[chaliy]

What changed

This fixes two weekly Dependabot cargo jobs that fail on every run, and stops Dependabot from bumping the Monty forks' pinned dependencies.

1. "/" job (red since 2026-10-19). turso_core was declared as "0.8.0-pre.1" while the lock held stable 0.8.3. Dependabot then treated 0.9.0-pre.2 as in range and tried a lockfile-only cargo update --precise, which cargo rejects. The requirement is now "0.8.3", and the lock is unchanged.
2. Example/fixture job (red since 2026-10-13). The hyperlight guest and both random-fs fixtures path-depend on crates/bashkit. Dependabot follows that path and treats every workspace dep of bashkit as theirs, then aborts with InvalidUpdatedDependencies: it can't change root-owned requirements, and the optional deps are in no lockfile here. That entry now allows only each manifest's own deps. It also uses versioning-strategy: increase, because the fixtures have no committed lockfile.
3. Fork deps. After feat(python): upgrade embedded Monty to 1.4.0 with per-VM memory metering #2842, Dependabot bumps crates that only bashkit-monty/bashkit-monty-types declare (chore(deps): bump the rust-dependencies group with 17 updates #2848 moved ruff_python_* from 0.0.14 to 0.0.20 and unicode_names2 from 1 to 4, and its CI is red). Those crates are now ignored in the "/" entry, so they move only with upstream Monty. Deps the forks share with bashkit stay bumpable.

New tests in scripts/tests/test_dependabot_coverage.py pin all three: no prerelease requirement over a stable lock, an allow list that covers each path-dep manifest's own deps, and every fork-only dep ignored.

Why

These jobs fail every week, so nothing gets updated (#2848 shows the fork problem).

Before / After

Before, with the old requirement:

$ cargo update -p turso_core --precise 0.9.0-pre.2
error: failed to select a version for the requirement `turso_core = "^0.8.0-pre.1"`
candidate versions found which didn't match: 0.9.0-pre.2

Dependabot logs: Error processing turso_core (RuntimeError) and Previous version was not provided for: 'num-bigint, pyo3' No requirements change for: 'tokio, thiserror, ...'.

After: the new tests fail on the old config (5 failures) and pass on the new one. The real proof is the next weekly Dependabot run.

Risk

• Low: Dependabot config, one requirement string, and script tests. Cargo.lock is unchanged.
• A new direct dep in a hyperlight or fixture manifest has to be added to allow. The test enforces this.

---

---

<a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1796519405&installation_model_id=447267&pr_number=2852&ref=codesmith_pr_footer&repository=everruns%2Fbashkit&return_to=https%3A%2F%2Fgithub.com%2Feverruns%2Fbashkit%2Fpull%2F2852&signature=3668fa76ab39ca42a778231af3ad0d512bd4ae4392d39fd62962d1d35880f339"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png" width="190" height="28">
^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	71fb4ac	Commit Preview URL Branch Preview URL	Nov 06 2026, 01:10 AM

[bashkit-pr-reviewer]

Review summary — #2852 (head 71fb4ac)

Verdict: looks good. The three failure modes check out against the code I read, and the new coverage tests pin each one. No findings, so no blocking review.

• Prerelease range (Cargo.toml): turso_core 0.8.3 matches the 0.8.3 entry in Cargo.lock, and sits inside the loosened range. The old ^0.8.0-pre.1 ceiling explanation (cargo refusing --precise 0.9.0-pre.2) is consistent with cargo semver semantics for prerelease bounds, and the test asserting no workspace requirement is a prerelease-over-stable-lock closes the loop.
• Out-of-scope manifests (new examples/hyperlight + test-fixtures/* entry with versioning-strategy: increase): I enumerated the externals in all four manifests (wit-bindgen, futures-util, getrandom, wasmtime, napi, napi-derive, napi-build, pyo3) and each is on the new allow list, so Dependabot no longer aborts on path-only bashkit deps. The existing test_no_cargo_entry_can_propose_a_wasmtime_bump guard still covers the root / entry.
• Fork-only ignores: I computed fork-direct-minus-rest deps (25 crates) and all 25 appear in the root ignore list; shared deps (chrono, fancy-regex, num-bigint, …) are deliberately left un-ignored so CI still signals fork breakage, and the new fork-only deps test computes the same set dynamically so the list can't silently rot.
• Knowledge: dependencies.md + log.md updated in the same change, matching project convention. No sandbox/security surface touched (CI config + version pins only).

Context read beyond the diff: Cargo.toml/Cargo.lock turso entries, all four example/fixture manifests, the fork manifests, the full dependabot.yml, test_dependabot_coverage.py, and the touched knowledge pages (via the PR snapshot at /workspace/bashkit).

Not reviewed: nothing material — diff was complete (truncated: false) and I could not run the test suite in this environment (no cargo), so I reasoned from the code rather than executing it.