[jdx]

https://entire.io/gh/jdx/mise/trails/724

cargo deny check now fails on rustls 0.23.45: its Debug impls for Tls12ClientSessionValue and Tls13ClientSessionValue print the TLS 1.2 master secret or TLS 1.3 resumption PSK (rustls/rustls#3299, fixed in 0.23.46). The advisory is not yet numbered (RUSTSEC-0000-0000). This makes trusted / lint red on every open PR.

mise does not format those values with Debug; the dependency path is the AWS SDK's HTTP client, so the exposure is limited to anything that would log a custom session store's values. The bump is a lockfile-only change (cargo update -p rustls --precise 0.23.46; it also moves rustls's getrandom dependency from 0.4.3 to 0.3.4), with no Cargo.toml change.

Validation: cargo check --bin mise builds. I could not run cargo deny locally (the shim has no installed version here), so CI's trusted / lint is the check.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: claude-code_2-1-295_agent.

🤖 Generated with Claude Code

---

Note

Low Risk
Patch-level TLS library upgrade with no application code changes; reduces secret-leak risk in debug output rather than changing runtime TLS behavior.

Overview
Bumps rustls from 0.23.45 to 0.23.46 in Cargo.lock only (no Cargo.toml edits), addressing a pending RustSec issue where Debug on TLS session types could leak the TLS 1.2 master secret or TLS 1.3 resumption PSK—fixing failing cargo deny / trusted / lint on PRs.

The lockfile refresh also pins tempfile’s transitive getrandom dependency to 0.3.4 instead of 0.4.3 as part of the same cargo update -p rustls resolution.

^{Reviewed by Cursor Bugbot for commit e74cbfd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

No reviewable files after applying ignore patterns.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 81400c12-f292-4a72-9102-74e18982d578

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▇▇█▂▅▅▆▄▁	27,717,813 → 27,693,008	-0.09%	19.73 → 19.36ms	-1.86%
hook-env	▅▃▇▇▅▁█▃▂	29,974,360 → 29,967,023	-0.02%	21.03 → 20.37ms	-3.12%
ls	▆▅█▃▄▇▆▃▁	31,895,068 → 31,876,496	-0.06%	21.93 → 21.58ms	-1.57%
registry	█▇▇▅▆█▆▆▁	40,028,122 → 39,959,283	-0.17%	17.78 → 17.83ms	+0.26%
startup	▅▂█▇▃▄▄▆▁	11,034,128 → 11,011,780	-0.20%	11.81 → 12.31ms	+4.26%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{e74cbfdb93b9 vs 22717299563d · measured on the runner, not pushed to the history.}