chore(deps): bump msrv for aws smithy updates by jdx · Pull Request #9295 · jdx/mise

jdx · 2026-04-22T13:20:16Z

Summary

bump the repo/package MSRV from Rust 1.88 to Rust 1.91 so the AWS Smithy stack can move forward
switch AWS dependencies to default-https-client and refresh the lockfile to remove the legacy rustls 0.21 / rustls-webpki 0.101.7 path
update COPR/PPA package build requirements and clean up stale cargo deny ignores

Why

cargo deny started failing on RUSTSEC-2026-0104 for two rustls-webpki lines.

The 0.103.x line could be updated in place, but the older 0.101.7 path was coming from the legacy AWS Smithy TLS client chain. The repo had been held at Rust 1.88, which prevented moving to the newer AWS Smithy releases needed to refresh that dependency graph.

I verified the current packaging targets first:

COPR builder image: Fedora 43 with rustc 1.94.1
CentOS Stream 9/10 base images (EPEL approximation): rust 1.94.1
Ubuntu resolute: rustc 1.93.1ubuntu1

So the active COPR/PPA targets already satisfy Rust 1.91+ and do not need to be dropped for this bump.

Changes

Cargo.toml
- bump rust-version to 1.91
- switch AWS crates to default-https-client
Cargo.lock
- refresh AWS Smithy/AWS runtime dependencies
- remove the legacy rustls 0.21 / rustls-webpki 0.101.7 path
- update rustls-webpki 0.103.12 -> 0.103.13
packaging/copr/build-copr.sh
- bump BuildRequires: rust >= 1.91
.github/workflows/ppa-publish.yml
- bump Debian rustc (>= 1.91) build dependency
deny.toml
- remove stale ignore entries for advisories no longer present after the dependency update

Validation

cargo deny check
cargo check --all-features
direct container checks of packaging environments:
- COPR image ghcr.io/jdx/mise:copr@sha256:90db6cd...
- quay.io/centos/centos:stream9
- quay.io/centos/centos:stream10
- ubuntu:resolute

This PR was generated by an AI coding assistant.

Note

Medium Risk
Primarily a dependency/toolchain bump, but it changes the AWS HTTP/TLS client stack and minimum compiler version, which can affect build/packaging and runtime networking behavior.

Overview
Bumps the project MSRV to Rust 1.91 and updates Linux packaging requirements to match (Debian PPA rustc (>= 1.91) and COPR BuildRequires: rust >= 1.91).

Updates AWS dependencies to use default-https-client and refreshes Cargo.lock to newer AWS Smithy/runtime crates, removing the legacy TLS dependency chain (including older rustls/rustls-webpki) and cleaning up now-unneeded cargo-deny advisory ignores.

^{Reviewed by Cursor Bugbot for commit 913507f. Bugbot is set up for automated code reviews on this repo. Configure here.}

gemini-code-assist

Code Review

This pull request updates the project's Rust version to 1.91 and performs a major cleanup of dependencies, consolidating versions for networking and AWS SDK crates while resolving several security advisories. Feedback focuses on several regressive downgrades in the Cargo.lock file for itertools, windows-sys, and base64 crates, which likely conflict with dependency requirements or introduce unnecessary version duplication.

gemini-code-assist · 2026-04-22T13:21:48Z

 "cexpr",
 "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.12.1",


The downgrade of itertools from 0.13.0 to 0.12.1 for bindgen 0.72.1 appears to be an error. bindgen 0.72.1 specifies a dependency on itertools 0.13. Forcing an older version in the lockfile will likely lead to compilation or resolution failures when cargo validates the graph. It is recommended to let cargo regenerate the lockfile automatically to ensure all version constraints are satisfied.

gemini-code-assist · 2026-04-22T13:21:48Z

 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.45.0",


The lockfile contains several suspicious downgrades of the windows-sys crate (e.g., from 0.61.2 to 0.45.0 for os_pipe). These changes are likely unintended and could break platform-specific functionality or introduce regressions. These should be reverted in favor of a standard cargo update which would maintain or advance these versions while satisfying the dependency graph.

