[dependabot]

Bumps the rust-dependencies group with 4 updates: fancy-regex, russh, napi and napi-derive.

Updates fancy-regex from 0.19.2 to 0.20.0

Release notes

Sourced from fancy-regex's releases.

0.20.0

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants (\<, \>) and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

Changelog

Sourced from fancy-regex's changelog.

[0.20.0] - 2026-10-24

Added

• Add RegexOptionsBuilder::build_delegate_prefilter to disable building the prefilter (#282)
• Add RegexOptionsBuilder::start_bytes that returns the first bytes that can match a pattern so you can build your own prefilter (#282)
• Add RegexOptionsBuilder::required_bytes that returns the required bytes for a pattern to match (#287)
• Add RegexOptionsBuilder::max_prog_size / RegexBuilder::max_prog_size to cap the number of VM instructions emitted while compiling. Subroutine calls are inlined at compile time, so a self- or mutually-recursive pattern can expand without bound even while the recursion-depth cap is respected; this bounds the emitted instruction vector instead. Exceeding the cap returns CompileError::PatternTooComplex. Disabled by default. (#298)
• Implement support for variable length hard lookbehinds, by seeking backwards to candidate match start positions and then matching forward as usual. The reverse DFA honours delegate_size_limit and delegate_dfa_size_limit. (#286, #309)
• Add RegexOptionsBuilder::delegate_dfa_skip_cache_capacity_check / RegexBuilder::delegate_dfa_skip_cache_capacity_check, enabled by default. Setting it to false makes the reverse DFA of a variable-length lookbehind strictly honour delegate_dfa_size_limit, so a too-small limit becomes a compile error. (#309)
• Add ByteSet::is_subset to test whether one byte set is a subset of another. (#289)

Changed

• If a lookbehind consists of an Alt containing only easy expressions and at least 4 branches (and no capture groups), compile it as a variable lookbehind (if the feature is enabled) instead of trying every branch as its own const-size lookbehind. One reverse-DFA delegate over the whole alternation is much cheaper per attempt, and grants a perf boost. (#285)
• Word boundaries (\b, \B, \<, \>) are no longer marked hard outside a lookbehind. regex-automata supports them, so a pattern like \b(?:foo|bar|baz)\b now compiles to a single delegated engine instead of one branch per alternative — previously it grew linearly with the number of alternatives. They remain hard inside a lookbehind, since regex-automata's reverse DFA can't run a variable-length lookbehind on unicode haystacks. The half-boundary variants and \Z are still always hard. (#311)
• The parser now tracks every capture group declared with the same name; Regex::capture_names reports the name for each of them, and named backrefs resolve to the last group with that name (#177)

Fixed

• The reverse lazy DFA built for a variable-length lookbehind failed to compile when it needed a larger cache capacity than the configured delegate_dfa_size_limit (or the default of 2 MiB); for example (?<=\p{L}{99,100})x failed to compile with default settings. The capacity is now rounded up to the minimum required. Ordinary delegates were not affected because the meta engine falls back to another engine when the lazy DFA cannot be built. (#309)
• delegate_dfa_size_limit now sets the lazy DFA cache capacity (hybrid_cache_capacity) as documented, instead of the fully compiled DFA size limit. It had been forwarded to the wrong regex-automata option since the switch from the regex crate. (#307)
• Fix bug with literal bytes being used in unicode mode unexpectedly: in Unicode mode, \xHH escapes above 0x7F now match the Unicode codepoint (as UTF-8 bytes) instead of the raw byte, so e.g. \xFF matches ÿ rather than the byte 0xFF. In bytes modes the raw byte is matched as before. (#292)
• Fix case-insensitive prefilter computation for non-ASCII class ranges that fold to characters with different lead bytes (e.g. (?i)[à-ÿ]), which previously could miss candidate start positions. (#296)
• Fix ^ / $ and their multi-line variants matching at the start/end of arbitrary-byte haystacks in Ascii and UnicodeBytes bytes modes, where the match position was not a UTF-8 codepoint boundary. (#300)
• Fix seek optimization dropping matches when conditionals had empty branches, e.g. (a)?b(?(1)c) no longer fails to match b. (#304)
• Fix hard variable-length lookbehind reverse DFA ignoring the caller's Unicode and bytes-mode settings, giving wrong results in non-Unicode bytes modes (e.g. (?<=(\w+)\1)x on ééx). (#310)

