chore(deps): bump turso_core from 0.8.2 to 0.8.3

[chaliy]

What changed

Takes the turso 0.8.2 → 0.8.3 bump from #2707 and adds the supply-chain delta
audits it needs. No observable behavior change in bashkit: turso_core stays
BETA behind the non-default sqlite feature.

Supersedes #2707, which cannot merge as-is.

Why

Every rust job on #2707 was green — Test, Lint, Examples, the WASM and
Windows jobs — except Audit, where cargo vet --locked reported the four
turso crates unvetted at the new version:

Vetting Failed!

4 unvetted dependencies:
  turso_core:0.8.3 missing ["safe-to-deploy"]
  turso_ext:0.8.3 missing ["safe-to-deploy"]
  turso_macros:0.8.3 missing ["safe-to-deploy"]
  turso_parser:0.8.3 missing ["safe-to-deploy"]

Dependabot cannot write an audit, and the / cargo entry excludes
turso_* from the aggregated group precisely so each bump gets reviewed on
its own. So the review is the work here; the lockfile change is the easy part.

Before / After

$ cargo vet --locked        # before
Vetting Failed!  4 unvetted dependencies

$ cargo vet --locked        # after
Vetting Succeeded (91 fully audited, 79 partially audited, 499 exempted)

What the review found

Diffed each published package against 0.8.2. turso_ext, turso_macros and
turso_parser contain no Rust source change at all — zero differing .rs
files across the two published trees, only the crate version, matching sibling
versions and release metadata (Cargo.lock, .cargo_vcs_info.json).

turso_core changes nine Rust files. No new dependencies, no new unsafe, no
new build scripts, and no new host filesystem, network or process access:

• AUTOINCREMENT explicit rowid. The disk advance now also reads the backing
  table's is_called column. A fresh sequence row is (1, is_called = 0), and
  without that check an explicit rowid of 1 left the next generated id at 1, so
  the next insert replaced the row. The single Le comparison becomes Lt/Gt
  plus an is_called test, with the descending case mirrored.
• Abandoned MVCC commit. Finishing one now releases the connection's read
  transaction and, for the main database only, resets transaction state — state
  the dropped CommitStateMachine does not own and previously leaked. Attached
  databases keep their own slot, already cleared by the state machine.
• Cursor seek reuse narrows from "position matches the seek key" to
  "position is the only row for that key", which requires a rowid, a whole
  index entry, or every column of a UNIQUE index with no NULL.
• Logical-log header upgrade returns the CRC-filled header for the caller
  to adopt instead of publishing it before the write lands, so a failed header
  write keeps the previous on-disk header and retries. A new fault-injecting
  file covers that path.
• MVCC tombstone insertion for B-tree-resident rows moves into its own helper
  with visibility and write-write conflict rules unchanged.

Recorded as four 0.8.2 -> 0.8.3 delta audits, the same shape as the existing
0.8.1 -> 0.8.2 entries.

Risk

• Low for this repo: sqlite is off by default, and the four changes above
  are each a narrowing — a leak closed, a stale watermark corrected, a seek
  fast path restricted, a header no longer published before it is durable.
• turso_core remains BETA upstream, as
  knowledge/runtimes/sqlite-builtin.md says. This bump does not change that.
• The audit notes are a source safety review, not a formal transactional proof;
  the MVCC and logical-log changes are the parts a future regression would most
  likely come from.
• Does not touch the sqlite builtin or its VFS/IO bridge, so no
  just bench-sqlite regeneration is included.

Checklist

• Tests added or updated — none needed: dependency bump plus supply-chain
  metadata, with the existing sqlite suite covering behavior. The gate that
  was failing is shown passing above. Matches the shape of the last turso
  bump (chore(deps): bump turso_core from 0.8.1 to 0.8.2-pre.2 #2528: Cargo.lock + supply-chain/audits.toml).
• Backward compatibility considered — no bashkit API change; the engine
  stays behind the non-default sqlite feature.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	38e973b	Commit Preview URL Branch Preview URL	Oct 13 2026, 10:07 AM