chore: bump iii-sdk to 0.11.3 across all workers#33
Conversation
Aligns every worker on main to iii v0.11.3 (released 2026-04-22). Adds
explicit `=0.11.3` pins so breaking changes in future minor versions
surface as build failures rather than silent drift.
Per-worker:
- llm-router: 0.11.2 -> =0.11.3. 30 tests pass. Fixes README SDK line
(was "0.11.0"), refreshes stats.rs comment noting that the `prefix`
arg sent to `state::list` is client-side-only in 0.11.3 (engine
takes only `{scope}`). Tidies three Default::default() field-
reassign patterns flagged by clippy in tests.
- image-resize: 0.9.0 -> =0.11.3. Drops the `otel` feature flag — OTel
is now always-on in the SDK crate. Switches
`register_function(msg, handler)` to `register_function_with(msg,
handler)` since 0.11.x made `register_function` a single-arg form
via `IntoFunctionRegistration`. 31 tests pass.
- iii-lsp: git dep -> =0.11.3. Adds `..Default::default()` to the
`WorkerMetadata` struct literal since the 0.11.x SDK added an
`isolation` field. 61 tests pass.
- todo-worker (node): 0.9.0 -> 0.11.3. Deletes the committed
`package-lock.json` and adds lockfile patterns to the root
`.gitignore` so lockfile drift cannot reintroduce stale pins.
- todo-worker-python: unpinned -> =0.11.3 via pyproject.
v0.11.3 SDK deltas worth knowing:
- Node SDK now surfaces a typed `IIIInvocationError` with `.code` and
`.function_id`. Existing `catch(e)` paths keep working.
- Engine honors `Content-Type` + response headers on `ApiResponse`
returns (custom content types now passed through).
- RBAC: `engine::channels::create`, `engine::workers::register`, and
`engine::log::*` / `engine::baggage::*` are in the infrastructure
carve-out. Restrictive allow-lists no longer need to enumerate them.
Release: https://github.com/iii-hq/iii/releases/tag/iii/v0.11.3
📝 WalkthroughWalkthroughThe PR updates the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.gitignore (1)
8-10: Avoid ignoring JS lockfiles repo-wide.Adding
package-lock.json,pnpm-lock.yaml, andyarn.lockto.gitignoremakes dependency resolution non-reproducible and weakens supply-chain traceability in CI/CD. Prefer committing exactly one lockfile per JS package-manager path and ignoring only unused lockfile types (or scoping ignores to directories that must stay lockfile-free).Suggested adjustment
node_modules -package-lock.json -pnpm-lock.yaml -yarn.lock +# Keep lockfiles committed for reproducible installs. +# If needed, ignore only lockfiles for package managers not used in this repo.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.gitignore around lines 8 - 10, The .gitignore currently ignores all JS lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) which prevents committing a single authoritative lockfile; remove those entries from .gitignore (or scope them to specific directories that truly should not contain lockfiles) and instead commit the appropriate lockfile for the chosen package manager for each package; update repository policy or README to state which package manager/lockfile to use so CI/CD and dependency resolution remain reproducible.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@todo-worker/package.json`:
- Line 12: The package.json pins "iii-sdk" but no lockfile is committed;
generate and commit the appropriate Node lockfile for the project's package
manager (package-lock.json for npm, pnpm-lock.yaml for pnpm, or yarn.lock for
yarn) by running the install command (npm install / pnpm install / yarn install)
in the todo-worker workspace so transitive dependencies for "iii-sdk" are
reproducible, then add and commit the generated lockfile alongside package.json
and ensure the lockfile is not ignored.
---
Nitpick comments:
In @.gitignore:
- Around line 8-10: The .gitignore currently ignores all JS lockfiles
(package-lock.json, pnpm-lock.yaml, yarn.lock) which prevents committing a
single authoritative lockfile; remove those entries from .gitignore (or scope
them to specific directories that truly should not contain lockfiles) and
instead commit the appropriate lockfile for the chosen package manager for each
package; update repository policy or README to state which package
manager/lockfile to use so CI/CD and dependency resolution remain reproducible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e0caa5ef-e8a4-4667-8a78-c94edce64d0d
⛔ Files ignored due to path filters (3)
iii-lsp/Cargo.lockis excluded by!**/*.lockimage-resize/Cargo.lockis excluded by!**/*.locktodo-worker/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (12)
.gitignoreiii-lsp/Cargo.tomliii-lsp/src/engine_client.rsimage-resize/Cargo.tomlimage-resize/example/package.jsonimage-resize/src/main.rsllm-router/Cargo.tomlllm-router/README.mdllm-router/src/config.rsllm-router/src/functions/stats.rstodo-worker-python/pyproject.tomltodo-worker/package.json
| }, | ||
| "dependencies": { | ||
| "iii-sdk": "0.9.0" | ||
| "iii-sdk": "0.11.3" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify whether a package-manager lockfile remains in the repo and can cover Node worker installs.
