mise manager pins cargo: tools to =x.y.z, which mise cannot resolve

[cffnpwr]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.280.0 (Mend-hosted app, taken from the renovate-debug metadata of the PR linked below). Also reproduced locally with the self-hosted CLI 43.150.0.

Please tell us more about your question or problem

Minimal reproduction: https://github.com/cffnpwr/renovate-repro-mise-cargo-pin

Current behavior

For cargo: backend tools in mise.toml, Renovate pins with Cargo dependency requirement syntax:

 [tools]
-"cargo:flip-link" = "0.1.12"
+"cargo:flip-link" = "=0.1.12"

The version field of a mise tool is not a Cargo dependency requirement, and mise does not support =-prefixed semver ranges there. After such a pin PR is merged, mise can no longer resolve the tool (mise 2026.7.16):

$ mise ls --current
mise WARN  semver range "=0.1.12" is not supported for cargo:flip-link (source: mise.toml); use a concrete version or version prefix
cargo:flip-link  =0.1.12 (missing)  mise.toml  =0.1.12

$ mise latest "cargo:flip-link@=0.1.12"
mise WARN  semver range "=0.1.12" is not supported for cargo:flip-link (source: command argument); use a concrete version or version prefix

The second command prints no version: =0.1.12 is treated as a single opaque version string and matches nothing in the remote version list. On the mise side, the warning comes from src/toolset/tool_request.rs, and range filtering is only applied to versions coming from a package.json idiomatic version file (src/toolset/tool_version.rs), so the value is used verbatim for every other source.

Why it happens

1. lib/modules/manager/mise/backends.ts — createCargoToolConfig() returns { packageName, datasource: crate } and sets no versioning
2. lib/modules/datasource/crate/index.ts — override defaultVersioning = cargoVersioning.id
3. lib/modules/versioning/cargo/index.ts — getPinnedValue(newVersion) returns `=${newVersion}`

=x.y.z is the correct pinned form for a Cargo.toml dependency requirement, but not for a mise tool version.

Expected behavior

No pin PR at all, because 0.1.12 is already an exact version as far as mise is concerned, and later updates simply rewrite the plain version string.

Setting a versioning that treats a bare 0.1.12 as a single version (e.g. semver) on cargo: deps in the mise manager achieves this: the pin branch in lib/workers/repository/process/lookup/index.ts only runs when !versioningApi.isSingleVersion(compareValue), and afterwards rangeStrategy falls back to replace. Versions published to crates.io must be three-part SemVer (https://doc.rust-lang.org/cargo/reference/manifest.html#the-version-field), so semver fits the crate datasource here.

Related

• Discussion Mise Cargo dependencies with exact versions (`=x.y.z`) don't parse #44054 reports the same pin diff together with a TypeError: Invalid Version: =0.1.4 crash. PR fix(manager/mise): skip non-pinned lockedVersion from lock file #44022 (still open) makes the manager skip a non-pinned lockedVersion from mise.lock, which stops that crash, but it does not change the value Renovate writes into mise.toml, so the problem above remains.

Workaround

{
  "packageRules": [
    {
      "matchManagers": ["mise"],
      "matchDatasources": ["crate"],
      "versioning": "semver"
    }
  ]
}

Logs (if relevant)

Logs

DEBUG: packageFiles with updates (repository=local)
       "config": {
         "mise": [
           {
             "deps": [
               {
                 "depName": "cargo:flip-link",
                 "currentValue": "0.1.12",
                 "packageName": "flip-link",
                 "datasource": "crate",
                 "updates": [
                   {
                     "updateType": "pin",
                     "isPin": true,
                     "newValue": "=0.1.12",
                     "newVersion": "0.1.12",
                     "newMajor": 0,
                     "branchName": "renovate/pin-dependencies"
                   }
                 ],
                 "versioning": "cargo",
                 "warnings": [],
                 "sourceUrl": "https://github.com/knurling-rs/flip-link",
                 "registryUrl": "sparse+https://index.crates.io",
                 "dependencyUrl": "https://crates.io/crates/flip-link",

[RahulGautamSingh]

Thanks for the detailed, finding. I will be happy to review a PR with the versioning switch solution you proposed.

[cffnpwr]

Thanks. I've opened #44966, which sets versioning: semver on cargo: backend tools using the crate datasource.