[M3gA-Mind]

Summary

main is red on module-ci / supply-chain and storage-boundary. Both jobs fail in cargo deny check, the last step of the storage-boundary job.

The "failed closed: cargo tree for tinychannels did not contain its root package" line in that job is not the failure. It's the --self-test negative control of scripts/check-storage-engine-trees.sh, which then prints "self-test passed" and "dependency boundary passed for all native library packages".

cargo-deny reports two advisories. This PR fixes the first one:

1. RUSTSEC-2026-0441: pin-utils is unmaintained. It comes in only through async-imap 0.12.0 (the email feature).
   • Upstream replaced it with pin-project in chatmail/async-imap@d1f2606, the only commit after the 0.12.0 release (31fde98fce). So the patched crate is 0.12.0 with that single change, and its API is unchanged.
   • This PR points async-imap at that commit through [patch.crates-io], and adds that one git source to deny.toml's allow-git, which is needed because unknown-git = "deny". No advisory is ignored.
   • The patch carries a comment to drop it, and its allow-git entry, once a release after 0.12.0 is published.
2. RUSTSEC-2026-0459 (CVE-2026-119375): bundled SQLite < 3.54 in libsqlite3-sys 0.38.2. NOT fixed here.
   • It comes in through rusqlite 0.40.2, both directly (imessage) and via tinystoragedrivers-connect/-document.
   • libsqlite3-sys is links = "sqlite3", so tinychannels can't move to rusqlite 0.41 on its own; tinystoragedrivers has to move first.
   • A follow-up PR will bump the tinystoragedrivers rev and tinychannels' own rusqlite once that lands. cargo-deny stays red on this one advisory until then.

Lockfile change (+1/-9): async-imap's source becomes the git rev, and the pin-utils package and its dependency line are removed. Nothing else is re-resolved.

API Or Behavior Changes

None. async-imap stays at 0.12.0, with only its internal pin projection changed upstream.

Tests

Run on a Linux CI host on the exact tree of this commit (tree 54eed3d7f8), checked out from official main a626f12 plus this change:

• The storage-boundary job's guards, verbatim from ci.yml: check-webpki-roots.py --self-test and the real check, check-storage-engine-trees.sh --self-test and the real check. All pass.
• cargo deny --locked check all: RUSTSEC-2026-0441 no longer reported. The only remaining error is RUSTSEC-2026-0459 (see above). cargo deny --locked check sources: pass.
• cargo clippy --locked --all-targets --all-features -- -D warnings: pass.
• cargo build --locked --all-targets --all-features: pass.
• cargo test --locked --all-features: 2323 passed. The 4 tinychannels-client tests fail identically on main without a staged fixture ("TINYCHANNELS_CLIENT_TEST_ARCHIVE_NAME must identify the staged local fixture"); CI stages it.
• cargo check --locked -p tinychannels --no-default-features --features email: pass.
• cargo fmt --check: not run. No Rust source changes (Cargo.toml, deny.toml and Cargo.lock only).
• scripts/test-features.sh: not run locally; covered by module-ci on this PR.

Documentation

Not needed. The patch and the allow-git entry each carry a comment explaining why they exist and when to remove them.

Summary by CodeRabbit

• Chores
  • Updated the underlying email connectivity dependency to a specific upstream revision.

[tinysweeper]

Tiny Sweeper review

Reviewed head: fe668a7cd026d688142185b651dcbc5073a2fdd9

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 3 files; not reviewed: Cargo.lock.
Pull request purpose (title): Patch async-imap to…

Diagnostics and supporting details

Full summary

Pull request purpose (title): Patch async-imap to the upstream commit that drops pin-utils (RUSTSEC-2026-0441). This pull request patches `async-imap` to the upstream commit that drops the unmaintained `pin-utils` dependency, addressing RUSTSEC-2026-0441, which is failing `cargo deny check` on `main`. The patch is declared in `[patch.crates-io]` and the corresponding git source is added to `deny.toml`'s `allow-git` list, required because `unknown-git = "deny"`. The second advisory, RUSTSEC-2026-0459 (bundled SQLite in `libsqlite3-sys`), is explicitly left unfixed and cargo-deny remains red on it. The latest-push-delta section is unavailable.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`Cargo.toml` gains a `[patch.crates-io]` entry pointing `async-imap` at git rev `d1f2606421c9211f992c1c565a32d8f770476aeb`, with a comment explaining the pin-utils removal and when to drop the patch. `deny.toml` adds `https://github.com/async-email/async-imap` to `allow-git` and extends the explanatory comment. `Cargo.lock` re-resolves `async-imap` to the git source and removes the `pin-utils` package and its dependency line, with nothing else re-resolved. No Rust source changes.

Features

• Added — async-imap patched to upstream pin-utils-removal commit: Replaces the crates.io 0.12.0 source with the single upstream commit after that release, removing the unmaintained `pin-utils` dependency (RUSTSEC-2026-0441) without changing the crate's API or version. (Cargo.toml resolver = "3")

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with 0 findings across both reviewed files.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `73c60b76cec8`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with 0 findings across both reviewed files.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `73c60b76cec8`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered with no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `73c60b76cec8`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The description matches the diff: it points `async-imap` at the upstream d1f2606421 rev through `[patch.crates-io]`, adds the matching `allow-git` entry that `unknown-git = "deny"` requires, and both additions carry the removal note the body refers to. It also explicitly discloses that the second advisory (RUSTSEC-2026-0459) is left unfixed, and the lockfile at the reviewed commit shows exactly the source/pin-project change it describes. No behavior change, so the absence of Rust source edits and new tests is consistent with the repository's testing rule; nothing significant is done by the diff that the body fails to mention. _The code index is behind this pull request (indexed at `73c60b76cec8`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.009320
• Tokens: 223318 input · 26887 output · 75904 cached · 115 embedding
• Updated: 2026-11-11T08:53:49Z

Head	State	Pass summary
fe668a7cd026	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T08:53:49Z)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The manifest pins async-imap to an upstream Git revision. The source policy allows that repository and updates comments about the async-imap and TinyBus pins.

Changes: async-imap Dependency Pin

Layer / File(s)	Summary
Pin async-imap and allow its source Cargo.toml, deny.toml	Cargo.toml patches async-imap to an upstream commit. deny.toml allows the Git repository and updates comments about the pins and their removal conditions.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: senamakel, tinysweeper

Merge Risk: Minimal · up to fe668

This change swaps a dependency source to remove an advisory-flagged transitive crate without changing the API. No new merge-blocking risk was found. The separate SQLite advisory remains and is tracked as a follow-up.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: pinning async-imap to an upstream commit that removes pin-utils and addresses RUSTSEC-2026-0441.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the pinned crate,
Then reads the source list at the gate.
The upstream commit hops into view,
A note tells when to bid adieu.
The rabbit rests beside the code.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d85b0c73-570c-45b1-bb84-fc2e74740dfa

Commits

Reviewing files that changed from the base of the PR and between a626f12 and fe668a7.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• Cargo.toml
• deny.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0093