chore(release): prepare v0.20.2

CHANGELOG.md

@@ -1,11 +1,38 @@
 # Changelog
 
-## [Unreleased]
+## [0.20.2] - 2026-10-30
+
+### Highlights
+
+- **Patched CPython sandbox engine.** Wasmtime 48.0.8 addresses RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424; the embedded CPython artifact is rebuilt with the same exact engine version ([#2798](https://github.com/everruns/bashkit/pull/2798)).
+- **Signed Windows Python wheels.** Windows native modules receive Authenticode signatures and timestamps, verified before the final wheel is tested and published ([#2799](https://github.com/everruns/bashkit/pull/2799)).
+- **Binary-safe HTTP output.** curl downloads and curl/wget stdout preserve bytes through redirections and pipelines, including compressed responses ([#2778](https://github.com/everruns/bashkit/pull/2778)).
+- **Correct directory-content copies.** `cp -r source/. destination` copies contents into an existing destination without adding a source-directory layer ([#2796](https://github.com/everruns/bashkit/pull/2796)).
 
 ### What's Changed
 
-- fix(cp): copy directory contents for `source/.` operands without nesting the source directory in an existing destination.
-- fix(http): preserve binary curl downloads and curl/wget stdout through redirections and pipelines, including compressed responses and byte counts.
+* chore(python): sign Windows release wheels with Authenticode ([#2799](https://github.com/everruns/bashkit/pull/2799)) by @chaliy
+* Fix Wasmtime security advisories ([#2798](https://github.com/everruns/bashkit/pull/2798)) by @chaliy
+* fix(testing): render the diagnostic slot in the fuzz echo gate ([#2797](https://github.com/everruns/bashkit/pull/2797)) by @chaliy
+* fix(cp): preserve directory-dot contents operands ([#2796](https://github.com/everruns/bashkit/pull/2796)) by @chaliy
+* ci(npm): re-publish an existing release tag via a tag input ([#2794](https://github.com/everruns/bashkit/pull/2794)) by @chaliy
+* fix(deps): clear the seroval script-injection advisories in the site lockfile ([#2795](https://github.com/everruns/bashkit/pull/2795)) by @chaliy
+* chore(python): document Smart App Control workaround and reproduction ([#2793](https://github.com/everruns/bashkit/pull/2793)) by @chaliy
+* chore(deps): bump the rust-dependencies group and record its vet audits ([#2792](https://github.com/everruns/bashkit/pull/2792)) by @chaliy
+* ci(npm): publish via npm trusted publishing (GitHub OIDC) ([#2791](https://github.com/everruns/bashkit/pull/2791)) by @chaliy
+* chore(deps): bump vt100 to 0.18 and migrate the NonZero screen API ([#2789](https://github.com/everruns/bashkit/pull/2789)) by @chaliy
+* fix(ci): retry the Rosetta cross build through toolchain segfaults ([#2788](https://github.com/everruns/bashkit/pull/2788)) by @chaliy
+* chore(ci): bump the github-actions group across 1 directory with 4 updates ([#2787](https://github.com/everruns/bashkit/pull/2787)) by @app/dependabot
+* chore(deps): bump the examples-npm group across 2 directories with 7 updates ([#2785](https://github.com/everruns/bashkit/pull/2785)) by @app/dependabot
+* fix(js): size the host-callback timeout for the slowest shipped lane ([#2780](https://github.com/everruns/bashkit/pull/2780)) by @chaliy
+* chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 3 updates ([#2784](https://github.com/everruns/bashkit/pull/2784)) by @app/dependabot
+* chore(deps): bump the site-npm group in /site with 4 updates ([#2783](https://github.com/everruns/bashkit/pull/2783)) by @app/dependabot
+* chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates ([#2782](https://github.com/everruns/bashkit/pull/2782)) by @app/dependabot
+* chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates ([#2781](https://github.com/everruns/bashkit/pull/2781)) by @app/dependabot
+* chore(builtins): sync uutils/coreutils argument surfaces and vendored modules ([#2779](https://github.com/everruns/bashkit/pull/2779)) by @chaliy
+* fix(http): preserve binary download and stream output ([#2778](https://github.com/everruns/bashkit/pull/2778)) by @chaliy
+
+**Full Changelog**: https://github.com/everruns/bashkit/compare/v0.20.1...v0.20.2
 
 ## [0.20.1] - 2026-10-25
 

Cargo.toml

@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.20.1"
+version = "0.20.2"
 edition = "2024"
 license = "MIT"
 authors = ["Mykhailo Chalyi <mike@chaliy.name>", "Everruns"]

README.md

@@ -442,7 +442,7 @@ Enable the `sqlite` feature to embed [Turso](https://github.com/tursodatabase/tu
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["sqlite"] }
+bashkit = { version = "0.20.2", features = ["sqlite"] }
 ```
 
 ```rust

crates/bashkit-cli/Cargo.toml

@@ -39,7 +39,7 @@ interactive = ["dep:rustyline", "dep:terminal_size", "dep:signal-hook"]
 # `tzdata` is listed explicitly: an interactive shell must keep honouring
 # named `TZ=` zones in `date`, which stopped being implied when chrono-tz
 # moved behind a feature.
-bashkit = { path = "../bashkit", version = "0.20.1", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
+bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
 tokio = { workspace = true, features = ["macros", "net", "rt", "rt-multi-thread", "time", "io-std"] }
 clap.workspace = true
 anyhow.workspace = true

crates/bashkit-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Sandboxed bash interpreter for JavaScript/TypeScript",
   "packageManager": "pnpm@10.33.0",
   "main": "wrapper.js",

crates/bashkit-scripted-tool/Cargo.toml

@@ -30,7 +30,7 @@ jq = ["bashkit/jq"]
 tracing = ["dep:tracing"]
 
 [dependencies]
-bashkit = { path = "../bashkit", version = "0.20.1", default-features = false, features = ["bash_tool"] }
+bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["bash_tool"] }
 tokio = { workspace = true }
 async-trait = { workspace = true }
 tower = { workspace = true }

crates/bashkit-wasm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit-wasm",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Sandboxed bash interpreter for the browser (WebAssembly). Single-threaded \u2014 no SharedArrayBuffer, no COOP/COEP headers.",
   "type": "module",
   "main": "index.js",

crates/bashkit/Cargo.toml

@@ -143,7 +143,7 @@ monty = { version = "=0.0.19", optional = true }
 
 # Real CPython 3.14 as a WASI guest, precompiled to Pulley (cpython feature).
 # See knowledge/runtimes/cpython-wasm.md.
-bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.1", optional = true }
+bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.2", optional = true }
 wasmtime = { workspace = true, optional = true, features = ["pooling-allocator"] }
 monty-types = { version = "=0.0.19", optional = true }
 # Monty's ruff AST uses compact_str 0.9; get-size2 >=0.10.2 only implements

crates/bashkit/docs/cpython.md

@@ -19,7 +19,7 @@ Enable the `cpython` cargo feature and register the builtins:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["cpython"] }
+bashkit = { version = "0.20.2", features = ["cpython"] }
 ```
 
 ```rust
@@ -242,7 +242,7 @@ executable memory. Enable `cpython-native` instead of `cpython` to compile it
 to machine code for your target at build time:
 
 ```toml
-bashkit = { version = "0.20.1", features = ["cpython-native"] }
+bashkit = { version = "0.20.2", features = ["cpython-native"] }
 ```
 
 Calls get 4-10x faster (`print(1)` ~1 ms instead of ~4 ms; CPU-bound code

crates/bashkit/docs/logging.md

@@ -14,7 +14,7 @@ Add the `logging` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["logging"] }
+bashkit = { version = "0.20.2", features = ["logging"] }
 tracing-subscriber = "0.3"  # or your preferred subscriber
 ```
 

crates/bashkit/docs/sqlite.md

@@ -13,7 +13,7 @@ the `sqlite` feature. The engine is [Turso](https://github.com/tursodatabase/tur
 
 ```toml
 # Cargo.toml
-bashkit = { version = "0.20.1", features = ["sqlite"] }
+bashkit = { version = "0.20.2", features = ["sqlite"] }
 ```
 
 ```rust,ignore

crates/bashkit/src/lib.rs

@@ -323,7 +323,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.1", features = ["git"] }
+//! bashkit = { version = "0.20.2", features = ["git"] }
 //! ```
 //!
 //! ```rust,ignore
@@ -354,7 +354,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.1", features = ["python"] }
+//! bashkit = { version = "0.20.2", features = ["python"] }
 //! ```
 //!
 //! ```rust,ignore

docs/builtin_typescript.md

@@ -12,7 +12,7 @@ Add the `typescript` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.1", features = ["typescript"] }
+bashkit = { version = "0.20.2", features = ["typescript"] }
 ```
 
 Enable TypeScript in the builder:

docs/migrating-scripted-tool.md

@@ -23,8 +23,8 @@ features = ["scripted_tool", "python", "typescript", "jq"]
 After:
 
 ```toml
-bashkit = { version = "0.20.1", features = ["python", "typescript", "jq"] }
-bashkit-scripted-tool = { version = "0.20.1", features = ["python", "typescript", "jq"] }
+bashkit = { version = "0.20.2", features = ["python", "typescript", "jq"] }
+bashkit-scripted-tool = { version = "0.20.2", features = ["python", "typescript", "jq"] }
 ```
 
 Keep `bashkit` only if you use it directly (`Bash`, `BashTool`, the `Tool`