fix(security): clear fuzz lockfile advisories and close the audit gap

[chaliy]

What changed

Refreshed crates/bashkit/fuzz/Cargo.lock, clearing three advisories, and closed the two structural gaps that let them accumulate:

• CI now audits both cargo lockfiles, not just the workspace root.
• Dependabot gained a /crates/bashkit/fuzz entry, so the fuzz workspace gets weekly updates like every other manifest.

Advisories cleared:

Crate	Was	Now	Advisory
anyhow	1.0.102	1.0.104	RUSTSEC-2026-0190 — unsound Error::downcast_mut() (memory-corruption; patched in 1.0.103)
js-sys	0.3.88	0.3.104	yanked
wasm-bindgen	0.2.111	0.2.127	yanked

Why

crates/bashkit/fuzz is a separate cargo workspace with its own lockfile, and nothing was watching it. cargo audit in CI scanned only the root lockfile, and Dependabot's cargo entry only covered directory: "/". So the fuzz lockfile sat untouched since the v0.16.0 release prep and quietly rotted.

Refreshing the lockfile alone would have been a fix with a shelf life — the same drift would recur the moment the next advisory landed. Both watchers are corrected so it cannot silently repeat.

Before / After

Before — the fuzz lockfile was never scanned by CI. Running the scan manually:

$ cargo audit -f crates/bashkit/fuzz/Cargo.lock
    Scanning crates/bashkit/fuzz/Cargo.lock for vulnerabilities (198 crate dependencies)
Crate:     anyhow
Version:   1.0.102
Warning:   unsound
Title:     Unsoundness in `Error::downcast_mut()`
ID:        RUSTSEC-2026-0190

Crate:     js-sys
Version:   0.3.88
Warning:   yanked

Crate:     wasm-bindgen
Version:   0.2.111
Warning:   yanked

warning: 3 allowed warnings found

After — clean, and now running as part of every CI run:

$ cargo audit --ignore RUSTSEC-2023-0071 -f crates/bashkit/fuzz/Cargo.lock
    Scanning crates/bashkit/fuzz/Cargo.lock for vulnerabilities (180 crate dependencies)
$ echo $?
0

Fuzz workspace still builds against the refreshed lockfile:

$ cd crates/bashkit/fuzz && cargo check --locked
    Checking bashkit v0.16.0 (/home/user/bashkit/crates/bashkit)
    Checking bashkit-fuzz v0.0.0 (/home/user/bashkit/crates/bashkit/fuzz)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 30.21s

Root workspace audit is unchanged and still clean (2 documented unmaintained warnings, both already in the deny.toml ignore table). just check-okf and just check-doc-links pass.

Risk

• Low
• Scope is fuzz-only build dependencies — crates/bashkit/fuzz is test tooling and is never shipped in the published library, so no user-facing surface changes. Exposure was limited to the nightly fuzz runners.
• The realistic failure mode is a dependency bump breaking the fuzz build; verified with cargo check --locked on the fuzz workspace (compiles clean).
• The new Dependabot entry will open one grouped chore(deps) PR for fuzz dependencies on its weekly schedule — expected, not a regression.

Checklist

• Tests added or updated — no test changes; the guard here is the new CI audit step, which fails the build on any future fuzz-lockfile advisory (verified failing on the old lockfile, passing on the new one)
• Backward compatibility considered — no public API or shipped dependency touched

Knowledge updated in the same change: knowledge/security/threat-model.md (two-lockfile audit surface, Dependabot per-workspace requirement) and knowledge/log.md.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	751227d	Commit Preview URL Branch Preview URL	Aug 13 2026, 09:16 AM