[chaliy]

What changed

Moves the workspace fancy-regex requirement to 0.20 and refreshes every
lockfile that resolves it: root Cargo.lock, crates/bashkit/fuzz/Cargo.lock
and examples/hyperlight/Cargo.lock. No call sites change; the builder methods
bashkit uses (delegate_size_limit, delegate_dfa_size_limit,
backtrack_limit) are unchanged in 0.20.0.

Also corrects the REGEX_DFA_SIZE_LIMIT doc comment, which was silently wrong
after this bump: one constant feeds two engines whose contracts have now
diverged (details below).

The unrelated transitive fancy-regex 0.17.0 in the root lockfile is untouched.

Why

Supersedes #2806. Dependabot's fuzz-dependencies group is scoped to
crates/bashkit/fuzz, but the dependency it found lives in the workspace
root Cargo.toml. So #2806 edited the root manifest while refreshing only
fuzz/Cargo.lock, leaving the root and examples/hyperlight lockfiles pinned
to 0.19.2. Every --locked job then failed:

error: cannot update the lock file /home/runner/work/bashkit/bashkit/Cargo.lock
       because --locked was passed to prevent this

That is a manifest/lockfile split dependabot cannot fix from the fuzz group, so
the bump has to land as one atomic change instead.

Worth noting for whoever reads this later: today's aggregated root cargo group
run failed outright (turso_core, unknown_error), which is why fancy-regex
reached us only through the fuzz group in the first place.

Before / After

Before — cargo test --locked on #2806's head fails before compiling anything
(6 red checks: all three CPython legs, both WASM jobs, Audit).

After — the full CI-equivalent slice is green:

$ cargo test --workspace --lib --bins --tests --features http_client,sqlite --no-fail-fast
... 7091 passed; 0 failed
$ cargo clippy --workspace --all-targets --features http_client,sqlite -- -D warnings
Finished (0 warnings)
$ cargo fmt --check                # clean

No observable behavior change in the shipped builtins. 0.20.0 does carry three
upstream changes that land on code paths bashkit cares about, since grep, sed,
rg and jq all compile on this engine under TM-DOS-025 backtracking bounds:

• delegate_dfa_size_limit now sets the lazy-DFA cache capacity rather than
  a compiled-DFA size cap, and delegate_dfa_skip_cache_capacity_check is on by
  default — so our 1 MB value degrades instead of hard-erroring when undersized.
• In Unicode mode \xHH above 0x7F now matches the codepoint (\xFF → ÿ).
• \b, \B, \< and \> are no longer hard outside lookbehinds.

The TM-DOS-025 bounds are intact — all five backtracking-limit tests pass:

builtins::sed::tests::fancy_regex_backtrack_limit_is_enforced ... ok
builtins::grep::tests::test_grep_perl_catastrophic_backtrack_is_bounded ... ok
builtins::grep::tests::test_grep_bre_backreference_backtracking_is_bounded ... ok
interpreter::tests::test_cond_extglob_backtracking_is_bounded ... ok
interpreter::glob::tests::star_backtracking_restores_bracket_cache_state ... ok

Not run locally: ssh_supabase_connects, which dials the live public
supabase.sh endpoint and is unreachable from this sandbox. It is unrelated to
regex and remains a required CI gate.

Risk

• Low for the lockfile bump itself: existing coverage over grep/sed/rg/jq regex
  behavior and the backtracking caps passes unchanged.
• The residual risk is the three upstream semantic changes above. The ones with
  user-visible potential — \xHH in Unicode mode and word-boundary compilation
  — are covered by the grep/sed suites and the Bash/Debian oracle scoreboards,
  all green here and in CI.
• delegate_dfa_size_limit becoming a cache capacity means the 1 MB value is no
  longer a hard ceiling on delegate DFA memory; it bounds cache size instead.
  REGEX_SIZE_LIMIT and FANCY_BACKTRACK_LIMIT still bound compilation and
  backtracking, so TM-DOS-025 does not depend on this knob.

Checklist

• Tests added or updated — no new tests; this is a dependency bump, and the
  existing TM-DOS-025 and grep/sed/rg/jq suites are the regression gate
• Backward compatibility considered — internal dependency only, no public
  API change

Follow-ups

• chore(deps): bump fancy-regex from 0.19.2 to 0.20.0 in /crates/bashkit/fuzz in the fuzz-dependencies group #2806 is superseded and should be closed once this merges.
• The root cargo dependabot group needs a look: it has been failing on
  turso_core, so aggregated Rust bumps are not landing at all right now.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	6cb3792	Commit Preview URL Branch Preview URL	Nov 02 2026, 10:16 AM