echo "Node manifests:"
fd -e json 'package\.json$' | sort
echo
echo "Node lockfiles:"
fd '^(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|bun\.lockb)$' | sortRepository: iii-hq/workers
Length of output: 177
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if lockfiles are explicitly ignored in .gitignore
echo "=== Checking .gitignore for lockfile patterns ==="
if [ -f .gitignore ]; then
echo "Contents of .gitignore:"
cat -n .gitignore
else
echo ".gitignore not found"
fi
echo
echo "=== Checking for monorepo/workspace locks ==="
fd -e lock -e lockfile | head -20
echo
echo "=== Checking for any .npmrc or package manager config ==="
fd -e npmrc -e yarnrc | head -10Repository: iii-hq/workers
Length of output: 455
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check recent git history for lockfile removal
echo "=== Recent commits mentioning package-lock or lockfile ==="
git log --oneline --all -20 | grep -i "lock\|package-lock" || echo "No matches in recent commits"
echo
echo "=== Check if package-lock.json was ever in git history ==="
git log --all --full-history --oneline -- "*package-lock.json" | head -10 || echo "No package-lock.json history found"Repository: iii-hq/workers
Length of output: 760
Keep the Node worker install graph reproducible.
iii-sdk is pinned directly, but package-lock.json, pnpm-lock.yaml, and yarn.lock are explicitly excluded via .gitignore. Without a committed package-manager lockfile, workspace lockfile, or equivalent constraints artifact, transitive dependencies will drift between CI and deployment. Please commit a lockfile for Node workers.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@todo-worker/package.json` at line 12, The package.json pins "iii-sdk" but no
lockfile is committed; generate and commit the appropriate Node lockfile for the
project's package manager (package-lock.json for npm, pnpm-lock.yaml for pnpm,
or yarn.lock for yarn) by running the install command (npm install / pnpm
install / yarn install) in the todo-worker workspace so transitive dependencies
for "iii-sdk" are reproducible, then add and commit the generated lockfile
alongside package.json and ensure the lockfile is not ignored.
There was a problem hiding this comment.
Intentional repo policy: lockfiles stay out of git. Rationale: repo publishes no Node application; package.json only pins the top-level iii-sdk, which is itself pinned to an exact version (0.11.3). The handful of remaining transitive deps are compiled/bundled downstream. Committing a lockfile in each worker would create cross-worker merge conflicts and rotting pins without buying reproducibility the deploy path actually uses. Not applying.
There was a problem hiding this comment.
@rohitg00, understood — that's a clear and well-reasoned policy. I'll record it so this isn't flagged again in future reviews.
ʕ •ᴥ•ʔ 🐇💭
✏️ Learnings added
Learnt from: rohitg00
Repo: iii-hq/workers PR: 33
File: todo-worker/package.json:12-12
Timestamp: 2026-04-22T20:29:05.242Z
Learning: In the iii-hq/workers repository, it is intentional repo policy to NOT commit Node package manager lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock). Rationale: the repo publishes no Node application; top-level iii-sdk is pinned to an exact version in package.json; transitive deps are compiled/bundled downstream; committing lockfiles per worker would cause cross-worker merge conflicts and rotting pins without adding reproducibility value to the actual deploy path. Do not flag missing lockfiles as an issue in this repository.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: CR
Repo: iii-hq/workers PR: 0
File: iii-lsp-vscode/AGENTS.md:0-0
Timestamp: 2026-04-14T11:20:40.697Z
Learning: Use containers for Node commands in the iii-lsp-vscode project. Do not install host-global Node packages.
2 participants
Summary
=0.11.3) on Rust workers so future minor bumps fail loudPer-worker
=0.11.2=0.11.30.9.0(+otel feature)=0.11.3register_function→register_function_with=0.11.3WorkerMetadata { ..Default::default() }for newisolationfield0.9.00.11.3package-lock.json; root.gitignoreblocks future lockfiles==0.11.3llm-router review findings addressed
iii-sdk 0.11.0while Cargo pinned=0.11.2. Both now=0.11.3.state::listengine endpoint takes only{scope}—prefixsent by workers is silently discarded. Added an accurate comment instats.rsso future readers understand thescan_prefixoptimization is forward-looking until the engine supports prefix filtering. Existing code works becauseparse_item::<T>type-discriminates viadeny_unknown_fields.field_reassign_with_defaulterrors in tests fixed via struct-literal form socargo clippy --all-targets -- -D warningsis clean.v0.11.3 SDK deltas worth knowing for worker authors
IIIInvocationErrorwith.codeand.function_id. Existingcatch(e)paths keep working; narrow to the typed class when you need.code≠TIMEOUT|UNKNOWN|FORBIDDEN|….Content-Type+ response headers onApiResponsereturns (custom content types pass through correctly).engine::channels::create,engine::workers::register,engine::log::*,engine::baggage::*are in the infrastructure carve-out. Restrictive allow-lists no longer need to enumerate these.Verification
cargo test+cargo clippy --all-targets --all-features -- -D warningspass on llm-router (30), image-resize (31), iii-lsp (61)cargo checkclean on all Rust workers against 0.11.3 from crates.ioTest plan
Summary by CodeRabbit
Chores
Documentation
Bug Fixes
Style
.gitignoreto exclude additional package manager lockfiles.