gemini-code-assist · 2026-04-22T13:21:48Z

 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",


The base64 dependency for oauth2 is being downgraded from 0.22.1 to 0.21.7. Given that the workspace already explicitly depends on base64 0.22 in Cargo.toml, this downgrade creates unnecessary version duplication in the dependency graph and uses an older API. It should be kept at 0.22.x to maintain consistency.

greptile-apps · 2026-04-22T13:22:06Z

Greptile Summary

Bumps the MSRV from Rust 1.88 to 1.91 to unblock AWS Smithy dependency updates, switches aws-config and aws-sdk-s3 from the rustls feature to default-https-client, and refreshes the lockfile to eliminate the legacy rustls 0.21 / rustls-webpki 0.101.7 chain that was triggering RUSTSEC-2026-0104. Packaging specs (COPR and Debian PPA) and deny.toml ignores are updated accordingly. The changes are well-validated and the scope is appropriate for a dependency hygiene PR.

Confidence Score: 5/5

Safe to merge — well-scoped dependency hygiene with no logic changes and verified packaging targets.

All changes are mechanical: MSRV bump, AWS feature-flag rename, lockfile refresh, packaging spec updates, and removal of now-resolved advisory ignores. The PR author validated against all active packaging environments and ran cargo deny check and cargo check --all-features. No application logic is touched, and the lockfile confirms the old rustls 0.21 path is fully removed.

No files require special attention.

Important Files Changed

Filename	Overview
Cargo.toml	MSRV bumped 1.88→1.91; `aws-config` and `aws-sdk-s3` switched from `rustls` to `default-https-client` feature — clean and correct.
Cargo.lock	Lockfile refresh removes legacy `rustls 0.21.12`, `hyper-rustls 0.24.2`, `tokio-rustls 0.24.1`, and `rustls-webpki 0.103.12`; consistent with the `Cargo.toml` feature changes.
deny.toml	Removes three now-stale advisory ignores (RUSTSEC-2024-0436, RUSTSEC-2026-0098, RUSTSEC-2026-0099); the underlying crates are gone from the dependency graph after the lockfile refresh.
.github/workflows/ppa-publish.yml	Debian `Build-Depends` bumped from `rustc (>= 1.88)` to `rustc (>= 1.91)` — aligns with the new MSRV.
packaging/copr/build-copr.sh	RPM `BuildRequires` bumped from `rust >= 1.88` to `rust >= 1.91` — aligns with the new MSRV.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[aws-config / aws-sdk-s3] -->|feature: default-https-client| B[aws-smithy-http-client]
    B --> C[rustls 0.23.x]
    C --> D[rustls-webpki 0.103.13]

    E[OLD: aws-config / aws-sdk-s3] -->|feature: rustls| F[aws-smithy-http-client legacy]
    F --> G[rustls 0.21.12]
    G --> H[rustls-webpki 0.101.7]
    H -->|RUSTSEC-2026-0098/0099| X[⚠ Advisories]

    style E fill:#ffcccc
    style F fill:#ffcccc
    style G fill:#ffcccc
    style H fill:#ffcccc
    style X fill:#ff4444,color:#fff
    style A fill:#ccffcc
    style B fill:#ccffcc
    style C fill:#ccffcc
    style D fill:#ccffcc

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/rustls-webp..." | Re-trigger Greptile}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 15e17b2. Configure here.}

cursor · 2026-04-22T13:24:56Z

 ]
 build = "build.rs"
-rust-version = "1.88"
+rust-version = "1.91"


Renovate still blocks AWS SDK updates after MSRV bump

Medium Severity

The MSRV is bumped to 1.91 here, but .github/renovate.json still contains a rule with "enabled": false for aws-config and aws-sdk-* packages, with the description "AWS SDK requires MSRV 1.91.1, project is 1.88.0. Re-enable when MSRV is bumped." Since this PR bumps the MSRV (the exact condition the rule says to act on), the Renovate rule needs to be removed or re-enabled. Without that, future AWS SDK security patches and version updates will silently be suppressed by Renovate.

