[chaliy]

What changed

rustyline 18.0.1 → 19.0.0 for bashkit-cli's interactive feature, with its
cargo vet exemption moved to the new version in the same commit.

Supersedes #2765, which proposed the same bump but cannot edit
supply-chain/config.toml, so its Audit job fails on the new version with
nothing dependabot can do about it.

Why

A major bump, but no API migration needed: bashkit-cli compiles unchanged
against 19.0.0, so the Editor/Helper surface src/interactive.rs uses is
unaffected. That is the thing worth checking on a major, and it holds.

The lockfile cascade is most of the diff. rustyline 19 drops its cfg-if edge
and pulls windows-sys 0.52.0 → 0.61.2 through the crates that share it
(clipboard-win, rustix, rustls-native-certs, tempfile and neighbours),
plus getrandom 0.3.4 → 0.4.3 under tempfile. cargo vet already covers
every one of those, so rustyline is the only unvetted crate:

$ cargo vet --locked
Vetting Failed!

1 unvetted dependencies:
  rustyline:19.0.0 missing ["safe-to-deploy"]

Its exemption therefore moves 18.0.1 → 19.0.0 — a carry-forward of trust
already extended to this crate, not a grant to something new. The whole
supply-chain diff is one line.

Before / After

No user-visible change: same REPL, same line editing. Verified on the pinned
toolchain (1.95.0):

$ cargo build -p bashkit-cli          # default features, so `interactive` on
   Compiling rustyline v19.0.0
   Compiling bashkit-cli v0.19.0
    Finished `dev` profile

$ cargo test -p bashkit-cli
test result: ok. 67 passed; 0 failed; 0 ignored

$ cargo vet --locked
Vetting Succeeded (98 fully audited, 83 partially audited, 495 exempted)

Compiling is not the same as working, so the REPL was also driven through the
real rustyline read loop rather than only the one-shot path the tests cover:

$ printf 'echo hello-from-repl\nexit\n' | bashkit
hello-from-repl
$ echo $?
0

Risk

• Low
• Confined to the interactive feature of bashkit-cli; the library is
  untouched. A major bump is the thing to be careful with, which is why the
  REPL was exercised directly and not just built.
• getrandom 0.3.4 → 0.4.3 arrives transitively under tempfile. It is
  already vetted at that version, and nothing in bashkit calls it directly.

Checklist

• Tests added or updated — existing bashkit-cli suite (67 tests) plus a
  REPL smoke test; the bump adds no new code surface to test
• Backward compatibility considered — no API change in bashkit's own
  surface; rustyline is an internal CLI dependency

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	74f8aec	Commit Preview URL Branch Preview URL	Oct 20 2026, 11:28 AM

[chaliy]

The Audit failure on 74f8aec is not this PR's, and it is more urgent than this PR.

cargo audit flagged two wasmtime advisories against examples/hyperlight/host/Cargo.lock:

Crate:    wasmtime
Version:  48.0.6
Title:    Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Date:     2026-10-19
ID:       RUSTSEC-2026-0379
Severity: 9.9 (critical)
Solution: Upgrade to >=36.0.19, <37.0.0 OR >=48.0.7, <49.0.0 OR >=49.0.4

Crate:    wasmtime
Version:  48.0.6
Title:    Panic lowering a host-created component model stream into a guest that expects a different payload type
Date:     2026-10-19
ID:       RUSTSEC-2026-0378
Severity: 5.7 (medium)
Solution: Upgrade to >=48.0.7, <49.0.0 OR >=49.0.4

Both were published 2026-10-19 and have nothing to do with rustyline — this PR touches Cargo.lock, crates/bashkit-cli/Cargo.toml and one line of supply-chain/config.toml, none of which involve wasmtime or hyperlight. The Audit job scans every lockfile in the tree regardless of the diff, so this reddens any PR built after the advisory database picked these up, main included. It is not a flake and a re-run will not clear it.

I am not porting the fix into this PR. A critical sandbox-escape advisory deserves its own clearly-titled, independently revertable PR rather than riding inside a rustyline bump where nobody would look for it. So I am closing this one to free the branch, landing the wasmtime fix first, and reopening the rustyline bump afterwards — the work is already verified and will come back unchanged (build clean, 67/67 bashkit-cli tests, cargo vet green, REPL smoke-tested through the real rustyline read loop).

For the record on the fix: 48.0.7 is the in-line patch, so the exact =48.0.6 workspace pin moves to =48.0.7 and stays on the 48.x line the pinned rustc 1.95 supports — the 49.x route is the one that would need a toolchain bump. All three affected lockfiles (root, crates/bashkit/fuzz, examples/hyperlight/host) move together, and cargo vet needs no new exemptions because the bytecodealliance import — wasmtime's own maintainers — already audits the 48.0.7 crates.

---

Generated by Claude Code