[M3gA-Mind]

Summary

Move tinyflows to tinystoragedrivers v2.1.3 and tinybus v0.3.12, and clear the advisories in its lockfile.

1. tinystoragedrivers v2.1.3 (f5a33025b9) in tinyflows-storage, tinyflows-drivers, tinyflows-module and tinyflows-adaptive. It brings:
   • rusqlite 0.41 / libsqlite3-sys 0.39.1, for RUSTSEC-2026-0459 (bundled SQLite < 3.54);
   • rustix 1.1.6 + xattr 1.7.0, for RUSTSEC-2026-0486;
   • the busproxy upload race fix (tinystoragedrivers#96).
2. tinybus v0.3.12 (106eda127f) in the root [patch.crates-io] and tinyflows-storage's tinybus-sdk. This is the rev tinystoragedrivers v2.1.3 pins, so tinybus::Connection stays one type with its busproxy, and it fixes a stream close that could read as aborted. The lock has exactly one tinybus.
3. rustls-webpki 0.103.16 and webpki-root-certs 1.0.12, clearing RUSTSEC-2026-0382 and RUSTSEC-2026-0383. Both advisories were already on main. Lock-only.

MSRV: rusqlite 0.41 needs Rust 1.89, so the four crates above move to 1.89. The published engine (tinyflows) and the crates that don't depend on tinystoragedrivers (bus, catalog, copilot, schedule) keep 1.88. The CI MSRV job now checks the workspace on 1.89 and those five crates on 1.88.

Related issue

The tinystoragedrivers v2.1.3 rollout (pin bumps after tinystoragedrivers#95/#96).

API or behavior changes

None in tinyflows' own API. Breaking only for consumers of the four storage crates on Rust 1.88: they now need 1.89.

Validation

On a Linux build host, on main 8b22179 (merges cleanly onto dc2525e):

• cargo test --workspace --locked --all-features: 2856 passed, 0 failed, 35 ignored, the same as main.
• clippy -D warnings (0 items), cargo fmt --check.
• cargo +1.89.0 check --workspace --locked --all-features.
• cargo +1.88.0 check --locked --all-features -p tinyflows -p tinyflows-bus -p tinyflows-catalog -p tinyflows-copilot -p tinyflows-schedule.
• cargo deny --locked check advisories: exit 0. Main has 0382, 0383 and 0459. There's no deny.toml, so this uses the defaults.
• cargo tree -i libsqlite3-sys → 0.39.1. -i xattr → 1.7.0. -i rustls-webpki → 0.103.16.
• Lockfile:
  • Only the tinystoragedrivers and tinybus families, the fixed crates, and what tinybus 0.3.12 needs (icu_casemap, rawzip, unicode-normalization).
  • Crates only tinybus 0.3.6 used (nix, typed-path, zip) are dropped.
  • Unrelated windows-sys re-pointing from cargo update was trimmed back.
  • ulid stays as 1.2.1 + 3.0.0 until a tinystoragedrivers release with ulid 3.
• tinyflows-drivers and tinyflows-module have no Mongo-backed tests to run live.

Summary by CodeRabbit

• Compatibility
  • Storage-related components now require Rust 1.89; other components continue to support Rust 1.88.
• Updates
  • Updated storage driver and bus components to newer versions.
  • Updated rusqlite and rustix to address reported security advisories.
• Bug Fixes
  • Fixed a race condition affecting busproxy uploads.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The PR updates tinystoragedrivers and tinybus dependency revisions, raises the minimum Rust version for four crates from 1.88 to 1.89, and changes CI to check the full workspace with Rust 1.89 and selected crates with Rust 1.88.

Changes: Storage dependency and MSRV update

Layer / File(s)	Summary
Update storage dependency pins crates/tinyflows-adaptive/Cargo.toml, crates/tinyflows-drivers/Cargo.toml, crates/tinyflows-module/Cargo.toml, crates/tinyflows-storage/Cargo.toml, Cargo.toml	The storage-related crates update their tinystoragedrivers dependencies to version 2.1.3 at the new pinned revision. The workspace tinybus patches and storage crate’s tinybus SDK also use the updated revision.
Declare crate Rust requirements crates/tinyflows-adaptive/Cargo.toml, crates/tinyflows-drivers/Cargo.toml, crates/tinyflows-drivers/README.md, crates/tinyflows-module/Cargo.toml, crates/tinyflows-storage/Cargo.toml	The four crates declare Rust 1.89. The adaptive feature comment and drivers README state the same requirement.
Align CI checks and changelog .github/workflows/ci.yml, CHANGELOG.md	CI checks the full workspace with Rust 1.89 and checks five listed crates with Rust 1.88. The changelog records the dependency updates, associated fixes, and Rust requirements.

