Release v0.20.3

Highlights

• markkit and fetchkit builtins. Opt-in markkit and fetchkit features register both tools with the same CLI as the standalone binaries. Files come from the VFS and every HTTP hop goes through the sandbox HTTP client; host-only flags fail closed (#2803). Bumped to markkit 0.3.1 and fetchkit 0.7.1 for RUSTSEC-2026-0436 (#2823).
• Fewer round trips on remote filesystems. Tree walkers (rg, find, du, grep -r, tar, cp -r, ls -R, tree) use a bounded bulk walk hook, trust read_dir metadata and stay within memory and entry budgets on remote backends (#2816, #2819, #2820, #2821).
• Execution output to a VFS file. Execution::output_file writes combined output into a capped VFS file; Python execute/execute_sync accept output_file, and the Deep Agents backend offloads large output natively (#2818).
• Deep Agents backend improvements. Per-call timeouts (ExecOptions::timeout, Python timeout_seconds) that can only tighten the configured limit, base64 binary reads, and structured file-operation error codes, plus a new integration guide (#2817, #2824).
• Python exit crash fixed. A timed-out async callback no longer races interpreter finalization and aborts the process on CPython < 3.13 (#2802).
• crates.io trusted publishing. Rust crates publish through GitHub OIDC instead of a stored token (#2801).

What's Changed

• chore(deps): bump russh to 0.65.0 and the napi group, with vet audits (#2826) by @chaliy
• docs(python): add Deep Agents integration guide (#2824) by @chaliy
• fix(deps): bump markkit to 0.3.1 and fetchkit to 0.7.1 for RUSTSEC-2026-0436 (#2823) by @chaliy
• fix(fs): walk directories in path order so prefetch matches consumers (#2821) by @chaliy
• test(fs): large-tree stress tests; stream rg's walk, cap ls at the stdout limit (#2820) by @chaliy
• fix(builtins): list ls -R and tree through bounded bulk walk batches (#2819) by @chaliy
• fix(fs): cut round trips and bound memory for tree walkers on remote backends (#2816) by @chaliy
• feat: tee execution output to a VFS file; native capture offload for Deep Agents (#2818) by @chaliy
• feat(python): per-call timeout and multimodal reads for the Deep Agents backend (#2817) by @chaliy
• feat(builtins): add markkit and fetchkit builtins with the upstream CLI (#2803) by @chaliy
• chore(deps): bump the examples-npm group across 1 directory with 6 updates (#2812) by @app/dependabot
• chore(ci): bump the github-actions group with 2 updates (#2811) by @app/dependabot
• chore(deps): bump fancy-regex to 0.20.0 across all three lockfiles (#2813) by @chaliy
• chore(deps): bump the js-npm group in /crates/bashkit-js with 5 updates (#2809) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 4 updates (#2808) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 3 updates (#2807) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2805) by @chaliy
• ci: pin nightly jobs to nightly-2026-10-30 (#2804) by @chaliy
• fix(python): drain abandoned callback dispatch before interpreter exit (#2802) by @chaliy
• ci(release): use crates.io trusted publishing (#2801) by @chaliy

Full Changelog: v0.20.2...v0.20.3

Release v0.20.2

Highlights

• Patched CPython sandbox engine. Wasmtime 48.0.8 addresses RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424; the embedded CPython artifact is rebuilt with the same exact engine version (#2798).
• Signed Windows Python wheels. Windows native modules receive Authenticode signatures and timestamps, verified before the final wheel is tested and published (#2799).
• Binary-safe HTTP output. curl downloads and curl/wget stdout preserve bytes through redirections and pipelines, including compressed responses (#2778).
• Correct directory-content copies. cp -r source/. destination copies contents into an existing destination without adding a source-directory layer (#2796).

