[M3gA-Mind]

Summary

Release prep for v0.4.3 (patch), cut from main on the tinybus 0.1 line. Two commits:

1. fix(deps): tokio 1.53.1 → 1.53.3 in Cargo.lock, for RUSTSEC-2026-0386. It's the patched release in the same minor, with the same dependencies and MSRV, and it clears the supply-chain failure on main.
2. chore(release): versions 0.4.1 → 0.4.3, plus the matching workspace-crate entries in Cargo.lock.

It's a patch: #40 (bundle credential pruning and refusal), #41 (vercel dot-segment ids, adding Error::InvalidIdentifier to a #[non_exhaustive] enum) and #43 (rustls-webpki). v0.4.2 was tagged on epic/8056-modules-wiring, not main, so main's next release is 0.4.3.

Test plan

• cargo build --locked, a lockfile-unchanged check, and full module-ci (Linux), run off-GitHub on the cuttlefish check host.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3eb96e16-27cb-49ce-ad00-891aceba63f2

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 1e98da382b7edc80e03e97c1c6f39856fa8be636

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 3 files; not reviewed: Cargo.lock.
Pull request purpose (title): chore(release): tiny…

Diagnostics and supporting details

Full summary

Pull request purpose (title): chore(release): tinyhosts 0.4.3. Release prep for tinyhosts 0.4.3 (patch) per the pull-request title and description, cut from main on the tinybus 0.1 line. The whole pull request touches Cargo.lock, Cargo.toml, and crates/tinyhosts-bus/Cargo.toml with 7 additions and 7 deletions. No lane reported any issue, and none is contradicted.

Unreviewed paths

• Cargo.lock

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

In the manifests, the tinyhosts package version and the workspace dependency requirement on tinyhosts-bus move from 0.4.1 to 0.4.3 (Cargo.toml), and the tinyhosts-bus package version likewise moves 0.4.1 to 0.4.3 (crates/tinyhosts-bus/Cargo.toml). The pull-request description also states a Cargo.lock tokio bump 1.53.1 to 1.53.3 for RUSTSEC-2026-0386 in the same minor with the same dependencies and MSRV, plus matching workspace-crate version entries in Cargo.lock; Cargo.lock is listed among the changed files, though the description lane notes it was not visible in the diff it reviewed. The description attributes the patch content to #40 (bundle credential pruning and refusal), #41 (vercel dot-segment ids, adding Error::InvalidIdentifier to a #[non_exhaustive] enum), and #43 (rustls-webpki), and explains that v0.4.2 was tagged on epic/8056-modules-wiring rather than main, so main's next release is 0.4.3.

Features

• Modified — tinyhosts package version bump: The crate's published version moves from 0.4.1 to 0.4.3, preparing the patch release described as cut from main on the tinybus 0.1 line. (Cargo.toml)
• Modified — Workspace dependency version requirement on tinyhosts-bus: The path dependency requirement on tinyhosts-bus is raised to 0.4.3 so the workspace resolves the matching bus crate version. (Cargo.toml)
• Modified — tinyhosts-bus package version bump: The tinyhosts-bus crate version moves from 0.4.1 to 0.4.3, tracking the release bump. (crates/tinyhosts-bus/Cargo.toml)
• Modified — Workspace exclude of vendor/tinybus: The exclusion recorded as part of the workspace configuration; the description lane reviewed the manifests as a pure release bump and reported no finding against it. (Cargo.toml exclude = ["vendor/tinybus"])

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The critique lane is answered, covering 2 of 2 files with 0 findings.
• Positive: The critique lane notes the code index is behind this pull request (indexed at f3df6eb), so retrieved context may be out of date.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `f3df6eb17dbd`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane is answered, covering 2 of 2 files with 0 findings.
• Positive: The security lane also notes the code index is behind this pull request (indexed at f3df6eb), so retrieved context may be out of date.
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `f3df6eb17dbd`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane is answered with 0 findings and reports no sensitive content in committed files.
• Positive: The commits lane notes the code index is behind this pull request (indexed at f3df6eb), so retrieved context may be out of date.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `f3df6eb17dbd`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane is answered with 0 findings: the diff it reviewed is a pure release bump, Cargo.toml and crates/tinyhosts-bus/Cargo.toml go 0.4.1 to 0.4.3 and the workspace dependency requirement follows, matching the PR body.
• Positive: The description lane notes the claimed Cargo.lock tokio bump is not visible in the diff it reviewed, since only the two manifest files were shown, and that nothing in the description contradicts the visible change.
• Lane summary: The diff is a pure release bump: `Cargo.toml` and `crates/tinyhosts-bus/Cargo.toml` go 0.4.1 → 0.4.3 and the workspace dependency requirement follows. The PR body describes exactly that, and the claimed `Cargo.lock` tokio bump is simply not visible in this diff (only the two manifest files were shown), so nothing in the description contradicts the visible change. No findings. _The code index is behind this pull request (indexed at `f3df6eb17dbd`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.004930
• Tokens: 158141 input · 3469 output · 14720 cached · 40 embedding
• Updated: 2026-10-23T15:03:55Z

Head	State	Pass summary
1e98da382b7e	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T15:03:55Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0049