Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughVersion bump from ChangesRelease 2026.6.10
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryStandard release bump from
Confidence Score: 5/5Routine release commit; all version strings are consistent and the registry changes come from the upstream aqua-registry. All changes are mechanical version bumps or vendored upstream registry updates. No logic changes, no new code paths in mise itself, and the registry YAML edits look structurally sound (version constraints chain correctly, checksums are present for the new cdxgen package, and the ghcup-hs Windows extension follows the existing pattern used by other packages). No files require special attention. Important Files Changed
Reviews (9): Last reviewed commit: "chore: release 2026.6.10" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - type: github_release | ||
| repo_owner: CycloneDX | ||
| repo_name: cdxgen | ||
| description: Creates CycloneDX Bill of Materials (BOM) from source code and container images | ||
| version_constraint: "false" | ||
| version_overrides: | ||
| - version_constraint: semver("< 11.5.0") | ||
| error_message: The version is too old. Please use a version 11.5.0 or higher. | ||
| - version_constraint: semver("<= 11.9.0") | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | ||
| checksum: | ||
| type: github_release | ||
| asset: "{{.Asset}}.sha256" | ||
| algorithm: sha256 | ||
| - version_constraint: semver("<= 12.0.0") | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | ||
| checksum: | ||
| type: github_release | ||
| asset: "{{.Asset}}.sha256" | ||
| algorithm: sha256 | ||
| supported_envs: | ||
| - linux | ||
| - darwin/arm64 | ||
| - windows | ||
| - version_constraint: "true" | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl |
There was a problem hiding this comment.
The PR description adds CycloneDX/cdxgen as a new aqua registry package but does not include its GitHub star count. Per the team's review rule, new registry tool additions must include the GitHub star popularity count in the PR description so low-popularity tools can be screened before merging.
Rule Used: What: new registry tools must include the github s... (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@vendor/aqua-registry/metadata.json`:
- Line 3: The "tag" field in the metadata.json file contains an incorrect commit
hash that only updates anomalyco/opencode instead of the packages specified in
the PR objectives. Replace the current tag value with the correct commit hash
that actually contains the expected changes to CycloneDX/cdxgen,
aquaproj/registry-tool, and haskell/ghcup-hs. Verify the commit hash by checking
which commit includes all the package updates mentioned in the PR goals before
updating.
In `@vendor/aqua-registry/registry.yml`:
- Around line 46734-46745: The Windows downloads for GHCup fail because the URL
template for the file at line 46734 does not include the `.exe` file extension
that is required by the Haskell downloads server. The current `windows: mingw64`
replacement at line 46743 generates the stem `x86_64-mingw64-ghcup-<version>`,
but the actual Windows executable file is `x86_64-mingw64-ghcup-<version>.exe`.
Add a Windows-specific URL override in the registry configuration that appends
the `.exe` extension to the filename for Windows builds, or modify the template
structure to conditionally include `.exe` for Windows platforms while keeping
other operating systems unchanged.
- Around line 2419-2452: The Windows asset for cdxgen is currently resolved as
cdxgen-windows-amd64, but the upstream binary is named cdxgen-windows-amd64.exe.
Add a Windows-specific asset override in the overrides section of each version
constraint block (for semver("<= 11.9.0"), semver("<= 12.0.0"), and "true") in
the vendor/aqua-registry/registry.yml file, similar to the existing Linux musl
overrides. Each override should specify goos: windows and transform the asset
name from cdxgen-{{.OS}}-{{.Arch}} to cdxgen-{{.OS}}-{{.Arch}}.exe so that the
correct binary name and its .sha256 checksum file are located during Windows
installations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 311b41d1-df15-477b-a8bd-a63daa5e6980
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (12)
CHANGELOG.mdCargo.tomlREADME.mdcompletions/_misecompletions/mise.bashcompletions/mise.fishcompletions/mise.ps1default.nixpackaging/rpm/mise.specsnapcraft.yamlvendor/aqua-registry/metadata.jsonvendor/aqua-registry/registry.yml
| - version_constraint: semver("<= 11.9.0") | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | ||
| checksum: | ||
| type: github_release | ||
| asset: "{{.Asset}}.sha256" | ||
| algorithm: sha256 | ||
| - version_constraint: semver("<= 12.0.0") | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | ||
| checksum: | ||
| type: github_release | ||
| asset: "{{.Asset}}.sha256" | ||
| algorithm: sha256 | ||
| supported_envs: | ||
| - linux | ||
| - darwin/arm64 | ||
| - windows | ||
| - version_constraint: "true" | ||
| asset: cdxgen-{{.OS}}-{{.Arch}} | ||
| format: raw | ||
| overrides: | ||
| - goos: linux | ||
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | ||
| checksum: | ||
| type: github_release | ||
| asset: "{{.Asset}}.sha256" | ||
| algorithm: sha256 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
base="https://github.com/cdxgen/cdxgen/releases/download/v12.3.1"
for asset in cdxgen-windows-amd64 cdxgen-windows-amd64.exe; do
code="$(curl -fsSIL -o /dev/null -w '%{http_code}' "$base/$asset" || true)"
printf '%s -> %s\n' "$asset" "$code"
doneRepository: jdx/mise
Length of output: 179
🏁 Script executed:
# Verify the file exists and check line count
wc -l vendor/aqua-registry/registry.yml
# Check the specific lines mentioned in the review (2419-2452)
sed -n '2419,2452p' vendor/aqua-registry/registry.ymlRepository: jdx/mise
Length of output: 1109
🏁 Script executed:
# Also verify the src/backend/aqua.rs behavior mentioned
sed -n '714,749p' src/backend/aqua.rsRepository: jdx/mise
Length of output: 1582
Add a Windows-specific asset override for cdxgen.
