Repository navigation
Pin official tinystoragedrivers v2.1.3 and tinybus, and move to Rust 1.89 - #130
Conversation
…1.89 cargo-deny fails Supply chain on main with RUSTSEC-2026-0459 (CVE-2026-119375): libsqlite3-sys 0.38.2 bundles SQLite older than 3.54. It arrives through the tinystoragedrivers testkit dev-dependency (via rusqlite 0.40). - tinystoragedrivers: move from a personal fork (senamakel/tinystoragedrivers c447da3) to the official tinyhumansai/tinystoragedrivers v2.1.3 release (f5a33025b9), which ships rusqlite 0.41.1 / libsqlite3-sys 0.39.1. We pin only releases from the official repository. - tinybus: move from senamakel/tinybus to the official tinyhumansai/tinybus at the same revision (85345114, which is on official main), and drop the now-unused patch for the fork URL. The vendored submodule already tracks the official repository. - deny.toml allow-git lists only official repositories. - Rust 1.89, because rusqlite 0.41 requires it: rust-version in every crate and the proof workspace, the CI and distro-build toolchains, and the floor checks in scripts/test_native_e2e_topology.py, which tie the bus floor to tinystoragedrivers-types (now 1.89). The tinytools 1.88 notes stay, since that is tinytools' own minimum. - rustix 1.1.6 and xattr 1.7.0, for RUSTSEC-2026-0486 (rustix 1.0-1.1.5 xattr functions unsound on a zero-length buffer). Nothing in this workspace calls those functions directly.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Tiny Sweeper reviewVerdict: Incomplete · Priority: none Diagnostics and supporting detailsFull summaryPull request purpose (title): Pin official tinystoragedrivers v2.1.3 and tinybus, and move to Rust 1.89. The pull request moves the tinystoragedrivers dependency from a personal fork to the official tinyhumansai v2.1.3 release to fix a supply-chain vulnerability (libsqlite3-sys bundling an old SQLite) and migrates tinybus to the official tinyhumansai repository at the same revision. It raises the workspace MSRV from 1.88 to 1.89 to accommodate the new rusqlite/libsqlite3-sys requirements. deny.toml is narrowed to allow only official tinyhumansai git repositories, and the unused senamakel/tinybus patch stanza is removed. All crate manifests, CI toolchains, the distro build script, the topology test, and related READMEs are updated accordingly. No public API changes are introduced. Unreviewed paths
Partial review reasons
Review snapshot
Completeness: Incomplete What changedThis pull request addresses a supply-chain vulnerability by moving from a personal fork (senamakel/tinystoragedrivers) to the official tinyhumansai/tinystoragedrivers v2.1.3 release, which upgrades rusqlite to 0.41.1 / libsqlite3-sys to 0.39.1, and moves tinybus from senamakel/tinybus to tinyhumansai/tinybus at the same revision. It raises the workspace MSRV from 1.88 to 1.89 across all crate manifests, CI workflows, the distro build script, the topology test, and the proof-workspace. deny.toml is updated to allow-git only the official tinyhumansai repositories. The unused [patch.https://github.com/senamakel/tinybus] stanza is removed from the root Cargo.toml. All READMEs that state the Rust floor are updated. No public API or behavior changes are present. FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before merge
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
Summary
Supply chainis red onmain. cargo-deny reports RUSTSEC-2026-0459 (CVE-2026-119375):libsqlite3-sys0.38.2 bundles SQLite older than 3.54. It reaches this workspace through the tinystoragedrivers testkit dev-dependency, viarusqlite0.40.tinystoragedrivers: moves from a personal fork (
senamakel/tinystoragedriversc447da3) to the officialtinyhumansai/tinystoragedriversv2.1.3 release (f5a33025b9feaa36fea522cce764fe8c796e5139). That release shipsrusqlite0.41.1 /libsqlite3-sys0.39.1. We pin only releases from the official repository.tinybus: moves from
senamakel/tinybusto the officialtinyhumansai/tinybus, at the same revision (85345114, which is on officialmain). The now-unused patch for the fork URL is removed. The vendored submodule already tracks the official repository.deny.toml:allow-gitnow lists only the official repositories (tinytools, tinystoragedrivers, tinybus).Rust 1.89, because
rusqlite0.41 requires it:rust-versionin every crate and the proof workspace;1.88.0→1.89.0);scripts/test_native_e2e_topology.py, which tie the bus floor totinystoragedrivers-types(now 1.89);The notes saying
tinytoolsneeds 1.88 are unchanged, since that's tinytools' own minimum.rustix 1.1.6 and xattr 1.7.0, for RUSTSEC-2026-0486 (rustix 1.0–1.1.5 xattr functions mark a zero-length buffer as filled; patched in 1.1.6). Nothing in this workspace calls those functions directly.
Lockfile: +30/-30. Only the tinystoragedrivers crates,
rusqlite/libsqlite3-sys,rustixandxattrchange; tinybus resolves to the vendored checkout as before.Related issue
None. The failing check is
Supply chainonmain.API or behavior changes
None in the public API. The minimum supported Rust version rises from 1.88 to 1.89.
Validation
Run on our Linux CI runner, on this exact tree, checked out from
main522121a:cargo deny --locked check all: exit 0cargo build --locked --all-targets --all-features: passcargo test --locked --all-features: 935 passed, 0 failedcargo clippy --locked --all-targets --all-features -- -D warnings: passcargo +1.89 build --locked --workspace --all-targets --all-features: passcargo +1.89 test --locked -p tinywallet-x402 --features ledger: pass (the ledger MSRV job)cargo +1.89 test --locked --manifest-path proof-workspaces/storage-contract/Cargo.toml: passpython3 scripts/test_native_e2e_topology.py,scripts/check_bus_boundaries_tests.py,scripts/check-bus-boundaries.py: passDocumentation
The READMEs that state the Rust floor are updated.