Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Updates all lockfile dependencies to latest compatible versions. Holds back rattler crates due to rattler_virtual_packages 2.3.12+ requiring rattler_conda_types 0.44 while other rattler crates still pin 0.43.4. Also cleans up deny.toml: - Remove stale OpenSSL license allowance and ring clarification - Remove resolved RUSTSEC-2026-0049 advisory ignore Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Greptile SummaryRefreshes Confidence Score: 5/5Safe to merge — lockfile-only update with well-reasoned hold-backs and CI-verified deny.toml cleanup. All deny.toml changes are justified cleanup of obsolete suppressions (verified by CI running cargo deny check against a fresh advisory DB). The rattler hold-backs are correctly documented and prevent a known cross-crate version conflict. No direct code changes introduce new risk. No files require special attention; reviewers may want to re-evaluate the rattler pin when rattler_conda_types 0.44 is broadly adopted across the rattler ecosystem. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Cargo.lock update] --> B{rattler ecosystem}
A --> C{zip / lzma-rust2}
A --> D{TLS / crypto stack}
B --> E[rattler_virtual_packages\nHeld back at 2.3.10]
B --> F[rattler_conda_types\nHeld at 0.43.4]
B --> G[Other rattler crates\nUpdated to latest]
E -- incompatible with --> H[rattler_conda_types 0.44\nnot yet adopted]
C --> I[zip 7 eliminated\nlzma-rust2 0.15.x eliminated]
I --> J[Resolves crc version conflict\nfrom issue 8416]
D --> K[ring 0.17.14 remains\nLicense clarification removed]
D --> L[rustls 0.21.12 + rustls-webpki 0.101.7\nStill present via aws-smithy-http-client]
L -- RUSTSEC-2026-0049 ignore --> M[Removed from deny.toml\nAdvisory retracted in RustSec DB]
Reviews (1): Last reviewed commit: "chore(deps): update lockfile deps (hold ..." | Re-trigger Greptile |
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.4.3 x -- echo |
22.1 ± 0.4 | 21.4 | 26.4 | 1.00 |
mise x -- echo |
22.5 ± 0.4 | 21.7 | 24.8 | 1.02 ± 0.03 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.4.3 env |
21.5 ± 0.6 | 20.7 | 28.9 | 1.00 |
mise env |
21.9 ± 0.3 | 21.3 | 23.8 | 1.02 ± 0.03 |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.4.3 hook-env |
22.3 ± 0.4 | 21.6 | 24.2 | 1.00 |
mise hook-env |
22.7 ± 0.4 | 21.9 | 25.5 | 1.02 ± 0.02 |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.4.3 ls |
19.5 ± 0.3 | 18.9 | 21.1 | 1.00 |
mise ls |
20.1 ± 0.4 | 19.3 | 21.5 | 1.03 ± 0.03 |
xtasks/test/perf
| Command | mise-2026.4.3 | mise | Variance |
|---|---|---|---|
| install (cached) | 148ms | 149ms | +0% |
| ls (cached) | 78ms | 79ms | -1% |
| bin-paths (cached) | 83ms | 82ms | +1% |
| task-ls (cached) | 796ms | 799ms | +0% |
### 🚀 Features - **(ci)** auto-convert external PRs to draft mode by @jdx in [#8896](#8896) - **(deps)** add `depends` field for user-specified tool dependencies by @cprecioso in [#8776](#8776) - **(dotnet)** support runtime-only installs by @fragon10 in [#8524](#8524) - **(npm)** apply install_before to transitive dependencies by @risu729 in [#8851](#8851) - **(task)** allow passing arguments to task dependencies via {{usage.*}} templates by @jdx in [#8893](#8893) - add options field to BackendListVersionsCtx by @esteve in [#8875](#8875) ### 🐛 Bug Fixes - **(backend)** filter PEP 440 .dev versions in fuzzy version matching by @richardthe3rd in [#8849](#8849) - **(ci)** update COPR BuildRequires rust version to match MSRV 1.88 by @jdx in [#8911](#8911) - **(ci)** add Ruby build dependencies to e2e Docker image by @jdx in [#8910](#8910) - **(ci)** add missing build dependencies to e2e Docker image by @jdx in [#8912](#8912) - **(ci)** add missing build dependencies to e2e Docker image by @jdx in [#8914](#8914) - **(ci)** use Node 24 LTS for corepack e2e test by @jdx in [#8915](#8915) - **(ci)** add libxml2 and pkg-config to e2e Docker image by @jdx in [#8917](#8917) - **(ci)** add libxml2-dev to e2e image and disable Swift SPM tests by @jdx in [#8918](#8918) - **(docs)** use sans-serif font for badges by @jdx in [#8887](#8887) - **(env)** parse --env=VALUE and -E=VALUE flag forms correctly by @jdx in [#8889](#8889) - **(exec)** use i64::from() for seccomp syscall numbers to survive autofix by @jdx in [#8882](#8882) - **(github)** preserve