[oxoxDev]

Summary

Moves the tinystoragedrivers git dependency from bf1f0a97fbe6 to 19be64111fbe (tinystoragedrivers #88, "fix(deps): move zstd to 0.14.3"), the smallest commit containing the fix. This clears RUSTSEC-2026-0391 (zstd < 0.14.3) and RUSTSEC-2026-0398 / RUSTSEC-2026-0403 (zstd-safe < 8.2.0), which fail the module-ci / supply-chain cargo-deny check on every branch, including #157. No advisory ignores are added.

Dependency path: dev/test-only. zstd arrives through tinystoragedrivers-connect / -document, reached from tinymcp via the tinystoragedrivers-testkit dev-dependencies.

Related issue

None. Unblocks the supply-chain check on #157.

API or behavior changes

None. Dev/test dependency pin only; no source changes. tinystoragedrivers-* stays at 2.1.1.

Cargo.lock changes: the 12 tinystoragedrivers-* entries re-pinned bf1f0a97fbe6 -> 19be64111fbe; zstd 0.13.3 -> 0.14.3; zstd-safe 7.3.0 -> 8.2.0. No other lock churn.

Validation

Commands actually run, with their outcome:

• cargo fmt --all -- --check (exit 0)
• cargo clippy --workspace --all-targets --all-features -- -D warnings (exit 0)
• cargo build --workspace --all-targets --all-features (exit 0)
• cargo test --workspace --all-features (exit 0, 1787 passed, 0 failed)
• cargo deny check all (exit 0: advisories ok, bans ok, licenses ok, sources ok; the existing RUSTSEC-2026-0367/0368/0369 ignores now print "advisory not detected" warnings, left untouched)

Tests

No tests added or changed; the existing suite passes against the new pin.

Documentation

Not needed; no documented behavior changes.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

🤖 Generated with Claude Code

https://claude.ai/code/session_01MiwnTYiLyeqebY2Bq7S1Vc

Summary by CodeRabbit

• Chores
  • Updated the underlying storage components to a newer revision. No user-facing behavior changes are included in this update.

[tinysweeper]

Tiny Sweeper review

Reviewed head: dc9bdd3df0f1d7f892ac6e48392ae0d93e3f0c35

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: Cargo.lock.
Pull request purpose (title): fix(deps): move tiny…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(deps): move tinystoragedrivers to the zstd 0.14.3 fix (RUSTSEC-2026-0391/0398/0403). Tiny Sweeper completed its review; deterministic results follow.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The root `Cargo.toml` now pins six `tinystoragedrivers-*` git dependencies (`-api`, `-types`, `-busproxy`, `-testkit`, `-document`, `-secrets`) to rev `19be64111fbecb4b11f3752432a0356029a83328` instead of `bf1f0a97fbe6165a6edd9521659c7f6859700761`, while leaving the git URL, `version = "2.1.1"`, and the existing feature flags (`default-features = false, features = ["memory"]` on `tinystoragedrivers-document`) unchanged. The effect is that the workspace resolves the tinystoragedrivers crates — and, through their transitive dev/test dependency path, zstd/zstd-safe — to the newer revision intended to carry the zstd 0.14.3 fix, clearing the cited advisories without adding advisory ignores. The description also records matching `Cargo.lock` re-pins of the 12 `tinystoragedrivers-*` entries plus `zstd` 0.13.3 -> 0.14.3 and `zstd-safe` 7.3.0 -> 8.2.0. Because the dependency path is dev/test-only per the description, no production API or runtime behavior is claimed to change.

