[chaliy]

What changed

Same dependency bumps as #2848 (fancy-regex 0.20, getrandom 0.4, hashbrown 0.17, itertools 0.15, speedate 0.18, strum 0.28) except ruff_python_* capped at 0.0.15 instead of 0.0.20, plus two small API adaptations. Supersedes #2848.

Why

#2848 cannot land: ruff 0.0.16+ requires rustc 1.97 but the repo pins Rust 1.96.0 (error: rustc 1.96.0 is not supported by ruff_python_ast@0.0.20 ... fails every CI job). Newest rustc-1.96-compatible ruff release is 0.0.15 (verified via crates.io metadata for all six crates).

Before / After

Before (#2848): Lint and every downstream job fail at dependency resolution.
After: cargo check --workspace --all-targets, cargo clippy -- -D warnings, and cargo test -p bashkit-monty (49 passed) all green locally; full matrix runs here.

API adaptations (behavior-preserving):

• fancy-regex 0.20 made Captures generic over input type: Captures<'_> → Captures<'_, str> (2 call sites)
• ruff 0.0.15 renamed TokenKind::Name → TokenKind::Identifier (1 site)

Risk

• Low: version bumps + mechanical type-level adaptations, no logic changes.
• Dependabot will re-propose ruff 0.0.20+ while the toolchain stays at 1.96; that proposal must wait for a deliberate Rust 1.97 bump.

Checklist

• cargo check --workspace --all-targets green
• cargo clippy --workspace --all-targets -- -D warnings green
• cargo test -p bashkit-monty green (49 passed)
• CI green — required before merge

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	9a278ed	Commit Preview URL Branch Preview URL	Nov 06 2026, 05:39 AM

[bashkit-pr-reviewer]

Dependency bump with mechanical adaptations; verified the two API changes against the new crate versions and the lockfile. One maintainability suggestion below, otherwise clean.

[bashkit-pr-reviewer]

[P2] The ruff 0.0.15 cap is correct (0.0.x caret semantics pin it exactly, and the toolchain is pinned to 1.96.0 in rust-toolchain.toml), but nothing in the manifest records why ruff is held back while everything else floats. The PR body itself notes Dependabot will re-propose 0.0.20+, which will break dependency resolution in every CI job again. Consider a one-line comment above these pins (and the ruff_python_stdlib pin in bashkit-monty-types/Cargo.toml), e.g. # ruff >0.0.15 requires rustc 1.97; held until the 1.96 toolchain pin is deliberately bumped.

[bashkit-pr-reviewer]

Review summary (head 9a278ed, 5 commits, rebased on 4800b28)

Verdict: The new supply-chain commit is thorough and internally consistent. No new inline findings; one open verification item below (CI-decided), plus the earlier P2 still stands.

What the new commit does: supply-chain/audits.toml (+18) adds delta audits whose endpoints all match the new lockfile (signal-hook→0.4.6, smallvec→1.16.4 with a chained 1.15.2→1.16.0→1.16.4, syn 3.0.4→…→3.0.8 chain, twox-hash→2.1.4, unicode-normalization→0.1.26, uuid 1.24.1→1.26.0, wasm-bindgen→0.2.128). supply-chain/config.toml (+23/−15) adds matching exemptions for the bumped versions (fancy-regex 0.20.0, getrandom 0.4.3, speedate 0.18.0, strum 0.28.0 + macros, unicode_names2 4.0.0, the six ruff 0.0.15 crates including the newly-introduced ruff_python_trivia, syn 3.0.9). No criteria weakened; everything stays safe-to-deploy.

Open verification item (not a finding): hashbrown 0.17.1 and itertools 0.15.0 are in the new lockfile but have no local audit or exemption (only hashbrown 0.15.5 / itertools 0.13.0+0.14.0 are exempted). Coverage must therefore come from the bytecodealliance/mozilla imports at vet time, which I cannot resolve offline. The cargo vet --locked job (ci.yml) is the decider: green means covered, red means add delta audits or exemptions for those two versions.

Still open from last round: ruff-ignore-without-coverage-test (P2) — the six dependabot ignores have no enforcement-test sibling; untouched by this push.

Standing verification: pin comments + dependabot ignores intact after rebase; generic-Captures adaptation and TokenKind::Identifier unchanged; no sandbox/VFS/threat-model impact; knowledge file already indexed.

Review caveat: the snapshot checkout dropped 154 files on transport errors (examples/docs); I refreshed supply-chain/* directly and reviewed those plus the full diff (truncated: false, all 10 files visible). Cannot build here, so CI remains the backstop.

[bashkit-pr-reviewer]

Rebase looks clean and the earlier feedback is preserved. One suggestion on making the new guardrail stick.

[bashkit-pr-reviewer]

[P2] These six ignores are the only thing stopping Dependabot from re-proposing ruff 0.0.20+ (the exact failure that sank #2848), but unlike the analogous wasmtime hold, nothing tests that they survive. test_no_cargo_entry_can_propose_a_wasmtime_bump in scripts/tests/test_dependabot_coverage.py enforces the wasmtime ignore per cargo entry; a sibling test_no_cargo_entry_can_propose_a_ruff_bump asserting the six ruff_python_* names stay ignored for >=0.0.16 would give this hold the same protection. Without it, a future dependabot.yml tidy can silently drop these lines and the breakage only resurfaces as red CI on the next'Dependabot PR.

[chaliy]

This PR is obsolete — main solved the same problem a different way a few hours after it was opened, and the approach here now fails CI.

Every bump in this PR is to a crate only the Monty forks declare (ruff_python_*, hashbrown, itertools, speedate, strum, unicode_names2). Since #2852 those are in Dependabot's ignore list — that block cites #2848 by name — and since #2861 check_monty_fork.py rejects any fork Cargo.toml dependency that differs from upstream Monty 1.4.0. Rebasing this branch on current main gives 18 drift errors, 15 of them these manifest lines.

So the premise no longer holds either: capping ruff_python_* at 0.0.15 is unnecessary, because Dependabot no longer proposes those crates at all. The forks move when upstream source is re-copied, per the re-sync workflow in knowledge/operations/dependencies.md.

The two API adaptations here are still needed and have landed with their own markers in #2876 (Captures<'_, str> for fancy-regex 0.20) — that PR takes the shared-dep half of this work (fancy-regex 0.20, getrandom 0.4) the way the current rules allow.

Recommend closing. Leaving it to you rather than closing someone else's PR; nothing here is lost.

---

Generated by Claude Code

[chaliy]

Closing as approved — obsolete, and nothing in it is lost.

Every bump here was to a crate only the Monty forks declare (ruff_python_*, hashbrown, itertools, speedate, strum, unicode_names2). Since #2852 those are in Dependabot's ignore list, and since #2861 check_monty_fork.py rejects any fork Cargo.toml dependency differing from upstream Monty 1.4.0 — rebasing this branch on current main produced 18 drift errors, 15 of them these manifest lines.

The premise is gone too: capping ruff_python_* at 0.0.15 is unnecessary now that Dependabot does not propose those crates at all. The forks move when upstream source is re-copied, per the re-sync workflow in knowledge/operations/dependencies.md.

The two API adaptations have landed with markers in #2876 (Captures<'_, str> for fancy-regex 0.20), which took the shared-dep half of this work the way the current rules allow.

---

Generated by Claude Code