chore(deps): unblock cargo-deny advisories check by jdx · Pull Request #9112 · jdx/mise

jdx · 2026-04-15T13:34:53Z

Summary

Drop stale ignore for RUSTSEC-2026-0066 (astral-tokio-tar) — the crate is no longer in the dep tree, so cargo-deny was failing with advisory-not-detected and blocking every PR's lint job (e.g. registry: add sheldon #9104).
Bump rustls-webpki 0.103.11 → 0.103.12 via cargo update to pick up the fix for RUSTSEC-2026-0098 / RUSTSEC-2026-0099 on the modern rustls 0.23 line.
Ignore RUSTSEC-2026-0098 / RUSTSEC-2026-0099 for the transitive rustls-webpki 0.101.7 pulled in by aws-smithy-http-client via rustls 0.21. Swapping the aws-config / aws-sdk-s3 rustls feature to default-https-client would move to hyper 1.x / rustls 0.23 but requires an MSRV bump, so we wait on aws-sdk to backport or until we bump MSRV.

Verified locally with `cargo deny check advisories` → `advisories ok`.

Test plan

`cargo deny check advisories` passes locally
CI lint job green

🤖 Generated with Claude Code

Note

Medium Risk
Primarily dependency/lockfile churn, including updates in TLS/crypto and async networking crates (rustls, hyper-rustls, tokio), which can affect runtime behavior despite being mostly patch-level bumps.

Overview
Unblocks cargo-deny advisory checks by updating the advisory ignore list: removes the stale ignore for RUSTSEC-2026-0066 and adds ignores for RUSTSEC-2026-0098/RUSTSEC-2026-0099 affecting transitive rustls-webpki 0.101.7 (via the rustls 0.21 AWS dependency chain).

Refreshes Cargo.lock via cargo update, notably bumping the modern TLS stack (hyper-rustls and rustls/rustls-webpki on the 0.23 line) and rolling forward various supporting deps (e.g., tokio, rand, openssl, rayon), plus consolidating/removing an extra windows-registry version entry.

^{Reviewed by Cursor Bugbot for commit a7e0c08. Bugbot is set up for automated code reviews on this repo. Configure here.}

- Drop stale ignore for RUSTSEC-2026-0066 (astral-tokio-tar): crate is no longer in the dep tree, so cargo-deny was failing on the unused ignore with `advisory-not-detected`. - Update rustls-webpki 0.103.11 -> 0.103.12 to pick up the fix for RUSTSEC-2026-0098 / RUSTSEC-2026-0099 on that line. - Ignore RUSTSEC-2026-0098 / RUSTSEC-2026-0099 for the transitive rustls-webpki 0.101.7 pulled in by aws-smithy-http-client via rustls 0.21 — no upgrade path until aws-sdk bumps rustls. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Routine lockfile refresh pulled alongside the deny.toml cleanup. Bumps rustls 0.23.37→0.23.38, tokio 1.51.1→1.52.0, hyper-rustls 0.27.7→0.27.9, rattler 0.40.5→0.40.6 and friends, plus assorted minor/patch updates. aws-sdk / aws-config / aws-smithy are left alone — moving off the legacy `rustls` feature to a newer stack would require an MSRV bump. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-04-15T13:37:20Z

Greptile Summary

Unblocks cargo-deny advisory checks by cleaning up the ignore list: removes the stale RUSTSEC-2026-0066 entry (the triggering crate astral-tokio-tar was upgraded from 0.5.6 → 0.6.0, fixing the advisory — it remains in the dep tree via rattler_package_streaming), adds ignores for RUSTSEC-2026-0098/0099 affecting the legacy rustls-webpki 0.101.7 path kept alive by aws-smithy-http-client's rustls 0.21 dependency, and bumps rustls-webpki to 0.103.12 on the modern rustls 0.23 line.

Confidence Score: 5/5

Safe to merge — deny.toml changes are correct, all remaining concerns are P2 documentation clarifications.

The code changes are correct: removing the stale advisory ignore and adding well-reasoned ignores for the two TLS advisories that cannot be resolved without an MSRV bump. The only finding is a P2 clarification that the astral-tokio-tar crate is still in the dep tree (upgraded to a patched version), not removed entirely as the PR description implies. No logic bugs, security issues, or blocking concerns.

No files require special attention. The deny.toml changes are correct; the P2 note is informational only.

Important Files Changed

Filename	Overview
deny.toml	Drops stale RUSTSEC-2026-0066 ignore (astral-tokio-tar 0.5.6 was upgraded to 0.6.0, fixing the advisory) and adds ignores for RUSTSEC-2026-0098/0099 affecting rustls-webpki 0.101.7 pulled in transitively via aws-smithy-http-client/rustls 0.21.
Cargo.lock	Lockfile refresh bumping rustls-webpki 0.103.x to 0.103.12 and other minor patch bumps; both rustls 0.21.12 (using webpki 0.101.7) and rustls 0.23.38 (using webpki 0.103.12) remain present as dual dependencies of aws-smithy-http-client.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[mise / aws-sdk-s3] --> B[aws-smithy-http-client 1.1.9]
    B --> C[rustls 0.21.12\nlegacy path]
    B --> D[rustls 0.23.38\nmodern path]
    C --> E[rustls-webpki 0.101.7\n⚠️ RUSTSEC-2026-0098\n⚠️ RUSTSEC-2026-0099\nignored — awaiting aws-sdk MSRV bump]
    D --> F[rustls-webpki 0.103.12\n✅ patched in this PR]
    G[rattler_package_streaming] --> H[astral-tokio-tar 0.6.0\n✅ upgraded from 0.5.6\nRUSTSEC-2026-0066 ignore removed]

