fix(upgrade): skip untrusted tracked configs during upgrade by jdx · Pull Request #8195 · jdx/mise

jdx · 2026-02-16T22:42:05Z

Summary

mise up --bump loads all tracked config files to determine which tool versions are still needed by other projects
If any tracked config (e.g. ~/foo/.mise.toml from a prior cd ~/foo) is untrusted, this triggers an interactive trust prompt mid-upgrade and then displays a scary mise ERROR message
Skip untrusted/ignored tracked configs silently instead of prompting or erroring
Downgrade remaining parse failure log from error!() to warn!()

Test plan

Builds and passes lint
Verified get_tracked_config_files() checks is_trusted() before calling parse(), avoiding the interactive trust_check() prompt in MiseToml::from_str()

🤖 Generated with Claude Code

Note

Low Risk
Small change scoped to tracked-config loading and logging; main risk is inadvertently skipping a config that should have been considered trusted due to trust-root/path edge cases.

Overview
get_tracked_config_files() now pre-checks trust (via config_trust_root/is_trusted) for each tracked config and skips untrusted files instead of attempting to parse them, preventing interactive trust prompts during operations like mise upgrade.

Parse failures for tracked configs are now logged as warn! (with path context) rather than error!, reducing scary upgrade output while still surfacing issues.

^{Written by Cursor Bugbot for commit e8ae343. This will update automatically on new commits. Configure here.}

When `mise upgrade --bump` runs, it loads all tracked config files to determine which tool versions are still needed by other projects. If any tracked config (e.g. ~/foo/.mise.toml from a prior `cd ~/foo`) is untrusted, this would trigger an interactive trust prompt mid-upgrade and then display a scary ERROR message, even though the upgrade itself succeeded. Skip untrusted/ignored tracked configs silently instead of prompting or erroring. Also downgrade the error log to warn for other parse failures. Fixes #8130 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gemini-code-assist · 2026-02-16T22:42:15Z

Summary of Changes

Hello @jdx, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness of the mise upgrade process by gracefully handling untrusted or unparseable tracked configuration files. Previously, these situations could lead to disruptive interactive prompts or hard errors, interrupting the upgrade flow. The changes ensure that such configurations are silently skipped, allowing the upgrade to proceed smoothly without user intervention or misleading error messages, thereby improving the user experience during system maintenance.

Highlights

Untrusted Config Handling: Implemented logic to skip untrusted or ignored tracked configuration files during operations like mise up --bump to prevent interactive trust prompts and error messages.
Error Logging Downgrade: Changed the logging level for parse failures of tracked config files from an error!() to a warn!() to reduce severity for non-critical issues.

Changelog

src/config/mod.rs
- Added checks for trusted config files before parsing to avoid interactive prompts.
- Changed error logging for failed config file parsing to a warning.

Activity

Verified that the build passes and lint checks are successful.
Confirmed that get_tracked_config_files() now checks is_trusted() before parsing, effectively bypassing interactive trust_check() prompts.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request addresses an issue where mise upgrade could trigger an interactive prompt for untrusted config files. The changes introduce a pre-check to silently skip untrusted or ignored tracked configs, which effectively prevents the interactive prompt and improves the user experience during upgrades. Additionally, the log level for parsing errors on these files has been appropriately downgraded from error to warn, with a more informative message. The implementation is correct and directly solves the problem described. Overall, this is a good improvement.

src/config/mod.rs

Copilot

Pull request overview

This PR fixes an issue where mise up --bump would trigger interactive trust prompts when loading tracked config files from previously visited directories. The fix skips untrusted tracked configs and downgrades parse error logging from error to warning level.

