build(deps): relax tinybus pin to a range, bump vendored tinybus to 0.1.5

[senamakel]

Part of tinyhumansai/openhuman#7610, #7543, #7523

Summary by CodeRabbit

• Chores
  • Updated the app’s underlying messaging components and dependency configuration.
  • No user-facing behavior changes are noted in this update.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T17:54:04.947783Z	f18eafe	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 99ae6457-72ef-4f46-a1e0-97ac4c1afca4

📥 Commits

Reviewing files that changed from the base of the PR and between 3e2e829 and f18eafe.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Cargo.toml
• crates/tinyjuice-module/Cargo.toml
• vendor/tinybus

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The module manifest now uses version constraints for tinybus dependencies. The root manifest adds crates.io path overrides for the vendored tinybus crates, and the vendored submodule reference changes to a new commit.

Changes: tinybus dependency resolution

Layer / File(s)	Summary
Dependency declarations and vendored resolution Cargo.toml, crates/tinyjuice-module/Cargo.toml, vendor/tinybus	The module manifest replaces pinned path dependencies with >=0.1.3, <0.2 version constraints. The root manifest adds crates.io path overrides for the three vendored tinybus crates. The vendored submodule points to a new commit.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f18ea

The dependency declarations now use version ranges directed to vendored tinybus crates. Available evidence shows no concrete failure, though the updated vendored packages’ feature compatibility remains unconfirmed.

### Architecture Summary

Architecture risk: 🔵 Low · up to f18ea

The change affects 2 systems.

Changed systems: Cargo.toml, crates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Cargo.toml (service) was modified; 1 changed file maps to changed impact.
• observed — crates (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Cargo.toml: Adds crates.io path overrides for the three vendored tinybus crates; the existing Git-source override for tinybus remains in place.
• observed — Modified behavior in crates/tinyjuice-module/Cargo.toml: The runtime tinybus and tinybus-module dependencies replace pinned 0.1.4 vendored-path dependencies with registry version constraints >=0.1.3, <0.2; the runtime dependency retains its existing features.
• observed — Modified behavior in crates/tinyjuice-module/Cargo.toml: The test tinybus dependency replaces its pinned 0.1.4 vendored-path source with the >=0.1.3, <0.2 registry version range, retaining default-features = false and test-support.
• observed — Modified behavior in vendor/tinybus: The vendor/tinybus submodule pointer now references commit eb5cf727071a6eb12f9efa3db8ec59e54039f336 instead of 1f2557657db97470cd4efb7e1fc2f374f36fdd22.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes the two main changes: relaxing the tinybus dependency range and updating the vendored tinybus version to 0.1.5.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the crates in line,
The paths resolve, the versions shine.
The tiny bus rolls on its way,
A newer commit joins the day.
Soft paws close the manifest tight.}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: f18eafe0d07b
Updated: 2026-10-13T23:29:15Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	1
Documentation	0	Resolved findings	0
Configuration	2	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Lower-confidence notes

• medium · description — Describe the change accurately: no vendored bump to 0.1.5 (\(pull request description\))

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `51e83a7b4f6f`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 2 files; 0 findings. _The code index is behind this pull request (indexed at `51e83a7b4f6f`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change relaxes the tinybus dependency from an exact 0.1.4 pin to a `>=0.1.3, <0.2` range in tinyjuice-module and adds `[patch.crates-io]` entries for the three tinybus crates, while the title claims a bump of the vendored checkout to 0.1.5 — a version change that does not appear anywhere in the diff. The dependency edits themselves are coherent with the workspace patch section, but the description/title misrepresents the change, and that is what I report. _The code index is behind this pull request (indexed at `51e83a7b4f6f`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000355
• Tokens: 140006 input · 4472 output · 25856 cached · 98 embedding

Head	State	Pass summary
f18eafe0d07b	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-13T23:29:15Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0004 · 140,006 in / 4,472 out · 25,856 cached (18%) · ladder/vectors-oai3, deepseek-v4.1-flash · 98 embedded
critique:    $0.0002 · 90,643 in  / 2,242 out · 15,232 cached (17%) · deepseek-v4.1-flash
security:    $0.0000 · 27,519 in  / 208 out   · 3,968 cached (14%)  · deepseek-v4.1-flash
description: $0.0001 · 19,836 in  / 1,192 out · 6,656 cached (34%)  · deepseek-v4.1-flash