docs(security): clarify minimum release age support

[jdx]

Summary

• add a Security page for supply-chain controls
• move software verification and minimum release age guidance out of Tips & Tricks into Security
• clarify that minimum_release_age has two capability levels: top-level fuzzy version filtering and transitive dependency filtering
• document that only npm: and pipx: currently forward the cutoff to package-manager dependency resolution
• keep Tips & Tricks as short pointers to the Security page

Tests

• cargo test test_settings_toml_is_sorted
• mise run docs:build

This PR was generated by an AI coding assistant.

---

Note

Low Risk
Documentation-only changes with no runtime or configuration behavior changes.

Overview
Adds a dedicated Security docs page and links it from the Dev Tools sidebar. Software verification (aqua Cosign/SLSA/attestations, env toggles) and minimum release age guidance move out of Tips & Tricks into that page, with Tips & Tricks reduced to links.

minimum_release_age is documented as two separate capabilities: top-level fuzzy version filtering (backends with release timestamps) versus transitive dependency filtering during install, which only npm: and pipx: currently forward to the package manager. Other backends may pick an older tool version but do not age-filter installer-fetched dependencies. The same wording is aligned in mise-lock.md and the generated settings.toml docs for minimum_release_age.

^{Reviewed by Cursor Bugbot for commit 4159922. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

@jdx, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 37 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 089237ea-0d1b-4692-a32e-437df4e3ae23

📥 Commits

Reviewing files that changed from the base of the PR and between 7e0b436 and 4159922.

📒 Files selected for processing (5)

• docs/.vitepress/config.ts
• docs/dev-tools/mise-lock.md
• docs/security.md
• docs/tips-and-tricks.md
• settings.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/min-release-age-capabilities

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR adds a dedicated /security docs page consolidating supply-chain controls (software verification and minimum release age) that previously lived in Tips & Tricks, and clarifies the two-tier capability model for minimum_release_age across settings.toml, mise-lock.md, and the new page.

• New docs/security.md: structured with a capability table distinguishing top-level version filtering (many backends) from transitive dependency filtering (npm: and pipx: only), with per-tool override and exclusion examples, and links to backend-specific docs.
• settings.toml: rewrites the minimum_release_age description to enumerate the same capability tiers; a separate **Behavior** paragraph below the new bullets partially overlaps them (flagged in a prior review thread).
• docs/tips-and-tricks.md: Software Verification and Minimum Release Age sections are replaced with short redirects to /security; no content is lost.

Confidence Score: 5/5

Documentation-only changes with no runtime or configuration behavior modifications; safe to merge.

All changes are documentation: a new markdown page, sidebar nav entry, and rewrites of existing doc sections. No code paths, settings parsing, or runtime logic are touched. The capability descriptions match the existing runtime behavior as documented elsewhere in the codebase.

No files require special attention beyond the open threads on settings.toml (redundant paragraph) and docs/dev-tools/mise-lock.md (omitted backend list).

Important Files Changed

Filename	Overview
docs/security.md	New top-level Security page consolidating supply-chain controls; well-structured with a capability table, per-tool override examples, and proper internal links.
docs/.vitepress/config.ts	Adds Security link to the Dev Tools sidebar section; consistent with existing pattern of non-/dev-tools/ prefixed pages (e.g. /registry, /core-tools) placed in this section.
docs/dev-tools/mise-lock.md	Expands minimum_release_age description to separate top-level filtering from transitive dependency filtering; backend list is omitted here (covered in a previous review thread).
docs/tips-and-tricks.md	Replaces long Software Verification and Minimum Release Age sections with short pointers to the new Security page; no content is lost.
settings.toml	Rewrites minimum_release_age description to distinguish top-level vs transitive filtering; the new bullet list and the Behavior paragraph below it overlap (flagged in a previous review thread).

_{Reviews (3): Last reviewed commit: "docs(security): format minimum release a..." | Re-trigger Greptile}

[greptile-apps]

Backend list omitted here but present elsewhere

tips-and-tricks.md and settings.toml both now enumerate the backends that support top-level filtering (aqua:, cargo:, github:, gitlab:, go:, npm:, pipx:, and many core tools). This section only says "backends that provide release timestamps," which is less discoverable for readers who land on this page first. Keeping the backend list consistent across all three pages would help.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.1 x -- echo	22.0 ± 1.3	19.1	26.3	1.00
mise x -- echo	22.5 ± 2.2	18.9	46.4	1.03 ± 0.12

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.1 env	21.1 ± 1.3	18.8	26.1	1.00
mise env	21.7 ± 1.2	19.2	28.7	1.03 ± 0.08

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.1 hook-env	21.9 ± 1.2	19.7	28.6	1.00
mise hook-env	22.7 ± 1.4	20.2	28.9	1.04 ± 0.09

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.6.1 ls	18.0 ± 1.2	15.4	22.7	1.00
mise ls	18.0 ± 1.5	15.0	25.7	1.00 ± 0.11

xtasks/test/perf

Command	mise-2026.6.1	mise	Variance
install (cached)	143ms	142ms	+0%
ls (cached)	61ms	62ms	-1%
bin-paths (cached)	73ms	72ms	+1%
task-ls (cached)	134ms	135ms	+0%