[dependabot]

Bumps the fuzz-dependencies group in /crates/bashkit/fuzz with 6 updates:

Package	From	To
tokio	1.53.1	1.53.2
wasmtime	48.0.5	49.0.2
thiserror	2.0.20	2.0.21
fancy-regex	0.19.0	0.19.2
flate2	1.1.9	1.1.10
clap	4.6.6	4.6.7

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates wasmtime from 48.0.5 to 49.0.2

Release notes

Sourced from wasmtime's releases.

v49.0.2

49.0.2

Released 2026-10-02.

Fixed

• WASI preview 0 implementation of poll_oneoff circumvents fuel consumption. GHSA-j366-h8gg-77pm

• Excessive allocated memory on the host when guests don't have stdio. GHSA-gqmc-89g8-p25r

• fd_readdir copies uninitialized struct padding into guest memory. GHSA-96f6-r43r-8c24

• Guest can panic host through filesystem timestamp before the epoch on wasip3. GHSA-mr2v-56j5-cmfc

• Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. GHSA-32h6-97mm-8q3c

• Mis-typed WebAssembly tag imports can lead to GC heap corruption. GHSA-cfhf-m2cr-62wj

• Wasmtime wasi:http implementation panics with a zero timeout supplied. GHSA-w4qr-p94g-mjhv

• Rooting for GC values live across try_call may be missing, causing GC heap corruption. GHSA-hw8m-q44c-ggrf

v49.0.1

49.0.1

Released 2026-09-24.

Fixed

• Do not drop fuel-spend accrued by callees of call_ref and callees that return via exception throws. GHSA-m63x-6p34-q65x

• Fix fuel spend for dynamic record lifting. GHSA-jqpg-j7w6-42pr

• Fix host memory exhaustion on outgoing HTTP body write. GHSA-c9gc-w9vx-w86p

• wasmtime-wasi: Fix panic on out-of-range datetimes in WASI filesystem set-times, set-times-at.

... (truncated)

Changelog

Sourced from wasmtime's changelog.

49.0.2

Released 2026-10-02.

Fixed

• WASI preview 0 implementation of poll_oneoff circumvents fuel consumption. GHSA-j366-h8gg-77pm

• Excessive allocated memory on the host when guests don't have stdio. GHSA-gqmc-89g8-p25r

• fd_readdir copies uninitialized struct padding into guest memory. GHSA-96f6-r43r-8c24

• Guest can panic host through filesystem timestamp before the epoch on wasip3. GHSA-mr2v-56j5-cmfc

• Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. GHSA-32h6-97mm-8q3c

• Mis-typed WebAssembly tag imports can lead to GC heap corruption. GHSA-cfhf-m2cr-62wj

• Wasmtime wasi:http implementation panics with a zero timeout supplied. GHSA-w4qr-p94g-mjhv

• Rooting for GC values live across try_call may be missing, causing GC heap corruption. GHSA-hw8m-q44c-ggrf

---

49.0.1

Released 2026-09-24.

Fixed

• Do not drop fuel-spend accrued by callees of call_ref and callees that return via exception throws. GHSA-m63x-6p34-q65x

• Fix fuel spend for dynamic record lifting. GHSA-jqpg-j7w6-42pr

• Fix host memory exhaustion on outgoing HTTP body write. GHSA-c9gc-w9vx-w86p

• wasmtime-wasi: Fix panic on out-of-range datetimes in WASI filesystem set-times, set-times-at. GHSA-j2g9-4prp-pf6h

... (truncated)

Commits

• 3c8a3e7 Release Wasmtime 49.0.2 (#14474)
• 63609c8 [49.0.x] Combined backports and fixes for today's security release (#14477)
• 46c23a8 Release Wasmtime 49.0.1 (#14401)
• 74657a7 Fix four vulnerabilities in Wasmtime v49. (#14406)
• 17830bd Release Wasmtime 49.0.0 (#14363)
• 18efdb6 Update release notes (#14322)
• 51387c9 Drop cached compiler contexts between modules/components (#14314) (#14321)
• 9847e1b [49.0.0] Backport some recent fixes/improvements from main (#14306)
• 62ef0a5 Release Wasmtime 49.0.0-rc.1 (#14283)
• cb4c215 Limit alias regions in Wasm-to-CLIF translation to 256 (#14253)
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates fancy-regex from 0.19.0 to 0.19.2

Release notes

Sourced from fancy-regex's releases.

