From e9197d2900662289fe6a32ec50a99ca0d86a5ae9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:02:55 +0000 Subject: [PATCH 1/3] fix(mise): drop tools the registry cannot resolve and the invalid [alias] table mise warned on every cd into the repo: git, gofmt, cargo, go-task, gnu-sed/tar/grep, vitest and jest are not in the mise registry, and the [alias] table is deprecated and held command shortcuts rather than tool aliases. Runtimes that resolve, and the zig pin zig.yml asserts, are kept. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ --- mise.toml | 28 ++++++---------------------- 1 file changed, 6 insertions(+), 22 deletions(-) diff --git a/mise.toml b/mise.toml index 2bb8e171..716f2e3f 100644 --- a/mise.toml +++ b/mise.toml @@ -1,8 +1,8 @@ [tools] # Language runtimes node = "latest" -rust = "latest" -go = "latest" +rust = "latest" # provides cargo, rustfmt and clippy +go = "latest" # provides gofmt zig = "0.16.0" # pinned; .github/workflows/zig.yml asserts this equals ZIG_VERSION java = "latest" bun = "latest" @@ -11,11 +11,8 @@ bun = "latest" npm = "latest" yarn = "latest" pnpm = "latest" -cargo = "latest" -go-task = "latest" # Formatting & Linting -gofmt = "latest" prettier = "latest" shfmt = "latest" stylua = "latest" @@ -25,24 +22,11 @@ cmake = "latest" make = "latest" ninja = "latest" -# Shell tools -git = "latest" -gnu-sed = "latest" -gnu-tar = "latest" -gnu-grep = "latest" - -# Testing -vitest = "latest" -jest = "latest" +# Not listed on purpose: git, GNU sed/tar/grep (system tools), go-task, vitest +# and jest. None resolves in the mise registry, so listing them made mise warn +# on every `cd` into the repo. The command shortcuts that used to sit under +# [alias] were never tool aliases; `just --list` is the task entry point. [env] # Common environment variables NODE_ENV = "development" - -# Task runner alias -[alias] -task = "go-task" -build = "cargo build --release || npm run build || go build" -test = "cargo test || npm test || go test ./..." -lint = "prettier --check ." -fmt = "prettier --write ." From 43c26234d083210c880b8020539251d472513e3e Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 20:41:41 +0000 Subject: [PATCH 2/3] fix(ci): add cargo-deny policy and update locked dependencies --- Cargo.lock | 58 ++++++++++++++++++++++-------------------------------- deny.toml | 46 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+), 34 deletions(-) create mode 100644 deny.toml diff --git a/Cargo.lock b/Cargo.lock index 9d44e46d..6b7e3904 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -71,7 +71,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -82,7 +82,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -484,9 +484,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -625,7 +625,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -642,15 +642,6 @@ dependencies = [ "tokio-util", ] -[[package]] -name = "concurrent-queue" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" -dependencies = [ - "crossbeam-utils", -] - [[package]] name = "config" version = "0.15.25" @@ -824,9 +815,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" dependencies = [ "crossbeam-utils", ] @@ -1029,7 +1020,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1147,7 +1138,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1162,11 +1153,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ] @@ -1445,9 +1435,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.15" +version = "0.4.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" +checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118" dependencies = [ "atomic-waker", "bytes", @@ -2356,7 +2346,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -2861,9 +2851,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.16" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "aws-lc-rs", "bytes", @@ -3208,14 +3198,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", @@ -3266,7 +3256,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3612,7 +3602,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3763,7 +3753,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3773,7 +3763,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874" dependencies = [ "rustix", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -4550,7 +4540,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] diff --git a/deny.toml b/deny.toml new file mode 100644 index 00000000..3d600a87 --- /dev/null +++ b/deny.toml @@ -0,0 +1,46 @@ +# SPDX-License-Identifier: MPL-2.0 +# Keep this policy in the repository so CI does not generate a legacy schema. + +[advisories] +db-urls = ["https://github.com/rustsec/advisory-db"] +# Vulnerabilities are denied by default. Keep maintenance checks enabled, with +# explicit exceptions for the two existing, non-blocking maintenance warnings. +unmaintained = "all" +yanked = "warn" +ignore = [ + { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is transitive through tabled_derive; no patched release. Retain the existing maintenance warning policy; cargo audit still reports it." }, + { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is transitive through serde_yaml; no patched release. A YAML parser migration needs separate compatibility testing; cargo audit still reports this maintenance warning." }, +] + +[licenses] +# Unlicensed crates and licenses outside this list are denied by