Repository navigation
chore(deps): bump vt100 to 0.18 and migrate the NonZero screen API - #2789
Merged
Merged
Conversation
Supersedes Dependabot #2786, which bumped the version alone and failed 28 jobs: vt100 0.18 takes and returns screen dimensions as `NonZero<u16>` where 0.16 used `u16`, so the bump needs a source change Dependabot cannot make. `TerminalSize` keeps plain `u16` fields -- they are public API, and nothing about this upgrade justifies breaking callers -- so the conversion lives at the vt100 boundary only, in the six call sites across `terminal/tty.rs` and `terminal/mod.rs`. Zero needs a decision, since `NonZero` cannot carry it. `TerminalSize::new` clamps each dimension to 2, but the struct's fields are public and can be set literally, so a zero can still arrive. It clamps to 1 rather than panicking: a degenerate size is the caller's to notice and not worth aborting a session over, and 0.16 accepted it without complaint. No behaviour change for any non-zero size, and no public API change. Verified: cargo check, fmt and clippy --all-targets clean on the `terminal` feature; 3801 + 2358 + 160 + 85 + 67 + 29 tests pass with 0 failures across `-p bashkit -p bashkit-cli --features terminal`. (bashkit-cli has to be in the selection -- the threat-model suite spawns that binary and fails its own precondition check without it, which is unrelated to this change.)
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 0c30093 | Commit Preview URL Branch Preview URL |
Oct 26 2026, 12:15 PM |
`Audit` failed on the bump with `vt100:0.18.1 missing ["safe-to-deploy"]`: the 0.16.2 exemption does not carry across versions. Move the exemption rather than add a delta audit. That delta is ~3100 lines across a dozen files plus a new `capture.rs`, so a delta audit would claim a review that diff does not get -- the same call #2773 made for crypto-bigint. Checked instead for what the exemption actually asserts, and all of it still holds: - zero `unsafe` anywhere in src, unchanged from 0.16.2 - zero use of `std::fs`, `std::net`, `std::process` or `std::env` - no new runtime dependency: 0.18.1 adds only an optional `embedded-io`, which stays unenabled and does not appear among vt100's resolved deps in Cargo.lock (itoa, unicode-width, vte); vte stays at 0.15.0 Also keep the lockfile delta to the vt100 entry alone. `cargo update -p vt100` additionally moved tempfile from getrandom 0.3.4 to 0.4.3, which this change has no reason to carry; main's lockfile is not stale (`cargo metadata --locked` passes on it), so that was opportunistic re-resolution. The lockfile now changes two lines and still validates under `--locked`. Verified: `cargo vet --locked` succeeds (98 fully audited, 86 partially audited, 492 exempted); fmt clean; the same terminal test slice passes `--locked` with 0 failures.
This was referenced Oct 26, 2026
chaliy
added a commit
that referenced
this pull request
Oct 27, 2026
…ts (#2792) Supersedes Dependabot #2790, which bumped the five versions alone and failed Audit with seven unvetted crates. Dependabot cannot write supply-chain audits, so a group bump never goes green on its own. tokio 1.53.3 -> 1.54.1, jaq-core 3.1.1 -> 3.1.2, jaq-std 3.0.3 -> 3.0.4, napi 3.14.2 -> 3.15.0, napi-derive 3.6.12 -> 3.6.13, plus napi-derive-backend 6.1.5 -> 6.1.6 and napi-sys 3.4.1 behind them. The lockfile carries those seven entries and nothing else; Dependabot's six windows-sys 0.61.2 -> 0.52.0 re-points and its getrandom move are opportunistic re-resolution and are left out, as #2789 did. tokio needs no audit -- [[trusted.tokio]] already trusts Alice Ryhl, so it needs only the publisher fact for 1.54.1 in imports.lock. The other six are hand delta audits chained onto the existing entries. napi 3.15.0 was read in full (24 files, ~2700 lines): no new ambient capability, byte-identical build.rs, no new dependency, and one new napi_run_script call on a constant source that the audit note names rather than buries. Its new class_identity check lands squarely here, since bashkit-js selects napi6 and so has no Node-API type tag to check instead. Also fixes a latent gap that blocked the tokio refresh: a workspace crate published to crates.io needs policy.<name>.audit-as-crates-io, or cargo-vet refuses to run. bashkit-scripted-tool reached crates.io in 0.20.0 with no entry, and nothing failed because CI's `cargo vet --locked` never reaches that check -- while the non-locked run, the only way to refresh imports.lock, was broken for everyone. test_ci_supply_chain.py now derives the published set from the release-check recipe and fails when one of those crates has no entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
vt1000.16 → 0.18, with the source migration the bump requires. No publicAPI change and no behaviour change for any non-zero terminal size.
Supersedes #2786, which Dependabot opened with the version bump alone.
Why
#2786 failed 28 jobs. vt100 0.18 takes and returns screen dimensions as
NonZero<u16>where 0.16 usedu16:That is a source change Dependabot cannot make, so the PR could only ever sit
red.
Two judgement calls worth stating:
TerminalSizekeeps plainu16fields. They are public API and nothingabout this upgrade justifies breaking callers, so the conversion lives at the
vt100 boundary only — six call sites across
terminal/tty.rsandterminal/mod.rs.NonZerocannot carry 0.TerminalSize::newalready clamps each dimension to 2, but the struct'sfields are public and can be set literally, so a zero can still arrive. 0.16
accepted it without complaint; a degenerate size is the caller's to notice
and not worth aborting a session over.
Before / After
Before:
#2786— 28 failing jobs, the crate does not compile withterminal.After, locally on the
terminalfeature:bashkit-clihas to be in the test selection: the threat-model suite spawnsthat binary and fails its own precondition check without it. That is unrelated
to this change — it fails the same way on an unmodified tree.
Risk
terminalfeature is off by default. The only semanticdifference is at a size of zero, which previously reached vt100 as 0 and now
arrives as 1;
TerminalSize::newalready made that unreachable through thenormal constructor.
Checklist
terminalcoverage exercises themigrated paths (screen sizing, resize, scrollback paging, cursor line)
TerminalSizeunchangedGenerated by Claude Code