[jdx]

https://entire.com/gh/jdx/mise/trails/1022

Three e2e tests on main fail since the security fixes landed together. #14901 now rejects a tool version that starts with /, or that contains template or shell characters, while parsing arguments. Some assertions added by #14896 and #14897 expected each backend's own, later error for those same inputs. The inputs are still refused; only the message changed.

This updates the tests so they keep proving the inputs are refused and have no side effects, and keeps each backend's own check covered:

• test_npm_registry_version_spec: an absolute path accepts either refusal. A new npm:left-pad@./payload case passes the general version check and still reaches the npm backend's "not a version, range or dist-tag" check. The test also asserts that nothing was installed.
• test_ruby_build_runs_outside_project: an absolute path accepts either refusal. A new ruby@./jruby-9.4.5.0 case, naming a file planted in the project, still gets ruby's "a build definition name cannot be a path" and never reaches ruby-build.
• test_upgrade_bump_template_version: the exec() version is now refused at install, before anything is written. The test checks that mise.toml is unchanged, that the payload never ran and that nothing was installed. A second tool offers 2.0.0{{env.…}}, which has template syntax but no forbidden characters, so the config-write check is still what refuses it, for both upgrade --bump and use --pin.

These three tests, plus test_resolved_version_path_safety, pass on this branch. No Rust code changed.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: 2.1.308.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Expanded coverage for invalid npm versions, including absolute and relative paths, and verified rejected inputs do not result in matching installations.
  • Added checks for version-list templates containing executable expressions, confirming failed bump or pin operations leave configuration unchanged and do not write rendered content or install matching packages.
  • Added Ruby build-path rejection checks for relative and absolute paths, including verification that rejected paths are not sourced or passed to ruby-build.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: jdx/mise
• Branch: fix/e2e-after-security-merges
• File: .coderabbit.yaml
• Commit: e2efa21
• Layers: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1561afa1-0272-404e-b67b-61221da64eb8

📥 Commits

Reviewing files that changed from the base of the PR and between 43cbeff and e2efa21.

📒 Files selected for processing: 3

• e2e/backend/test_npm_registry_version_spec
• e2e/cli/test_upgrade_bump_template_version
• e2e/core/test_ruby_build_runs_outside_project

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The end-to-end tests now cover path-like version rejection in npm and Ruby, and template-version handling in upgrade and pin commands. They also check that rejected inputs do not cause specified installs, sourcing, or config changes.

Changes: Version validation coverage

Layer / File(s)	Summary
Path-like version rejection e2e/backend/test_npm_registry_version_spec, e2e/core/test_ruby_build_runs_outside_project	The tests check rejection of absolute and relative paths. They verify that matching npm installs are absent, the Ruby project file remains unsourced, and the relative path is not passed to ruby-build.
Template versions in bump and pin commands e2e/cli/test_upgrade_bump_template_version	The tests check exec() and version-valid template entries with mise upgrade --bump and mise use --pin. They verify the expected errors and that config contents, rendered markers, and matching installs remain unchanged or absent.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• jdx/mise#14901: Moves resolved-version validation into argument parsing and adds backend checks for unsafe versions. This PR updates related npm, Ruby, and template-version tests.
• jdx/mise#14896: Adds the original npm and Ruby path-like version checks that this PR updates.

Merge Risk: ⚪ Minimal · up to e2efa

No actionable issue is identified in the updated version-validation tests; the change is mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating end-to-end test expectations after version validation moved earlier.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This test-only PR appears safe to merge.

Summary

Updates three end-to-end tests for version checks that now reject unsafe inputs earlier.

• The npm and Ruby tests keep checking where bad paths are refused.
• Version-list bump tests cover template refusals at both validation stages.

No actionable issues found. Review was based on code inspection; tests were not run.

_{Reviews (1) · Last reviewed commit: "test: update e2e expectations after vers..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▁▁▁▁▁▁██	31,961,791 → 31,918,263	-0.14%	21.26 → 21.09ms	-0.81%
hook-env	▁▁▁▁▁▂██	34,240,399 → 34,217,914	-0.07%	22.10 → 22.36ms	+1.18%
ls	▁▁▁▁▁▂██	36,382,511 → 36,360,240	-0.06%	23.26 → 23.35ms	+0.36%
registry	▂▃▁▁▃▅█▂	43,981,947 → 43,858,614	-0.28%	18.86 → 19.31ms	+2.41%
startup	▂▁▂▁▄█▃▂	12,117,477 → 12,101,803	-0.13%	12.90 → 13.01ms	+0.85%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{e2efa2135cb9 vs 43cbeff80abb · measured on the runner, not pushed to the history.}