You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is the upstream roll-up for the security migration in OpenHuman. OpenHuman needs this change available upstream before it can advance its gitlink.
Update the vendored tinybus dependency from 0.1.6 to 0.3.12, which swaps
the zip crate for rawzip and pulls in icu_casemap and
unicode-normalization. The lockfile is regenerated to match, dropping the
now-unused nix and cfg_aliases entries.
Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
The generated TinyBus ABI items in the exports module now use allow instead of expect for missing_docs, since the lint may not fire in every configuration and expect would then fail the build. The comment was updated to reflect that the lint is scoped to this module.
Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
The generated TinyBus ABI items are now documented by TinyBus 0.3, so the
missing_docs allow scoped to the exports module is no longer needed.
Auto-committed-on: cuttlefish
Co-authored-by: Medulla <medulla@tinyhumans.ai>
This repository does not receive automatic reviews because it has fewer than 10 stars.
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: cc60539c-735e-4a2a-9491-32409ec2e289
No actionable comments were generated in the recent review.
Walkthrough
The workspace now accepts tinybus and tinybus-module versions from 0.3.12 up to, but not including, 0.4. The vendored tinybus reference and the static-link ABI module comment and lint attribute also changed.
Changes: tinybus dependency update
Layer / File(s)
Summary
Update tinybus references and module lint Cargo.toml, vendor/tinybus, crates/tinyconnectors/src/tinybus_module/mod.rs
The workspace dependency ranges changed to >=0.3.12, <0.4, and tinybus retains its feature configuration. The vendored subproject reference changed. The static-link ABI module comment changed, and its missing_docs expectation attribute was removed.
No verified merge-blocking issue remains in the dependency update or module changes.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title identifies the dependency migration roll-up, which matches the TinyBus upgrade and related lint updates. It is broad but still related to the changeset.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
Finishing Touches
Resolve merge conflicts
Resolve merge conflict in branch epic/8369-security-migration
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the version range, Then hops where tinybus has changed. The vendor pointer finds its place, A comment gets a different face. No lint expectation guards the page, The bunny closes out the change.
CodeRabbit Verify
Run CodeRabbit Verify to test the changes in this pull request.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 5f9b9f4f-9329-4c77-bf3f-13217e2e5c1d
Commits
Reviewing files that changed from the base of the PR and between b43fb6a and e66c8d3.
Files ignored due to path filters: 1
Cargo.lock is excluded by !**/*.lock
Files selected for processing: 3
Cargo.toml
crates/tinyconnectors/src/tinybus_module/mod.rs
vendor/tinybus
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
medium: Mention the tinystoragedrivers revision bump in the description ((pull request description)) Problem: The description says the PR "Rolls up the connector module and its TinyBus dependency update", but the diff also moves every `tinystoragedrivers` git dependency — `tinystoragedrive Suggested fix:
No concrete fix was supplied.
Verdict: Ready for maintainer review · Priority: medium Coverage: Reviewed 2 of 4 files; not reviewed: Cargo.lock, vendor/tinybus.
Completeness: Complete Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.
What changed
Cargo.toml moves tinybus from ">=0.3.6, <0.4" to ">=0.3.12, <0.4" and tinybus-module from ">=0.3.6, <0.4" to ">=0.3.12, <0.4", and repins tinystoragedrivers-types, tinystoragedrivers-api, tinystoragedrivers-busproxy and tinystoragedrivers-testkit from rev bf1f0a97fbe6165a6edd9521659c7f6859700761 to rev 6226b9484c8bd01c58741718cd89ba90a13a36bb; existing dependency comments are unchanged and Cargo.lock already reflects the resolutions. In crates/tinyconnectors/src/tinybus_module/mod.rs the export_module macro's exports module no longer carries the cfg_attr static-link expect(missing_docs) exemption, with the comment now stating that TinyBus 0.3 documents the ABI items generated below; the macro invocation and module exports are otherwise unchanged. The pull request also touches Cargo.lock and the vendor/tinybus submodule, neither of which the reviewed lanes covered.