Commits

• 031e5e5 Version 0.20.0
• 735c50a docs: add missing CHANGELOG entries for 0.19.2..main
• 5973d40 Merge pull request #311 from fancy-regex/easy_wordboundary_except_in_lookbehind
• 647646a Make VM word-boundary assertions respect unicode_mode
• d97e33c Serialize half word boundaries correct in Expr::to_str
• 466bc65 Add tests for word-boundary hardness outside a lookbehind
• 5ba2a98 Split in_lookaround in the analyzer into in_lookahead/in_lookbehind wit...
• 7a0ff5d Add word-boundary perf benchmark comparing hard vs delegated word boundaries
• ef97e6d improve word boundary seek behavior
• 03dd46a add unicode word boundary tests
• Additional commits viewable in compare view

Updates russh from 0.64.1 to 0.65.0

Release notes

Sourced from russh's releases.

v0.65.0

Breaking changes

• d507707: feat(server): expose the publickey algorithms to Handler (#785) (@​Eric-D) #785
  • Handler::auth_publickey_offered now takes a server::PublicKeyOffer and Handler::auth_publickey takes a server::VerifiedPublicKey instead of &PublicKey. Read the key from the public_key field. The new algorithm field makes accessible the signature algorithm used by the client, allowing the server to react to it
• 62efa5a: Remove the no-op async-trait dependency and crate feature (#786) (@​FalkWoldmann) #786

Security fixes

GHSA-9wfm-jcj8-jfv9 - russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

• 23aa5d2 - A malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-4p9f-7p9m-5vfg - russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

• b33e93b - russh did not limit the number of EXT_INFO messages that a malicious server can send, leading to unbounded memory growth over time

GHSA-fw5c-8223-6h42 - russh: peer-declared zero maximum packet size permanently stalls channel writes

• 39cb9db - malicious peers can hang up the channel by setting max packet size to zero

GHSA-662x-8wvj-2276 - pageant: unbounded frame buffering on peer-controlled 4-byte length prefix

• 69e4b55 - a malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-vp5q-ff62-jwqv - Agent server never calls Agent::confirm

• 62db6e7 - Agent::confirm was defunct and never got called by the agent server

GHSA-3hm4-p7h4-rvwp - russh: pre-authentication stack exhaustion via nested OpenSSH certificates

• 730d663 - a malicious client could trigger a stack overflow via a crafted OpenSSH certificate

Features

• d65823f: feat(client): support OpenSSH agent session binding (#794) (@​inureyes) #794
  • Exposes the verified initial key-exchange data through a typed AgentSessionBinding. You need it to send session-bind@openssh.com for OpenSSH destination-constrained agent keys.

Fixes

• 13c94f0: Fix channel window accounting on window adjust (#790) (@​notsapinho) #790
• e2bdf85: client: keep the session usable when a Signer fails after PK_OK (#788) (@​meanaverage) #788
• b10506e: Re-arm the client keepalive timer before authentication (#791) (@​Bokjan) #791
  • Fixes the client session task spinning on a CPU core when the keepalive timer fired before authentication.
• c1fada1: fix(agent): honor SSH_AGENT_RSA_SHA2_* flags when signing with RSA keys (#796) (@​mdevolde) #796
• 3beb126: client: don't arm the rekey timer on wasm32 (#797) (@​biao29) #797

New Contributors

• @​Eric-D made their first contribution in Eugeny/russh#785

... (truncated)

Commits

• 183a22e v0.65.0
• 39cb9db reject zero max packet size
• 69e4b55 limit pageant message sizes
• 62db6e7 call Agent::confirm
• b33e93b limit ext_info messages
• 730d663 check certificate nesting
• 23aa5d2 dedupe agent constraints
• d65823f feat(client): support OpenSSH agent session binding (#794)
• d507707 feat(server): expose the publickey algorithms to Handler (#785)
• 13c94f0 Fix channel window accounting on window adjust (#790)
• Additional commits viewable in compare view

Updates napi from 3.15.0 to 3.16.0

Release notes

Sourced from napi's releases.

napi-v3.16.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) compact class identity metadata (#3667)
• (napi) keep the registered classes when a later load fails (#3666)
• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)
• (napi) free threadsafe function call data when the call fails (#3656)

Commits

• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
• 5a49dad feat(napi): support symbol_for keys for class members (#3661)
• 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
• ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.13 to 3.7.0

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.7.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)

Commits

• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
• 5a49dad feat(napi): support symbol_for keys for class members (#3661)
• 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
• ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	98f1639	Commit Preview URL Branch Preview URL	Nov 02 2026, 09:52 AM

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.