Lines 2420, 2430, and 2444 resolve the Windows asset as cdxgen-windows-amd64, but upstream documents the standalone Windows binary as cdxgen-windows-amd64.exe. Because src/backend/aqua.rs:714-749 uses this registry asset template directly when picking the per-platform download and checksum, Windows installs will miss both the binary and its {{.Asset}}.sha256 sidecar.
🔧 Suggested fix
- version_constraint: semver("<= 11.9.0")
asset: cdxgen-{{.OS}}-{{.Arch}}
format: raw
overrides:
- goos: linux
asset: cdxgen-{{.OS}}-{{.Arch}}-musl
+ - goos: windows
+ asset: cdxgen-{{.OS}}-{{.Arch}}.exe
checksum:
type: github_release
asset: "{{.Asset}}.sha256"
algorithm: sha256
- version_constraint: semver("<= 12.0.0")
asset: cdxgen-{{.OS}}-{{.Arch}}
format: raw
overrides:
- goos: linux
asset: cdxgen-{{.OS}}-{{.Arch}}-musl
+ - goos: windows
+ asset: cdxgen-{{.OS}}-{{.Arch}}.exe
checksum:
type: github_release
asset: "{{.Asset}}.sha256"
algorithm: sha256
supported_envs:
- linux
- darwin/arm64
- windows
- version_constraint: "true"
asset: cdxgen-{{.OS}}-{{.Arch}}
format: raw
overrides:
- goos: linux
asset: cdxgen-{{.OS}}-{{.Arch}}-musl
+ - goos: windows
+ asset: cdxgen-{{.OS}}-{{.Arch}}.exe
checksum:
type: github_release
asset: "{{.Asset}}.sha256"
algorithm: sha256📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - version_constraint: semver("<= 11.9.0") | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 | |
| - version_constraint: semver("<= 12.0.0") | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 | |
| supported_envs: | |
| - linux | |
| - darwin/arm64 | |
| - windows | |
| - version_constraint: "true" | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 | |
| - version_constraint: semver("<= 11.9.0") | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| - goos: windows | |
| asset: cdxgen-{{.OS}}-{{.Arch}}.exe | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 | |
| - version_constraint: semver("<= 12.0.0") | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| - goos: windows | |
| asset: cdxgen-{{.OS}}-{{.Arch}}.exe | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 | |
| supported_envs: | |
| - linux | |
| - darwin/arm64 | |
| - windows | |
| - version_constraint: "true" | |
| asset: cdxgen-{{.OS}}-{{.Arch}} | |
| format: raw | |
| overrides: | |
| - goos: linux | |
| asset: cdxgen-{{.OS}}-{{.Arch}}-musl | |
| - goos: windows | |
| asset: cdxgen-{{.OS}}-{{.Arch}}.exe | |
| checksum: | |
| type: github_release | |
| asset: "{{.Asset}}.sha256" | |
| algorithm: sha256 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@vendor/aqua-registry/registry.yml` around lines 2419 - 2452, The Windows
asset for cdxgen is currently resolved as cdxgen-windows-amd64, but the upstream
binary is named cdxgen-windows-amd64.exe. Add a Windows-specific asset override
in the overrides section of each version constraint block (for semver("<=
11.9.0"), semver("<= 12.0.0"), and "true") in the
vendor/aqua-registry/registry.yml file, similar to the existing Linux musl
overrides. Each override should specify goos: windows and transform the asset
name from cdxgen-{{.OS}}-{{.Arch}} to cdxgen-{{.OS}}-{{.Arch}}.exe so that the
correct binary name and its .sha256 checksum file are located during Windows
installations.