tool options like filter_bins when version specified via CLI by @jdx in [#8888](#8888) - **(github)** use alias-specific options when tool_alias has its own config by @jdx in [#8892](#8892) - **(install)** add locked_verify_provenance setting and detect github attestations at lock time by @jdx in [#8901](#8901) - **(lock)** prune stale version entries during filtered `mise lock <tool>` runs by @altendky in [#8599](#8599) - **(python)** use lockfile URL for precompiled installs by @hehaoqian in [#8750](#8750) - **(release)** verify all build targets succeed before releasing by @jdx in [#8886](#8886) - **(ruby)** support build revisions for precompiled binaries in mise.lock by @jdx in [#8900](#8900) - **(swift)** fall back to Ubuntu 24.04 for unsupported Ubuntu versions by @jdx in [#8916](#8916) - **(zsh)** avoid duplicate trust warning after cd by @timothysparg in [#8898](#8898) - update flake.lock and add fix for rust-bindgen to default.nix by @esteve in [#8874](#8874) - when direnv diff is empty, do not try to parse it by @yaleman in [#8857](#8857) - skip trust check for plain .tool-versions in task list by @dportalesr in [#8876](#8876) ### 🚜 Refactor - **(go)** rename go_* settings to go.* namespace by @jdbruijn in [#8598](#8598) ### 📚 Documentation - **(tasks)** clarify task_config.includes behavior by @risu729 in [#8905](#8905) ### 🧪 Testing - **(ci)** run e2e tests inside Docker containers by @jdx in [#8899](#8899) ### 📦️ Dependency Updates - bump ubi from 0.8 to 0.9 by @jdx in [#8906](#8906) - bump zip from 3 to 8 by @jdx in [#8908](#8908) - update lockfile deps (hold back rattler) by @jdx in [#8909](#8909) - update bun.lock by @jdx in [#8913](#8913) ### 📦 Registry - add turso ([github:tursodatabase/turso-cli](https://github.com/tursodatabase/turso-cli)) by @kenn in [#8884](#8884) - remove carp test by @jdx in [#8894](#8894) ### Chore - **(ci)** add workflow to warn PRs modifying vendored aqua-registry by @jdx in [#8897](#8897) - **(ci)** use github.token for draft conversion in auto-draft workflow by @jdx in [#8903](#8903) - remove deprecated settings older than 12 months by @jdx in [#8904](#8904) ### New Contributors - @dportalesr made their first contribution in [#8876](#8876) - @timothysparg made their first contribution in [#8898](#8898) - @hehaoqian made their first contribution in [#8750](#8750) - @jdbruijn made their first contribution in [#8598](#8598) - @cprecioso made their first contribution in [#8776](#8776) - @yaleman made their first contribution in [#8857](#8857) - @kenn made their first contribution in [#8884](#8884) - @fragon10 made their first contribution in [#8524](#8524) ## 📦 Aqua Registry Updates #### New Packages (6) - [`ahkohd/oyo`](https://github.com/ahkohd/oyo) - [`bellicose100xp/jiq`](https://github.com/bellicose100xp/jiq) - [`kurama/dealve-tui`](https://github.com/kurama/dealve-tui) - [`micahkepe/jsongrep`](https://github.com/micahkepe/jsongrep) - [`textfuel/lazyjira`](https://github.com/textfuel/lazyjira) - [`ubugeeei/vize`](https://github.com/ubugeeei/vize) #### Updated Packages (1) - [`sigstore/cosign`](https://github.com/sigstore/cosign)
Summary
rattler_virtual_packages2.3.12+ requiringrattler_conda_types0.44 while other rattler crates still pin 0.43.4zip7 andlzma-rust20.15.x from the dep tree, resolving thecrcversion conflict in chore(deps): lock file maintenance #8416Test plan
cargo checkpasses locally🤖 Generated with Claude Code
Note
Medium Risk
Large dependency refresh affecting networking/crypto/tooling crates (e.g.
hyper,rustls,tokio,gix,zip) could introduce subtle runtime or build regressions across platforms. No application logic changes, but the breadth of transitive updates raises compatibility risk.Overview
Updates
Cargo.lockto newer compatible versions across the dependency tree, including notable bumps to core runtime and networking/crypto libraries (e.g.tokio,hyper,rustls, AWS Smithy crates, andgix) and introduces/removes several transitive crates as a result.Adjusts
cargo-denypolicy indeny.tomlby removing an advisory ignore entry and tightening license configuration (dropsOpenSSLfrom the allowlist and removes the customringlicense clarification).Reviewed by Cursor Bugbot for commit 79691a4. Bugbot is set up for automated code reviews on this repo. Configure here.