From 11a022ff75284a5cafb786cbc06e07bc1bea50a8 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Mon, 2 Nov 2026 09:55:53 +0000 Subject: [PATCH 1/3] chore(deps): bump fancy-regex 0.19.2 -> 0.20.0 across all lockfiles Dependabot's #2806 bumped the workspace `fancy-regex` requirement in the root Cargo.toml but only refreshed crates/bashkit/fuzz/Cargo.lock, because the fuzz-dependencies group is scoped to that directory. The root and examples/hyperlight lockfiles kept 0.19.2, so every `cargo --locked` job failed with "cannot update the lock file ... because --locked was passed". Bump the requirement and all three lockfiles that resolve fancy-regex together (root, crates/bashkit/fuzz, examples/hyperlight). The unrelated transitive fancy-regex 0.17.0 in the root lockfile is untouched. 0.20.0 carries behavior changes that matter here, since grep/sed/rg/jq all compile on this engine under TM-DOS-025 backtracking bounds: - `delegate_dfa_size_limit` now sets the lazy-DFA cache capacity rather than a compiled-DFA size limit, and `delegate_dfa_skip_cache_capacity_check` is on by default, so our 1 MB value no longer hard-errors when too small. - In Unicode mode `\xHH` above 0x7F now matches the codepoint (`\xFF` -> U+00FF). - `\b`, `\B`, `\<` and `\>` are no longer hard outside lookbehinds. No call-site changes were needed: the builder methods bashkit uses (delegate_size_limit, delegate_dfa_size_limit, backtrack_limit) are unchanged. --- Cargo.lock | 6 +++--- Cargo.toml | 2 +- crates/bashkit/fuzz/Cargo.lock | 10 +++++----- examples/hyperlight/Cargo.lock | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index ebc028bb1..96408fbff 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -376,7 +376,7 @@ dependencies = [ "criterion", "ed25519-dalek", "fail", - "fancy-regex 0.19.2", + "fancy-regex 0.20.0", "flate2", "foldhash", "futures-core", @@ -1818,9 +1818,9 @@ dependencies = [ [[package]] name = "fancy-regex" -version = "0.19.2" +version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912" +checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390" dependencies = [ "bit-set 0.8.0", "regex-automata", diff --git a/Cargo.toml b/Cargo.toml index 5f7915e28..26d3637fa 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -62,7 +62,7 @@ rustls = { version = "0.23", default-features = false, features = ["std", "tls12 # Regex regex = "1" regex-automata = { version = "0.4", default-features = false, features = ["std", "syntax", "hybrid", "unicode", "perf"] } -fancy-regex = "0.19" +fancy-regex = "0.20" # Date/Time # Important decision: `default-features = false` drops chrono's `wasmbind`, diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock index 185cf1060..a1c36f7be 100644 --- a/crates/bashkit/fuzz/Cargo.lock +++ b/crates/bashkit/fuzz/Cargo.lock @@ -718,14 +718,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] name = "fancy-regex" -version = "0.19.2" +version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912" +checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390" dependencies = [ "bit-set", "regex-automata", @@ -1564,7 +1564,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -2271,7 +2271,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/examples/hyperlight/Cargo.lock b/examples/hyperlight/Cargo.lock index e3c53e4bc..a361e91be 100644 --- a/examples/hyperlight/Cargo.lock +++ b/examples/hyperlight/Cargo.lock @@ -398,9 +398,9 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" [[package]] name = "fancy-regex" -version = "0.19.2" +version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912" +checksum = "20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390" dependencies = [ "bit-set", "regex-automata", From 116b68619749f836e83b5752c8c043028b245bc5 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Mon, 2 Nov 2026 10:03:59 +0000 Subject: [PATCH 2/3] docs(builtins): record the dual meaning of REGEX_DFA_SIZE_LIMIT One constant feeds two engines with different contracts, which fancy-regex 0.20.0 made divergent. For the `regex` crate it stays `dfa_size_limit`, a cap on compiled DFA size. For fancy-regex it is `delegate_dfa_size_limit`, which 0.20.0 redefined as the lazy-DFA cache capacity; 0.20.0 also turns on `delegate_dfa_skip_cache_capacity_check` by default, so an undersized value now degrades rather than failing compilation. Documentation only; the value and every call site are unchanged. --- crates/bashkit/src/builtins/search_common.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/crates/bashkit/src/builtins/search_common.rs b/crates/bashkit/src/builtins/search_common.rs index f804fed26..b1b690db6 100644 --- a/crates/bashkit/src/builtins/search_common.rs +++ b/crates/bashkit/src/builtins/search_common.rs @@ -13,7 +13,14 @@ use crate::builtins::limits::RUNTIME_REGEX_CACHE_ENTRIES; /// Default compiled-regex size limit (1 MB). pub(crate) const REGEX_SIZE_LIMIT: usize = 1_000_000; -/// Default DFA size limit (1 MB). +/// Default DFA budget (1 MB). +/// +/// Two engines read this constant and mean different things by it. For the +/// `regex` crate it is `dfa_size_limit`, a cap on compiled DFA size. For +/// fancy-regex it is `delegate_dfa_size_limit`, which since 0.20.0 sets the +/// *lazy-DFA cache capacity* rather than a compiled-DFA size cap; 0.20.0 also +/// enables `delegate_dfa_skip_cache_capacity_check` by default, so a value too +/// small for a pattern degrades instead of failing to compile. pub(crate) const REGEX_DFA_SIZE_LIMIT: usize = 1_000_000; /// Backtracking step cap for the fancy-regex (PCRE / `grep -P`) engine. From 6cb3792b98f6a1cf04471fbf693b0bd1afebf84b Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Mon, 2 Nov 2026 10:15:21 +0000 Subject: [PATCH 3/3] chore(deps): move the fancy-regex vet exemption to 0.20.0 `cargo vet --locked` failed the Audit job on this branch: 1 unvetted dependencies: fancy-regex:0.20.0 missing ["safe-to-deploy"] The exemption still named 0.19.2, which the bump removed from the graph. Retarget it to 0.20.0, matching the surrounding entries. The separate 0.17.0 exemption stays: that is an unrelated transitive copy still in the root lockfile. --- supply-chain/config.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 92f834f8c..42d7d3f15 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -597,7 +597,7 @@ version = "0.17.0" criteria = "safe-to-deploy" [[exemptions.fancy-regex]] -version = "0.19.2" +version = "0.20.0" criteria = "safe-to-deploy" [[exemptions.fastbloom]]