What's Changed

• chore(python): sign Windows release wheels with Authenticode (#2799) by @chaliy
• Fix Wasmtime security advisories (#2798) by @chaliy
• fix(testing): render the diagnostic slot in the fuzz echo gate (#2797) by @chaliy
• fix(cp): preserve directory-dot contents operands (#2796) by @chaliy
• ci(npm): re-publish an existing release tag via a tag input (#2794) by @chaliy
• fix(deps): clear the seroval script-injection advisories in the site lockfile (#2795) by @chaliy
• chore(python): document Smart App Control workaround and reproduction (#2793) by @chaliy
• chore(deps): bump the rust-dependencies group and record its vet audits (#2792) by @chaliy
• ci(npm): publish via npm trusted publishing (GitHub OIDC) (#2791) by @chaliy
• chore(deps): bump vt100 to 0.18 and migrate the NonZero screen API (#2789) by @chaliy
• fix(ci): retry the Rosetta cross build through toolchain segfaults (#2788) by @chaliy
• chore(ci): bump the github-actions group across 1 directory with 4 updates (#2787) by @app/dependabot
• chore(deps): bump the examples-npm group across 2 directories with 7 updates (#2785) by @app/dependabot
• fix(js): size the host-callback timeout for the slowest shipped lane (#2780) by @chaliy
• chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 3 updates (#2784) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 4 updates (#2783) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates (#2782) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates (#2781) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2779) by @chaliy
• fix(http): preserve binary download and stream output (#2778) by @chaliy

Full Changelog: v0.20.1...v0.20.2

Release v0.20.1

Highlights

• Windows CPython builds. The embedded CPython module uses a plain static slice on Windows and caches a 64 KiB-aligned copy at runtime, avoiding the Rust compiler trap when generating Windows COFF objects. Python and the hosted integration catalog remain available (#2777).
• Complete npm runtime files. The npm publish artifact includes runtime-functions.js and its declarations so importing the package succeeds (#2776).

What's Changed

• fix(cpython): avoid unsupported over-aligned statics on Windows (EVE-1311).
• fix(release): ship runtime-functions.js in the npm publish artifact (#2776).

Release v0.20.0

Highlights

• Live command I/O and async output sinks. Rust, Python, JavaScript, C and browser WASM consumers can stream command input/output while preserving shell routing and execution budgets (#2741, #2749).
• Host functions for embedded runtimes. Python and TypeScript scripts can call application-provided functions across native and browser bindings (#2739, #2740, #2742, #2743).
• Security updates across runtime graphs. Wasmtime 48.0.7, patched TLS validation/root bundles, Tokio 1.53.3 in the standalone Hyperlight guest, constant-time crypto fixes and supported Node security patches are included in the release source/build recipes. Unsoundness findings now fail every Cargo lockfile audit (#2767, #2768, #2772, #2773, #2774).
• Optional runtime warm-up. Embedders can initialize feature-enabled runtimes before serving requests with warm_up() (#2750).

Breaking Rust API change: the static-analysis enum analysis::CommandContext is now analysis::CommandPlacement. Before: use bashkit::analysis::CommandContext; and CommandContext::Direct. After: use bashkit::analysis::CommandPlacement; and CommandPlacement::Direct. Update annotations for AnalyzedCommand.context accordingly. The root bashkit::CommandContext now describes a live host-command invocation; it is not the analysis enum. Serialized context field names and values remain unchanged. See the streaming guide (#2741).

Remaining dependency caveats: optional SSH still uses RSA affected by Marvin (RUSTSEC-2023-0071); upstream has no published fix. Prefer Ed25519 to avoid RSA private-key operations. atomic-polyfill remains an unmaintained transitive dependency. Node is supplied by the embedding application: Node 18/20 compatibility does not imply security support; use a patched supported runtime. Downstream Rust applications should refresh their own lockfiles and rebuild. This release does not claim every dependency is vulnerability-free (#2774).

