[M3gA-Mind]

Moves the workspace zstd dependency from 0.13 to 0.14.3, which clears RUSTSEC-2026-0391 (zstd 0.13.3) and RUSTSEC-2026-0398 / RUSTSEC-2026-0403 (zstd-safe 7.3.0). tinystoragedrivers-document uses zstd unconditionally and tinystoragedrivers-connect uses it under sqlite, so every consumer, openhuman included, currently ships the vulnerable versions.

• Cargo.toml: zstd = { version = "0.14.3", default-features = false }. No code changes. The four calls used here (encode_all, decode_all, bulk::compress, bulk::decompress) have identical signatures in 0.14.3.
• Root Cargo.lock: zstd 0.13.3 → 0.14.3, zstd-safe 7.3.0 → 8.2.0, zstd-sys 2.1.1 → 2.1.2. The regen also re-pointed 8 Windows-only dependency edges (errno, quinn-udp, rustix, rustls-platform-verifier, socket2, tempfile, uds_windows, winapi-util) from windows-sys 0.52.0/0.60.2 to the 0.61.2 already in the lock. No windows-sys package was added, removed or bumped.
• proof-workspaces/{document-callback,storage-callback}/Cargo.lock: zstd 0.13.3 → 0.14.3, zstd-safe 7.3.0 → 8.2.0.

Checks, run on a remote runner:

• cargo update -p zstd on all three locks
• cargo check --locked --workspace --all-targets --all-features (root), plus cargo check --locked --all-targets in each proof workspace: exit 0
• cargo tree -i zstd / -i zstd-safe: only zstd 0.14.3 and zstd-safe 8.2.0 remain

[tinysweeper]

Tiny Sweeper review

Reviewed head: e513fc1154e815e9dec008102a03fc80f042487f

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 4 files; not reviewed: Cargo.lock, proof-workspaces…, and 1 additional unreviewed files.
Pull request purpose (title): fix(deps): move zstd…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(deps): move zstd to 0.14.3 for RUSTSEC-2026-0391/0398/0403. This pull request moves the workspace `zstd` dependency from 0.13 to 0.14.3 with `default-features = false`, clearing RUSTSEC-2026-0391 (zstd 0.13.3) and RUSTSEC-2026-0398/0403 (zstd-safe 7.3.0); the description notes tinystoragedrivers-document uses zstd unconditionally and tinystoragedrivers-connect uses it under `sqlite`, so every consumer including openhuman currently ships the vulnerable versions. The code change is a single version bump in Cargo.toml with no code changes, accompanied by lockfile updates in the root and both proof workspaces. No findings were raised in any answered lane.

Unreviewed paths

• Cargo.lock
• proof-workspaces/document-callback/Cargo.lock
• proof-workspaces/storage-callback/Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The workspace `zstd` dependency in Cargo.toml is bumped from 0.13 to 0.14.3, keeping `default-features = false` and the existing explanatory comment; the four APIs used by the workspace (`encode_all`, `decode_all`, `bulk::compress`, `bulk::decompress`) have identical signatures in 0.14.3. Lockfiles are regenerated: the root lock moves zstd 0.13.3 → 0.14.3, zstd-safe 7.3.0 → 8.2.0 and zstd-sys 2.1.1 → 2.1.2, re-pointing eight Windows-only dependency edges to the already-present windows-sys 0.61.2 without adding, removing or bumping any windows-sys package, and the two proof-workspace locks move zstd and zstd-safe to the same versions. Every consumer already uses `workspace = true`, so the bump propagates without code edits. The critique and security lanes answered with no defect and no security-relevant regression, noting the CONTRIBUTING dependency rule is satisfied by the existing comment and `default-features = false`. The commits and description lanes answered with no sensitive content and no contradiction between description and diff.

Features

• Modified — Workspace zstd dependency bump to 0.14.3: Moves the pinned zstd version from 0.13 to 0.14.3 while retaining `default-features = false` and the existing comment, so all consumers — tinystoragedrivers-document unconditionally and tinystoragedrivers-connect under `sqlite` — resolve the newer release and drop the vulnerable zstd 0.13.3 and zstd-safe 7.3.0. (Cargo.toml ulid = "1")

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a one-line bump of the workspace `zstd` dependency from 0.13 to 0.14.3, still with `default-features = false`. The APIs the workspace uses (`encode_all`, `decode_all`, `bulk::compress`, `bulk::decompress`) are stable across these versions and every consumer already uses `workspace = true`, so I found no defect in this change. _The code index is behind this pull request (indexed at `798affc6421f`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered lane finds no security-relevant regression and notes the CONTRIBUTING dependency rule (caret range, needed features only, commented why) is satisfied by the existing comment and `default-features = false`.
• Lane summary: Bumps the workspace `zstd` dependency from 0.13 to 0.14.3 with default features off, unchanged in shape; no code, CI, or feature-gating change accompanies it. Nothing in the diff shows a security-relevant regression, and the CONTRIBUTING dependency rule (caret range, needed features only, commented why) is satisfied by the existing comment and `default-features = false`. _The code index is behind this pull request (indexed at `798affc6421f`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered lane reports no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `798affc6421f`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Answered lane finds the title and body consistent with the diff: a pure dependency bump with no code changes and lockfile updates described, with nothing contradicting the description.
• Lane summary: The title and body describe a pure dependency bump from zstd 0.13 to 0.14.3, and the diff shows exactly that: a single version change in the workspace Cargo.toml. The claimed no-code-changes is consistent with the diff, and lockfile updates are described. Nothing in the diff contradicts the description, so no description defect. _The code index is behind this pull request (indexed at `798affc6421f`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000054
• Tokens: 132601 input · 2768 output · 29184 cached · 45 embedding
• Updated: 2026-10-27T13:23:30Z

Head	State	Pass summary
e513fc1154e8	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-27T13:23:30Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 723e8f6f-41af-4bd3-9e34-09b80e4dce28

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0001