From aee425f38b6c07db57dfb2c7f499f30dbaa175f4 Mon Sep 17 00:00:00 2001
From: "Ryan S. Northrup (RyNo)" <northrup@yellowapple.us>
Date: Thu, 20 Feb 2025 00:00:49 -0800
Subject: [PATCH 1/4] Update README.md examples to reflect the need for a
 "dependencies" key

---
 README.md | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index a6902fd..328b10c 100644
--- a/README.md
+++ b/README.md
@@ -97,7 +97,8 @@ precisely:
 
 ```toml
 # pkgx:
-#   openssl.org: 1.1.1n
+#   dependencies:
+#     openssl.org: 1.1.1n
 
 [package]
 name = "my cargo project"
@@ -116,9 +117,11 @@ we read a special `pkgx` node:
 ```json
 {
   "pkgx": {
-    "openssl.org": "1.1.1n",
-    "deno": "^2",
-    "npm": null
+    "dependencies": {
+      "openssl.org": "1.1.1n",
+      "deno": "^2",
+      "npm": null
+    }
   }
 }
 ```
@@ -130,10 +133,13 @@ You can also make a `pkgx.yaml` file.
 You can add your own environment variables if you like:
 
 ```toml
+# ---
 # pkgx:
-#   openssl.org: 1.1.1n
-# env:
-#   MY_VAR: my-value
+#   dependencies:
+#     openssl.org: 1.1.1n
+#   env:
+#     MY_VAR: my-value
+# ---
 ```
 
 > [!CAUTION]

From a95bee6ecdb94540582f540616e240a35a4adae6 Mon Sep 17 00:00:00 2001
From: "Ryan S. Northrup (RyNo)" <northrup@yellowapple.us>
Date: Thu, 20 Feb 2025 00:07:24 -0800
Subject: [PATCH 2/4] Remove outdated warning about env var command
 substitutions

---
 README.md | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 328b10c..cea3fbc 100644
--- a/README.md
+++ b/README.md
@@ -142,12 +142,10 @@ You can add your own environment variables if you like:
 # ---
 ```
 
-> [!CAUTION]
+> [!NOTE]
 >
-> The assignment of these variables are run through the shell, so you can do
-> stuff like `$(pwd)` if you like. Obviously, be careful with that—we don’t
-> sanitize the input. We will accept a PR to escape this by default or something
-> ∵ we agree this is maybe a bit insane.
+> The environment variable's value is sanitized, so expressions like
+> `MY_VAR: $(sudo rm -rf --no-preserve-root /)` will throw an error.
 
 ## `dev` & Editors
 

From aed3cafde5a5b7a3d705eeb647db9b32474cbdb3 Mon Sep 17 00:00:00 2001
From: "Ryan S. Northrup (RyNo)" <northrup@yellowapple.us>
Date: Thu, 20 Feb 2025 00:09:17 -0800
Subject: [PATCH 3/4] Missed a frontmatter fence

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index cea3fbc..774318e 100644
--- a/README.md
+++ b/README.md
@@ -96,9 +96,11 @@ We allow you to add YAML front matter to all files to specify versions more
 precisely:
 
 ```toml
+# ---
 # pkgx:
 #   dependencies:
 #     openssl.org: 1.1.1n
+# ---
 
 [package]
 name = "my cargo project"

From 9d0ce57bd8acbf9d9c26f93d8e6d6749a48233d3 Mon Sep 17 00:00:00 2001
From: "Ryan S. Northrup (RyNo)" <northrup@yellowapple.us>
Date: Thu, 20 Feb 2025 00:24:17 -0800
Subject: [PATCH 4/4] Update the "one-liner" example, too

---
 README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 774318e..7f669c0 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,10 @@ name = "my cargo project"
 We allow more terse expressions including eg:
 
 ```toml
-# pkgx: openssl.org@1.1.1n deno^2 npm
+# ---
+# pkgx:
+#   dependencies: openssl.org@1.1.1n deno^2 npm
+# ---
 ```
 
 The major exception being json since it doesn’t support comments, in this case