_{Reviews (3): Last reviewed commit: "chore(deps): bump sigstore-verification ..." | Re-trigger Greptile}

gemini-code-assist

Code Review

This pull request involves several dependency downgrades in Cargo.lock, including windows-sys, itertools, and base64, alongside an upgrade for rustls-webpki. It also updates deny.toml to ignore security advisories RUSTSEC-2026-0098 and RUSTSEC-2026-0099. Feedback suggests that instead of ignoring these vulnerabilities, the project should update aws-sdk-s3 to a version that utilizes rustls 0.23, as the current MSRV (1.88) is sufficient to support the fix.

gemini-code-assist · 2026-04-15T13:39:11Z

+  { id = "RUSTSEC-2026-0098", reason = "rustls-webpki 0.101.7 URI name constraints - transitive via aws-smithy-http-client/rustls 0.21, no safe upgrade until aws-sdk bumps rustls" },
+  { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.101.7 wildcard name constraints - transitive via aws-smithy-http-client/rustls 0.21, no safe upgrade until aws-sdk bumps rustls" },


The provided reason for ignoring these advisories states an MSRV bump is required to switch to default-https-client. The project's MSRV is 1.88, which appears to be sufficient for recent aws-sdk versions that use rustls 0.23 via the default-https-client feature (which requires Rust 1.75).

To avoid ignoring these security advisories, consider updating aws-sdk-s3 and switching to the default-https-client feature in Cargo.toml. This would resolve the underlying issue rather than suppressing the warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-04-15T14:15:23Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.12 x -- echo`	24.0 ± 0.4	23.2	26.9	1.00
`mise x -- echo`	24.6 ± 0.4	23.9	26.9	1.02 ± 0.02

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.12 env`	23.8 ± 0.8	22.8	34.1	1.00
`mise env`	24.1 ± 0.7	23.2	32.9	1.02 ± 0.05

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.12 hook-env`	24.2 ± 0.3	23.4	25.5	1.00
`mise hook-env`	24.7 ± 0.6	23.8	32.3	1.02 ± 0.03

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.12 ls`	21.7 ± 0.8	20.6	35.9	1.00
`mise ls`	21.8 ± 0.4	21.0	23.7	1.01 ± 0.04

`xtasks/test/perf`

Command	mise-2026.4.12	mise	Variance
install (cached)	155ms	154ms	+0%
ls (cached)	81ms	79ms	+2%
bin-paths (cached)	85ms	85ms	+0%
task-ls (cached)	777ms	774ms	+0%

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(schema)** support os arch filters by @risu729 in [#9095](#9095) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@jdx

## [2026.4.14](https://github.com/jdx/mise/compare/v2026.4.13..v2026.4.14) - 2026-04-15 ### Chore - bump sigstore-verification by @jdx in [#9128](jdx/mise#9128) ## [2026.4.13](https://github.com/jdx/mise/compare/v2026.4.12..v2026.4.13) - 2026-04-15 ### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](jdx/mise#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](jdx/mise#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](jdx/mise#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](jdx/mise#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](jdx/mise#9097) - @mcncl made their first contribution in [#9096](jdx/mise#9096) - @Oyami-Srk made their first contribution in [#9099](jdx/mise#9099) ## [2026.4.12](https://github.com/jdx/mise/compare/v2026.4.11..v2026.4.12) - 2026-04-15 ### 🚀 Features - **(npm)** use --min-release-age for npm 11.10.0+ supply chain protection by @webkaz in [#9072](jdx/mise#9072) - **(registry)** add openfga by @mnm364 in [#9084](jdx/mise#9084) - **(task)** allow to set confirmation default by @roele in [#9089](jdx/mise#9089) - support os/arch compound syntax in tool os filtering by @RobertDeRose in [#9088](jdx/mise#9088) ### 🐛 Bug Fixes - **(activate)** export __MISE_EXE and resolve bare ARGV0 to absolute path by @fru1tworld in [#9081](jdx/mise#9081) - **(install)** support aliased installs sharing a backend by @jdx in [#9093](jdx/mise#9093) - **(shim)** use which_no_shims when resolving mise binary in reshim and doctor by @kevinswiber in [#9071](jdx/mise#9071) - filter empty segments in colon-separated env var parsing by @baby-joel in [#9076](jdx/mise#9076) ### 📚 Documentation - fix wrong file reference to forgejo backend implemenation by @roele in [#9090](jdx/mise#9090) - fix cli token command for token resolution by @roele in [#9077](jdx/mise#9077)

jdx and others added 2 commits April 15, 2026 13:32

gemini-code-assist Bot reviewed Apr 15, 2026

View reviewed changes

chore(deps): bump sigstore-verification to 0.2.3

a7e0c08

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

jdx merged commit 3ba74c3 into main Apr 15, 2026
24 of 25 checks passed

jdx deleted the fix/stale-rustsec-ignore branch April 15, 2026 13:55

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.13 #9114

Merged

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.14 #9115

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): unblock cargo-deny advisories check#9112

chore(deps): unblock cargo-deny advisories check#9112
jdx merged 3 commits intomainfrom
fix/stale-rustsec-ignore

jdx commented Apr 15, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		{ id = "RUSTSEC-2026-0098", reason = "rustls-webpki 0.101.7 URI name constraints - transitive via aws-smithy-http-client/rustls 0.21, no safe upgrade until aws-sdk bumps rustls" },
		{ id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.101.7 wildcard name constraints - transitive via aws-smithy-http-client/rustls 0.21, no safe upgrade until aws-sdk bumps rustls" },

Uh oh!

Conversation

jdx commented Apr 15, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

greptile-apps Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 15, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 15, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`