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Possibly related PRs

• tinyhumansai/tinyflows#183: PR #183 updated the same tinystoragedrivers revision pins to v2.1.2. This PR updates those pins to v2.1.3 and raises the MSRV for the affected crates.
• tinyhumansai/tinyflows#180: PR #180 introduced the tinybus patch and tinystoragedrivers pins that this PR updates.
• tinyhumansai/tinyflows#182: PR #182 aligned tinystoragedrivers and the storage crate’s tinybus SDK. This PR updates both dependency revisions for tinystoragedrivers v2.1.3.

Suggested reviewers: senamakel

Merge Risk: Minimal · up to ca0c0

This updates storage driver dependencies to address reported security advisories and raises the Rust version required by four storage crates to 1.89. No actionable merge-blocking risk was found in the supplied changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the primary dependency updates to tinystoragedrivers v2.1.3 and tinybus v0.3.12.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the pins in place
Rust versions hop to their new pace
The changelog notes each version’s trail
CI checks each compiler scale
The bunny curls beside the build
While crates are neatly pinned and filled}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 128774d7-3935-4944-87b9-6b6d9c2489c0

Commits

Reviewing files that changed from the base of the PR and between 8a85f4c and ca0c06d.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• CHANGELOG.md

Files skipped from review as they are similar to previous changes: 1

• CHANGELOG.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[tinysweeper]

Tiny Sweeper review

Reviewed head: ca0c06dc0075f5b1788110fdf0d641d995daab35

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 8 of 9 files; not reviewed: Cargo.lock.
Pull request purpose (title): deps: tinystoragedri…

Diagnostics and supporting details

Full summary

Pull request purpose (title): deps: tinystoragedrivers v2.1.3 and tinybus v0.3.12. Purpose (title): “deps: tinystoragedrivers v2.1.3 and tinybus v0.3.12”, described as moving tinyflows to tinystoragedrivers v2.1.3 and tinybus v0.3.12 and clearing advisories in the lockfile. The pull request repins the tinystoragedrivers api/types dependencies (and their testkit/busproxy dev-dependencies) to v2.1.3 at rev f5a33025b9 across `tinyflows-storage`, `tinyflows-drivers`, `tinyflows-module` and `tinyflows-adaptive`, raises `rust-version` to 1.89 in those four crates while the engine and the crates without a tinystoragedrivers dependency stay at 1.88, moves the tinybus rev to 106eda127f in both the root `[patch.crates-io]` and `tinyflows-storage`'s `tinybus-sdk`, and splits the CI MSRV job so the workspace is checked on 1.89 and the five storage-free crates on 1.88, with matching CHANGELOG and drivers README updates.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	2	Resolved findings	0
Configuration	6	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

At the reviewed head, the four crates depending on tinystoragedrivers move from v2.1.2 (rev 6226b9484c) to v2.1.3 (rev f5a33025b9) and each raises `rust-version` from 1.88 to 1.89, while the published engine and the crates that do not depend on tinystoragedrivers keep 1.88. The tinybus git rev moves from 6ce06bc674 to 106eda127f in the root `[patch.crates-io]` for both `tinybus` and `tinybus-module` and in `tinyflows-storage`'s `tinybus-sdk`, keeping the patch and the dependency on the same rev so `tinybus::Connection` stays one type with the busproxy. The CI MSRV job switches its toolchain step to 1.89 for the workspace check and gains a step that installs 1.88 and checks the five storage-free crates. A CHANGELOG entry records the bump, its advisory motivation and the MSRV split, and the drivers README's MSRV note now says 1.89. Per the description, no tinyflows API or behaviour changes; the only breaking effect is the raised MSRV for the four storage crates, and the lockfile changes are lock-only. Latest push delta: unavailable — the review state has the prior reviewed head and rendered evidence but no trusted base-to-head diff comparison, so no push-specific delta is reported here.

