[chaliy]

What changed

Fixes the red .github/dependabot.yml check on main.

#2852 set versioning-strategy: increase on the examples/fixtures cargo entry. Cargo accepts only auto and lockfile-only, so Dependabot rejected the whole config file. That stops Dependabot updates for every ecosystem, not just this entry.

That setting was there so the two random-fs fixtures, which had no lockfile, would get previous versions for in-range bumps. This PR commits both fixture lockfiles instead (un-ignored). That achieves the same thing and also puts them in the audit-lockfiles advisory scan. Two new tests pin this: cargo strategies must be auto or lockfile-only, and every path-dep workspace must commit a lockfile.

Why

main is red on the Dependabot config check (run on a317737), which means Dependabot is not updating anything.

Before / After

Before (GitHub's Dependabot config check on main):

The property '#/updates/2/versioning-strategy' value "increase" did not match one of the following values: lockfile-only, auto

After: the property is gone, and scripts/tests pass with 2 new tests.

Risk

• Low: Dependabot config plus two fixture lockfiles. Fixture builds do not use --locked, so a stale lockfile only refreshes locally.

Checklist

• Unit tests are passed
• Documentation is updated
• Knowledge is up to date and not in conflict

---

---

<a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1796524809&installation_model_id=447267&pr_number=2854&ref=codesmith_pr_footer&repository=everruns%2Fbashkit&return_to=https%3A%2F%2Fgithub.com%2Feverruns%2Fbashkit%2Fpull%2F2854&signature=eadeec19a0494652a2bd0669fa793bd4542504987b194691d0b77f445c5c63f8"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png" width="190" height="28">
^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	813ab93	Commit Preview URL Branch Preview URL	Nov 06 2026, 03:09 AM

[bashkit-pr-reviewer]

Correct fix for the invalid versioning-strategy: increase, and the committed lockfiles check out (pyo3 0.29.3, napi 3.16.1, bashkit 0.20.3 = workspace version; audit script discovers lockfiles automatically). Two follow-ups below, one of which will bite on the next version bump.

[bashkit-pr-reviewer]

Review summary — #2854 (HEAD 813ab93)

Verdict: No material change since the last review — this push is a rebase onto new main (d739ba5) with identical PR content (same 9 files, same hunks, +3099/−16). All previously verified state still holds: workspace version 0.20.3, all four auxiliary lockfiles pin path-bashkit 0.20.3, both new coverage tests present, release-process refresh loop includes both fixture workspaces, no versioning-strategy key remains in dependabot.yml. No new findings — nothing submitted on this push.

Earlier findings (both resolved on the previous push):

• P1: release-refresh-omits-new-lockfiles — release-process.md loop covers both fixtures.
• P2: no-freshness-pin-for-fixture-lockfiles — test_path_dep_lockfiles_pin_the_workspace_bashkit_version pins locked bashkit to the workspace version.

Context re-checked on this push: workspace Cargo.toml version, bashkit entries in all five auxiliary lockfiles, presence of both new tests, release-process loop text, versioning-strategy occurrences in dependabot.yml (comment-only).

[chaliy]

deno 2.x (and the JS Check aggregate that depends on it) failed on this PR's head while cargo metadata fetched the crates.io index: unable to update registry crates-io while loading digest for blake2. That is a registry network failure, not this diff, which touches no JS or Cargo manifests. I re-ran the failed jobs once.

---

Generated by Claude Code