[chaliy]

What changed

Takes the rust-dependencies group bump from Dependabot #2790 and adds the
supply-chain audits it cannot write, so the bump can actually land.

tokio 1.53.3 → 1.54.1, jaq-core 3.1.1 → 3.1.2, jaq-std 3.0.3 → 3.0.4,
napi 3.14.2 → 3.15.0, napi-derive 3.6.12 → 3.6.13, plus napi-derive-backend
6.1.5 → 6.1.6 and napi-sys 3.4.0 → 3.4.1 behind them.

No library behaviour changes. One user-visible improvement arrives with napi
3.15.0: bashkit-js selects napi6, so its class instances carry no Node-API
type tag, and the new class_identity module checks the recorded Rust class
before casting a napi_unwrap result — a type-confusion cast now returns
InvalidArg instead.

It also closes a latent gap that blocked this bump: a first-party crate that
reaches crates.io needs a cargo-vet policy.* entry, and bashkit-scripted-tool
has had none since 0.20.0.

Why

#2790 was green on every job but Audit, where cargo vet --locked reported
seven unvetted crates. Dependabot cannot record audits, so a group bump never
goes green on its own — the same rule as #2706, #2720 and #2789.

tokio needed no audit: [[trusted.tokio]] already trusts Alice Ryhl, so the
bump needs only the publisher fact for 1.54.1 in imports.lock. Writing it
there is the non-locked cargo vet run — and that run was broken:

$ cargo vet
ERROR  × There are some issues with your policy.audit-as-crates-io entries
Error:   × Some non-crates.io-fetched packages match published crates.io versions
  │   bashkit-scripted-tool:0.20.1

cargo-vet calls a workspace member first-party by provenance. Once the same
name and version is also published, the two descriptions collide and the
command refuses to run. CI runs cargo vet --locked, which never reaches that
check, so the Audit job stayed green for four releases while the command was
broken for every developer — and for the only way to refresh imports.lock.
A bump riding publisher trust therefore could not be made to pass at all.

Before / After

cargo vet --locked, the exact command the Audit job runs:

# Before (#2790's lockfile)
Vetting Failed!
7 unvetted dependencies:
  jaq-core:3.1.2 missing ["safe-to-deploy"]
  jaq-std:3.0.4 missing ["safe-to-deploy"]
  napi:3.15.0 missing ["safe-to-deploy"]
  napi-derive:3.6.13 missing ["safe-to-deploy"]
  napi-derive-backend:6.1.6 missing ["safe-to-deploy"]
  napi-sys:3.4.1 missing ["safe-to-deploy"]
  tokio:1.54.1 missing ["safe-to-deploy"]

# After
Vetting Succeeded (98 fully audited, 86 partially audited, 492 exempted)

The new policy guard, with the entry removed again:

AssertionError: unexpectedly None : bashkit-scripted-tool is published to
crates.io but has no [policy.bashkit-scripted-tool] entry, so `cargo vet`
cannot run once that version is live

jq still works end to end on the new jaq versions:

$ bashkit -c 'echo "{\"items\":[{\"n\":\"a\",\"v\":2},{\"n\":\"b\",\"v\":40}]}" \
    | jq -c "[.items[] | select(.v > 1) | .n] , ([.items[].v] | add)"'
["a","b"]
42

A smaller lockfile than #2790's: 14 changed lines against its 21. Dependabot's
also re-pointed six windows-sys references from 0.61.2 down to 0.52.0 and
moved tempfile to getrandom 0.4.3, which none of the five updates asks for.
That is opportunistic re-resolution and is left out, as #2789 did.

Two findings from reading the deltas, both of which say don't change
anything:

• jaq-std 3.0.4 rewrites scan to jq's semantics and is inert here —
  builtins/jq/compat.rs prepends its own scan and shadows the stdlib one.
  That override is worth keeping: upstream's new definition is
  scan_(re; "g" + flags), which yields "gg" and a double-g compile error
  for a filter that already passes g, the exact case the compat definition
  was written to avoid.
• jaq-core 3.1.2 fixes a lexer panic on a comment that ends the input. It does
  not reproduce through the jq builtin on 3.1.1 — checked across eighteen
  filter shapes, malformed ones included, every one returning identical output
  on both versions. So filter_ending_in_a_comment_is_accepted pins a shape
  that had no coverage rather than guarding a regression, and the audit note
  says as much instead of claiming a fix this tree needed.

napi 3.15.0 is the one delta that needed real reading (24 files, ~2700 lines).
No new ambient capability: no std::fs, std::net or std::env,
std::process unchanged at 8 occurrences, byte-identical build.rs, no new
dependency. It does add a napi_run_script call — on a constant three-line
source with no interpolation, only on the ReadableStream cancel path — and the
audit note records that rather than burying it.

Risk

• Low.
• napi is the Node binding, and bashkit-js passes &mut RustBash, so it
  exercises the native_borrow paths 3.15.0 reworked. The JS matrix
  (node 20/22/24/latest, bun, deno, Rosetta) is the gate for that, and it is
  green.
• The audits are safe-to-deploy claims on code this tree ships. Each note
  states what was actually checked, and the napi one names the new
  code-evaluation path instead of asserting there is none.
• The policy entry only tells cargo-vet which copy of bashkit-scripted-tool
  is first-party, matching its six siblings; it weakens no audit gate.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	2e68756	Commit Preview URL Branch Preview URL	Oct 27 2026, 09:53 AM