Changes:

Add trust checks before parsing tracked config files to prevent interactive prompts
Downgrade parse failure logging from error!() to warn!()
Add debug logging when skipping untrusted configs

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-16T22:46:49Z

src/config/mod.rs

+            // Skip untrusted/ignored configs to avoid interactive prompts
+            // when loading tracked configs (e.g., during `mise upgrade`)
+            let trust_root = config_file::config_trust_root(&path);
+            if !config_file::is_trusted(&trust_root) && !config_file::is_trusted(&path) {


The trust check logic uses AND (&&) which means a config will only be skipped if BOTH the trust_root and path are untrusted. This seems incorrect - a config should be skipped if EITHER the trust_root OR the path is untrusted. Consider changing to OR (||) logic instead.

Suggested change

if !config_file::is_trusted(&trust_root) && !config_file::is_trusted(&path) {

if !config_file::is_trusted(&trust_root) || !config_file::is_trusted(&path) {

.tool-versions and idiomatic version files (.node-version, etc.) don't go through trust_check during parsing, so they won't have trust entries and would be incorrectly skipped. Limit the pre-check to TOML files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config/mod.rs

The .toml extension check missed non-.toml files that can still be parsed as MiseToml via MISE_OVERRIDE_CONFIG_FILENAMES or MISE_DEFAULT_CONFIG_FILENAME. Add is_mise_toml() helper that covers all cases where trust_check would be triggered. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but a Cloud Agent failed to start.}

src/config/config_file/mod.rs

Remove is_mise_toml() which incorrectly matched idiomatic .toml files like rust-toolchain.toml. Revert to checking is_trusted for all tracked files — non-MiseToml files (.tool-versions, idiomatic) don't call trust_check during parsing so they work fine when trusted. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-02-16T23:24:51Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.13 x -- echo`	24.0 ± 0.4	23.2	28.9	1.00
`mise x -- echo`	24.2 ± 0.7	23.4	30.2	1.01 ± 0.04

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.13 env`	23.6 ± 0.5	22.7	28.5	1.00
`mise env`	23.7 ± 0.3	22.9	24.8	1.00 ± 0.03

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.13 hook-env`	24.4 ± 0.5	23.5	30.4	1.00
`mise hook-env`	24.4 ± 0.4	23.6	26.3	1.00 ± 0.03

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.13 ls`	22.5 ± 0.3	21.9	24.2	1.00
`mise ls`	22.8 ± 0.4	22.1	25.5	1.02 ± 0.02

`xtasks/test/perf`

Command	mise-2026.2.13	mise	Variance
install (cached)	129ms	133ms	-3%
ls (cached)	81ms	82ms	-1%
bin-paths (cached)	85ms	86ms	-1%
task-ls (cached)	826ms	820ms	+0%

@jdx

### 🚀 Features - **(task)** stream keep-order output in real-time per task by @jdx in [#8164](#8164) ### 🐛 Bug Fixes - **(aqua)** resolve lockfile artifacts for target platform (fix discussion #7479) by @mackwic in [#8183](#8183) - **(exec)** strip shims from PATH to prevent recursive shim execution by @jdx in [#8189](#8189) - **(hook-env)** preserve PATH reordering done after activation by @jdx in [#8190](#8190) - **(lockfile)** resolve version aliases before lockfile lookup by @jdx in [#8194](#8194) - **(registry)** set helm-diff archive bin name to diff by @jean-humann in [#8173](#8173) - **(task)** improve source freshness checks with dynamic task dirs by @rooperuu in [#8169](#8169) - **(task)** resolve global tasks when running from monorepo root by @jdx in [#8192](#8192) - **(task)** prevent wildcard glob `test:*` from matching parent task `test` by @jdx in [#8165](#8165) - **(task)** resolve task_config.includes relative to config root by @jdx in [#8193](#8193) - **(upgrade)** skip untrusted tracked configs during upgrade by @jdx in [#8195](#8195) ### 🚜 Refactor - use enum for npm.pacakge_manager by @risu729 in [#8180](#8180) ### 📚 Documentation - **(plugins)** replace node/asdf-nodejs examples with vfox plugins by @jdx in [#8191](#8191) ### ⚡ Performance - call npm view only once by @risu729 in [#8181](#8181) ### New Contributors - @jean-humann made their first contribution in [#8173](#8173) - @mackwic made their first contribution in [#8183](#8183) - @rooperuu made their first contribution in [#8169](#8169) ## 📦 Aqua Registry Updates #### New Packages (2) - [`BetterDiscord/cli`](https://github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://github.com/glossia.ai/cli)

