[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the rust-dependencies group with 3 updates: fancy-regex, getrandom and signal-hook.

Updates fancy-regex from 0.17.0 to 0.20.0

Release notes

Sourced from fancy-regex's releases.

0.20.0

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants (\<, \>) and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

0.19.2

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

0.19.1

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

0.19.0

Added

• Add BytesMode and the RegexInput trait so the matching and capture APIs can operate on strings or bytes, and allows to opt out of unicode handling if desired (#248)
  • Also allows searching within a range without slicing (#253)
  • Assertions can be overridden at runtime, if the regex builder allow_input_assertion_overrides option was used (#254)
  • Search can be performed in anchored mode, searching only at the start position specified (#263)
• Add experimental seek optimization to only invoke the VM at candidate positions where a match could occur (#246)
• Add RegexBuilder::disallow_empty_match_at_eof_after_newline to reject empty matches at the end of the haystack following a trailing newline, to match Oniguruma behavior (#247)
• Add RegexSet API for efficiently matching multiple patterns against the same text (#255)

Changed

... (truncated)

Changelog

Sourced from fancy-regex's changelog.

[0.20.0] - 2026-10-24

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

[0.19.2] - 2026-09-13

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

• Fix a panic in capture_names() for a pattern with a zero-repeated named group such as (?<n>a){0} (#275)
• Literal bytes were being encoded as utf-8 in Ascii mode, now they match the exact byte literal

[0.19.1] - 2026-09-06

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

[0.19.0] - 2026-07-28

Added

• Add BytesMode and the RegexInput trait so the matching and capture APIs can operate on strings or bytes, and allows to opt out of unicode handling if desired (#248)
  • Also allows searching within a range without slicing (#253)
  • Assertions can be overridden at runtime, if the regex builder allow_input_assertion_overrides option was used (#254)
  • Search can be performed in anchored mode, searching only at the start position specified (#263)
• Add experimental seek optimization to only invoke the VM at candidate positions where a match could occur (#246)
• Add RegexBuilder::disallow_empty_match_at_eof_after_newline to reject empty matches at the end of the haystack following a trailing newline, to match Oniguruma behavior (#247)

... (truncated)

Commits

• 031e5e5 Version 0.20.0
• 735c50a docs: add missing CHANGELOG entries for 0.19.2..main
• 5973d40 Merge pull request #311 from fancy-regex/easy_wordboundary_except_in_lookbehind
• 647646a Make VM word-boundary assertions respect unicode_mode
• d97e33c Serialize half word boundaries correct in Expr::to_str
• 466bc65 Add tests for word-boundary hardness outside a lookbehind
• 5ba2a98 Split in_lookaround in the analyzer into in_lookahead/in_lookbehind wit...
• 7a0ff5d Add word-boundary perf benchmark comparing hard vs delegated word boundaries
• ef97e6d improve word boundary seek behavior
• 03dd46a add unicode word boundary tests
• Additional commits viewable in compare view

Updates getrandom from 0.3.4 to 0.4.3

Changelog

Sourced from getrandom's changelog.

0.4.3 - 2026-06-17

Added

• wasm64-unknown-unknown target support for wasm_js backend #848

Changed

• Drop wasip2 and wasip3 dependencies in favor of manual bindings #830

#830: rust-random/getrandom#830 #848: rust-random/getrandom#848

0.4.2 - 2026-03-03

Changed

• Bump r-efi dependency to v6 #814

Fixed

• Read errno only when it is set #810
• Check the return value of ProcessPrng on Windows #811

#810: rust-random/getrandom#810 #811: rust-random/getrandom#811 #814: rust-random/getrandom#814

0.4.1 - 2026-02-03

Fixed

• Documentation build on docs.rs #801

#801: rust-random/getrandom#801

0.4.0 - 2026-02-02

Added

• RawOsError type alias #739
• SysRng behind new feature sys_rng #751
• WASIp3 support #779
• extern_impl opt-in backend #786 #794
• Motor OS support #797

Changed

• Use Edition 2024 and MSRV 1.85 #749

#739: rust-random/getrandom#739 #749: rust-random/getrandom#749 #751: rust-random/getrandom#751 #779: rust-random/getrandom#779

... (truncated)

Commits

• 5e7cd57 Release v0.4.3 (#853)
• 1ea268a Use manual bindings for WASIp2/3 (#830)
• f7290b0 Update Cargo.lock (#852)
• 16ce801 Update Cargo.lock (#850)
• e5adfca Add wasm64-unknown-unknown support for wasm_js backend (#848)
• 626df8d Update Cargo.lock (#846)
• 4a01cb2 Update Cargo.lock (#841)
• f87bf39 Update Cargo.lock (#836)
• eadb879 ci: re-enable build job for x86_64-pc-cygwin (#832)
• d715d73 CI: Reduce the number of packages that are updated for wasip2 MSRV test (#825)
• Additional commits viewable in compare view

Updates signal-hook from 0.4.5 to 0.4.6

Changelog

Sourced from signal-hook's changelog.

