From 82fea8dbe0cd5bf7f2d7e8c2487405f15466ab26 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 10:56:00 +0000 Subject: [PATCH 1/2] chore(deps): bump rustyline Bumps the rust-dependencies group with 1 update: [rustyline](https://github.com/kkawakam/rustyline). Updates `rustyline` from 18.0.1 to 19.0.0 - [Release notes](https://github.com/kkawakam/rustyline/releases) - [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md) - [Commits](https://github.com/kkawakam/rustyline/compare/v18.0.1...v19.0.0) --- updated-dependencies: - dependency-name: rustyline dependency-version: 19.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] --- Cargo.lock | 19 +++++++++---------- crates/bashkit-cli/Cargo.toml | 2 +- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0c957da92..32a0c92e7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1029,7 +1029,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1779,7 +1779,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4867,7 +4867,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4925,7 +4925,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4966,12 +4966,11 @@ dependencies = [ [[package]] name = "rustyline" -version = "18.0.1" +version = "19.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53f6a737db68eb1a8ccff86b584b2fc13eca6a7bb6f78ebc7c529547e3ab9684" +checksum = "56e1d6bd81c2d5feafd2419138df9183c45a10a492c4e873b8b0acb8eb2b549e" dependencies = [ "bitflags 2.13.2", - "cfg-if", "clipboard-win", "home", "libc", @@ -5667,10 +5666,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6769,7 +6768,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/crates/bashkit-cli/Cargo.toml b/crates/bashkit-cli/Cargo.toml index 7dc458e93..a8967167a 100644 --- a/crates/bashkit-cli/Cargo.toml +++ b/crates/bashkit-cli/Cargo.toml @@ -43,7 +43,7 @@ bashkit = { path = "../bashkit", version = "0.19.0", default-features = false, f tokio = { workspace = true, features = ["macros", "net", "rt", "rt-multi-thread", "time", "io-std"] } clap.workspace = true anyhow.workspace = true -rustyline = { version = "18", optional = true } +rustyline = { version = "19", optional = true } terminal_size = { version = "0.4", optional = true } signal-hook = { version = "0.4", optional = true } From fcc02ff27d573570d060d1f0d8651abdd1d6fe97 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Wed, 21 Oct 2026 10:15:53 +0000 Subject: [PATCH 2/2] chore(deps): vet rustyline 19.0.0 for the dependabot bump `cargo vet --locked` fails on this PR's own bump -- `rustyline:19.0.0 missing ["safe-to-deploy"]` -- and that is the whole of its red `Audit` check. The advisory scan, cargo-deny licenses and cargo-deny sources all pass on this head; the `error: override toolchain ... is not installed` further up that job's log is noise that appears in passing runs too, where rustup then installs the toolchain and reports `licenses ok, sources ok`. Dependabot can move a version but cannot write a supply-chain entry, so every bump of a vetted or exempted crate arrives unvettable by construction. This is the missing half of its commit, not a separate change. 18.0.1 was an exemption rather than an audit, so the exemption moves to 19.0.0: writing a delta audit would claim a review of a major-version diff that is mostly an edition-2024 migration and a rustfmt reflow, which is not a claim worth making. What the delta was checked for instead: - Dependency set shrinks. `cfg-if` is dropped in favour of std's `cfg_select!`; nothing is added. - `unsafe` occurrences are unchanged at 46, so the termios/raw-mode surface this crate needs did not grow. - No new ambient capability: no filesystem, network or process access that 18.0.1 did not already have. - It builds against the `interactive` feature, which is on by default for `bashkit-cli`, so the editor-construction change in rustyline #950 does not break our call sites. One user-visible REPL change rides along and is recorded in the interactive shell knowledge: the "display all N possibilities?" prompt that `CompletionType::List` shows for a large match set now accepts Tab as confirmation (rustyline #955). --- knowledge/integrations/interactive-shell.md | 5 ++++- supply-chain/config.toml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/knowledge/integrations/interactive-shell.md b/knowledge/integrations/interactive-shell.md index 08885fd75..45634ba9c 100644 --- a/knowledge/integrations/interactive-shell.md +++ b/knowledge/integrations/interactive-shell.md @@ -74,7 +74,10 @@ Completes based on context: - Directories show trailing `/` Uses rustyline `Completer` trait with `CompletionType::List` (shows -all matches on tab). +all matches on tab). From rustyline 19, the "display all N +possibilities?" prompt that `List` shows for a large match set accepts +Tab as confirmation alongside `y`/`n` (rustyline #955), so a second Tab +no longer falls through as a rejected keypress. #### History Hints diff --git a/supply-chain/config.toml b/supply-chain/config.toml index f71744dd7..94c7631a0 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -1664,7 +1664,7 @@ version = "0.3.1" criteria = "safe-to-run" [[exemptions.rustyline]] -version = "18.0.1" +version = "19.0.0" criteria = "safe-to-deploy" [[exemptions.ryu]]