## Summary - `mise up --bump` loads all tracked config files to determine which tool versions are still needed by other projects - If any tracked config (e.g. `~/foo/.mise.toml` from a prior `cd ~/foo`) is untrusted, this triggers an interactive trust prompt mid-upgrade and then displays a scary `mise ERROR` message - Skip untrusted/ignored tracked configs silently instead of prompting or erroring - Downgrade remaining parse failure log from `error!()` to `warn!()` Fixes jdx#8130 ## Test plan - [x] Builds and passes lint - [x] Verified `get_tracked_config_files()` checks `is_trusted()` before calling `parse()`, avoiding the interactive `trust_check()` prompt in `MiseToml::from_str()` 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Small change scoped to tracked-config loading and logging; main risk is inadvertently skipping a config that should have been considered trusted due to trust-root/path edge cases. > > **Overview** > `get_tracked_config_files()` now pre-checks trust (via `config_trust_root`/`is_trusted`) for each tracked config and **skips untrusted files** instead of attempting to parse them, preventing interactive trust prompts during operations like `mise upgrade`. > > Parse failures for tracked configs are now logged as `warn!` (with path context) rather than `error!`, reducing scary upgrade output while still surfacing issues. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e8ae343. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

@jdx

### 🚀 Features - **(task)** stream keep-order output in real-time per task by @jdx in [jdx#8164](jdx#8164) ### 🐛 Bug Fixes - **(aqua)** resolve lockfile artifacts for target platform (fix discussion jdx#7479) by @mackwic in [jdx#8183](jdx#8183) - **(exec)** strip shims from PATH to prevent recursive shim execution by @jdx in [jdx#8189](jdx#8189) - **(hook-env)** preserve PATH reordering done after activation by @jdx in [jdx#8190](jdx#8190) - **(lockfile)** resolve version aliases before lockfile lookup by @jdx in [jdx#8194](jdx#8194) - **(registry)** set helm-diff archive bin name to diff by @jean-humann in [jdx#8173](jdx#8173) - **(task)** improve source freshness checks with dynamic task dirs by @rooperuu in [jdx#8169](jdx#8169) - **(task)** resolve global tasks when running from monorepo root by @jdx in [jdx#8192](jdx#8192) - **(task)** prevent wildcard glob `test:*` from matching parent task `test` by @jdx in [jdx#8165](jdx#8165) - **(task)** resolve task_config.includes relative to config root by @jdx in [jdx#8193](jdx#8193) - **(upgrade)** skip untrusted tracked configs during upgrade by @jdx in [jdx#8195](jdx#8195) ### 🚜 Refactor - use enum for npm.pacakge_manager by @risu729 in [jdx#8180](jdx#8180) ### 📚 Documentation - **(plugins)** replace node/asdf-nodejs examples with vfox plugins by @jdx in [jdx#8191](jdx#8191) ### ⚡ Performance - call npm view only once by @risu729 in [jdx#8181](jdx#8181) ### New Contributors - @jean-humann made their first contribution in [jdx#8173](jdx#8173) - @mackwic made their first contribution in [jdx#8183](jdx#8183) - @rooperuu made their first contribution in [jdx#8169](jdx#8169) ## 📦 Aqua Registry Updates #### New Packages (2) - [`BetterDiscord/cli`](https://github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://github.com/glossia.ai/cli)

