[dependabot]

Bumps the fuzz-dependencies group in /crates/bashkit/fuzz with 1 update: fancy-regex.

Updates fancy-regex from 0.19.2 to 0.20.0

Release notes

Sourced from fancy-regex's releases.

0.20.0

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants (\<, \>) and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

Changelog

Sourced from fancy-regex's changelog.

[0.20.0] - 2026-10-24

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

Commits

• 031e5e5 Version 0.20.0
• 735c50a docs: add missing CHANGELOG entries for 0.19.2..main
• 5973d40 Merge pull request #311 from fancy-regex/easy_wordboundary_except_in_lookbehind
• 647646a Make VM word-boundary assertions respect unicode_mode
• d97e33c Serialize half word boundaries correct in Expr::to_str
• 466bc65 Add tests for word-boundary hardness outside a lookbehind
• 5ba2a98 Split in_lookaround in the analyzer into in_lookahead/in_lookbehind wit...
• 7a0ff5d Add word-boundary perf benchmark comparing hard vs delegated word boundaries
• ef97e6d improve word boundary seek behavior
• 03dd46a add unicode word boundary tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	9f2495b	Commit Preview URL Branch Preview URL	Nov 02 2026, 09:50 AM

[chaliy]

Superseded by #2813, now merged: fancy-regex 0.20.0 is in main.

This PR could not go green on its own. The fuzz-dependencies group is scoped to crates/bashkit/fuzz, but the dependency it found is declared in the workspace root Cargo.toml. So it edited the root manifest while refreshing only crates/bashkit/fuzz/Cargo.lock, leaving the root and examples/hyperlight lockfiles pinned to 0.19.2. Every --locked job then failed before compiling anything:

error: cannot update the lock file /home/runner/work/bashkit/bashkit/Cargo.lock
       because --locked was passed to prevent this

#2813 bumps the requirement and all three lockfiles together, retargets the cargo-vet exemption to 0.20.0, and documents the delegate_dfa_size_limit semantic change 0.20.0 introduces.

Closing as redundant.

---

Generated by Claude Code

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml