## jdx/mise — vfox-v2026.9.20…vfox-v2026.10.0

_21 commits._

### Features
- **registry: add cloudflare-cf (#13871)** (3f0aa0a)
- **feat: add per-cask app directory overrides (#13865)** (2d0520f)

### Fixes
- **fix(aqua): accept RE2 quoted literals in cosign identity patterns (#13879)** (449df50)
- **fix(java): include target platform in missing metadata error (#13873)** (a097a43)
- **fix(bootstrap): remove the deprecated --from-git alias (#13872)** (b568cc4)
- **fix(backend): retire expired runtime symlink migration (#13868)** (7ddf767)
- **fix(dotfiles): diagnose stale history watchers (#13864)** (da0db43)
- **fix(aqua): install the registry's gnu build on musl hosts instead of requiring a musl asset (#13857)** (34e99e9)
- **fix: exit with status 130 on Ctrl-C (#13862)** (7e6c4a4)
- **fix(lock): switch backends for lock entries the config no longer resolves from (#13859)** (f932757)
- **fix(backend): trust SLSA provenance recorded in a lockfile (#13856)** (72b2e79)

### Backend
- **security(backend): anchor signer workflow match for GitHub attestations (#13877)** (ec6f2c4)
- **security(backend): enforce signer identity for keyless cosign bundles (#13875)** (4505f84)
- **security(config): require trust for .tool-versions entries with inline options (#13869)** (2dd1f36)

### Tests
- **test(task): run the Windows console interrupt test in a windowless console (#13763)** (58cd7df)

### Docs
- **docs: add a releases page with a timeline of release sizes and resolved issues (#13855)** (112a5b8)

### Chore
- **chore: release 2026.10.0 (#13858)** (bc11f90)
- **chore(ci): run clippy on Windows and fix the lints only it finds (#13757)** (ada70d9)
- **ci(release): comment on resolved issues and discussions with the fixing release (#13870)** (db908d2)
- **ci(release): enforce 15:00 Central cutoff (#13863)** (742377b)
- **chore(deps): update dependency aube to latest (#13848)** (8a1042b)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/jdx/mise?utm_source=github-action)._