Features

• Modified — tinystoragedrivers git dependency revision bump in Cargo.toml: The six `tinystoragedrivers-*` git dependency entries in the root manifest are re-pinned to rev `19be64111fbecb4b11f3752432a0356029a83328`, moving the workspace onto the revision the description says contains the zstd 0.14.3 fix. Repository URL, `version = "2.1.1"`, caret-range style, and existing feature flags are retained, so the set of crates and enabled features is unchanged; per the description this is a dev/test-only dependency path with no source or API behavior change. (Cargo.toml futures-util = { version = "0.3", default-features = false, features = ["std"] }, Cargo.toml)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The critique lane is Answered and reported that the manifest edit is internally consistent: only the pinned `rev` changes while `version = "2.1.1"` and the existing feature/default-features flags are kept, the crate set and placement are unchanged, and no defect introduced by this change was found. It noted that the new pinned revision itself could not be inspected.
• Lane summary: The diff is a mechanical update of six `tinystoragedrivers-*` git dependency entries in the root `Cargo.toml`, changing only the pinned `rev` (plus keeping the `version = "2.1.1"` and the existing feature/default-features flags). The set of crates, their feature flags, and their placement are unchanged, so I found no defect this change introduces; I could not inspect the new pinned revision itself, but the manifest edit is internally consistent. _The code index is behind this pull request (indexed at `00bb929a2604`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane is Answered and reported no security issue introduced by this diff: no new dependency, feature, build script, or code path is added, the repository URL, version, feature flags, and caret-range style are unchanged, and the revision being moved to is not in the tree, so what changed inside that crate cannot be reviewed here.
• Lane summary: The diff only repins seven `tinystoragedrivers-*` git dependencies in the root `Cargo.toml` from rev `bf1f0a97fbe6165a6edd9521659c7f6859700761` to rev `19be64111fbecb4b11f3752432a0356029a83328`, keeping the same repository URL, version, feature flags, and caret-range style. No new dependency, feature, build script, or code path is introduced by this file, so there is no attacker-controlled input or widened permission to evaluate. The revision being moved to is not in the tree, so what changed inside that crate cannot be reviewed here — but nothing in this diff is itself a defect. _The code index is behind this pull request (indexed at `00bb929a2604`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane is Answered and reported no sensitive content in the committed files it could see.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `00bb929a2604`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane is Answered and reported that the description's claim of a dev/test dependency revision bump with no source changes matches the diff: the pins are refreshed consistently throughout `Cargo.toml` and the entries carrying `default-features = false, features = ["memory"]` retain that shape, with no defect found in the diff.
• Lane summary: The change repins the six tinystoragedrivers git dependencies in the root Cargo.toml from bf1f0a97fbe6 to 19be64111fbe, which matches the description's claim that only a dev/test dependency revision is bumped and no source changes are made; the refreshed pins are consistent throughout Cargo.toml, and the two manifest entries with `default-features = false, features = ["memory"]` retain that shape. I found no defect in the diff. _The code index is behind this pull request (indexed at `00bb929a2604`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.004429
• Tokens: 83799 input · 2705 output · 13568 cached · 137 embedding
• Updated: 2026-10-28T09:47:03Z

Head	State	Pass summary
dc9bdd3df0f1	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-28T09:47:03Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 076dd3aa-88b7-4d5d-9866-202a068c32bd

Commits

Reviewing files that changed from the base of the PR and between b211f24 and dc9bdd3.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

All six tinystoragedrivers workspace dependencies now pin revision 19be64111fbecb4b11f3752432a0356029a83328. Their versions and dependency settings are unchanged.

Changes: Dependency revision update

Layer / File(s)	Summary
Update dependency revision Cargo.toml	All six tinystoragedrivers dependencies now pin revision 19be64111fbecb4b11f3752432a0356029a83328 instead of bf1f0a97fbe6165a6edd9521659c7f6859700761. Versions and dependency settings are unchanged.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Possibly related PRs

• tinyhumansai/tinymcp#154: Pins the same six dependencies to the previous revision; this PR updates those pins.

Suggested reviewers: senamakel

Merge Risk: Minimal · up to dc9bd

No actionable merge-blocking risk remains from this dependency-only update.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the dependency revision and its purpose: adopting the tinystoragedrivers commit that contains the zstd 0.14.3 security fix.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each pinned line,
Six revisions now align.
The version settings stay the same,
One newer hash completes the change.
I nibble clover, pleased to see,
The manifest is tidy.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0044