@jdx

### 🚀 Features - **(task)** stream keep-order output in real-time per task by @jdx in [jdx#8164](jdx#8164) ### 🐛 Bug Fixes - **(aqua)** resolve lockfile artifacts for target platform (fix discussion jdx#7479) by @mackwic in [jdx#8183](jdx#8183) - **(exec)** strip shims from PATH to prevent recursive shim execution by @jdx in [jdx#8189](jdx#8189) - **(hook-env)** preserve PATH reordering done after activation by @jdx in [jdx#8190](jdx#8190) - **(lockfile)** resolve version aliases before lockfile lookup by @jdx in [jdx#8194](jdx#8194) - **(registry)** set helm-diff archive bin name to diff by @jean-humann in [jdx#8173](jdx#8173) - **(task)** improve source freshness checks with dynamic task dirs by @rooperuu in [jdx#8169](jdx#8169) - **(task)** resolve global tasks when running from monorepo root by @jdx in [jdx#8192](jdx#8192) - **(task)** prevent wildcard glob `test:*` from matching parent task `test` by @jdx in [jdx#8165](jdx#8165) - **(task)** resolve task_config.includes relative to config root by @jdx in [jdx#8193](jdx#8193) - **(upgrade)** skip untrusted tracked configs during upgrade by @jdx in [jdx#8195](jdx#8195) ### 🚜 Refactor - use enum for npm.pacakge_manager by @risu729 in [jdx#8180](jdx#8180) ### 📚 Documentation - **(plugins)** replace node/asdf-nodejs examples with vfox plugins by @jdx in [jdx#8191](jdx#8191) ### ⚡ Performance - call npm view only once by @risu729 in [jdx#8181](jdx#8181) ### New Contributors - @jean-humann made their first contribution in [jdx#8173](jdx#8173) - @mackwic made their first contribution in [jdx#8183](jdx#8183) - @rooperuu made their first contribution in [jdx#8169](jdx#8169) ## 📦 Aqua Registry Updates #### New Packages (2) - [`BetterDiscord/cli`](https://github.com/BetterDiscord/cli) - [`glossia.ai/cli`](https://github.com/glossia.ai/cli)

Copilot AI review requested due to automatic review settings February 16, 2026 22:42

gemini-code-assist bot reviewed Feb 16, 2026

View reviewed changes

cursor bot reviewed Feb 16, 2026

View reviewed changes

src/config/mod.rs Show resolved Hide resolved

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Copilot started reviewing on behalf of jdx February 16, 2026 22:53 View session

cursor bot reviewed Feb 16, 2026

View reviewed changes

src/config/mod.rs Outdated Show resolved Hide resolved

cursor bot reviewed Feb 16, 2026

View reviewed changes

src/config/config_file/mod.rs Outdated Show resolved Hide resolved

jdx enabled auto-merge (squash) February 16, 2026 23:13

jdx merged commit c8d2ef8 into main Feb 16, 2026
35 checks passed

jdx deleted the fix/upgrade-skip-untrusted-tracked-configs branch February 16, 2026 23:26

mise-en-dev mentioned this pull request Feb 16, 2026

chore: release 2026.2.15 #8177

Merged

BrewTestBot mentioned this pull request Feb 17, 2026

mise 2026.2.15 Homebrew/homebrew-core#267924

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(upgrade): skip untrusted tracked configs during upgrade#8195

fix(upgrade): skip untrusted tracked configs during upgrade#8195
jdx merged 4 commits intomainfrom
fix/upgrade-skip-untrusted-tracked-configs

jdx commented Feb 16, 2026 •

edited by cursor bot

Loading

Uh oh!

gemini-code-assist bot commented Feb 16, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Feb 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	if !config_file::is_trusted(&trust_root) && !config_file::is_trusted(&path) {
	if !config_file::is_trusted(&trust_root) \|\| !config_file::is_trusted(&path) {

Uh oh!

Conversation

jdx commented Feb 16, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist bot commented Feb 16, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 16, 2026

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jdx commented Feb 16, 2026 •

edited by cursor bot

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`