[chaliy]

What changed

toml 1.1.8 → 1.2.0 and toml_writer 1.1.3 → 1.2.0, together with the imports.lock publisher facts the bump needs.

This is the half of #2880 that can land. russh 0.65.1 and signal-hook 0.4.6 are deliberately left out — see below.

Why

#2880's Audit job failed with:

Vetting Failed!
4 unvetted dependencies:
  russh:0.65.1 missing ["safe-to-deploy"]
  signal-hook:0.4.6 missing ["safe-to-deploy"]
  toml:1.2.0+spec-1.1.0 missing ["safe-to-deploy"]
  toml_writer:1.2.0+spec-1.1.0 missing ["safe-to-deploy"]

imports.lock records a publisher fact per exact version, so any bump of a trusted publisher's crate leaves the new version unattested. CI only ever runs cargo vet --locked, which cannot fetch facts; a non---locked run is the only thing that records them, and Dependabot never does one. So this is not a one-off — it will fail the same way on every group bump that moves such a crate, which is worth knowing independently of this PR.

The two facts here are fetched from crates.io, not authored in this PR — epage, 2026-11-04 for both.

Before / After

# Before (the CI failure, reproduced locally)
$ cargo vet --locked
Vetting Failed!   4 unvetted dependencies

# After
$ cargo vet --locked
Vetting Succeeded (97 fully audited, 81 partially audited, 585 exempted)

Also in the diff, both incidental rather than changes of ours:

• imports.lock re-aggregated Mozilla's utf8_iter wildcard audit, which changed upstream (who/end/notes).
• Cargo.lock re-picked which syn cssparser-macros resolves to (3.0.9 → 2.0.119) — ordinary cargo update resolver churn; both majors are already in the tree with safe-to-deploy exemptions, and cargo check --workspace --all-targets is clean.

I under-described this diff when I opened the PR (I named only the two publisher facts and the Mozilla hunk); the syn re-pick was caught in review and is listed here for completeness.

What I did NOT do, and why it needs you

russh and signal-hook are not on exemptions — they sit on delta-audit chains whose entries are human source-safety reviews:

• russh: 0.63.3 → 0.64.1 → 0.65.0
• signal-hook: 0.4.4 → 0.4.5

Every audit in audits.toml is authored by you. Landing 0.65.1 / 0.4.6 therefore needs a new delta audit each — cargo vet even sizes them (russh 15 files, +388/−49; signal-hook 4 files, +70/−12).

I did not write those, and did not substitute exemptions for them. Writing an audit would assert a source review that did not happen, in your name; swapping in an exemption would quietly downgrade an SSH implementation reached over the network from audited to accepted-unaudited without you deciding that. Either is your call, not mine.

To land them:

cargo vet diff signal-hook 0.4.5 0.4.6
cargo vet diff russh 0.65.0 0.65.1
cargo vet certify …

Dependabot will keep re-proposing both until then.

Risk

• Low. Lockfile plus attestation data; toml/toml_writer are the TOML parser/writer already in the tree, moving one minor version from the same publisher.
• cargo check --workspace --all-targets clean, 263 repo-script tests green, cargo vet --locked green.

Checklist

• cargo vet --locked passes (reproduced the failure first, then fixed it)
• Publisher facts fetched from the registry, not hand-written
• Backward compatibility considered — dependency versions only
• CI green — required before merge

Part of #2880.

---

Generated by Claude Code

---

<a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1796655045&installation_model_id=447267&pr_number=2884&ref=codesmith_pr_footer&repository=everruns%2Fbashkit&return_to=https%3A%2F%2Fgithub.com%2Feverruns%2Fbashkit%2Fpull%2F2884&signature=92a5dbe2a1bc309f11fdf7590d5fe0e39ec4aceb3a93cf7f86cf8f61eb26108e"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png" width="190" height="28">
^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	54f1f7f	Commit Preview URL Branch Preview URL	Nov 07 2026, 02:52 PM

[bashkit-pr-reviewer]

Review summary (PR #2884)

Verdict: No findings — this is a routine, well-formed automated dependency bump. Lockfile-only change (toml 1.1.8 → 1.2.0, toml_writer 1.1.3 → 1.2.0, same +spec-1.1.0), publisher facts refreshed to the same known publisher (Ed Page / epage, user-id 6743, 2026-11-04), no source changes. No review comments posted.

What I verified beyond the diff:

• crates/bashkit-coreutils-port/Cargo.toml requires toml = "1.1" (caret), so 1.2.0 satisfies the manifest without edits.
• Vet coverage holds: supply-chain/audits.toml has [[trusted.toml]] / [[trusted.toml_writer]] entries for publisher 6743, safe-to-deploy, window through 2027-05-16 — the refreshed 2026-11-04 publisher facts fall inside it.
• Two incidental hunks are benign: (1) cssparser-macros dep pin syn 3.0.9 → syn 2.0.119 is standard cargo update resolver churn (both syn versions carry safe-to-deploy exemptions in supply-chain/config.toml); (2) the utf8_iter wildcard-audit refresh corrects a previously mismatched who (Makoto Kato with hsivonen's user-id 4484) to Henri Sivonen, matching the author/user-id, and extends end to 2027-10-30 — consistent with a Mozilla upstream re-import, not a smuggled change.
• knowledge/operations/dependencies.md contains process guidance, no toml-version-specific statements — nothing made stale, no knowledge update needed.
• No prompt-injection or approval-begging content in the PR title/description/diff.

Not reviewed / limits: I did not build or run tests — this shell has no cargo/network (git offline, Bashkit-only tools), so the claimed cargo vet clean + full suite (1645 passed) is taken from the PR description, not independently reproduced. The diff was not truncated, so all changed files (Cargo.lock, supply-chain/imports.lock) were fully visible.