Skip to content

chore(deps): update lockfile deps (hold back rattler)#8909

Merged
jdx merged 1 commit intomainfrom
bump-zip
Apr 4, 2026
Merged

chore(deps): update lockfile deps (hold back rattler)#8909
jdx merged 1 commit intomainfrom
bump-zip

Conversation

@jdx
Copy link
Copy Markdown
Owner

@jdx jdx commented Apr 4, 2026

Summary

  • Updates all lockfile dependencies to latest compatible versions
  • Holds back rattler crates due to rattler_virtual_packages 2.3.12+ requiring rattler_conda_types 0.44 while other rattler crates still pin 0.43.4
  • Eliminates zip 7 and lzma-rust2 0.15.x from the dep tree, resolving the crc version conflict in chore(deps): lock file maintenance #8416

Test plan

  • cargo check passes locally
  • All pre-commit lints pass
  • CI passes

🤖 Generated with Claude Code


Note

Medium Risk
Large dependency refresh affecting networking/crypto/tooling crates (e.g. hyper, rustls, tokio, gix, zip) could introduce subtle runtime or build regressions across platforms. No application logic changes, but the breadth of transitive updates raises compatibility risk.

Overview
Updates Cargo.lock to newer compatible versions across the dependency tree, including notable bumps to core runtime and networking/crypto libraries (e.g. tokio, hyper, rustls, AWS Smithy crates, and gix) and introduces/removes several transitive crates as a result.

Adjusts cargo-deny policy in deny.toml by removing an advisory ignore entry and tightening license configuration (drops OpenSSL from the allowlist and removes the custom ring license clarification).

Reviewed by Cursor Bugbot for commit 79691a4. Bugbot is set up for automated code reviews on this repo. Configure here.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@jdx jdx changed the title chore(deps): bump zip from 3 to 8, update lockfile chore(deps): update lockfile deps (hold back rattler) Apr 4, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 4, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcargo/​chrono@​0.4.43 ⏵ 0.4.449910093100100
Updatedcargo/​clap@​4.5.56 ⏵ 4.6.09910093100100
Updatedcargo/​console@​0.16.2 ⏵ 0.16.39610093100100

View full report

Updates all lockfile dependencies to latest compatible versions.
Holds back rattler crates due to rattler_virtual_packages 2.3.12+
requiring rattler_conda_types 0.44 while other rattler crates still
pin 0.43.4.

Also cleans up deny.toml:
- Remove stale OpenSSL license allowance and ring clarification
- Remove resolved RUSTSEC-2026-0049 advisory ignore

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@jdx jdx enabled auto-merge (squash) April 4, 2026 20:39
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Apr 4, 2026

Greptile Summary

Refreshes Cargo.lock to pick up latest compatible crate releases while pinning rattler_virtual_packages at 2.3.10 and rattler_conda_types at 0.43.4 to avoid an upstream cross-crate version incompatibility (2.3.12+ requires rattler_conda_types 0.44 while other rattler crates still pin 0.43.4). The deny.toml removes two now-obsolete suppressions: the RUSTSEC-2026-0049 advisory ignore (the advisory was likely retracted or amended in the RustSec DB — confirmed safe since cargo deny check runs against a fresh advisory DB in CI and passes) and the ring license clarification (ring 0.17.14 no longer requires manual [[licenses.clarify]] intervention with current cargo-deny). Note that rustls 0.21.12 and rustls-webpki 0.101.7 remain in the graph as a transitive dependency of aws-smithy-http-client 1.1.9, but this is an upstream constraint that cannot be resolved at the mise level.

Confidence Score: 5/5

Safe to merge — lockfile-only update with well-reasoned hold-backs and CI-verified deny.toml cleanup.

All deny.toml changes are justified cleanup of obsolete suppressions (verified by CI running cargo deny check against a fresh advisory DB). The rattler hold-backs are correctly documented and prevent a known cross-crate version conflict. No direct code changes introduce new risk.

No files require special attention; reviewers may want to re-evaluate the rattler pin when rattler_conda_types 0.44 is broadly adopted across the rattler ecosystem.

Important Files Changed

Filename Overview
Cargo.lock Lockfile refreshed to latest compatible versions; zip 7 eliminated, lzma-rust2 bumped 0.15.x → 0.16.2, rattler crates pinned at compatible versions (rattler_virtual_packages 2.3.10, rattler_conda_types 0.43.4)
deny.toml Removes obsolete RUSTSEC-2026-0049 advisory ignore and ring license clarification/OpenSSL allowance — both are safe cleanup given CI passes with a fresh advisory DB pull

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Cargo.lock update] --> B{rattler ecosystem}
    A --> C{zip / lzma-rust2}
    A --> D{TLS / crypto stack}
    B --> E[rattler_virtual_packages\nHeld back at 2.3.10]
    B --> F[rattler_conda_types\nHeld at 0.43.4]
    B --> G[Other rattler crates\nUpdated to latest]
    E -- incompatible with --> H[rattler_conda_types 0.44\nnot yet adopted]
    C --> I[zip 7 eliminated\nlzma-rust2 0.15.x eliminated]
    I --> J[Resolves crc version conflict\nfrom issue 8416]
    D --> K[ring 0.17.14 remains\nLicense clarification removed]
    D --> L[rustls 0.21.12 + rustls-webpki 0.101.7\nStill present via aws-smithy-http-client]
    L -- RUSTSEC-2026-0049 ignore --> M[Removed from deny.toml\nAdvisory retracted in RustSec DB]
Loading

Reviews (1): Last reviewed commit: "chore(deps): update lockfile deps (hold ..." | Re-trigger Greptile

@jdx jdx merged commit 649a98c into main Apr 4, 2026
36 checks passed
@jdx jdx deleted the bump-zip branch April 4, 2026 20:56
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 4, 2026

Hyperfine Performance

mise x -- echo

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.4.3 x -- echo 22.1 ± 0.4 21.4 26.4 1.00
mise x -- echo 22.5 ± 0.4 21.7 24.8 1.02 ± 0.03

mise env

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.4.3 env 21.5 ± 0.6 20.7 28.9 1.00
mise env 21.9 ± 0.3 21.3 23.8 1.02 ± 0.03

mise hook-env

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.4.3 hook-env 22.3 ± 0.4 21.6 24.2 1.00
mise hook-env 22.7 ± 0.4 21.9 25.5 1.02 ± 0.02

mise ls

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.4.3 ls 19.5 ± 0.3 18.9 21.1 1.00
mise ls 20.1 ± 0.4 19.3 21.5 1.03 ± 0.03

xtasks/test/perf

Command mise-2026.4.3 mise Variance
install (cached) 148ms 149ms +0%
ls (cached) 78ms 79ms -1%
bin-paths (cached) 83ms 82ms +1%
task-ls (cached) 796ms 799ms +0%

jdx pushed a commit that referenced this pull request Apr 5, 2026
### 🚀 Features

- **(ci)** auto-convert external PRs to draft mode by @jdx in
[#8896](#8896)
- **(deps)** add `depends` field for user-specified tool dependencies by
@cprecioso in [#8776](#8776)
- **(dotnet)** support runtime-only installs by @fragon10 in
[#8524](#8524)
- **(npm)** apply install_before to transitive dependencies by @risu729
in [#8851](#8851)
- **(task)** allow passing arguments to task dependencies via
{{usage.*}} templates by @jdx in
[#8893](#8893)
- add options field to BackendListVersionsCtx by @esteve in
[#8875](#8875)