default. +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Zlib", + "CC0-1.0", + "MPL-2.0", + "Unicode-DFS-2016", + # Current ICU crates use the successor to Unicode-DFS-2016. + "Unicode-3.0", +] +# Restrict the additional permissive licenses to their existing consumers. +exceptions = [ + { crate = "webpki-roots", allow = ["CDLA-Permissive-2.0"] }, + { crate = "webpki-root-certs", allow = ["CDLA-Permissive-2.0"] }, + { crate = "xxhash-rust", allow = ["BSL-1.0"] }, +] + +[bans] +multiple-versions = "warn" +wildcards = "warn" +highlight = "all" + +[sources] +unknown-registry = "deny" +unknown-git = "warn" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] From 302947ef44060f259f5f794a6ba83f5dbf0c9542 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:59:27 +0000 Subject: [PATCH 3/3] revert: drop CodeRabbit autofix (Cargo.lock, deny.toml) from the mise change Out of scope for a mise.toml-only fix: it adds a deny.toml that conflicts with the one on main and rewrites Cargo.lock. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ --- Cargo.lock | 58 ++++++++++++++++++++++++++++++++---------------------- deny.toml | 46 ------------------------------------------- 2 files changed, 34 insertions(+), 70 deletions(-) delete mode 100644 deny.toml diff --git a/Cargo.lock b/Cargo.lock index 6b7e3904..9d44e46d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -71,7 +71,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -82,7 +82,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -484,9 +484,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.2" +version = "0.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" +checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -625,7 +625,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -642,6 +642,15 @@ dependencies = [ "tokio-util", ] +[[package]] +name = "concurrent-queue" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" +dependencies = [ + "crossbeam-utils", +] + [[package]] name = "config" version = "0.15.25" @@ -815,9 +824,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.21" +version = "0.9.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" +checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" dependencies = [ "crossbeam-utils", ] @@ -1020,7 +1029,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -1138,7 +1147,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -1153,10 +1162,11 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.2" +version = "5.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" +checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" dependencies = [ + "concurrent-queue", "parking", "pin-project-lite", ] @@ -1435,9 +1445,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.20" +version = "0.4.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118" +checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155" dependencies = [ "atomic-waker", "bytes", @@ -2346,7 +2356,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -2851,9 +2861,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.19" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "aws-lc-rs", "bytes", @@ -3198,14 +3208,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] name = "rustls" -version = "0.23.46" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -3256,7 +3266,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -3602,7 +3612,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -3753,7 +3763,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -3763,7 +3773,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874" dependencies = [ "rustix", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -4540,7 +4550,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] diff --git a/deny.toml b/deny.toml deleted file mode 100644 index 3d600a87..00000000 --- a/deny.toml +++ /dev/null @@ -1,46 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Keep this policy in the repository so CI does not generate a legacy schema. - -[advisories] -db-urls = ["https://github.com/rustsec/advisory-db"] -# Vulnerabilities are denied by default. Keep maintenance checks enabled, with -# explicit exceptions for the two existing, non-blocking maintenance warnings. -unmaintained = "all" -yanked = "warn" -ignore = [ - { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is transitive through tabled_derive; no patched release. Retain the existing maintenance warning policy; cargo audit still reports it." }, - { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml is transitive through serde_yaml; no patched release. A YAML parser migration needs separate compatibility testing; cargo audit still reports this maintenance warning." }, -] - -[licenses] -# Unlicensed crates and licenses outside this list are denied by default. -allow = [ - "MIT", - "Apache-2.0", - "Apache-2.0 WITH LLVM-exception", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "CC0-1.0", - "MPL-2.0", - "Unicode-DFS-2016", - # Current ICU crates use the successor to Unicode-DFS-2016. - "Unicode-3.0", -] -# Restrict the additional permissive licenses to their existing consumers. -exceptions = [ - { crate = "webpki-roots", allow = ["CDLA-Permissive-2.0"] }, - { crate = "webpki-root-certs", allow = ["CDLA-Permissive-2.0"] }, - { crate = "xxhash-rust", allow = ["BSL-1.0"] }, -] - -[bans] -multiple-versions = "warn" -wildcards = "warn" -highlight = "all" - -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"]