fix(deps): bump self_update to 1.3 to clear quick-xml advisories

[Svector-anu]

Automated dependency bump to address disclosed CVEs in a transitive dependency of self_update.

• CVE / Advisory: RUSTSEC-2026-0194, RUSTSEC-2026-0195
• Severity: high (CVSS 7.5, availability DoS)
• Package: self_update 0.44.0 → 1.3.0 (drops transitive quick-xml 0.38.4; remaining quick-xml usage is only 0.41.0 via plist / rattler_menuinst)

Why this works

self_update 1.x gates quick-xml behind the optional s3 feature. mise only uses the GitHub backend, so enabling github + the existing archive/signature features leaves the vulnerable 0.38 line out of the default graph. The July deny.toml ignores (#10717) can therefore be removed.

Verification

• Reproduced locally: yes
• Command: cargo tree -i quick-xml@0.38.4 (fails: package not present) / cargo tree -i quick-xml@0.41.0 / cargo check
• Before: self_update 0.44.0 → quick-xml 0.38.4 (RUSTSEC-2026-0194/0195)
• After: no quick-xml 0.38.4; only quick-xml 0.41.0
• Environment: rustc 1.98.0, cargo check clean on linux amd64

Detected by osv-scanner. Call-site edits follow the upstream 0.x → 1.0 migration guide (VersionStatus, release_tag, is_updated, Releases::latest).

Summary by CodeRabbit

• Bug Fixes
  • Improved the self-update process by adopting the latest update workflow.
  • Added support for GitHub releases and progress indicators during updates.
  • Updated release version handling for more reliable update checks.
  • Removed previously ignored security advisories from dependency auditing.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​self_update@​0.44.0 ⏵ 1.3.0	-3		+8

View full report

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 689e871b-8d19-4d9a-8050-a8ce559271e8

📥 Commits

Reviewing files that changed from the base of the PR and between 6ff7b1a and ed8e780.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Cargo.toml
• deny.toml
• src/cli/self_update.rs

💤 Files with no reviewable changes (1)

• deny.toml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The self-update dependency was upgraded to version 1. The implementation now uses VersionStatus, updated release APIs, and new feature names. Two advisory ignore entries were removed.

Changes

Self-update migration

Layer / File(s)	Summary
Update dependency features and advisory configuration Cargo.toml, deny.toml	The optional self_update dependency now uses version 1 features. The native-tls feature mapping was updated. Two advisory ignores were removed.
Migrate update status and release lookup src/cli/self_update.rs	The update flow now uses VersionStatus, is_updated(), latest(), version(), and release_tag(). Missing GitHub releases produce an explicit error.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to ed8e7

The update removes the vulnerable dependency and preserves the existing repository, archive, and signature-verification controls. It is mergeable with owner awareness that interruption, cleanup, and atomic replacement behavior in the upgraded self-update dependency should be confirmed.

Suggested reviewers: jdx, jambalaya56562, risu729

Poem

A rabbit checks the update trail
New status hops where old ones fail
Releases wear a fresher tag
Advisories leave the flag
Cargo packs the carrot cart

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the primary change: upgrading self_update to 1.3. It also states the purpose of removing quick-xml advisories.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR upgrades self_update from 0.44 to 1.3 and migrates mise’s self-update call sites to the new API, removing the vulnerable quick-xml 0.38 dependency and its advisory exceptions.

• Updates Unix and Windows archive, GitHub, progress, and TLS feature configuration.
• Adapts release selection, release-tag configuration, and update-status handling to self_update 1.x.
• Deduplicates related archive and signing dependencies in the lockfile.
• Removes obsolete quick-xml advisory ignores from deny.toml.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The dependency graph removes the vulnerable quick-xml version, the migrated feature combinations are covered by repository build configurations, and the self-update API changes preserve the existing release-tag, reporting, and signature-verification flow.

Important Files Changed

Filename	Overview
Cargo.toml	Upgrades self_update and configures the renamed archive and TLS features for supported Unix and Windows builds.
Cargo.lock	Resolves self_update 1.3.0, removes quick-xml 0.38.4, and deduplicates related ZIP and signing dependencies.
deny.toml	Removes the two quick-xml advisory exceptions after the affected dependency version leaves the graph.
src/cli/self_update.rs	Migrates release lookup, release-tag selection, and update-status checks to the self_update 1.x interfaces without an established regression.

_{Reviews (1): Last reviewed commit: "fix(deps): bump self_update to 1.3 to cl..." | Re-trigger Greptile}