chore(deps): bump the rust-dependencies group, with the audits it needs

[chaliy]

What changed

Carries the rust-dependencies group bump dependabot proposed in #2729, plus the supply-chain records that bump needs to go green. Supersedes #2729.

Dependency moves: proptest 1.11.0 -> 1.12.0, serde_json 1.0.151 -> 1.0.154, syn 3.0.7 -> 3.0.8, and rand_xorshift 0.4.0 -> 0.5.0 behind proptest. No first-party code changes; Cargo.lock plus supply-chain/.

Why

#2729 was green on Test, Lint, Examples, Fuzz Compile Check and every WASM/Windows job. Only Audit failed, with cargo vet --locked reporting eleven unvetted crates.

proptest 1.12.0 is the reason. A patch-level bump of a dev dependency looks like it should add nothing, but 1.12 pulls a borsh serialization chain into the tree: bit-set, bit-vec, borsh, borsh-derive, core_detect, proc-macro-crate and toml_edit.

cargo tree -e normal -i proptest finds no path to it, so that whole chain is dev-only and takes safe-to-run exemptions — the same way proptest and rand_xorshift were already carried. The stale proptest 1.11.0 and rand_xorshift 0.4.0 exemptions are dropped rather than left behind.

The two crates that actually ship took hand delta audits at safe-to-deploy, written after reading the diffs:

• serde_json 1.0.151 -> 1.0.154 is narrowing. -0 no longer parses to I64(0) so the sign survives under arbitrary_precision; Number::as_f32 filters non-finite results, fixing comparison of large non-integer values against f32::INFINITY; invalid UTF-8 is reported at the first bad byte. The lexical/math.rs churn is max_value() -> MAX renames only.
• syn 3.0.7 -> 3.0.8 only narrows operator parsing: <- is rejected with a diagnostic, and -> is no longer mis-parsed as subtraction nor <- as less-than.

One thing worth recording for a future reader: serde_json's new UTF-8 position arithmetic saturates in as_str, which is not feature-gated and is what this tree compiles, but not in begin_raw_buffering, which is reachable only under the raw_value feature this tree does not enable. Worst case in either is a wrong column in an error message, but enabling raw_value later means re-checking that subtraction. The preserve_order foldhash hasher change is likewise behind a feature this tree does not enable.

No unsafe added or changed in either delta, no new ambient access, no new build scripts.

Before / After

Before, on #2729:

Vetting Failed!

11 unvetted dependencies:
  bit-set:0.11.1 missing ["safe-to-run"]
  bit-vec:0.10.1 missing ["safe-to-run"]
  borsh:1.8.1 missing ["safe-to-run"]
  borsh-derive:1.8.1 missing ["safe-to-run"]
  core_detect:1.0.0 missing ["safe-to-run"]
  proc-macro-crate:3.5.0 missing ["safe-to-run"]
  proptest:1.12.0 missing ["safe-to-run"]
  rand_xorshift:0.5.0 missing ["safe-to-run"]
  serde_json:1.0.154 missing ["safe-to-deploy"]
  syn:3.0.8 missing ["safe-to-deploy"]
  toml_edit:0.25.17+spec-1.1.0 missing ["safe-to-run"]
##[error]Process completed with exit code 255.

After, here:

Vetting Succeeded (94 fully audited, 84 partially audited, 498 exempted)

No behavior change in bashkit itself; this is a dependency and supply-chain change.

Risk

• Low
• Three patch/minor dependency bumps with no API change on our side, and seven new crates that are dev-only and cannot reach a shipped artifact. The judgement call worth reviewing is the safe-to-run criteria on the new borsh chain: it rests on cargo tree -e normal -i proptest returning no path, so if proptest ever becomes a normal dependency those exemptions are the wrong criteria and must be revisited.

Checklist

• Tests added or updated — no new behavior to test; the gate that was failing is cargo vet --locked, which now passes. The property-based security suite, the direct consumer of proptest, is 27/27 on 1.12.
• Backward compatibility considered — no public API or behavior change.

Validated locally: just check exit 0 (fmt, clippy --all-targets -D warnings, cargo test — 33 suites, 7114 tests, 0 failures, 162 repo-script tests, and every parity/OKF/doc-link/changelog gate), cargo vet --locked exit 0, ./scripts/audit-lockfiles.sh exit 0, cargo deny check licenses sources ok with the new crates, and cargo test -p bashkit --test proptest_security -- --test-threads=1 27/27.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	223bfe6	Commit Preview URL Branch Preview URL	Oct 15 2026, 10:50 AM