[chaliy]

What changed

Two dependency fixes. Nightly is green again, and one of the two accepted npm
advisories is no longer accepted — it has a fix now.

1. Nightly AddressSanitizer compiles again. turso_core depends on
branches with default-features = false, and that no_std path compiles
core::intrinsics::abort() — an unstable intrinsic rustc removed in
1.101.0-nightly. bashkit now declares a direct branches edge under the
sqlite feature purely to turn std on for the whole graph, so abort()
resolves to std::process::abort() and the unstable intrinsic leaves the tree.
No crate is added; this is the same shape of feature-unification shim as the
existing get-size2 pin.

2. GHSA-ch52-4w7c-c8xp is no longer suppressed. When #2498 accepted it,
4.2.0 was both http-cache-semantics' latest release and the advisory's
last_affected — there was no floor to raise. 4.3.0 has since published above
it, which is exactly the removal condition that acceptance recorded. astro 7.3.5
requires ^4.2.0, so the floor goes in site/package.json beside the other
security overrides and the suppression comes out.

braces 3.0.3 is still both the latest release and the last affected one, so
GHSA-vfj7-8cjw-p6xm stays, now as the sole npm entry.

Why

Nightly run #242 failed on an unchanged tree — the same SHA that passed as
run #241 a day earlier. Only the ASan job both tracks floating nightly and
builds turso_core (bashkit-cli enables sqlite by default; Miri builds
bashkit --lib without it), which is why stable CI stayed green and the
breakage surfaced a day late in a job nobody was watching.

There is no version to bump to: branches 0.5.0, its latest release, carries
the same line, and turso_core requires ^0.4.3 regardless. Cargo cannot add a
feature to a transitive dependency, so a direct edge is the fix.

Before / After

Reproduced on the exact failing compiler, 1.101.0-nightly (db8f076d2 2026-10-03) — the same rustc the red run used:

before   $ cargo +nightly check -p bashkit --features sqlite
         error[E0425]: cannot find function `abort` in module `core::intrinsics`
           --> branches-0.4.6/src/lib.rs:45:23
         error[E0308]: mismatched types   (expected `!`, found `()`)
         error: could not compile `branches` (lib) due to 2 previous errors

after    $ cargo +nightly check --workspace --all-targets
         Finished `dev` profile [unoptimized + debuginfo] target(s)

Advisory scan, full tree, fresh RustSec database (1290 advisories), all three
ecosystems:

before   ./site: 1 suppressed (GHSA-ch52-4w7c-c8xp)
         ./site: no known vulnerabilities found

after    ./site: no known vulnerabilities found        <- nothing ignored
         ./crates/bashkit-js: 1 suppressed (GHSA-vfj7-8cjw-p6xm)
         (every other cargo / pnpm / uv lockfile clean)
         exit 0

The site lockfile diff is three lines of http-cache-semantics plus the
override; nothing else re-resolved. pnpm install --frozen-lockfile with the
pinned pnpm 10.11.1 succeeds and the full astro build plus all twelve postbuild
verifiers pass on 4.3.0.

The shim's failure modes are silent, so they are now tested. Cargo unifies
features per version, so bumping the declaration to 0.5.0 resolves a second
copy and leaves turso_core's 0.4.x one with no std. That is verified rather
than assumed — it reproduces the original error verbatim and locks both copies:

$ sed -i 's/"0.4.3"/"0.5.0"/' Cargo.toml && cargo +nightly check -p bashkit --features sqlite
error[E0425]: cannot find function `abort` in module `core::intrinsics`
locked copies of branches: ['0.4.6', '0.5.0']

scripts/tests/test_branches_std_shim.py asserts the std-only feature set,
the 0.4 version line, exactly one locked copy, that sqlite activates the edge,
and that Dependabot ignores the crate. Each of the five was verified to fail
when its invariant is removed, not just to pass as written. Dependabot ignores
branches for the same reason it ignores get-size2, and since 0.5.0 carries
the same intrinsic there is nothing a bump could gain.

A sqlite3 CREATE / INSERT / SELECT round-trip through the sandbox returns the
expected rows with the shim active, so the feature is exercised at runtime and
not only compiled.

Risk

• Low
• Enabling branches/std changes one thing: abort() raises SIGABRT through
  std::process::abort() instead of executing a trap. That is the behaviour a
  std-linking build wants, and it is an abort path either way. No crate added,
  no runtime surface enabled.
• The http-cache-semantics bump is a minor move in build-only tooling that
  never ships — astro is the site's build step. Proven by a frozen-lockfile
  install and a full site build, not just by resolution.
• One accepted risk becomes a real fix. The other stays accepted with its
  removal condition recorded, and suppressed findings are still printed by name,
  so it cannot go quiet.

Checklist

• Tests added or updated
• Backward compatibility considered

Tests: just pre-pr green (fmt, clippy, feature-sliced tests, cargo vet --locked); 147 script tests pass (5 new); full advisory scan exits 0 across
cargo, npm and PyPI; cargo +nightly check --workspace --all-targets clean on
the rustc that broke nightly; site frozen-lockfile install and build green.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	96986b1	Commit Preview URL Branch Preview URL	Oct 04 2026, 09:29 AM