### 🚀 Features

- **(backend)** support top-level aqua cosign verification by @risu729
in [#9111](#9111)

### 🐛 Bug Fixes

- **(schema)** validate all schema files with draft2020 and strict mode
by @risu729 in [#9594](#9594)
- **(shim)** skip network resolution for installed tool dirs by @jdx in
[#9599](#9599)

### 📚 Documentation

- **(dev-tools)** clarify vfox metadata depends for install hooks by
@risu729 in [#9573](#9573)
- **(plugins)** remove registry submission guidance by @risu729 in
[#9577](#9577)

### 📦️ Dependency Updates

- lock file maintenance by @renovate[bot] in
[#9586](#9586)

### 📦 Registry

- remove bashly asdf fallback by @risu729 in
[#9578](#9578)
- use github backend for rebar by @risu729 in
[#9576](#9576)
- add wasm-tools
([aqua:bytecodealliance/wasm-tools](https://github.com/bytecodealliance/wasm-tools))
by @2xdevv in [#9596](#9596)
- enable symlink_bins for elixir-ls by @AlternateRT in
[#9592](#9592)

### Chore

- **(release)** always append sponsor block to release notes by @jdx in
[#9580](#9580)
- warn on vendored vfox embedded plugins by @risu729 in
[#9588](#9588)
- prefer registry shorthands over cargo/npm backends in mise.toml by
@risu729 in [#9595](#9595)

## 📦 Aqua Registry Updates

### New Packages (2)

-
[`salesforce/reactive-grpc/protoc-gen-reactor-grpc`](https://github.com/salesforce/reactive-grpc)
- [`spinframework/spin`](https://github.com/spinframework/spin)

### Updated Packages (1)

- [`pnpm/pnpm`](https://github.com/pnpm/pnpm)

## Summary

- Rebased this branch onto current `main` after #9578 and #9576 landed,
then fast-forwarded over the latest `main` lockfile maintenance merge.
- Removed registry-level `depends` from generated `RegistryTool`, the
registry schema, and backend dependency expansion.
- Added `test.tools` support for registry tests. This is consumed only
by `mise test-tool`; it does not affect normal installs.
- Kept backend/tool optional dependency support outside the registry.

## Why registry `depends` is not needed

Registry `depends` mixed unrelated concerns: install ordering, runtime
companions, and tools needed only for registry tests. That made
shorthand registry entries apply dependencies too broadly across every
backend.

The remaining valid dependency paths are covered elsewhere:

- vfox plugins can declare install dependencies in plugin metadata with
`PLUGIN.depends`; mise already reads those through the vfox backend.
- asdf plugins require `depends`, but rebar was the only registry entry
still relying on that path, and #9576 moved it to
`github:erlang/rebar3`. New asdf plugins are not being added to the
registry.
- backend install hooks that need extra external tools are too fragile
for registry shorthand entries. Those tools should not be added to the
registry just to satisfy postinstall scripts.
- tools needed only to execute `test.cmd` belong in `test.tools`, which
is consumed only by `mise test-tool` and does not affect normal
installs.

## Registry file changes (`registry/*.toml`)

| Tool | Change |
|------|--------|
| **android-sdk** | Removed root `depends = ["java"]`; added `test.tools
= ["java"]` because the vendored vfox metadata notes Java 11+ and
`sdkmanager` shells out to `java`. |
| **elixir** | Removed root `depends = ["erlang"]`; `core:elixir`
handles Erlang as a backend dependency. |
| **google-java-format** | Removed root `depends = ["java"]`; its Linux
registry asset is a native executable, and the Docker probe passed
without adding Java. |
| **gradle** | Removed root `depends = ["java"]`; added `test.tools =
["java"]` because the Gradle launcher requires `java` for `gradle -V`. |
| **kscript** | Removed root `depends = ["kotlin"]`; added `test.tools =
["kotlin"]` after Docker/registry CI showed `kscript --version` fails
without Kotlin. |
| **ktlint** | Removed root `depends = ["java"]`; its registry test
remains disabled. |
| **kubecolor** | Removed root `depends = ["kubectl"]`; `mise x
kubecolor -- kubecolor --kubecolor-version` passed in the e2e Docker
image with no `kubectl` on PATH, so no `test.tools` entry is needed. |
| **pipenv** | Removed root `depends = ["python"]`; added `test.tools =
["python"]` because the vendored vfox post-install hook creates a venv
with `python3`/`python`, and the test should not rely on system Python.
|
| **pipx** | Removed root `depends = ["python"]`; added `test.tools =
["python"]` because the aqua `pipx.pyz` launcher uses `#!/usr/bin/env
python3`. |
| **rebar** | Removed root `depends = ["erlang"]`; #9576 moved this
registry entry to `github:erlang/rebar3`; added `test.tools =
["erlang"]` because `rebar3 --version` needs the Erlang runtime. |
| **sbt** | Removed root `depends = ["java"]`; the conda backend
installs OpenJDK in the package environment and the Docker probe passed
without registry `test.tools`. |
| **spark** | Removed root `depends = ["java"]`; no registry test
command is present. |
| **tridentctl** | Removed root `depends = ["kubectl"]`; `tridentctl
version --client` passed in Docker without `kubectl`. |

## vfox notes

- `vfox-android-sdk` is vendored in `crates/vfox/embedded-plugins/`; its
metadata says Java 11+ is required, and the installed `sdkmanager`
launcher checks `JAVA_HOME`/`java`. Its post-install hook only uses
common shell utilities (`mv`, `mkdir`, `rm`, `chmod`), which are not
registry tools.
- `vfox-pipenv` is vendored in `crates/vfox/embedded-plugins/`; its
post-install hook explicitly searches for `python3`/`python`, creates a
venv, then runs pip. Utility shell usage such as `pwd`, `mkdir`, and
`chmod` is intentionally ignored.
- `vfox-gradle` is not vendored under `crates/vfox/embedded-plugins/`;
the registry test still needs Java because the Gradle launcher itself
invokes `java`.

## Pipenv note

`mise-plugins/vfox-pipenv/pull/1` must be merged for `pipenv` to work
properly through the vfox backend. GitHub Actions and the e2e image
currently have Python available, but the registry should not rely on
system Python: `PLUGIN.depends` only declares plugin execution order, so
without a managed Python declaration pipenv falls back to whatever
system Python is available.

## Validation

- `taplo fmt --check registry/android-sdk.toml registry/gradle.toml
registry/pipenv.toml registry/pipx.toml registry/kscript.toml
registry/rebar.toml`
- `git diff --check`
- Docker image used by registry CI: `ghcr.io/jdx/mise:e2e`
- Direct Docker probes with `mise x <tool> -- <test.cmd>` for
`android-sdk`, `google-java-format`, `gradle`, `kscript`, `kubecolor`,
`pipenv`, `pipx`, `sbt`, and `tridentctl`