Skip to content

Release v0.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 05:30
· 55 commits to main since this release
v0.17.0
4b634fd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Bashkit runs as a plain wasm component, with no JS engine and no WASI.
    A component-model guest exposes shell execution over WIT, so hosts such as
    Hyperlight micro-VMs can embed the interpreter without shipping a JavaScript
    runtime or a WASI implementation, and bashkit now builds cleanly for WASI
    targets under CI coverage
    (#2311,
    #2310).
  • Untrusted input costs bounded work everywhere it is parsed. Script
    analysis, zip archive buffers, pipeline stderr aggregation, real-filesystem
    appends, snapshot chunk expansion, C ABI script intake, and CLI host stdin
    reads now charge or cap resources before allocating or blocking
    (#2333,
    #2330,
    #2326,
    #2327,
    #2282,
    #2334,
    #2335).
  • Sandbox escapes closed at the host boundary. The host bridge no longer
    interpolates into a shell, HostMounts normalizes VFS paths before mapping,
    backend symlink reads are refused, YAML aliases are rejected before parsing,
    and arithmetic command substitutions are flagged by static analysis
    (#2337,
    #2281,
    #2279,
    #2280,
    #2283).
  • The always-on dependency graph is 21 crates smaller and the browser wasm
    bundle 911 KB lighter.     Timezone data moved behind a default-on tzdata
    feature, the ICU4X stack pulled in by url is gone, and date fails loudly
    instead of silently formatting a named zone as UTC when tzdata is off
    (#2321).
  • Every cargo lockfile in the tree is audited, clearing 16 wasmtime
    advisories plus the fuzz lockfile gap     and the outstanding npm advisories in
    the example and site lockfiles
    (#2340,
    #2293,
    #2285,
    #2284).

Breaking Changes

  • http_client no longer implies a rustls crypto backend. Pick ring
    (previous behavior, enabled by default) or aws-lc-rs for a FIPS-capable
    backend. Enabling http_client with neither is a compile error. Only
    consumers building with --no-default-features need to act.

    Before:

    bashkit = { default-features = false, features = ["http_client"] }

    After:

    bashkit = { default-features = false, features = ["http_client", "ring"] }

  • Timezone data is behind the tzdata feature. It is on by default, so
    default builds are unchanged. Builds with --no-default-features that use
    TZ=<named zone> must add tzdata; without it date reports that it cannot
    honour the zone and exits 1 rather than returning a plausible-looking UTC
    time.

  • Non-ASCII domain names are rejected rather than normalized. Pinning
    idna_adapter drops UTS 46 normalization, which removes the homograph and
    punycode-confusion class from allowlist matching. Hosts that relied on
    internationalized domain names in HTTP allowlists must supply their punycode
    form.

What's Changed

  • chore(deps): bump wit-bindgen from 0.51.0 to 0.60.0 in /examples/hyperlight in the example-cargo group across 1 directory (#2342) by @dependabot
  • chore(deps): bump the examples-npm group across 1 directory with 2 updates (#2341) by @dependabot
  • fix(deps): clear 16 wasmtime advisories and audit every cargo lockfile (#2340) by @chaliy
  • chore(deps): bump ava to 8.0.1 and oxlint to 1.79.0 in bashkit-js (#2339) by @chaliy
  • fix(justfile): invoke bashkit-cli the way the CLI parses args (#2338) by @chaliy
  • fix(security): prevent host bridge shell injection (#2337) by @chaliy
  • fix(docs): keep dependency scan line-local (#2336) by @chaliy
  • fix(cli): bound host stdin reads by execution timeout (#2335) by @chaliy
  • fix(c-api): reject oversized scripts before UTF-8 validation (#2334) by @chaliy
  • fix(analysis): bound command validation work to prevent CPU amplification (#2333) by @chaliy
  • fix(tools): enforce referenced input schemas (#2332) by @chaliy
  • fix(streams): consume binary lines by byte offset (#2331) by @chaliy
  • fix(zip): budget archive buffers before allocation (#2330) by @chaliy
  • fix(interpreter): contain CommandResolver panics (#2328) by @chaliy
  • fix(realfs): bound append memory usage by streaming into staging (#2327) by @chaliy
  • fix(interpreter): bound pipeline stderr aggregation (#2326) by @chaliy
  • chore(ci): bump taiki-e/install-action from 2.86.1 to 2.86.3 in the github-actions group (#2325) by @dependabot
  • chore(deps): bump ai from 7.0.66 to 7.0.67 in /examples in the examples-npm group across 1 directory (#2324) by @dependabot
  • chore(deps): bump the site-npm group in /site with 3 updates (#2323) by @dependabot
  • chore(deps): trim always-on dependency graph, gate chrono-tz behind tzdata (#2321) by @chaliy
  • fix(testing): match shell echoes the shell actually produces (#2320) by @chaliy
  • fix(redirect): report redirection failures with bash's strerror wording (#2319) by @chaliy
  • fix(deps): pin a pnpm release cooldown so dependabot npm runs stop failing (#2318) by @chaliy
  • feat(http): make the rustls crypto backend a feature (#2317) by @chaliy
  • fix(examples): pin vite exactly and run the browser example's tests in CI (#2316) by @chaliy
  • chore(ci): bump taiki-e/install-action from 2.85.13 to 2.86.1 (#2315) by @dependabot
  • fix(ci): install a pinned wasm-opt instead of apt, and bound the wasm jobs (#2314) by @chaliy
  • chore(deps): bump vite from 6.4.3 to 8.2.1 in /examples/browser (#2313) by @dependabot
  • chore(deps): add dependabot version updates for the five npm lockfiles (#2312) by @chaliy
  • feat(wasm): run bashkit as a wasm component with no JS and no WASI (#2311) by @chaliy
  • fix(builtins): compile bashkit for WASI targets + CI check for wasm32-wasip2 (#2310) by @chaliy
  • feat(coreutils-port): resolve uucore Fluent messages at port time (#2309) by @chaliy
  • chore(deps): update dependencies (#2308) by @chaliy
  • chore(ci): bump the github-actions group with 2 updates (#2307) by @dependabot
  • fix(sqlite): handle turso StepResult::Sleep and bump to 0.8.0-pre.4 (#2306) by @chaliy
  • chore(deps): bump russh to 0.62.6 (#2305) by @chaliy
  • docs: remove em-dashes and AI-tell wording from markdown prose (#2304) by @chaliy
  • chore(ci): bump the github-actions group with 2 updates (#2303) by @dependabot
  • chore(deps): hold monty at 0.0.19 — 0.0.21 silently disables max_memory (#2300) by @chaliy
  • chore(deps): bump the rust-dependencies group with 5 updates (#2299) by @chaliy
  • chore(ci): bump taiki-e/install-action from 2.85.10 to 2.85.11 in the github-actions group (#2295) by @dependabot
  • fix(security): clear fuzz lockfile advisories and close the audit gap (#2293) by @chaliy
  • feat(bindings): host env and mounts applied after construction survive reset (#2292) by @chaliy
  • docs(security): record RUSTSEC-2023-0071 as TM-CRY-002; bump futures-util (#2290) by @chaliy
  • chore(deps): bump turso_core from 0.8.0-pre.2 to 0.8.0-pre.3 (#2289) by @dependabot
  • chore(deps): bump the rust-dependencies group with 6 updates (#2288) by @dependabot
  • chore(ci): bump the github-actions group with 4 updates (#2287) by @dependabot
  • fix(deps): bump spin to 0.9.9 to clear yanked-crate warning (#2286) by @chaliy
  • fix(deps): patch nanoid and brace-expansion advisories (#2285) by @chaliy
  • fix(deps): bump js-yaml override to ^4.3.1 for CVE-2026-59870 (#2284) by @chaliy
  • fix(analysis): flag arithmetic command substitutions (#2283) by @chaliy
  • fix(snapshot): enforce fs limits before expanding v2 snapshot chunks (#2282) by @chaliy
  • fix(fs): normalize VFS paths in HostMounts to prevent host traversal (#2281) by @chaliy
  • fix(yq): reject YAML aliases before parsing (#2280) by @chaliy
  • fix(fs): reject backend symlink reads (#2279) by @chaliy
  • fix(printf): sync uutils 0.10 formatting (#2278) by @chaliy

Full Changelog: v0.16.0...v0.17.0

Contributors

chaliy and dependabot
Assets 18
Loading