^{Reviewed by Cursor Bugbot for commit 15e17b2. Configure here.}

eh aws updates aggressively, it'll just break again

github-actions · 2026-04-22T13:39:16Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.18 x -- echo`	21.6 ± 0.7	20.9	35.0	1.00
`mise x -- echo`	22.1 ± 0.5	21.4	26.1	1.02 ± 0.04

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.18 env`	21.2 ± 0.6	20.3	27.5	1.00
`mise env`	21.6 ± 0.4	21.0	24.7	1.02 ± 0.04

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.18 hook-env`	21.8 ± 0.4	21.2	24.3	1.00
`mise hook-env`	22.2 ± 0.4	21.5	24.7	1.02 ± 0.03

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.18 ls`	19.1 ± 0.4	18.5	22.1	1.00
`mise ls`	19.7 ± 0.4	19.0	22.3	1.03 ± 0.03

`xtasks/test/perf`

Command	mise-2026.4.18	mise	Variance
install (cached)	142ms	146ms	-2%
ls (cached)	74ms	77ms	-3%
bin-paths (cached)	80ms	82ms	-2%
task-ls (cached)	808ms	793ms	+1%

socket-security · 2026-04-22T13:46:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/aws-config@1.8.13 ⏵ 1.8.14

View full report

## Summary - EPEL 9 / RHEL 9 ship rust below 1.91, so the spec's `BuildRequires: rust >= 1.91` (set after the MSRV bump in #9295) makes every `epel-9-aarch64` / `epel-9-x86_64` build fail at dependency resolution before `rpmbuild` ever runs. - Drop both `epel-9` chroots from the release event list and the `workflow_dispatch` default in `copr-publish.yml`. EPEL 10 stays — it has rust 1.91+. Example failure ([epel-9-aarch64 build 10411552](https://download.copr.fedorainfracloud.org/results/jdxcode/mise/epel-9-aarch64/10411552-mise/builder-live.log.gz)): > No matching package to install: 'rust >= 1.91' > Not all dependencies satisfied > Error: Some packages could not be found. The `epel-9-*` chroots may also want to be disabled in the COPR project's web settings to clean up the prior failed build state — that's outside this repo. ## Test plan - [ ] Next release-triggered (or manually dispatched) `copr-publish` run no longer attempts `epel-9-aarch64` / `epel-9-x86_64` - [ ] Fedora 42/43/44/rawhide and EPEL 10 builds still complete successfully 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk workflow-only change that just narrows the COPR build matrix; main risk is reduced build coverage for EPEL 9 rather than functional regressions. > > **Overview** > `copr-publish` no longer targets `epel-9-aarch64`/`epel-9-x86_64` by default. The workflow’s `workflow_dispatch` default `chroots` list and the release-triggered `CHROOTS` env now only include Fedora (rawhide/42-44) and `epel-10` chroots, avoiding EPEL 9 builds. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2ab1354. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

chore(deps): bump msrv for aws smithy updates

15e17b2

gemini-code-assist Bot reviewed Apr 22, 2026

View reviewed changes

cursor Bot reviewed Apr 22, 2026

View reviewed changes

Merge branch 'main' into fix/rustls-webpki-advisory

913507f

jdx merged commit e194f7e into main Apr 22, 2026
34 of 36 checks passed

jdx deleted the fix/rustls-webpki-advisory branch April 22, 2026 14:04

mise-en-dev mentioned this pull request Apr 22, 2026

chore: release 2026.4.19 #9258

Merged

jdx mentioned this pull request Apr 30, 2026

fix(copr): drop epel-9 chroots since rust >= 1.91 is unavailable #9484

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump msrv for aws smithy updates#9295

chore(deps): bump msrv for aws smithy updates#9295
jdx merged 2 commits intomainfrom
fix/rustls-webpki-advisory

jdx commented Apr 22, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Uh oh!

greptile-apps Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Apr 22, 2026

Uh oh!

jdx Apr 22, 2026

Uh oh!

github-actions Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Apr 22, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Changes

Validation

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 22, 2026

Choose a reason for hiding this comment

Renovate still blocks AWS SDK updates after MSRV bump

Uh oh!

jdx Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

socket-security Bot commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 22, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 22, 2026 •

edited

Loading

github-actions Bot commented Apr 22, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`