[chaliy]

What changed

Main CI and nightly are red in four independent ways, none caused by a code change of ours. Three commits, one per cause:

#	Break	Jobs it reddens	Fix
1	Advisories published 19–20 Oct: rustls-webpki 0.103.15 (RUSTSEC-2026-0382), webpki-root-certs 1.0.9 (RUSTSEC-2026-0383), certifi 2026.7.22 (GHSA-6q48-6c7w-9gw2)	Audit, on main and every PR	fixed releases + a reviewed cargo vet delta audit per crate
2	jq 1.8 stopped letting --indent 0 imply -c (jqlang/jq#3232), and our jq oracle was unpinned	Test, Generate Rust Coverage, nightly asan	follow current jq + digest-pinned scripts/install-jq-ci.sh
3	Python 3.9 is absent from the 26.04 hosted image; setup-python has no fallback	Test (Python 3.9)	pin the version matrix to ubuntu-24.04
4	Ubuntu 26.04 installs uutils as the coreutils package, so dd/join/od/pr stop reporting GNU	Generate Rust Coverage, and Test once #2 is fixed	pin the three jobs that need the GNU oracle to ubuntu-24.04

Commit 2 also fixes a pre-existing parity bug found while checking the flag combinations: -c always won over --indent N, and --tab always won over a later --indent N, but real jq — 1.7 and 1.8 alike — is strictly last-flag-wins, so jq -c --indent 4 was wrong here. The cause was redundant state: a compact_output bool beside an indent: Indent whose Compact variant already said the same thing, with the tie broken after parsing. One field now holds the output shape and each flag overwrites it, so last-wins falls out of parse order.

yq is deliberately untouched — its -I 0 means compact, which is mikefarah/yq's own documented semantics, not jq's.

Why these are together

They block each other. Audit and Test gate every PR, so while main is broken four ways no single-purpose PR can reach green — each fix is held red by the other three. Splitting them would mean porting fixes between branches to get any one of them verifiable. #2769 was the jq fix on its own; it is closed and absorbed here, with its diagnosis kept on that thread.

Break #4 was also hidden behind #2: cargo test aborts on the jq target before the integration binary runs, so fixing jq alone would only have moved the Test job's red from one cause to another. It surfaced in the coverage job, which got further.

Before / After

Advisory scan (./scripts/audit-lockfiles.sh, the single source both the CI Audit job and nightly's Advisory Audit call) — before, from nightly run 39541706404:

cargo audit ./Cargo.lock
  rustls-webpki 0.103.15     RUSTSEC-2026-0382
  webpki-root-certs 1.0.9    RUSTSEC-2026-0383
error: 2 vulnerabilities found!
cargo audit ./crates/bashkit/fuzz/Cargo.lock
  rustls-webpki 0.103.15     RUSTSEC-2026-0382
error: 1 vulnerability found!
osv audit ./examples/docs-grep-agent/uv.lock: 1 vulnerable packages
  certifi 2026.7.22   GHSA-6q48-6c7w-9gw2, PYSEC-2026-4320
Process completed with exit code 1

After, across all four cargo lockfiles, five pnpm lockfiles and the uv lockfile: clean, with only the pre-existing allowlisted atomic-polyfill warning. cargo vet --locked → Vetting Succeeded (98 fully audited, 84 partially audited, 494 exempted).

jq --indent 0 — oracle is jq 1.8.1, SHA-256 020468de…c2a0d, matching the pin. echo '{"a":[1,2]}' | jq <flags> .:

flags	before	after	real jq 1.8.1
--indent 0	{"a":[1,2]}	newlines, no indent	same as after
-c --indent 0	{"a":[1,2]}	newlines, no indent	same as after
--indent 0 -c	{"a":[1,2]}	{"a":[1,2]}	same
-c --indent 4	{"a":[1,2]}	4-space indented	same as after
--indent 4 -c	{"a":[1,2]}	{"a":[1,2]}	same
-c --tab	{"a":[1,2]}	tab indented	same as after
--tab --indent 4	tab indented	4-space indented	same as after

I replayed every case in the differential suite against both jq 1.7 and 1.8.1 to size the blast radius. --indent 0 is the only behavior the two versions disagree on anywhere, which is why the precedence cases assert unconditionally and only --indent 0 is gated behind assert_matches_from_jq((1, 8), …):

SAME -c --indent 4   SAME --indent 4 -c   SAME --indent 0 -c   SAME -c --tab
SAME --tab -c        SAME --tab --indent 4   SAME --indent 4 --tab
SAME --indent 0 --indent 4
DIFF -c --indent 0   1.7={"a":[1,2]}   1.8={|"a": [|1,|2|]|}

Local verification of the whole branch — just check with the pinned jq 1.8.1 on PATH, exit 0, no failures. The tests that prove each fix:

test builtins::jq::format::tests::indent_zero_renders_newlines_without_indent ... ok
test builtins::jq::format::tests::indent_zero_nests_without_indent ... ok
test builtins::jq::format::tests::compact_is_the_only_compact_switch ... ok
test builtins::jq::tests::output_shape_flags_are_last_wins ... ok
test builtins::jq::tests::later_indent_overrides_tab ... ok
test builtins::jq::tests::differential::diff_indent_0 ... ok
test builtins::jq::tests::differential::diff_indent_0_nested ... ok
test builtins::jq::tests::differential::diff_output_shape_flags_are_last_wins ... ok
test dd_tests::dd_normal_copies_match_gnu ... ok
test join_resource_tests::join_ordinary_options_match_gnu ... ok
test od_resource_tests::od_normal_layout_matches_gnu ... ok
test pr_resource_tests::pr_finite_pagination_matches_real_bash_and_gnu_pr ... ok

Plus cargo vet --locked, just check-workflow-parity (version coverage matches; it ignores runner labels, so the Python pin keeps CI and release in step), just check-okf, just check-doc-links.

Risk

• Low for feat(bashkit): Phase 0 - Bootstrap minimal working shell #1 and feat(bashkit): Phase 2 complete - control flow, functions, builtins #3: patch-level dependency bumps and a runner label.
• Low–Medium for feat(bashkit): Phase 1 - Foundation with variables, pipes, redirects #2: --indent 0 and the flag combinations change output shape, so a caller relying on --indent 0 meaning compact now gets pretty output — exactly as from a real jq 1.8 upgrade. -c alone, --indent N alone and --tab alone are unchanged, and those are the only forms any jq spec case in the repo uses.
• feat(bashkit): Phase 3 - Command substitution and arithmetic expansion #4 is a stopgap, and is recorded as one in knowledge/operations/testing.md rather than left to rot. Pinning the image keeps the GNU 9.4 oracle these expectations were written against, but 24.04 runners retire and the pin stops those jobs exercising newer images. The durable fix is to install the GNU oracle explicitly, the way rg and jq now are — left out on purpose, because moving the oracle's version can move the expectations with it and that deserves its own differential review. join also probes only /opt/homebrew/bin/gjoin, so it needs normalising before a PATH-based GNU install would cover all four.
• Pinning the image does not undo the jq pin: that oracle arrives via GITHUB_PATH, so jq is 1.8.1 on either image.

Checklist

• Tests added or updated — --indent 0 flat and nested, -c still compact, the full last-wins matrix as unit and differential tests, a regression test for --tab followed by --indent N, and a version-gated oracle helper
• Backward compatibility considered — internal code, no shim; the jq behavior change is the point

Unblocks #2765, whose only red check was the Audit job above.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	1cdf8f7	Commit Preview URL Branch Preview URL	Oct 21 2026, 09:46 AM