What's Changed

• fix(release): recover publication from immutable tags by @chaliy
• fix(builtins): track uucore quoting-style rename in printf shim (#2738) by @chaliy
• feat(python): expose embedded runtime host functions to agent tools (#2739) by @chaliy
• feat(js): add Python and TypeScript runtime host functions (#2740) by @chaliy
• feat(capi): add Python and TypeScript runtime host functions (#2742) by @chaliy
• feat(streaming): add live command I/O and async output sinks (#2741) by @chaliy
• fix(capi): export runtime callbacks in Windows import libraries (#2744) by @chaliy
• feat(wasm): add Python and TypeScript runtime host functions (#2743) by @chaliy
• fix(ci): open a new coreutils drift PR when the previous one was closed (#2745) by @chaliy
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2746) by @chaliy
• fix(testing): attribute fuzz canary echoes to the script that caused them (#2747) by @chaliy
• fix(testing): keep killed CLI children out of tarpaulin's coverage merge (#2748) by @chaliy
• fix(streaming): enforce budgets and preserve routed byte output (#2749) by @chaliy
• feat(bashkit): add feature-gated warm_up() entry point (#2750) by @chaliy
• fix(builtins): read od's generated args under either clap value type (#2754) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.87.28 to 2.87.29 in the github-actions group (#2756) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 3 updates (#2751) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 4 updates (#2757) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates (#2752) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 6 updates (#2753) by @app/dependabot
• chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates (#2755) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2759) by @chaliy
• fix(ci): open coreutils drift PRs with a token permitted to create them (#2760) by @chaliy
• chore(deps): land the safe rust-dependencies bumps and hold oxc at 0.117.x (#2761) by @chaliy
• chore(deps): bump wrangler from 4.151.0 to 4.151.1 in /site in the site-npm group (#2762) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates (#2763) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 4 updates (#2764) by @app/dependabot
• fix(deps): bump wasmtime to 48.0.7 for RUSTSEC-2026-0379 and -0378 (#2767) by @chaliy
• fix(ci): unbreak main after the ubuntu-26.04 roll and the October advisories (#2768) by @chaliy
• chore(deps): bump rustyline from 18.0.1 to 19.0.0 (#2765) by @app/dependabot
• fix(builtins): read shuf's input range under either generated value type (#2770) by @chaliy
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2771) by @chaliy
• fix(deps): clear the 2026-10-23 constant-time and npm advisories (#2773) by @chaliy
• fix(ci): pin supported Node security patch versions (#2772) by @chaliy
• fix(security): complete standalone runtime audits (#2774) by @chaliy

Full Changelog: v0.19.0...v0.20.0

Release v0.19.0

Highlights

• Interactive terminals for applications and agents. In-process terminals provide screen text, scrollback, input, interrupts, and editor/pager commands; Rust, Python, and JavaScript bindings expose the terminal alongside TerminalTool (#2509, #2518, #2521, #2523).
• Real CPython in the sandbox. The opt-in cpython feature runs CPython 3.14 as python3 through WebAssembly, with VFS access and HTTP routed through Bashkit's egress boundary. The existing lightweight Python runtime remains available (#2515, #2568).
• Broader shell and utility compatibility. Concurrent pipelines and background jobs, a default root filesystem, symlink traversal, additional everyday commands, and GNU-oriented awk/coreutils behavior expand the scripts Bashkit can run (#2524, #2525, #2526, #2527, #2541, #2583).
• Resource and dependency hardening. Expanded allocation, recursion, input, and output accounting makes resource refusals explicit across the interpreter and builtins; dependency updates address published advisories (#2452, #2468, #2725, #2733, #2734, #2696).
• Breaking change: ScriptedTool moves to its own package. Rust callers replace bashkit's scripted_tool feature and imports with bashkit-scripted-tool = "0.19" / bashkit_scripted_tool; replace builder.tool_registry(registry) with registry.install(builder). Python imports move from bashkit to bashkit.scripted; JavaScript imports move from @everruns/bashkit to @everruns/bashkit/scripted. See the migration guide (#2519, #2520).

