Some Aqua installs issuing noisy 403 warnings, perhaps for some latest usages

[chadlwilson]

Has something changed with the Aqua backend or how updates are checked for?

Previously cleanly working Aqua registry tool installs/upgrades are logging noisy 403s (even for unrelated actions) while looking at a Mise-specific Github-related API.

WARN  mise-versions endpoint=github_release repo=aws/session-manager-plugin tag=latest outcome=failed status=403 fallback=true error="HTTP status client error (403 Forbidden) for url (https://mise-versions.jdx.dev/api/github/repos/aws/session-manager-plugin/releases/latest)"

I can't see anything in release notes that explains this, but the warnings also have no call-to-action and tell the user nothing about the consequences of the warning. It "looks" like it cannot check for updates as a result - but who knows? When you run with DEBUG or VERBOSE you can see it does seem to be able to get the versions directly from Github API so I'm not sure?

https://github.com/aquaproj/aqua-registry/blob/67b6483daa337d6b0300ad86da686d7cc3110b25/pkgs/aws/session-manager-plugin/registry.yaml#L13

Doesn't seem to have a problem with aqua:getgauge/gauge, however.

$ MISE_DEBUG=1 mise install aqua:aws/session-manager-plugin@latest
DEBUG Version: 2026.6.2 macos-arm64 (2026-06-09)
DEBUG ARGS: /opt/homebrew/bin/mise install aqua:aws/session-manager-plugin@latest
DEBUG [vfox] Getting metadata for ant
DEBUG [vfox] Getting metadata for chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for yarn
DEBUG config: ~/.config/mise/config.toml
DEBUG [vfox] Getting metadata for ant
DEBUG [vfox] Getting metadata for chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for yarn
DEBUG config: ~/.config/mise/config.toml
DEBUG [aqua:aws/session-manager-plugin@1.2.814.0] list_bin_paths: ["/Users/chad/.local/share/mise/installs/aqua-aws-session-manager-plugin/1.2/sessionmanager-bundle/bin"]
DEBUG Backend aws-cli does not provide release dates; release-date filter may not work as expected
DEBUG Backend python does not provide release dates; release-date filter may not work as expected
DEBUG [vfox] Getting metadata for ant
DEBUG [vfox] Getting metadata for chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for vfox-mise-plugins-vfox-chromedriver
DEBUG [vfox] Getting metadata for yarn
DEBUG config: ~/.config/mise/config.toml
DEBUG Backend python does not provide release dates; release-date filter may not work as expected
DEBUG Backend aws-cli does not provide release dates; release-date filter may not work as expected
DEBUG GET https://mise-versions.jdx.dev/api/github/repos/aws/session-manager-plugin/releases/latest
DEBUG GET https://mise-versions.jdx.dev/api/github/repos/aws/session-manager-plugin/releases/latest 403 Forbidden
WARN  mise-versions endpoint=github_release repo=aws/session-manager-plugin tag=latest outcome=failed status=403 fallback=true error="HTTP status client error (403 Forbidden) for url (https://mise-versions.jdx.dev/api/github/repos/aws/session-manager-plugin/releases/latest)"
DEBUG GET https://api.github.com/repos/aws/session-manager-plugin/releases/latest
DEBUG GET https://api.github.com/repos/aws/session-manager-plugin/releases/latest 200 OK
DEBUG Getting env keys for ant version 1.10.17
DEBUG [vfox] Getting metadata for ant
DEBUG [vfox:ant] env_keys
DEBUG Getting env keys for chromedriver version 115.0.5763.0
DEBUG [vfox] Getting metadata for chromedriver
DEBUG [vfox:chromedriver] env_keys
DEBUG Getting env keys for yarn version 1.22.22
DEBUG [vfox] Getting metadata for yarn
DEBUG [vfox:yarn] env_keys
DEBUG updating 1 lockfiles

At DEBUG level there are also a whole lot of noisy release-filter-related debug lines implying it's confused about what a backend is?

DEBUG Backend aws-cli does not provide release dates; release-date filter may not work as expected
DEBUG Backend python does not provide release dates; release-date filter may not work as expected

aws-cli, python etc are not backends, right? They are plugins in the default backend via mise's own registry?

[chadlwilson]

This is basically the same as #10284 so will close it.

[jdx]

Thanks for the detailed debug output. I opened #10341 for this.

There were two related issues here:

• 2026.6.2 had the GitHub-backend guard that skips mise-versions for non-registry tools, but Aqua still had a separate latest_marked_release_version() path calling the unguarded GitHub release helper. That is why aqua:aws/session-manager-plugin@latest still queried https://mise-versions.jdx.dev/api/github/repos/aws/session-manager-plugin/releases/latest before falling back to GitHub.
• The warning hid the response body, so users saw only 403 Forbidden instead of the useful service message: GitHub repo is not in the mise registry. The PR includes a capped response body in these fallback warnings.

With the PR, Aqua GitHub release metadata lookups go directly to GitHub, and I verified the reported path with MISE_DEBUG=1 cargo run --quiet -- latest aqua:aws/session-manager-plugin: it hits api.github.com directly and returns 1.2.814.0 without a mise-versions request.

This comment was generated by an AI coding assistant.

[jdx]

Correction on the PR direction: the fix should not remove mise-versions from Aqua globally. Registry-backed Aqua tools still need the shared host to avoid unauthenticated GitHub rate limits.

I amended #10341 so Aqua release metadata is now registry-aware:

• act / shorthand mise-registry Aqua backend still uses mise-versions
• aqua:aws/session-manager-plugin / fully qualified non-registry Aqua backend skips mise-versions, because the client can tell locally that the service will reject it as not in the mise registry
• warnings from actual mise-versions failures are still shown, now with a capped response body

Verified with debug smoke tests for both paths.

This comment was generated by an AI coding assistant.