[M3gA-Mind]

Summary

Moves every tinystoragedrivers pin from 29471a1 (2.1.1) to the v2.1.2 release, tag commit 6226b9484c8bd01c58741718cd89ba90a13a36bb on its main. v2.1.2 is a version-only release on top of tinystoragedrivers#88 (19be641), which moves its workspace zstd to 0.14.3, which clears RUSTSEC-2026-0391 (zstd 0.13.3) and RUSTSEC-2026-0398 / RUSTSEC-2026-0403 (zstd-safe 7.3.0) from this workspace's lock.

In tinyflows, zstd was a dev-only dependency. It is reached only through tinystoragedrivers-testkit → -document / -connect → zstd, and all four crates take testkit under [dev-dependencies]. cargo tree -i zstd -e normal,build prints nothing, so the shipped module never linked it. The advisories only showed up in cargo deny.

• crates/tinyflows-{adaptive,drivers,module,storage}/Cargo.toml: 15 pins, version = "2.1.1" / rev 29471a1 → version = "2.1.2" / rev 6226b94. tinybus-sdk stays on 6ce06bc, the same rev v2.1.2 uses.
• Cargo.lock:
  • The 11 tinystoragedrivers packages move to 2.1.2 at ?rev=6226b94….
  • zstd 0.13.3 → 0.14.3 and zstd-safe 7.3.0 → 8.2.0 (zstd-sys was already 2.1.2).

API Or Behavior Changes

None. The zstd frame format is unchanged, and no tinyflows source changed.

Tests

Run on a remote runner (not in GitHub CI), at the final lock:

• Lock regenerated with cargo update -p zstd@0.13.3, then cargo update -p tinystoragedrivers-api for v2.1.2. Net change against main: the 11 tsd packages plus zstd and zstd-safe; nothing else moved
• cargo check --locked --workspace --all-targets --all-features: exit 0
• cargo tree --locked -i zstd / -i zstd-safe (all features, -e normal,build,dev): only zstd 0.14.3 / zstd-safe 8.2.0
• cargo tree --locked -i zstd -e normal,build: nothing to print (dev-only)
• cargo fmt --check, clippy, build, test: GitHub CI

Documentation

Not needed: dependency pin only.

[tinysweeper]

Tiny Sweeper review

Reviewed head: bc8e9dc84d5407e29306f975a422e4b71234331b

Findings

No active actionable findings.

Advisory notes

• medium: Correct the rev and version stated in the PR body ((pull request description))
  Problem: The body says every pin moves `29471a1` → `19be641` and that "The tsd crates stay at version 2.1.1." The diff does neither: all 15 pins use `rev = "6226b9484c8bd01c58741718cd89ba90
  Suggested fix:
  No concrete fix was supplied.

Verdict: Ready for maintainer review · Priority: medium
Coverage: Reviewed 4 of 5 files; not reviewed: Cargo.lock.

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(deps): pin tinystoragedrivers at 19be641 (zstd 0.14.3). The description states every tinystoragedrivers pin moves from 29471a1 to 19be641 to pick up zstd 0.14.3 and clear three RUSTSEC advisories, and that the tsd crates stay at version 2.1.1. The manifests instead move the rev to 6226b9484c8bd01c58741718cd89ba90a13a36bb and raise the version requirement to 2.1.2 across all 15 pins at crates/tinyflows-adaptive/Cargo.toml#thiserror = "2", crates/tinyflows-drivers/Cargo.toml#store = [, crates/tinyflows-module/Cargo.toml#crate-type = ["rlib", "cdylib"] and crates/tinyflows-storage/Cargo.toml#publish = false. The critique, security and commits lanes answered with no findings; the description lane answered raising one finding that the diff contradicts the description, and noted the Cargo.lock changes described in the body are not present in the diff. The latest-push delta is not available.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	1
Documentation	0	Resolved findings	0
Configuration	4	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

All four manifests change the tinystoragedrivers-api, -types, -testkit and -busproxy git pins (at crates/tinyflows-adaptive/Cargo.toml#thiserror = "2", crates/tinyflows-drivers/Cargo.toml#store = [, crates/tinyflows-module/Cargo.toml#crate-type = ["rlib", "cdylib"] and crates/tinyflows-storage/Cargo.toml#publish = false) from rev 29471a164619bcec03e5858a7d7ee0c65f52bf22 / version 2.1.1 to rev 6226b9484c8bd01c58741718cd89ba90a13a36bb / version 2.1.2. The title and description instead claim a move to 19be641 with the tsd crates staying at 2.1.1, so the stated purpose does not match the manifests. The optional and dev-dependency structure otherwise stays the same.