0.4.6

• Allow registering 'static flags in addition to Arc ones (#215, #180).

Commits

• 0a1de6b Version 0.4.6
• ae4ece5 Merge pull request #215 from Frost-54/static-atomic-unsafe-trait
• 48b56d5 Deps updates
• fd51cde Allow &'static AtomicBool in flag module - #213
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	5f697c5	Commit Preview URL Branch Preview URL	Nov 06 2026, 03:46 AM

[bashkit-pr-reviewer]

Review verdict: approve — routine dependency bump, no blocking issues

Dependabot group bump: fancy-regex 0.17.0→0.20.0 and getrandom 0.3→0.4 in crates/bashkit-monty/Cargo.toml (+ lockfile dedup removing the old fancy-regex 0.17.0 entry), plus signal-hook 0.4.5→0.4.6 patch. This also unifies monty with the workspace root, which already pins fancy-regex = "0.20" / getrandom = "0.4".

Findings

• P0: none.
• P1: none.
• P2: none. Two non-blocking observations only:
  • fancy-regex 0.18–0.20 changes observable matching semantics in edge cases (e.g. \xFF in Unicode mode now matches ÿ instead of byte 0xFF; word-boundary delegation; variable-length lookbehind; duplicate named-group handling). These are upstream bug fixes; no code adaptation needed, but worth knowing if a Python re differential test trips on \x80–\xFF escapes.
  • types/re_pattern.rs maps only BacktrackLimitExceeded/RegexTooBig explicitly; the new 0.20 CompileError::PatternTooComplex (from the new max_prog_size cap, disabled by default) falls into the generic invalid-regex arm. Correct behavior since the cap is never enabled here — no change needed.

Context read (beyond the diff)

• crates/bashkit-monty/Cargo.toml, root Cargo.toml (workspace already on 0.20/0.4, edition 2024 so getrandom 0.4's MSRV 1.85 is fine), Cargo.lock dedup.
• Call sites: crates/bashkit-monty/src/types/re_pattern.rs (RegexBuilder::{delegate_size_limit, backtrack_limit, build}, error mapping — all APIs still present per 0.20 release notes), crates/bashkit-monty/src/types/random.rs:445 and crates/bashkit/src/credential.rs:146 (getrandom::fill — unchanged in 0.4, error/expect handling tolerant of the new Error type).
• PR body release notes/changelog for fancy-regex 0.20/0.19.x and getrandom 0.4.x; signal-hook is a patch bump with no API surface in this repo's diff.

Not reviewed

• Could not build or run tests (no cargo/network in this shell — per project reviewer rules, reasoned from code only). Relied on release-note API continuity rather than a compile check; CI cargo test -p bashkit-monty (especially re/random module tests) is the backstop for the major-version jumps.

[chaliy]

Analysed — the content of this PR is being taken in #2876, which also fixes the reason this one could not merge.

This PR edits crates/bashkit-monty/Cargo.toml, a Monty fork manifest. Since #2861, check_monty_fork.py rejects any fork dependency differing from upstream Monty 1.4.0, so the bump failed Lint and everything downstream. It also could not have compiled: fancy-regex 0.20 made Captures generic over the haystack type, and re_match.rs / re_pattern.rs still passed Captures<'_>.

The underlying problem was that two rules disagreed. #2852 told Dependabot to ignore only fork-only crates, leaving shared ones such as fancy-regex and getrandom bumpable on purpose — but a proposal for a shared crate edits the fork manifest too, which #2861 then rejects. That made this PR unmergeable in a way that would have recurred on every weekly run, not a one-off.

#2876 resolves it: a fork dependency's version may diverge when its line carries a bashkit fork: marker, and it applies that to fancy-regex 0.20 and getrandom 0.4 with the Captures<'_, str> adaptations and CPython-checked re regression tests. Closing once #2876 lands.

For the record, signal-hook needed no manifest change — crates/bashkit-cli is already on 0.4, so that part was lockfile-only.

---

Generated by Claude Code

[chaliy]

Closing: this PR's content landed in #2876 (squashed as 38d2c4c), together with the fix for the reason it could not merge.

fancy-regex 0.17 → 0.20 and getrandom 0.3 → 0.4 are now in crates/bashkit-monty/Cargo.toml, carrying the Captures<'_, str> source adaptations this PR was missing and bashkit fork: markers so the fork-drift check accepts the divergence. fancy-regex 0.17 is gone from the lockfile, so the duplicate major is out of the graph. signal-hook needed no manifest change — bashkit-cli was already on 0.4, so that part was lockfile-only.

Going forward, a shared-dep bump like this one is mergeable: move the fork line too and mark it. That is now documented in .github/dependabot.yml next to the ignore list and in knowledge/operations/dependencies.md.

---

Generated by Claude Code

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml