[chaliy]

What changed

Prepare Bashkit 0.20.2 from current main, including Wasmtime 48.0.8 (#2798), Authenticode-signed Windows Python wheels (#2799), binary-safe HTTP output (#2778), and recursive directory-dot copies (#2796). Synchronize Rust/npm versions, internal Rust dependency requirements, auxiliary lockfiles, and documentation examples; record all 20 merged changes since 0.20.1.

Why

Downstream applications need a published Bashkit and bashkit-cpython-wasm pair built with the patched Wasmtime engine. Include the latest merged Windows signing changes in the same release.

Before / After

Before: all four Rust packages, PyPI, and both npm packages publish 0.20.1. The published CPython runtime predates the Wasmtime 48.0.8 fix.
After: release automation will publish 0.20.2, with both the CPython build dependency and runtime using =48.0.8. The four-package Cargo dry-run verified the exact unpublished internal dependency graph. Native JS smoke confirmed cp -r source/. destination copies contents without an extra directory layer.

Publish readiness

• just pre-pr: passed; 7,274 Rust tests plus 204 script tests (four platform-specific skips).
• cargo clippy --all-targets --all-features -- -D warnings: passed.
• just test: passed, including 19 security failpoint tests.
• CPython feature tests: 15 unit and 138 integration/security tests passed.
• cargo vet --locked: passed using the existing audit policy.
• Four-package cargo publish --dry-run --allow-dirty: passed.
• Verified cargo package -p bashkit-cpython-wasm --allow-dirty: 8,159,908 bytes, below the 10 MiB registry limit.
• Main and auxiliary cargo metadata --locked --offline: passed; Wasmtime resolves to 48.0.8.
• Both API references regenerated without drift; native JS build and smoke passed.
• Current main CI: https://github.com/everruns/bashkit/actions/runs/41125463634
• Production Windows signing smoke: https://github.com/everruns/bashkit/actions/runs/41125599754. Signed artifact digest: sha256:170798025f72b9dfe4d0ff5852043c5e50dd8c2271a529019a38b5aec80a5fb8.

Local differential tests used pinned jq 1.8.1/ripgrep 15.1.0 and an isolated temporary directory: the sandbox's synthetic /tmp/.git otherwise changes the real-ripgrep oracle's repository detection. Assertions and security policy were unchanged.

just check-nightly passed: the last three nightly and last three fuzz runs are green. Fresh full validation on the release base:

• Nightly (advisory audit, Miri, security analysis, AddressSanitizer): https://github.com/everruns/bashkit/actions/runs/41126997696
• Full seven-target fuzz runs: https://github.com/everruns/bashkit/actions/runs/41127003778 and https://github.com/everruns/bashkit/actions/runs/41128913303

Risk

Medium: release fan-out spans Rust, Python, npm, CLI/Homebrew, and C ABI archives. Windows signing is now mandatory for the PyPI publication path; its production smoke passed. Monitor all publication workflows and verify registries after merge.

Checklist

• Existing regression and release security tests exercised
• Backward compatibility considered: patch release; no additional API changes

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	488af11	Commit Preview URL Branch Preview URL	Oct 30 2026, 09:21 PM