What's Changed

• fix(hextools): report a missing operand the way real od does (#2438) by @chaliy
• fix(parser): keep } inside a word unless it stands alone (#2439) by @chaliy
• fix(builtins): report unreadable operands with the real errno text (#2440) by @chaliy
• fix(grep): send read diagnostics to stderr and exit 2 (#2441) by @chaliy
• fix(grep): align with GNU grep and gate the spec suite against it (#2442) by @chaliy
• fix(interpreter): terminate command-resolution diagnostics with a newline (#2443) by @chaliy
• fix(head,tail): support GNU count forms (negative, suffixes, tail -c) (#2449) by @chaliy
• fix(interpreter): read file for $(<file) and run redirect-only commands (#2450) by @chaliy
• fix(awk): treat multi-char FS and split() separators as regexes (#2451) by @chaliy
• fix(builtins): report resource caps instead of truncating silently (#2452) by @chaliy
• fix(awk): cap string, field and variable memory growth (#2453) by @chaliy
• fix(jq): meter live values so growth stops at a limit (#2454) by @chaliy
• fix(awk): make expression format errors fatal (#2458) by @chaliy
• fix(limits): bound shell recursion by host stack safety (#2464) by @chaliy
• fix(limits): fail execution on rejected scalar assignment (#2466) by @chaliy
• fix(release): drop unsupported forwarded CLI features (#2461) by @chaliy
• fix(wasm): bound blocking sleep by execution timeout (#2460) by @chaliy
• fix(python): bound Deep Agents VFS searches (#2457) by @chaliy
• fix(sed): bound output growth during execution (#2455) by @chaliy
• fix(limits): meter array contents against the variable byte budget (#2468) by @chaliy
• fix(jq): bound recursive filter execution (#2467) by @chaliy
• fix(interpreter): meter resource usage for $(<file) command substitutions (#2469) by @chaliy
• test(jq): pin cap-test timeouts so sanitizer builds cannot race the deadline (#2470) by @chaliy
• chore(deps): resync auxiliary workspace lockfiles with the workspace (#2471) by @chaliy
• chore(deps): bump the site-npm group in /site with 3 updates (#2472) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 6 updates (#2473) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 4 updates (#2474) by @app/dependabot
• chore(deps): bump the examples-npm group across 2 directories with 6 updates (#2475) by @app/dependabot
• chore(ci): bump the github-actions group with 2 updates (#2478) by @app/dependabot
• fix(deps): patch wasmtime for RUSTSEC-2026-0315 and RUSTSEC-2026-0316 (#2486) by @chaliy
• fix(awk): meter reopened getline inputs (#2479) by @chaliy
• fix(headtail): avoid line offset allocation (#2480) by @chaliy
• fix(scripted-tool): sanitize custom builtin errors (#2481) by @chaliy
• fix(changelog): parse asterisk bullets for stale PRs (#2482) by @chaliy
• fix(realfs): protect Windows home mounts (#2484) by @chaliy
• fix(python): reject read-only self mounts (#2483) by @chaliy
• fix(grep): skip operands for quiet zero match limit (#2485) by @chaliy
• chore(deps): bump turso_core from 0.8.0-pre.11 to 0.8.0-pre.13 (#2477) by @app/dependabot
• chore(deps): bump the rust-dependencies group with 7 updates (#2476) by @app/dependabot
• fix(grep): apply -m per file, as GNU does (#2487) by @chaliy
• fix(deps): clear seven dependency advisories across npm and PyPI lockfiles (#2488) by @chaliy
• fix(ci): scan npm and PyPI advisories beside cargo (#2489) by @chaliy
• fix(deps): cover the python random-fs workspace in dependabot (#2490) by @chaliy
• fix(deps): clear the three advisory clusters that turned nightly red (#2498) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.87.20 to 2.87.22 in the github-actions group (#2497) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 2 updates (#2491) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 4 updates (#2494) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 3 updates (#2492) by @app/dependabot
• chore(deps): bump langchain from 1.4.2 to 1.4.3 in /examples/docs-grep-agent in the docs-grep-agent-uv group (#2493) by @app/dependabot
• chore(deps): bump bigdecimal from 0.4.10 to 0.4.11 in the rust-dependencies group (#2495) by @app/dependabot
• chore(deps): bump turso_core from 0.8.0-pre.14 to 0.8.0 (#2496) by @app/dependabot
• fix(deps): unbreak nightly ASan, and clear the http-cache-semantics advisory (#2499) by @chaliy
• chore(deps): bump @langchain/core from 1.2.13 to 1.2.14 in /crates/bashkit-js in the js-npm group (#2500) by @app/dependabot
• chore(deps): bump wrangler from 4.143.0 to 4.145.0 in /site in the site-npm group (#2501) by @app/dependabot
• chore(deps): bump the docs-gre...

Release v0.18.2

Highlights

• sed is GNU-aligned. The stream editor was rewritten after a differential audit against GNU sed 4.9 found 46 mismatches. It adds the missing commands (y = l n N P D T z F r R w W), GNU range-address semantics, \U \L \u \l \E case conversion, a real getopt (-s, -z, -f, -l, attached -i.bak), and it preserves a missing final newline. -i now writes atomically (#2436).
• Windows path fix. VFS paths use forward slashes on every host (#2435).
• Release pipeline hardening. npm publish verification now outlasts the registry cache (#2426), and untrusted workflow code no longer receives the checkout token (#2420).

What's Changed

• fix(sed): GNU-align the stream editor and add the missing commands in #2436
• chore(deps): bump the rust-dependencies group with 5 updates in #2431
• chore(deps): bump the site-npm group in /site with 3 updates in #2428
• chore(deps): bump langchain from 1.4.0 to 1.4.1 in /examples/docs-grep-agent in the docs-grep-agent-uv group in #2430
• chore(deps): bump the examples-npm group across 1 directory with 4 updates in #2432
• chore(deps): bump the js-npm group in /crates/bashkit-js with 5 updates in #2429
• chore(deps): bump clap from 4.6.6 to 4.6.7 in /examples/hyperlight in the example-cargo group across 1 directory in #2434
• chore(ci): bump the github-actions group with 2 updates in #2433
• fix(fs): build VFS paths with forward slashes on every host in #2435
• fix(ci): let npm publish verification outlast the registry cache in #2426
• docs(readme): point computerwelt link to curiosity-ai org in #2424
• test(bench): retry the stub-shell exec past ETXTBSY in #2423
• test(ci): scope the broad-token probe to the injected token in #2422
• fix(ci): un-quarantine the bun canary job in #2421
• fix(ci): stop handing the checkout token to untrusted workflow code in #2420

Full Changelog: v0.18.1...v0.18.2

Release v0.18.1

Highlights

• ScriptedTool builtins can now use clap. ScriptedToolBuilder::builtin(...) registers a raw-argv builtin alongside ToolDef tools, so commands needing positionals, short flags, --, or parse-time required-argument checking work inside a ScriptedTool (#2408).
• Closed schemas reject unknown flags. With "additionalProperties": false, an unrecognised flag is now an error naming the valid flags instead of a silently-dropped property, and clap output is stripped of ANSI codes (#2408).

What's Changed

• chore(deps): bump actions/download-artifact from 6 to 7 in #2414
• chore(deps): bump actions/upload-artifact from 5 to 6 in #2413
• chore(deps): bump pypa/gh-action-pypi-publish from 1.12.1 to 1.13.0 in #2412
• chore(deps): bump actions/checkout from 5 to 6 in #2411
• chore(deps): bump actions/setup-node from 5 to 6 in #2410
• chore(deps): bump actions/setup-python from 5 to 6 in #2409
• feat(scripted_tool): let ScriptedTool builtins use clap in #2408
• chore(deps): bump github/codeql-action from 3 to 4 in #2406
• chore(deps): bump pypa/cibuildwheel from 3.1 to 3.2 in #2405
• chore(deps): bump actions/cache from 4 to 5 in #2404
• chore(deps): bump ast-grep from 0.40.1 to 0.41.0 in #2403
• chore(deps): bump the npm_and_yarn group with 2 updates in #2402
• chore(deps): bump actions/stale from 9 to 10 in #2401
• fix(docs-grep-agent): reject zero-context matches with a helpful error in #2400
• fix(capi): make trybuild a dev-dependency with idiomatic assertions in #2399
• chore(deps): bump astral-sh/setup-uv from 6 to 7 in #2398
• chore(deps): bump crate-ci/typos from 1.35 to 1.36 in #2397
• docs(eval): record variadic builtins limitation L30 in #2395

Full Changelog: v0.18.0...v0.18.1

Release v0.18.0

[0.18.0] - 2026-09-10

Highlights

• Security hardening. The Rust update takes russh 0.63.1 security fixes
  (#2365), sqlite budgets account
  for work performed inside a single engine step (TM-SQL-014)
  (#2369), the host-environment hole
  in builtins is closed
  (#2385), and tabled 0.22 retires
  RUSTSEC-2026-0173
  (#2379).
• C ABI improvements. The C ABI exposes host-directory mounts, bringing native
  embeddings to parity with other host bindings
  (#2371).

What's Changed

• fix(host-call): enforce the execution deadline while parked by @chaliy in #2349
• chore(ci): bump taiki-e/install-action from 2.86.3 to 2.86.5 in the github-actions group by @app/dependabot in #2354
• chore(deps): bump @langchain/core from 1.2.8 to 1.2.9 in /crates/bashkit-js in the js-npm group by @app/dependabot in #2350
• chore(deps): bump the site-npm group in /site with 3 updates by @app/dependabot in #2352
• chore(deps): bump the examples-npm group across 2 directories with 6 updates by @app/dependabot in #2353
• chore(deps): bump wasmtime from 47.0.4 to 48.0.0 in /examples/hyperlight/host in the example-cargo group across 1 directory by @app/dependabot in #2355
• chore(deps): bump turso_core from 0.8.0-pre.4 to 0.8.0-pre.7 by @chaliy in #2356
• chore(deps): move chacha20 off yanked 0.10.1 by @chaliy in #2357
• chore(security): record why the rsa advisory suppression stops matching by @app/claude in #2358
• chore(deps): bump the js-npm group in /crates/bashkit-js with 2 updates by @app/dependabot in #2359
• chore(deps): bump the site-npm group in /site with 3 updates by @app/dependabot in #2361
• chore(deps): bump the examples-npm group across 1 directory with 4 updates by @app/dependabot in #2362
• chore(ci): bump taiki-e/install-action from 2.86.5 to 2.87.0 in the github-actions group by @app/dependabot in #2363
• chore(deps): bump the example-cargo group across 2 directories with 3 updates by @app/dependabot in #2364
• fix(deps): bump rust-dependencies group, taking russh 0.63.1 security fixes by @chaliy in #2365
• fix(bindings): canonicalize runtime mount replay keys by @chaliy in #2366
• fix(sqlite): count work performed inside a single engine step (TM-SQL-014) by @chaliy in #2369
• fix(docs): render inline SVG diagrams correctly by @chaliy in #2368
• chore(bench): add vm-linux-x86_64 benchmark run 2026-09-02 by @chaliy in #2370
• feat(capi): expose host-directory mounts over the C ABI by @tersePrompts in #2371
• chore(maintenance): refresh dependencies and resolve security findings by @chaliy in #2378
• chore(deps): upgrade tabled to 0.22 and retire RUSTSEC-2026-0173 by @chaliy in #2379
• chore(ci): bump the github-actions group with 2 updates by @app/dependabot in #2383
• chore(deps): bump the example-cargo group across 1 directory with 3 updates by @app/dependabot in #2384
• chore(deps): bump the examples-npm group across 1 directory with 3 updates by @app/dependabot in #2382
• fix(builtins): sync uutils coreutils drift and close host-env hole by @chaliy in #2385
• chore(deps): stop dependabot reopening the unbuildable get-size2 bump by @chaliy in #2386
• docs(readme): add Java and Elixir community bindings by @chaliy in #2390
• fix(fs): set RealFs mtime with FILE_WRITE_ATTRIBUTES on Windows by @chaliy in #2391
• fix(awk): stop number lexer swallowing following +/- operators by @chaliy in #2392
• feat(bindings): add read-only filesystem mounts by @chaliy in #2393

Full Changelog: v0.17.1...v0.18.0

Release v0.17.1

Highlights

• The native npm package ships again. @everruns/bashkit stalled at 0.16.0
  during the v0.17.0 release because the publish workflow tested Node 20 in
  ways CI no longer did; the release path and CI now agree, and a check fails
  when they drift apart again.

Fixed

• The npm native package publishes again: publish-js.yml no longer runs the
  ava suites on Node 20, which ava 8 dropped support for. Node 20 keeps running
  the runtime-compat suite against the shipped binding, matching how js.yml
  already split them; that suite runs under bash so the Windows runner
  expands its glob, which Node 20 cannot do itself.
• The JS runtime-compat mount and unmount test mounts a real temporary
  directory instead of a hardcoded /tmp, so it passes on the Windows runners
  the release workflow tests on.

Added

• just check-workflow-parity fails when a release workflow tests a runtime
  version CI does not, when a shared test suite is gated to more versions at
  release time than in CI, or when dtolnay/rust-toolchain pins disagree
  across workflows. This class of drift is otherwise invisible until a tag
  exists and part of the release has already published.

Performance

• Ported coreutils builtins reuse pre-built clap Command definitions instead
  of rebuilding them per invocation
  (#2347).

What's Changed

• perf(builtins): cache pre-built clap Commands for ported coreutils builtins (#2347) by @chaliy
• fix(test): mount a real temp dir in the JS runtime-compat suite (#2346) by @chaliy
• fix(release): run the Node 20 compat suite under bash on Windows (#2345) by @chaliy
• fix(release): unblock the npm native publish and catch release/CI matrix drift (#2344) by @chaliy

Full Changelog: v0.17.0...v0.17.1

Release v0.17.0

Highlights

• Bashkit runs as a plain wasm component, with no JS engine and no WASI.
  A component-model guest exposes shell execution over WIT, so hosts such as
  Hyperlight micro-VMs can embed the interpreter without shipping a JavaScript
  runtime or a WASI implementation, and bashkit now builds cleanly for WASI
  targets under CI coverage
  (#2311,
  #2310).
• Untrusted input costs bounded work everywhere it is parsed. Script
  analysis, zip archive buffers, pipeline stderr aggregation, real-filesystem
  appends, snapshot chunk expansion, C ABI script intake, and CLI host stdin
  reads now charge or cap resources before allocating or blocking
  (#2333,
  #2330,
  #2326,
  #2327,
  #2282,
  #2334,
  #2335).
• Sandbox escapes closed at the host boundary. The host bridge no longer
  interpolates into a shell, HostMounts normalizes VFS paths before mapping,
  backend symlink reads are refused, YAML aliases are rejected before parsing,
  and arithmetic command substitutions are flagged by static analysis
  (#2337,
  #2281,
  #2279,
  #2280,
  #2283).
• The always-on dependency graph is 21 crates smaller and the browser wasm
  bundle 911 KB lighter. Timezone data moved behind a default-on tzdata
  feature, the ICU4X stack pulled in by url is gone, and date fails loudly
  instead of silently formatting a named zone as UTC when tzdata is off
  (#2321).
• Every cargo lockfile in the tree is audited, clearing 16 wasmtime
  advisories plus the fuzz lockfile gap and the outstanding npm advisories in
  the example and site lockfiles
  (#2340,
  #2293,
  #2285,
  #2284).

Breaking Changes

• http_client no longer implies a rustls crypto backend. Pick ring
  (previous behavior, enabled by default) or aws-lc-rs for a FIPS-capable
  backend. Enabling http_client with neither is a compile error. Only
  consumers building with --no-default-features need to act.

  Before:

  bashkit = { default-features = false, features = ["http_client"] }

  After:

  bashkit = { default-features = false, features = ["http_client", "ring"] }

• Timezone data is behind the tzdata feature. It is on by default, so
  default builds are unchanged. Builds with --no-default-features that use
  TZ=<named zone> must add tzdata; without it date reports that it cannot
  honour the zone and exits 1 rather than returning a plausible-looking UTC
  time.

• Non-ASCII domain names are rejected rather than normalized. Pinning
  idna_adapter drops UTS 46 normalization, which removes the homograph and
  punycode-confusion class from allowlist matching. Hosts that relied on
  internationalized domain names in HTTP allowlists must supply their punycode
  form.

What's Changed

• chore(deps): bump wit-bindgen from 0.51.0 to 0.60.0 in /examples/hyperlight in the example-cargo group across 1 directory (#2342) by @dependabot
• chore(deps): bump the examples-npm group across 1 directory with 2 updates (#2341) by @dependabot
• fix(deps): clear 16 wasmtime advisories and audit every cargo lockfile (#2340) by @chaliy
• chore(deps): bump ava to 8.0.1 and oxlint to 1.79.0 in bashkit-js (#2339) by @chaliy
• fix(justfile): invoke bashkit-cli the way the CLI parses args (#2338) by @chaliy
• fix(security): prevent host bridge shell injection (#2337) by @chaliy
• fix(docs): keep dependency scan line-local (#2336) by @chaliy
• fix(cli): bound host stdin reads by execution timeout (#2335) by @chaliy
• fix(c-api): reject oversized scripts before UTF-8 validation (#2334) by @chaliy
• fix(analysis): bound command validation work to prevent CPU amplification (#2333) by @chaliy
• fix(tools): enforce referenced input schemas (#2332) by @chaliy
• fix(streams): consume binary lines by byte offset (#2331) by @chaliy
• fix(zip): budget archive buffers before allocation (#2330) by @chaliy
• fix(interpreter): contain CommandResolver panics (#2328) by @chaliy
• fix(realfs): bound append memory usage by streaming into staging (#2327) by @chaliy
• fix(interpreter): bound pipeline stderr aggregation (#2326) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.86.1 to 2.86.3 in the github-actions group (#2325) by @dependabot
• chore(deps): bump ai from 7.0.66 to 7.0.67 in /examples in the examples-npm group across 1 directory (#2324) by @dependabot
• chore(deps): bump the site-npm group in /site with 3 updates (#2323) by @dependabot
• chore(deps): trim always-on dependency graph, gate chrono-tz behind tzdata (#2321) by @chaliy
• fix(testing): match shell echoes the shell actually produces (#2320) by @chaliy
• fix(redirect): report redirection failures with bash's strerror wording (#2319) by @chaliy
• fix(deps): pin a pnpm release cooldown so dependabot npm runs stop failing (#2318) by @chaliy
• feat(http): make the rustls crypto backend a feature (#2317) by @chaliy
• fix(examples): pin vite exactly and run the browser example's tests in CI (#2316) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.85.13 to 2.86.1 (#2315) by @dependabot
• fix(ci): install a pinned wasm-opt instead of apt, and bound the wasm jobs (#2314) by @chaliy
• chore(deps): bump vite from 6.4.3 to 8.2.1 in /examples/browser (#2313) by @dependabot
• chore(deps): add dependabot version updates for the five npm lockfiles (#2312) by @chaliy
• feat(wasm): run bashkit as a wasm component with no JS and no WASI (#2311) by @chaliy
• fix(builtins): compile bashkit for WASI targets + CI check for wasm32-wasip2 (#2310) by @chaliy
• feat(coreutils-port): resolve uucore Fluent messages at port time (#2309) by @chaliy
• chore(deps): update dependencies (#2308) by @chaliy
• chore(ci): bump the github-actions group with 2 updates (#2307) by @dependabot
• fix(sqlite): handle turso StepResult::Sleep and bump to 0.8.0-pre.4 (#2306) by @chaliy
• chore(deps): bump russh to 0.62.6 (#2305) by @chaliy
• docs: remove em-dashes and AI-tell wording from markdown prose (#2304) by @chaliy
• chore(ci): bump the github-actions group with 2 updates (#2303) by @dependabot
• chore(deps): hold monty at 0.0.19 — 0.0.21 silently disables max_memory (#2300) by @chaliy
• chore(deps): bump the rust-dependencies group with 5 updates (#2299) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.85.10 to 2.85.11 in the github-actions group (#2295) by @dependabot
• fix(security): clear fuzz lockfile advisories and close the audit gap (#2293) by @chaliy
• feat(bindings): host env and mounts applied after construction survive reset (#2292) by @chaliy
• docs(security): record RUSTSEC-2023-0071 as TM-CRY-002; bump futures-util (#2290) by @chaliy
• chore(deps): bump turso_core from 0.8.0-pre.2 to 0.8.0-pre.3 (#2289) by @dependabot
• chore(deps): bump the rust-dependencies group with 6 updates (#2288) by @dependabot
  *...