Features

• Modified — tinystoragedrivers pinned to v2.1.3 across the storage-backed crates: `tinyflows-storage`, `tinyflows-drivers`, `tinyflows-module` and `tinyflows-adaptive` move their api/types dependencies and their testkit/busproxy dev-dependencies from v2.1.2 (rev 6226b9484c) to v2.1.3 (rev f5a33025b9); per the description this brings rusqlite 0.41 for RUSTSEC-2026-0459, rustix 1.1.6 for RUSTSEC-2026-0486, and the busproxy upload race fix. (crates/tinyflows-storage/Cargo.toml, crates/tinyflows-drivers/Cargo.toml, crates/tinyflows-module/Cargo.toml, crates/tinyflows-adaptive/Cargo.toml)
• Modified — tinybus rev moved to 106eda127f in the workspace patch and tinybus-sdk: The root `[patch.crates-io]` entries for `tinybus` and `tinybus-module`, together with `tinyflows-storage`'s `tinybus-sdk`, all move to rev 106eda127f; the in-manifest comment states the dependency must stay on the rev tinystoragedrivers pins so `tinybus::Connection` is a single type shared with its busproxy. (Cargo.toml, crates/tinyflows-storage/Cargo.toml)
• Modified — Rust MSRV raised to 1.89 for the four tinystoragedrivers-dependent crates: `rust-version` becomes 1.89 in these four crates while the published engine and the crates without a tinystoragedrivers dependency keep 1.88, confining the MSRV increase to consumers of the storage adapters. (crates/tinyflows-storage/Cargo.toml, crates/tinyflows-drivers/Cargo.toml, crates/tinyflows-module/Cargo.toml, crates/tinyflows-adaptive/Cargo.toml)
• Modified — CI MSRV job checks 1.89 workspace-wide and 1.88 for the storage-free crates: The Rust MSRV job's toolchain step becomes 1.89 for the workspace check and adds a step that installs 1.88 and checks `tinyflows`, `tinyflows-bus`, `tinyflows-catalog`, `tinyflows-copilot` and `tinyflows-schedule`, so both declared minimums stay enforced in CI. (.github/workflows/ci.yml)
• Added — CHANGELOG entry for the tinystoragedrivers 2.1.3 / tinybus v0.3.12 roll-forward: Records the dependency bump, the advisories it is meant to clear, and the MSRV split between the four storage crates (1.89) and the rest of the workspace (1.88). (CHANGELOG.md)
• Modified — tinyflows-drivers README MSRV note updated to 1.89: The storage-crate-split documentation now states the crate needs Rust 1.89, matching the manifest change. (crates/tinyflows-drivers/README.md)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: It could not verify that the pinned tinybus rev is v0.3.12 because `vendor/tinybus` is not checked out, and nothing in the diff contradicts it.
• Lane summary: The change adds a single Unreleased changelog entry describing the tinystoragedrivers 2.1.3 / tinybus bump and the resulting MSRV split. Checked against the manifests at this commit, the named crates (`tinyflows-storage`, `tinyflows-drivers`, `tinyflows-module`, `tinyflows-adaptive`) all carry the 2.1.3 pin, all four declare `rust-version = "1.89"`, and the engine plus the workspace default stay at 1.88, so the entry matches the tree. The only claim I could not verify is that the pinned tinybus rev is v0.3.12, because `vendor/tinybus` is not checked out; nothing in the diff contradicts it. No defects to report. _The code index is behind this pull request (indexed at `8a85f4c902f5`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane is answered and reports 0 findings across its 6 reviewed files: the toolchain step moves 1.88.0 to 1.89.0 and the added step installs 1.88.0 and checks five packages that exist as workspace members declaring 1.88; permissions are not widened, no untrusted input is interpolated into a shell, and no new subprocess or network path is introduced. The scanner's `unpinned-action` hit on `dtolnay/rust-toolchain@1.89.0` is treated as a false positive because on that action the ref is the toolchain selector. `CHANGELOG.md` was excluded as prose.
• Lane summary: The diff only raises the pinned MSRV toolchain from 1.88.0 to 1.89.0 and adds a step that installs 1.88.0 and checks the five storage-free packages against it; all five `-p` names (`tinyflows`, `tinyflows-bus`, `tinyflows-catalog`, `tinyflows-copilot`, `tinyflows-schedule`) exist as workspace members and declare `rust-version = "1.88"`, so the narrower check is a valid superset-of-nothing improvement over the previous whole-workspace 1.88 run. No permissions are widened, nothing untrusted is interpolated into a shell, and no new subprocess/network path is introduced. The scanner's `unpinned-action` hit on `dtolnay/rust-toolchain@1.89.0` is a false positive for this change: on that action the ref *is* the toolchain selector (the repository already uses `@stable`), and the edit only moves the version forward without widening what runs. 1 file was not security-reviewed: CHANGELOG.md (prose or tabular data). _The code index is behind this pull request (indexed at `8a85f4c902f5`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane is answered and reports no sensitive content in the committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `8a85f4c902f5`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane is answered and reports the description matches the diff: the four storage-dependent crates bump to tinystoragedrivers 2.1.3 and Rust 1.89, the root `[patch.crates-io]` and `tinyflows-storage`'s `tinybus-sdk` move to the tinybus rev, the CI MSRV job checks 1.89 plus the five storage-free crates on 1.88, and the CHANGELOG entry restates the same facts; it judged the CI addition safe to merge since it only installs and selects a toolchain.
• Lane summary: The description accurately matches the diff: the four storage-dependent crates bump to tinystoragedrivers 2.1.3 and Rust 1.89, root `[patch.crates-io]` and `tinyflows-storage`'s `tinybus-sdk` move to the tinybus rev, the CI MSRV job checks the workspace on 1.89 plus the five storage-free crates on 1.88, and the CHANGELOG entry added in this revision restates the same facts. The CI addition only installs and selects a toolchain — permissions are unchanged, no untrusted context is interpolated into a shell, and the only action reference touched is the toolchain tag the job already used — so the change looks safe to merge. _The code index is behind this pull request (indexed at `8a85f4c902f5`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.007181
• Tokens: 166411 input · 28004 output · 61440 cached · 373 embedding
• Updated: 2026-11-11T13:17:50Z

Head	State	Pass summary
8a85f4c902f5	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T12:17:36Z)
ca0c06dc0075	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T13:17:50Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0415