0.19.2

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

0.19.1

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

Changelog

Sourced from fancy-regex's changelog.

[0.19.2] - 2026-09-13

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

• Fix a panic in capture_names() for a pattern with a zero-repeated named group such as (?<n>a){0} (#275)
• Literal bytes were being encoded as utf-8 in Ascii mode, now they match the exact byte literal

[0.19.1] - 2026-09-06

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

Commits

• e268485 Version 0.19.2
• ee2e3a0 Merge pull request #281 from fancy-regex/leftmost_longest
• c9fa74e add another leftmost longest test assertion
• 797768f add leftmost_longest check to agents.md
• c323111 small refactor to avoid duplicating code
• c063e72 fix bug whereby leftmost longest match wasn't being returned when later, long...
• 04d8796 Update changelog
• 515397a add missing feature flag to documentation
• ba0416f small addition to contributing guide
• 4be8648 feat: gate leftmost_longest behind optional feature flag
• Additional commits viewable in compare view

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

• feat: reuse zlib's decoder buffer by @​Vaiz in rust-lang/flate2-rs#532
• feat: add reset method for read::GzDecoder and buffered::GzDecoder by @​Vaiz in rust-lang/flate2-rs#534
• Drop cloudflare-zlib by @​kornelski in rust-lang/flate2-rs#539
• Add a wrapper for the Crc struct by @​MikkelPaulson in rust-lang/flate2-rs#540
• Bump miniz_oxide to 0.9 by @​oscargus in rust-lang/flate2-rs#543
• Upgrade miniz_oxide and add unit tests of the different flush kinds by @​fintelia in rust-lang/flate2-rs#498
• Fix infinite loop in writing gzip header/footer by @​Shnatsel in rust-lang/flate2-rs#547
• test: generate corrupt gzip fixture at runtime by @​nanookclaw in rust-lang/flate2-rs#550
• Reject oversized gzip extra fields by @​Byron in rust-lang/flate2-rs#553
• Reject incomplete deflate streams at EOF by @​Guflly in rust-lang/flate2-rs#556
• Include README.md in a private module by @​bushrat011899 in rust-lang/flate2-rs#562
• Add no_std support using nightly alloc_io by @​bushrat011899 in rust-lang/flate2-rs#559
• Update get_mut() documentation to make clear how 'inner` can be used by @​Byron in rust-lang/flate2-rs#558

New Contributors

• @​Vaiz made their first contribution in rust-lang/flate2-rs#532
• @​MikkelPaulson made their first contribution in rust-lang/flate2-rs#540
• @​oscargus made their first contribution in rust-lang/flate2-rs#543
• @​nanookclaw made their first contribution in rust-lang/flate2-rs#550
• @​Guflly made their first contribution in rust-lang/flate2-rs#556
• @​bushrat011899 made their first contribution in rust-lang/flate2-rs#562

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits

• ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
• fb5228d Merge pull request #559 from bushrat011899/no_std
• 6ed3ba3 Add executable no_std example
• faed8a0 Expand CI to test no_std compatibility and correctness
• 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
• 3fe1126 Centralize usage of std for error and io
• 98e313a Add GzHeader::mtime_as_duration
• 0642965 Switch to core implicit prelude and only use std where required
• 454a63c Remove left-over dbg! statement
• 2a490b7 Add runtime_detection feature
• Additional commits viewable in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	08a4d66	Commit Preview URL Branch Preview URL	Oct 07 2026, 04:20 AM