### 🐛 Bug Fixes

- **(backend)** filter PEP 440 .dev versions in fuzzy version matching
by @richardthe3rd in [#8849](#8849)
- **(ci)** update COPR BuildRequires rust version to match MSRV 1.88 by
@jdx in [#8911](#8911)
- **(ci)** add Ruby build dependencies to e2e Docker image by @jdx in
[#8910](#8910)
- **(ci)** add missing build dependencies to e2e Docker image by @jdx in
[#8912](#8912)
- **(ci)** add missing build dependencies to e2e Docker image by @jdx in
[#8914](#8914)
- **(ci)** use Node 24 LTS for corepack e2e test by @jdx in
[#8915](#8915)
- **(ci)** add libxml2 and pkg-config to e2e Docker image by @jdx in
[#8917](#8917)
- **(ci)** add libxml2-dev to e2e image and disable Swift SPM tests by
@jdx in [#8918](#8918)
- **(docs)** use sans-serif font for badges by @jdx in
[#8887](#8887)
- **(env)** parse --env=VALUE and -E=VALUE flag forms correctly by @jdx
in [#8889](#8889)
- **(exec)** use i64::from() for seccomp syscall numbers to survive
autofix by @jdx in [#8882](#8882)
- **(github)** preserve tool options like filter_bins when version
specified via CLI by @jdx in
[#8888](#8888)
- **(github)** use alias-specific options when tool_alias has its own
config by @jdx in [#8892](#8892)
- **(install)** add locked_verify_provenance setting and detect github
attestations at lock time by @jdx in
[#8901](#8901)
- **(lock)** prune stale version entries during filtered `mise lock
<tool>` runs by @altendky in
[#8599](#8599)
- **(python)** use lockfile URL for precompiled installs by @hehaoqian
in [#8750](#8750)
- **(release)** verify all build targets succeed before releasing by
@jdx in [#8886](#8886)
- **(ruby)** support build revisions for precompiled binaries in
mise.lock by @jdx in [#8900](#8900)
- **(swift)** fall back to Ubuntu 24.04 for unsupported Ubuntu versions
by @jdx in [#8916](#8916)
- **(zsh)** avoid duplicate trust warning after cd by @timothysparg in
[#8898](#8898)
- update flake.lock and add fix for rust-bindgen to default.nix by
@esteve in [#8874](#8874)
- when direnv diff is empty, do not try to parse it by @yaleman in
[#8857](#8857)
- skip trust check for plain .tool-versions in task list by @dportalesr
in [#8876](#8876)

### 🚜 Refactor

- **(go)** rename go_* settings to go.* namespace by @jdbruijn in
[#8598](#8598)

### 📚 Documentation

- **(tasks)** clarify task_config.includes behavior by @risu729 in
[#8905](#8905)

### 🧪 Testing

- **(ci)** run e2e tests inside Docker containers by @jdx in
[#8899](#8899)

### 📦️ Dependency Updates

- bump ubi from 0.8 to 0.9 by @jdx in
[#8906](#8906)
- bump zip from 3 to 8 by @jdx in
[#8908](#8908)
- update lockfile deps (hold back rattler) by @jdx in
[#8909](#8909)
- update bun.lock by @jdx in
[#8913](#8913)

### 📦 Registry

- add turso
([github:tursodatabase/turso-cli](https://github.com/tursodatabase/turso-cli))
by @kenn in [#8884](#8884)
- remove carp test by @jdx in
[#8894](#8894)

### Chore

- **(ci)** add workflow to warn PRs modifying vendored aqua-registry by
@jdx in [#8897](#8897)
- **(ci)** use github.token for draft conversion in auto-draft workflow
by @jdx in [#8903](#8903)
- remove deprecated settings older than 12 months by @jdx in
[#8904](#8904)

### New Contributors

- @dportalesr made their first contribution in
[#8876](#8876)
- @timothysparg made their first contribution in
[#8898](#8898)
- @hehaoqian made their first contribution in
[#8750](#8750)
- @jdbruijn made their first contribution in
[#8598](#8598)
- @cprecioso made their first contribution in
[#8776](#8776)
- @yaleman made their first contribution in
[#8857](#8857)
- @kenn made their first contribution in
[#8884](#8884)
- @fragon10 made their first contribution in
[#8524](#8524)

## 📦 Aqua Registry Updates

#### New Packages (6)

- [`ahkohd/oyo`](https://github.com/ahkohd/oyo)
- [`bellicose100xp/jiq`](https://github.com/bellicose100xp/jiq)
- [`kurama/dealve-tui`](https://github.com/kurama/dealve-tui)
- [`micahkepe/jsongrep`](https://github.com/micahkepe/jsongrep)
- [`textfuel/lazyjira`](https://github.com/textfuel/lazyjira)
- [`ubugeeei/vize`](https://github.com/ubugeeei/vize)

#### Updated Packages (1)

- [`sigstore/cosign`](https://github.com/sigstore/cosign)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant