fix: resolve failing CI (run 32803046325)

[WomB0ComB0]

Automated CI fix from ralph triage --fix-ci using a local model. Failing run: https://github.com/resq-software/crates/actions/runs/32803046325

⚠️ Agent-generated — please review before merging.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 525be966-8b02-4627-a10b-ee195ea0bdd2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Audit started.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for #193 · age00 · 119.5 AIC · ⌖ 13.3 AIC · ⊞ 7.3K · ◷

[github-actions]

PR Audit: #193

Summary

This PR modifies Cargo.lock to downgrade windows-sys from 0.61.2 to 0.52.0 for several crates. This appears to be a targeted fix to resolve CI failures or unify dependency versions.

Findings

1. Incomplete Dependency Consolidation (Cargo.lock)

While several crates were downgraded to windows-sys 0.52.0, tokio v1.53.1 still requires windows-sys 0.61.2. This means the workspace still contains two versions of windows-sys, which partially defeats the purpose of consolidation and increases build times/binary size slightly.

• Recommendation: Consider if tokio can also be downgraded to a version that supports 0.52.0, or if all other crates can be upgraded to 0.61.2 instead.

2. Potential Indexing Limitation in resq-dsa (General Observation)

While not introduced in this PR, I noticed that BloomFilter and CountMinSketch use u32 for hashing and then cast to usize for modulo indexing:

let mut h: u32 = ...;
(h as usize) % m

On 64-bit systems, if m (bit count or width) exceeds u32::MAX (~4.29 billion), the higher bits will never be indexed, effectively capping the filter size at 512MB and increasing the false positive rate for larger allocations.

• Recommendation: Use u64 or usize for the hash state to support larger data structures on 64-bit platforms.

3. Security: Bootstrap Script (bootstrap.sh)

The bootstrap.sh script uses the curl | sh pattern. While convenient, it relies on the security of the remote server and the transport layer.

• Recommendation: Ensure that the remote installer is pinned to a specific hash or version if possible, or provide checksum verification.

Conclusion

The PR is safe to merge as it resolves immediate CI issues, but further cleanup of the dependency tree and the noted library bugs is recommended.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for #193 · age00 · 119.5 AIC · ⌖ 13.3 AIC · ⊞ 7.3K · ◷

[WomB0ComB0]

Ralph verified: CI is green and the PR is mergeable — ready for your review/merge.