| url: https://downloads.haskell.org/~ghcup/{{trimV .Version}}/{{.Arch}}-{{.OS}}-ghcup-{{trimV .Version}} | ||
| format: raw | ||
| windows_arm_emulation: true | ||
| link: https://www.haskell.org/ghcup/ | ||
| description: GHCup is an installer for the general purpose language Haskell | ||
| replacements: | ||
| arm64: aarch64 | ||
| amd64: x86_64 | ||
| darwin: apple-darwin | ||
| windows: mingw64 | ||
| files: | ||
| - name: ghcup |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
base="https://downloads.haskell.org/~ghcup/0.2.5.0"
for asset in x86_64-mingw64-ghcup-0.2.5.0 x86_64-mingw64-ghcup-0.2.5.0.exe; do
code="$(curl -fsSIL -o /dev/null -w '%{http_code}' "$base/$asset" || true)"
printf '%s -> %s\n' "$asset" "$code"
doneRepository: jdx/mise
Length of output: 195
🏁 Script executed:
cd vendor/aqua-registry && cat -n registry.yml | sed -n '46720,46760p'Repository: jdx/mise
Length of output: 1777
🏁 Script executed:
cd vendor/aqua-registry && git log --oneline -20 -- registry.ymlRepository: jdx/mise
Length of output: 86
🏁 Script executed:
cd vendor/aqua-registry && git show 19cf60d3 -- registry.yml | grep -A 20 -B 5 'ghcup-hs' | head -50Repository: jdx/mise
Length of output: 931
🏁 Script executed:
cd vendor/aqua-registry && git show HEAD~1:registry.yml 2>/dev/null | grep -A 15 'ghcup-hs' || echo "Previous version not found or ghcup-hs not in previous version"Repository: jdx/mise
Length of output: 115
The .exe suffix is required for Windows downloads; the current replacement produces a 404.
The windows: mingw64 replacement on line 46743 combined with the URL template on line 46734 generates x86_64-mingw64-ghcup-<version>, but the Haskell downloads server publishes x86_64-mingw64-ghcup-<version>.exe. This breaks Windows artifact downloads. Add a Windows-specific URL override or include .exe in the template for Windows builds.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@vendor/aqua-registry/registry.yml` around lines 46734 - 46745, The Windows
downloads for GHCup fail because the URL template for the file at line 46734
does not include the `.exe` file extension that is required by the Haskell
downloads server. The current `windows: mingw64` replacement at line 46743
generates the stem `x86_64-mingw64-ghcup-<version>`, but the actual Windows
executable file is `x86_64-mingw64-ghcup-<version>.exe`. Add a Windows-specific
URL override in the registry configuration that appends the `.exe` extension to
the filename for Windows builds, or modify the template structure to
conditionally include `.exe` for Windows platforms while keeping other operating
systems unchanged.
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.9 x -- echo |
19.7 ± 1.0 | 17.8 | 25.1 | 1.00 |
mise x -- echo |
20.4 ± 1.6 | 18.4 | 49.3 | 1.04 ± 0.10 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.9 env |
19.1 ± 0.9 | 17.6 | 24.9 | 1.00 |
mise env |
20.0 ± 1.0 | 18.2 | 24.9 | 1.05 ± 0.07 |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.9 hook-env |
19.9 ± 0.9 | 18.1 | 23.2 | 1.00 |
mise hook-env |
20.4 ± 0.9 | 18.7 | 24.1 | 1.03 ± 0.07 |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.6.9 ls |
16.7 ± 0.9 | 15.3 | 22.3 | 1.00 |
mise ls |
17.8 ± 1.0 | 15.9 | 21.8 | 1.06 ± 0.08 |
xtasks/test/perf
| Command | mise-2026.6.9 | mise | Variance |
|---|---|---|---|
| install (cached) | 134ms | 135ms | +0% |
| ls (cached) | 59ms | 60ms | -1% |
| bin-paths (cached) | 64ms | 65ms | -1% |
| task-ls (cached) | 125ms | 125ms | +0% |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@vendor/aqua-registry/metadata.json`:
- Line 3: The tag in metadata.json points to commit
d14115e2f7bacf0323e58ea623266b3424783075, which only updates the k0sproject/k0s
package and does not include the required updates for CycloneDX/cdxgen,
aquaproj/registry-tool, and haskell/ghcup-hs as specified in the PR objectives.
