e Compare April 19, 2026 05:29

cursor Bot reviewed Apr 19, 2026

View reviewed changes

[autofix.ci] apply automated fixes

7551829

jdx merged commit 105274d into main Apr 19, 2026
35 checks passed

jdx deleted the feat/deps-command branch April 19, 2026 07:11

mise-en-dev mentioned this pull request Apr 19, 2026

chore: release 2026.4.18 #9246

Merged

BrewTestBot mentioned this pull request Apr 19, 2026

mise 2026.4.18 Homebrew/homebrew-core#278355

Merged

jdx mentioned this pull request Apr 22, 2026

refactor(deps): store deps state under $MISE_STATE_DIR #9301

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: rename `mise prepare` to `mise deps` and add package management#9056

feat: rename `mise prepare` to `mise deps` and add package management#9056
jdx merged 5 commits intomainfrom
feat/deps-command

jdx commented Apr 11, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Apr 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	DepsEngine::execute_command(&cmd, &env, None)?;
	DepsEngine::execute_command(&cmd, &env, provider.timeout())?;

Uh oh!

Conversation

jdx commented Apr 11, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 19, 2026

Choose a reason for hiding this comment

Windows e2e test still uses old command name

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 11, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

github-actions Bot commented Apr 11, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`