Features

• Modified — tinystoragedrivers pins moved to rev 6226b948 and version 2.1.2: The manifests point at 6226b948 and require 2.1.2 on all 15 pins, contradicting the title and body, which say the pins move to 19be641 and stay at tsd version 2.1.1; the intended rev/version is unverified. (crates/tinyflows-adaptive/Cargo.toml thiserror = "2", crates/tinyflows-drivers/Cargo.toml store = [, crates/tinyflows-module/Cargo.toml crate-type = ["rlib", "cdylib"], crates/tinyflows-storage/Cargo.toml publish = false)
• Modified — tinyflows-adaptive optional and dev tinystoragedrivers pins: The optional api/types entries and the dev-dependency api/types/testkit entries all move to rev 6226b948 with version 2.1.2; the feature gate still activates the optional deps. (crates/tinyflows-adaptive/Cargo.toml tinyflows = { path = "../tinyflows", features = ["store", "mock"] })
• Modified — tinyflows-storage dev-dependency tinystoragedrivers pins: Testkit and busproxy dev-dependencies move to rev 6226b948 with version 2.1.2; the crate keeps its non-published status. (crates/tinyflows-storage/Cargo.toml ulid = "1", crates/tinyflows-storage/Cargo.toml publish = false)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with no findings for the manifest changes.
• Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `8b57d2dc43e8`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with no findings.
• Lane summary: Reviewed 4 files; 0 findings. _The code index is behind this pull request (indexed at `8b57d2dc43e8`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered and reported no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `8b57d2dc43e8`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The description does not match the diff. It claims the pins move from `29471a1` to `19be641` and that the tsd crates stay at version 2.1.1, but every changed line bumps the rev to `6226b9484c8bd01c58741718cd89ba90a13a36bb` and the version requirement to 2.1.2. The Cargo.lock changes the body describes are also absent from the diff. I cannot verify which rev/version is the intended one, so I am flagging the mismatch rather than the pins themselves. _The code index is behind this pull request (indexed at `8b57d2dc43e8`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.002404
• Tokens: 273783 input · 4024 output · 207104 cached · 197 embedding
• Updated: 2026-10-27T16:00:48Z

Head	State	Pass summary
5fd48e2c9e0f	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T15:35:20Z)
8b57d2dc43e8	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T15:51:28Z)
bc8e9dc84d54	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T16:00:48Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f1ad73e7-8931-4f5c-91cf-051d13afb83d

Commits

Reviewing files that changed from the base of the PR and between 91df965 and 5fd48e2.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 4

• crates/tinyflows-adaptive/Cargo.toml
• crates/tinyflows-drivers/Cargo.toml
• crates/tinyflows-module/Cargo.toml
• crates/tinyflows-storage/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Four Cargo manifests now pin their tinystoragedrivers dependencies to revision 19be64111fbecb4b11f3752432a0356029a83328. Dependency versions, optionality, and feature wiring remain unchanged.

Changes: Storage driver revision pins

Layer / File(s)	Summary
Update dependency revision pins crates/tinyflows-adaptive/Cargo.toml, crates/tinyflows-drivers/Cargo.toml, crates/tinyflows-module/Cargo.toml, crates/tinyflows-storage/Cargo.toml	Runtime, optional, and development dependencies now use the new revision. Their versions and dependency wiring remain unchanged.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related issues

• tinyhumansai/openhuman#8427: The issue identifies inconsistent tinystoragedrivers revision pins, and this change updates the tinyflows pins.

Possibly related PRs

• tinyhumansai/tinyflows#180: Updates the same dependencies from version 2.1.0 to 2.1.1, preceding this revision pin change.
• tinyhumansai/tinyflows#182: Changes the same four manifests and tinystoragedrivers revision pins.

Suggested reviewers: tinysweeper

Merge Risk: Minimal · up to 5fd48

No merge-blocking risk is evident from this dependency revision update.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title identifies the dependency pin update and the zstd 0.14.3 change. It is related to the main changes, although the PR states that tinystoragedrivers remains at version 2.1.1 rather than v2.1.2…

Full details: Title check

Explanation

The title identifies the dependency pin update and the zstd 0.14.3 change. It is related to the main changes, although the PR states that tinystoragedrivers remains at version 2.1.1 rather than v2.1.2.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each Cargo line,
The driver pins now match in time.
Four manifests join the trail,
Old revisions leave the file.
Hop, the new hash lands in place.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0001