Replace the tag value with the commit hash that contains all the necessary
package updates across all four packages (k0sproject/k0s, CycloneDX/cdxgen,
aquaproj/registry-tool, and haskell/ghcup-hs) to align with the PR requirements.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2d83820d-0ddc-4e98-8c01-cf41c98643bd
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (12)
CHANGELOG.mdCargo.tomlREADME.mdcompletions/_misecompletions/mise.bashcompletions/mise.fishcompletions/mise.ps1default.nixpackaging/rpm/mise.specsnapcraft.yamlvendor/aqua-registry/metadata.jsonvendor/aqua-registry/registry.yml
✅ Files skipped from review due to trivial changes (7)
- snapcraft.yaml
- packaging/rpm/mise.spec
- completions/mise.fish
- README.md
- Cargo.toml
- completions/mise.ps1
- CHANGELOG.md
🚧 Files skipped from review as they are similar to previous changes (3)
- completions/mise.bash
- default.nix
- vendor/aqua-registry/registry.yml
| { | ||
| "repository": "aquaproj/aqua-registry", | ||
| "tag": "4e1e686b8558cf90e8c6fe326e15a75cda30d2b2" | ||
| "tag": "d14115e2f7bacf0323e58ea623266b3424783075" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify the aqua-registry commit contains the expected package changes.
echo "=== Checking commit existence and message ==="
gh api repos/aquaproj/aqua-registry/commits/d14115e2f7bacf0323e58ea623266b3424783075 --jq '.sha, .commit.message' 2>&1
echo -e "\n=== Files changed in this commit ==="
gh api repos/aquaproj/aqua-registry/commits/d14115e2f7bacf0323e58ea623266b3424783075 --jq '.files[].filename' 2>&1
echo -e "\n=== Checking for cdxgen package ==="
gh api repos/aquaproj/aqua-registry/contents/pkgs/CycloneDX/cdxgen/registry.yaml?ref=d14115e2f7bacf0323e58ea623266b3424783075 --jq '.name, .size' 2>&1 || echo "cdxgen not found"
echo -e "\n=== Checking for registry-tool package ==="
gh api repos/aquaproj/aqua-registry/contents/pkgs/aquaproj/registry-tool/registry.yaml?ref=d14115e2f7bacf0323e58ea623266b3424783075 --jq '.name, .size' 2>&1 || echo "registry-tool not found"
echo -e "\n=== Checking for ghcup-hs package ==="
gh api repos/aquaproj/aqua-registry/contents/pkgs/haskell/ghcup-hs/registry.yaml?ref=d14115e2f7bacf0323e58ea623266b3424783075 --jq '.name, .size' 2>&1 || echo "ghcup-hs not found"Repository: jdx/mise
Length of output: 561
Commit d14115e2f7bacf0323e58ea623266b3424783075 contains incorrect package updates.
The commit only modifies pkgs/k0sproject/k0s/pkg.yaml and updates the k0sproject/k0s package, not the packages mentioned in the PR objectives. The commit message confirms this: "chore: update k0sproject/k0s v1.35.4+k0s.0 to v1.36.1+k0s.0". Expected changes to CycloneDX/cdxgen, aquaproj/registry-tool, and haskell/ghcup-hs are not present in this commit.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@vendor/aqua-registry/metadata.json` at line 3, The tag in metadata.json
points to commit d14115e2f7bacf0323e58ea623266b3424783075, which only updates
the k0sproject/k0s package and does not include the required updates for
CycloneDX/cdxgen, aquaproj/registry-tool, and haskell/ghcup-hs as specified in
the PR objectives. Replace the tag value with the commit hash that contains all
the necessary package updates across all four packages (k0sproject/k0s,
CycloneDX/cdxgen, aquaproj/registry-tool, and haskell/ghcup-hs) to align with
the PR requirements.
mise-en-dev
force-pushed
the
release
branch
5 times, most recently
from
2ad0dbb to
aaa2c52
Compare
2 participants
🚀 Features
🐛 Bug Fixes
📦️ Dependency Updates
Chore
📦 Aqua Registry Updates
New Packages (1)
CycloneDX/cdxgenUpdated Packages (2)
aquaproj/registry-toolhaskell/ghcup-hs