Features
Modified — TinyBus and tinybus-module version floors raised to >=0.3.12, <0.4: The connector's TinyBus requirements move from the 0.3.6 floor to >=0.3.12, <0.4; the security lane notes the lockfile already resolves tinybus 0.3.12 and that vendored patch entries still apply, while the critique lane notes it could not confirm the new revision actually exposes the APIs the crates call because vendor/tinybus is unreadable here. (Cargo.tomltinyconnectors-sync = { path = "crates/tinyconnectors-sync" })
Modified — All four tinystoragedrivers git dependencies repinned to rev 6226b948: The description lane flags that this repin is not mentioned in the pull-request body, which advertises only the TinyBus update. (Cargo.tomltinyconnectors-sync = { path = "crates/tinyconnectors-sync" })
Removed — Removal of the static-link missing_docs lint exemption in export_module!: The generated exports module no longer expects missing_docs under the static-link feature, on the stated basis that TinyBus 0.3 documents the generated ABI items. The tests lane notes the only thing that can regress is missing rustdoc on the generated ABI items, which the repository's own missing_docs-as-error CI setting already catches, so no new test is warranted; upstream documentation in vendor/tinybus could not be verified. (crates/tinyconnectors/src/tinybus_module/mod.rsfn setup_factory() -> impl Fn(Connection, ModuleConfig) -> SetupFuture + Send +)
Tests
No supported feature-to-test mapping was produced. Test execution is not inferred.
Before merge
None.
Agent review details
critique
Conclusion: Success
Scope reviewed: all assigned evidence
Lane summary: The change bumps the workspace-pinned `tinybus`/`tinybus-module` caret ranges and moves all four `tinystoragedrivers` git pins to the same new rev, which Cargo.lock already reflects; dependency comments are unchanged and still accurate. I could not verify that the new revs actually contain the APIs the crates call (`vendor/tinybus` is unreadable here, and the storage driver repo is external), so I have nothing to report beyond that limitation.
security
Conclusion: Success
Scope reviewed: all assigned evidence
Positive: The security lane is answered with no findings, reporting no security-relevant defect visible in the manifest change, with the lockfile already resolving tinybus 0.3.12 and the vendored patch entries still applying.
Lane summary: The change bumps the tinybus/tinybus-module caret ranges to >=0.3.12 and moves the tinystoragedrivers git dependencies to a newer pinned rev; the lockfile already resolves tinybus 0.3.12, and the vendored patch entries still apply. No security-relevant defect is visible in this manifest change.
tests
Conclusion: Success
Scope reviewed: all assigned evidence
Positive: The tests lane is answered with no findings, holding that the diff adds no runtime behaviour a test could pin and that the missing_docs-as-error CI setting already covers the removed lint suppression.
Lane summary: The change removes a `cfg_attr(expect(missing_docs))` suppression in `export_module!` and bumps the tinybus and tinystoragedrivers floors; the only thing that can regress is missing rustdoc on the generated ABI items, which the repository's own `missing_docs`-as-error CI setting already catches, so no new test is warranted. I could not verify upstream documentation in `vendor/tinybus` (submodule not checked out), but a dependency bump plus removal of a lint suppression has no silently regressing runtime behaviour to pin with a test.
commits
Conclusion: Success
Scope reviewed: all assigned evidence
Positive: The commits lane is answered with no findings, reporting no sensitive content in committed files.
Lane summary: No sensitive content in committed files.
description
Conclusion: Success
Scope reviewed: all assigned evidence
Lane summary: The Cargo.toml side of the change is coherent — the TinyBus requirement moves to `>=0.3.12, <0.4` and Cargo.lock already resolves `tinybus`/`tinybus-module` at 0.3.12 — but the pull request description undercounts the diff: it advertises only a TinyBus dependency update while the same commit also repins all four `tinystoragedrivers` git dependencies to a new revision. That needs to be stated before this merges.
Keeps this branch's tinybus >=0.3.12 bounds. vendor/tinybus moves to
106eda1 (tinybus main), which contains both this branch's 8534511 and
main's 6ce06bc; the two had diverged. Main's tinystoragedrivers rev and
0.22.1 release merge as they are.
tinystoragedrivers v2.1.1 pulled zstd 0.13.3 and zstd-safe 7.3.0, which
cargo deny refuses for RUSTSEC-2026-0391, -0398 and -0403. v2.1.2
(6226b94, tinystoragedrivers main) moves zstd to 0.14.3; between the two
releases only manifests and lockfiles changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This is the upstream roll-up for the security migration in OpenHuman. OpenHuman needs this change available upstream before it can advance its gitlink.
Required by tinyhumansai/openhuman#8487.
Rolls up the connector module and its TinyBus dependency update.
Validation: no tests or builds were run for this PR. The source branch SHA and its diff against main were verified before opening.
Summary by CodeRabbit