From 65f5693fa08664fae65cae2a26c8cec79c88d850 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 10:30:07 +0000 Subject: [PATCH 1/6] deps: bump tinystoragedrivers-core from v1.0.0 to v1.5.0 Bumps [tinystoragedrivers-core](https://github.com/tinyhumansai/tinystoragedrivers) from v1.0.0 to v1.5.0. - [Release notes](https://github.com/tinyhumansai/tinystoragedrivers/releases) - [Commits](https://github.com/tinyhumansai/tinystoragedrivers/compare/141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d...c9ea6ff1615b77b55d7269403af5fd11bedc9ce8) --- updated-dependencies: - dependency-name: tinystoragedrivers-core dependency-version: 6d1a1029de402f5937113fcc56e4023e0dc61c94 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Cargo.lock | 26 +++++++++++++++++++++----- crates/tinymcp-bus/Cargo.toml | 2 +- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0a1ea9dc..9b57eb73 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1917,7 +1917,7 @@ dependencies = [ "tinymcp-bus", "tinystoragedrivers-busproxy", "tinystoragedrivers-client", - "tinystoragedrivers-core", + "tinystoragedrivers-core 1.5.0", "tinystoragedrivers-secrets", "tinytools", "tokio", @@ -1937,7 +1937,7 @@ dependencies = [ "schemars", "serde", "serde_json", - "tinystoragedrivers-core", + "tinystoragedrivers-core 1.5.0", "tokio", "url", ] @@ -1963,7 +1963,7 @@ dependencies = [ "tinybus", "tinystoragedrivers-bus", "tinystoragedrivers-client", - "tinystoragedrivers-core", + "tinystoragedrivers-core 1.0.0", "tokio", ] @@ -1976,7 +1976,7 @@ dependencies = [ "serde", "serde_json", "tinystoragedrivers-bus", - "tinystoragedrivers-core", + "tinystoragedrivers-core 1.0.0", "tinystoragedrivers-secrets", "tokio", ] @@ -1997,6 +1997,22 @@ dependencies = [ "zstd", ] +[[package]] +name = "tinystoragedrivers-core" +version = "1.5.0" +source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.5.0#c9ea6ff1615b77b55d7269403af5fd11bedc9ce8" +dependencies = [ + "async-trait", + "data-encoding", + "serde", + "serde_json", + "sha2 0.10.9", + "thiserror", + "tokio", + "ulid", + "zstd", +] + [[package]] name = "tinystoragedrivers-secrets" version = "1.0.0" @@ -2012,7 +2028,7 @@ dependencies = [ "serde", "serde_json", "sha2 0.10.9", - "tinystoragedrivers-core", + "tinystoragedrivers-core 1.0.0", "tokio", "winapi-util", "windows-permissions", diff --git a/crates/tinymcp-bus/Cargo.toml b/crates/tinymcp-bus/Cargo.toml index cb6d83f5..729c3506 100644 --- a/crates/tinymcp-bus/Cargo.toml +++ b/crates/tinymcp-bus/Cargo.toml @@ -30,7 +30,7 @@ base64 = { workspace = true } # no I/O. Its sole tokio features are io-util and time, so this adds no runtime # to a host that links the contract. Backs `storage::storage_schema`; optional, # enabled only by the `storage` feature so the default closure stays pure. -tinystoragedrivers-core = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0", default-features = false, optional = true } +tinystoragedrivers-core = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0", default-features = false, optional = true } [dev-dependencies] # The WHATWG parser the `ui` link splitter must agree with: its differential From 8648838e4391c6e14b3ddf4b8f33fe09202b5e17 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Wed, 21 Oct 2026 16:20:29 +0000 Subject: [PATCH 2/6] chore: files changed Cargo.toml Auto-committed-on: cuttlefish Co-authored-by: Medulla --- Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 2ec89111..893ae8d3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -115,9 +115,9 @@ tracing = { version = "0.1", default-features = false, features = ["std"] } # store call them. A git tag, like every other tinystoragedrivers consumer, so a # host that vendors the repository once redirects it with a `[patch]`. This # crate links no database: the host picks the backend. -tinystoragedrivers-core = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0", features = ["blocking"] } +tinystoragedrivers-core = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0", features = ["blocking"] } # The `SecretStore` port: server environment values and OAuth bundles are kept -# there, never in a document. Same tag as the core. +# there, never in a document. Same release family as the core. tinystoragedrivers-secrets = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0" } # The module-side storage bus: `connect_storage` over the module's TinyBus # connection, giving the same port traits the host serves. Used only by the From 9c7a5c3d9066f896c3eee0fa64d4f93d619251f4 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Wed, 21 Oct 2026 16:22:58 +0000 Subject: [PATCH 3/6] chore: files changed Cargo.toml Auto-committed-on: cuttlefish Co-authored-by: Medulla --- Cargo.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 893ae8d3..566ba269 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -118,12 +118,12 @@ tracing = { version = "0.1", default-features = false, features = ["std"] } tinystoragedrivers-core = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0", features = ["blocking"] } # The `SecretStore` port: server environment values and OAuth bundles are kept # there, never in a document. Same release family as the core. -tinystoragedrivers-secrets = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0" } +tinystoragedrivers-secrets = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0" } # The module-side storage bus: `connect_storage` over the module's TinyBus # connection, giving the same port traits the host serves. Used only by the # `module` feature (a cdylib reaches storage through the host, never a file). -tinystoragedrivers-busproxy = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0" } -tinystoragedrivers-client = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.0.0" } +tinystoragedrivers-busproxy = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0" } +tinystoragedrivers-client = { git = "https://github.com/tinyhumansai/tinystoragedrivers", tag = "v1.5.0" } # Locating a user's home directory, to find the version-manager shim # directories a desktop launch's stripped PATH leaves out. dirs = "7" From da87777cd2c2fb65d7825d2c4ef98e8b31fb59e7 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Wed, 21 Oct 2026 16:23:37 +0000 Subject: [PATCH 4/6] chore: files changed Cargo.lock Auto-committed-on: cuttlefish Co-authored-by: Medulla --- Cargo.lock | 42 +++++++++++++----------------------------- 1 file changed, 13 insertions(+), 29 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9b57eb73..00d5b6dd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1917,7 +1917,7 @@ dependencies = [ "tinymcp-bus", "tinystoragedrivers-busproxy", "tinystoragedrivers-client", - "tinystoragedrivers-core 1.5.0", + "tinystoragedrivers-core", "tinystoragedrivers-secrets", "tinytools", "tokio", @@ -1937,15 +1937,15 @@ dependencies = [ "schemars", "serde", "serde_json", - "tinystoragedrivers-core 1.5.0", + "tinystoragedrivers-core", "tokio", "url", ] [[package]] name = "tinystoragedrivers-bus" -version = "1.0.0" -source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.0.0#141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d" +version = "1.5.0" +source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.5.0#c9ea6ff1615b77b55d7269403af5fd11bedc9ce8" dependencies = [ "serde", "serde_json", @@ -1954,8 +1954,8 @@ dependencies = [ [[package]] name = "tinystoragedrivers-busproxy" -version = "1.0.0" -source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.0.0#141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d" +version = "1.5.0" +source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.5.0#c9ea6ff1615b77b55d7269403af5fd11bedc9ce8" dependencies = [ "async-trait", "serde", @@ -1963,40 +1963,24 @@ dependencies = [ "tinybus", "tinystoragedrivers-bus", "tinystoragedrivers-client", - "tinystoragedrivers-core 1.0.0", + "tinystoragedrivers-core", "tokio", ] [[package]] name = "tinystoragedrivers-client" -version = "1.0.0" -source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.0.0#141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d" +version = "1.5.0" +source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.5.0#c9ea6ff1615b77b55d7269403af5fd11bedc9ce8" dependencies = [ "async-trait", "serde", "serde_json", "tinystoragedrivers-bus", - "tinystoragedrivers-core 1.0.0", + "tinystoragedrivers-core", "tinystoragedrivers-secrets", "tokio", ] -[[package]] -name = "tinystoragedrivers-core" -version = "1.0.0" -source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.0.0#141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d" -dependencies = [ - "async-trait", - "data-encoding", - "serde", - "serde_json", - "sha2 0.10.9", - "thiserror", - "tokio", - "ulid", - "zstd", -] - [[package]] name = "tinystoragedrivers-core" version = "1.5.0" @@ -2015,8 +1999,8 @@ dependencies = [ [[package]] name = "tinystoragedrivers-secrets" -version = "1.0.0" -source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.0.0#141fd9ed0ad5d14a8fb5a1b3e837a719e81ac08d" +version = "1.5.0" +source = "git+https://github.com/tinyhumansai/tinystoragedrivers?tag=v1.5.0#c9ea6ff1615b77b55d7269403af5fd11bedc9ce8" dependencies = [ "async-trait", "atomicwrites", @@ -2028,7 +2012,7 @@ dependencies = [ "serde", "serde_json", "sha2 0.10.9", - "tinystoragedrivers-core 1.0.0", + "tinystoragedrivers-core", "tokio", "winapi-util", "windows-permissions", From 5262de424f60606b430e98ae194ea2579b74b517 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Wed, 21 Oct 2026 16:33:43 +0000 Subject: [PATCH 5/6] chore: files changed scripts/build-module.sh Auto-committed-on: cuttlefish Co-authored-by: Medulla --- scripts/build-module.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/build-module.sh b/scripts/build-module.sh index 0185c41d..ecfa9d7f 100755 --- a/scripts/build-module.sh +++ b/scripts/build-module.sh @@ -72,6 +72,10 @@ while IFS= read -r file; do mkdir -p "$stage/$(dirname "$file")" cp "$file" "$stage/$file" done < <(jq -r '.[]' <<<"$extras") +# Keep extracted module directories private from group and other writers. The +# verifier rejects writable directories because another user could replace the +# library after its checksum is checked. +find "$stage" -type d -exec chmod go-w {} + archive="$output/${crate}-${version}-${host}.tar.gz" tar -C "$stage" -czf "$archive" . echo "$archive" From 56f2126c45f4644f23243745c84bb0f24da630ad Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Wed, 21 Oct 2026 18:57:26 +0000 Subject: [PATCH 6/6] chore(build): simplify comment on module directory permissions Reworded the comment explaining why packaged module directories are made non-writable for group and other users, dropping the reference to the verifier's checksum check. Auto-committed-on: cuttlefish Co-authored-by: Medulla --- scripts/build-module.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/scripts/build-module.sh b/scripts/build-module.sh index ecfa9d7f..021f5207 100755 --- a/scripts/build-module.sh +++ b/scripts/build-module.sh @@ -72,9 +72,7 @@ while IFS= read -r file; do mkdir -p "$stage/$(dirname "$file")" cp "$file" "$stage/$file" done < <(jq -r '.[]' <<<"$extras") -# Keep extracted module directories private from group and other writers. The -# verifier rejects writable directories because another user could replace the -# library after its checksum is checked. +# Keep packaged module directories from being writable by group or other users. find "$stage" -type d -exec chmod go-w {} + archive="$output/${crate}-${version}-${host}.tar.gz" tar -C "$stage" -czf "$archive" .