[jdx]

Summary

Groundwork for embedding aube's library crates in mise (first aube-registry for npm metadata/installs, potentially resolver/store/linker later — see jdx/mise#11147). Two things blocked that today: the declared MSRV, and workspace-level cargo features that leak global build side effects into any embedding binary.

MSRV: 1.93 → 1.91

mise's MSRV is pinned to 1.91 by its distro packaging (Debian PPA, Fedora COPR), and cargo's MSRV-aware resolver silently falls back to aube-registry 1.0.0-beta.2 when a 1.91 project adds the dependency. The whole workspace already compiles and tests cleanly on 1.91 — the 1.93 declaration was incidental from init, not a real requirement. The existing cargo msrv verify step in CI enforces the new floor automatically.

Feature hygiene: TLS / DNS / zlib backends move from workspace to leaf

Cargo features unify across the final binary, so workspace-wide choices became the embedder's choices too:

• reqwest/hickory-dns flips the default DNS resolver for every reqwest client in the host binary (hickory_dns: cfg!(feature = "hickory-dns") in reqwest's builder) — in mise's case that would silently change DNS behavior for its own HTTP plus rattler/gix/sigstore internals.
• reqwest/rustls forces a second TLS stack into the host build even when the embedder never constructs an aube client.
• flate2/zlib-ng forces libz-ng-sys (cmake + C toolchain) onto every cross-compile target of the embedder.

None of these are code dependencies of the library crates (the rustls ClientSessionStore wiring lives in the bin crate; libs only use TLS-generic reqwest APIs), so they're now selected at the edges:

• workspace reqwest drops rustls/hickory-dns; aube-registry gains features default = ["rustls", "hickory-dns"] plus a standalone rustls — standalone aube behavior is unchanged via defaults, embedders use default-features = false, features = ["rustls"] (a compile_error! fires if rustls is off)
• rustls stays the only TLS backend per the CLAUDE.md policy (no OpenSSL / native-tls); embedders disabling defaults just re-enable rustls to keep hickory-dns out of their build
• aube-util gains a matching rustls forward (default empty) and its webpki-root-fallback helper compiles to a no-op without it
• build_http_client now pins rustls explicitly (use_rustls_tls()) instead of relying on reqwest's default selection, which silently becomes native-tls if an embedder's other deps pull reqwest's native-tls feature in — that would mismatch the rustls client-cert Identity and session-ticket wiring
• workspace flate2 moves to rust_backend; the aube binary re-enables zlib-ng, and feature unification makes the C backend win for the whole standalone aube build, so no perf change

Verified

• cargo check/test on the full workspace with defaults (stable + 1.91): behavior-identical, aube binary tree still contains hickory-dns, rustls, and libz-ng-sys
• Embed shape cargo check/test -p aube-registry --no-default-features --features rustls: passes (227 registry unit tests), tree contains zero hickory/libz-ng entries
• openssl / native-tls / hyper-tls: 0 entries in Cargo.lock; cargo deny check bans passes
• --no-default-features alone fails fast with the intended compile_error!

Suggested CI addition (couldn't push workflow changes — token lacks workflow scope)

To keep the embed shape from regressing, add to test-linux after the cargo msrv step:

      # The library shape mise embeds: no default features, rustls-only,
      # no hickory-dns, no zlib-ng. Keeps that build from silently
      # regressing when features or deps change.
      - run: cargo check -p aube-registry --no-default-features --features rustls

This PR was generated by an AI coding assistant (Claude Code).

[coderabbitai]

Warning

Review limit reached

@jdx, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ae63d2af-14c0-41cb-a32c-9121a116082e

📥 Commits

Reviewing files that changed from the base of the PR and between e7adb3f and a3a24a0.

📒 Files selected for processing (7)

• Cargo.toml
• crates/aube-registry/Cargo.toml
• crates/aube-registry/src/client/http.rs
• crates/aube-registry/src/lib.rs
• crates/aube-util/Cargo.toml
• crates/aube-util/src/http/mod.rs
• crates/aube/Cargo.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

[greptile-apps]

Greptile Summary

This PR lowers the workspace MSRV from 1.93 to 1.91 and moves TLS, DNS, and compression backend choices off the workspace so embedding aube-registry in another binary (e.g. mise) does not force rustls, hickory-dns, or libz-ng-sys into the host's dependency graph via Cargo feature unification.

• MSRV 1.93 → 1.91: rust-version is lowered in the workspace Cargo.toml with a comment anchoring it to mise's distro-packaging constraint; CI's cargo msrv verify step continues to enforce the floor. CLAUDE.md was not updated and still declares msrv: 1.93 in two places (see comment on Cargo.toml).
• Feature hygiene: Workspace reqwest drops rustls/hickory-dns; aube-registry gains a [features] section with default = [\"rustls\", \"hickory-dns\"], a compile_error! guard when neither TLS backend is active, and explicit use_rustls_tls() to prevent silent native-tls fallback; aube-util forwards the rustls feature and makes with_webpki_root_fallback a no-op without it.
• Compression: Workspace flate2 switches to rust_backend; the aube binary re-adds zlib-ng, so feature unification keeps the fast C backend for standalone builds while embedders see only the pure-Rust backend.

Confidence Score: 4/5

Safe to merge for standalone aube builds; the one gap is CLAUDE.md still advertising 1.93 as the MSRV, which will mislead contributors and AI assistants into thinking 1.93-only features are safe to use.

The Cargo feature wiring is correct and well-tested. The only real gap is that CLAUDE.md still says msrv 1.93 in two places after the 1.91 change, creating a contradiction that could silently re-introduce 1.93-only features in future PRs and break cargo msrv verify in CI.

CLAUDE.md (not in the diff) needs its two msrv: 1.93 references updated; Cargo.toml is where the rust-version change lives and is the best place to catch this omission.

Important Files Changed

Filename	Overview
Cargo.toml	MSRV lowered 1.93→1.91 with clear rationale; workspace reqwest drops rustls/hickory-dns; flate2 moves to rust_backend. CLAUDE.md not updated to match the new MSRV (see comment).
crates/aube-registry/Cargo.toml	Adds [features] with default=["rustls","hickory-dns"], plus individual rustls/hickory-dns forwards. No native-tls added; CLAUDE.md TLS policy is respected. Feature wiring is correct.
crates/aube-registry/src/client/http.rs	Adds explicit use_rustls_tls() to prevent silent native-tls fallback; gates hickory_dns behind #[cfg(feature="hickory-dns")]; extracts client_identity helper using from_pem (rustls-only, PKCS#8+PKCS#1). Logic is sound and well-commented.
crates/aube-registry/src/lib.rs	Adds compile_error! guard enforcing the rustls feature is active, giving embedders a clear build-time error instead of a runtime failure. Correct and minimal.
crates/aube-util/Cargo.toml	Adds [features] with rustls=["reqwest/rustls"]. webpki-root-certs remains an unconditional dep, causing unnecessary compilation when rustls is off (see comment).
crates/aube-util/src/http/mod.rs	with_webpki_root_fallback correctly compiles to a no-op when rustls feature is absent; cfg conditions are proper De Morgan complements. No issues.
crates/aube/Cargo.toml	Re-enables flate2/zlib-ng at the binary level only; feature unification ensures the fast C backend wins for the standalone aube build while library crates stay on rust_backend. Correct.

_{Reviews (2): Last reviewed commit: "refactor(registry): drop native-tls, kee..." | Re-trigger Greptile}