Repository navigation
fix(config): keep installed versions eligible with release age - #10973
Conversation
Entire-Checkpoint: b95657ff4295
📝 WalkthroughWalkthroughThe change makes installed-version release-date filtering explicit, configures it per CLI command, updates version-resolution fast paths, and adds end-to-end coverage and documentation for ChangesMinimum release age resolution
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CLICommand
participant ToolVersion
participant RemoteListing
CLICommand->>ToolVersion: resolve requested version with filtering mode
ToolVersion->>ToolVersion: evaluate installed-version fast path
ToolVersion-->>CLICommand: return installed match
ToolVersion->>RemoteListing: fetch versions when remote resolution is required
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 44064e4. Configure here.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/security.md`:
- Around line 47-48: Update the installed-version eligibility statement in the
security documentation to limit the exception to ordinary resolution. Clarify
that installed matches remain eligible during normal version selection, while
`mise lock` may re-check fuzzy installed matches against release metadata and
apply the minimum release age cutoff.
In `@e2e/cli/test_minimum_release_age_installed_resolution`:
- Around line 15-20: Update the test setup around the dummy spy plugin scripts
to replace or trap both list-all and latest-stable with marker-touching failing
scripts. Keep the existing cache reset and marker assertion behavior so any
remote metadata fetch is detected, including the latest_version_with_refresh
path.
In `@src/cli/lock.rs`:
- Around line 88-92: Update the fallback toolset construction in
config.get_toolset() to apply the same lock-specific ResolveOptions, including
filter_installed_versions_by_release_date. Build that branch through
ToolsetBuilder::new().with_resolve_options(lock_resolve_options.clone()),
preserving the existing before_date and other resolution settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: bd5f4e20-eb24-4326-b936-6de840a3f350
📒 Files selected for processing (9)
docs/security.mde2e/cli/test_minimum_release_age_installed_resolutione2e/cli/test_which_no_remote_fetche2e/cli/test_which_prefer_offlinesrc/cli/install.rssrc/cli/lock.rssrc/cli/upgrade.rssrc/cli/use.rssrc/toolset/tool_version.rs
Entire-Checkpoint: 25d437807ea3
Entire-Checkpoint: 1d093e17efa7
Greptile SummaryThis PR fixes a bug where
Confidence Score: 5/5Safe to merge — the change is well-scoped, defaults the new flag to The new No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "perf(lock): preserve cached toolset with..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 x -- echo |
19.9 ± 2.6 | 17.4 | 34.1 | 1.00 ± 0.15 |
mise x -- echo |
19.9 ± 1.7 | 18.0 | 47.7 | 1.00 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 env |
19.3 ± 1.0 | 17.3 | 23.5 | 1.00 |
mise env |
22.4 ± 3.0 | 18.4 | 30.3 | 1.16 ± 0.16 |
env measured 16% slower, but the relative uncertainty overlaps the 10% threshold. |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 hook-env |
19.9 ± 1.3 | 17.8 | 27.4 | 1.00 |
mise hook-env |
21.4 ± 1.2 | 18.8 | 28.3 | 1.07 ± 0.09 |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.5 ls |
17.7 ± 0.8 | 16.0 | 21.5 | 1.00 |
mise ls |
19.4 ± 1.2 | 17.0 | 24.0 | 1.10 ± 0.09 |
xtasks/test/perf
| Command | mise-2026.7.5 | mise | Variance |
|---|---|---|---|
| install (cached) | 170ms | 166ms | +2% |
| ls (cached) | 68ms | 70ms | -2% |
| bin-paths (cached) | 79ms | 77ms | +2% |
| task-ls (cached) | 153ms | 156ms | -1% |
Entire-Checkpoint: 724a2ea2ae1f
Summary
minimum_release_ageis configuredRoot cause
An explicit
minimum_release_agecutoff globally disabled installed-version fast paths. As a result, ordinary online resolution could select an older age-eligible remote release while offline/prefer-offline resolution and prune selected the latest installed release. This made the samelatestrequest resolve inconsistently and made prune appear to remove an active version.minimum_release_ageis an installation/discovery gate: an explicitly installed version remains eligible. Commands that intentionally discover versions (upgrade, install resolution,latest,ls-remote, and date-aware lock generation) continue to apply the cutoff to remote candidates.Addresses discussion #10944.
Validation
mise run lint-fixmise run test:unit(1,668 passed)mise run test:e2e test_minimum_release_age_installed_resolutionmise run test:e2e test_install_prefer_offline_no_refresh test_which_no_remote_fetch test_which_prefer_offlinemise run test:e2e e2e/cli/test_lock(target test passed)mise run test:e2e test_npm_install_beforeNote
Medium Risk
Changes central version resolution in
tool_version.rs, which affects most commands that resolve tools; behavior is narrowed with explicit opt-in for lockfile discovery and regression tests, but edge cases around fuzzy specs and release age remain possible.Overview
Fixes inconsistent behavior where an explicit
minimum_release_age(or built-in default cutoff) could skip installed-version fast paths, forcing remote lookups for fuzzy specs likelatestand making online resolution,mise which, andmise prunedisagree about the active version.Resolution now treats release age as a remote discovery gate:
ResolveOptionsaddsfilter_installed_versions_by_release_date(default off). Ordinary flows (install,use,upgrade, hook-env-style resolution) leave it false, so already-installed fuzzy matches stay eligible without re-checking release metadata.mise locksets it true and may rebuild the toolset when a release-age policy is configured, so lock generation can still pick age-eligible remote versions over a newer installed match.Docs in
docs/security.mdspell out that installed versions are not made inactive by the setting. E2E coverage addstest_minimum_release_age_installed_resolutionand adjusts lock / which regression tests.Reviewed by Cursor Bugbot for commit 02b677e. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
mise install,mise use, andmise upgradenow avoid release-age filtering for installed matches and reduce unnecessary remote lookups.mise lockcontinues to apply minimum release age filtering when selecting versions.