chore(deps): land the safe rust-dependencies bumps and hold oxc at 0.117.x

[chaliy]

What changed

Resolves this week's aggregated chore(deps) group (#2758), which could not
merge as one unit — three patch bumps in it are fine, the oxc_* jump is not.

Landed: sha2 0.11.0 → 0.11.1, syn 3.0.8 → 3.0.9, tokio 1.53.2 →
1.53.3. Lockfile-only. The first two already went in through the fuzz lockfile
in #2755, so this brings the root lockfile in step.

Supply chain: no new exemptions. Refreshing imports.lock picks up upstream
mozilla / bytecodealliance audits that already cover all three, and retires
seven exemptions those imports now subsume — bit-set, bit-vec,
core_detect, futures-core, pastey, pkg-config, tracing-core. The
audited share of the graph goes up, not down.

Held: oxc_* is added to dependabot's ignore list, with the rationale in
knowledge/operations/dependencies.md alongside the existing branches and
idna_adapter entries.

Why

The oxc_* 0.117.0 → 0.154.0 bump in #2758 fails three independent ways:

1. MSRV. oxc 0.154 requires rustc 1.97.0 against the 1.95.0 in
   rust-toolchain.toml. This is what reddened the WASM web package job:

   error: rustc 1.95.0 is not supported by the following packages:
     oxc_allocator@0.154.0 requires rustc 1.97.0
     ... 12 more oxc crates
   

   The same shape as the wasmtime 49.x failure in chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates #2708, which is why
   wasmtime is already ignored.

2. It splits the oxc graph in two. zapcode-core 1.5.1 requires
   oxc ^0.117, so it does not move with bashkit's declaration. The bumped
   lockfile carries both trees:

   oxc_parser    ['0.117.0', '0.154.0']
   oxc_ast       ['0.117.0', '0.154.0']
   oxc_allocator ['0.117.0', '0.154.0']
   ... 10 more doubled
   

   bashkit declares those five crates for the wasm32-unknown-unknown
   TypeScript path, where zapcode_browser/parser walks the oxc AST directly,
   and crates/bashkit/Cargo.toml says the versions exist to match what
   upstream ZapCode vendors. The bump puts the two sides of one parser pipeline
   37 minor versions apart.

3. Supply chain. It adds 19 unvetted crates — compact_str 0.10,
   phf 0.14, oxc_index 5.0 and the oxc stack — doubling the vendored oxc
   surface for a bump that cannot build anyway.

Ignored outright rather than by update-type: every release past 0.117.x splits
the graph the same way, so there is no version to bump to. Lifting it waits on a
zapcode-core release built against a newer oxc, and then means bumping the
pinned toolchain and porting the vendored parser together — a deliberate change,
not an aggregated chore(deps) PR. Without the entry dependabot reopens the
same unlandable PR every week, which is what the monty and get-size2
comments in that file describe happening before.

Before / After

Before — #2758's Audit job, with the oxc stack in the tree:

Vetting Failed!

21 unvetted dependencies:
  compact_str:0.10.0 missing ["safe-to-deploy"]
  oxc_allocator:0.154.0 missing ["safe-to-deploy"]
  ... 16 more oxc/phf crates
  sha2:0.11.1 missing ["safe-to-deploy"]
  syn:3.0.9 missing ["safe-to-deploy"]
  tokio:1.53.3 missing ["safe-to-deploy"]

After — oxc held, the three patch bumps carried, imports refreshed:

$ cargo vet --locked
Vetting Succeeded (98 fully audited, 83 partially audited, 495 exempted)

$ cargo build --workspace
Finished `dev` profile [unoptimized + debuginfo] target(s)

$ python3 -m unittest discover -s scripts/tests -p 'test_*.py'
Ran 179 tests in 29.586s
OK

scripts/tests/test_dependabot_coverage.py passes with the new entry, the
config parses with oxc_* in the ignore list for the / cargo entry, and
just check-okf and just check-doc-links are both clean.

The intermediate step is worth stating explicitly: I reproduced #2758's
Audit failure locally, then confirmed that holding oxc reduces it to exactly
the three patch bumps, and that an imports.lock refresh clears those without
a single hand-written trust decision.

Risk

• Low
• Three patch bumps and a lockfile; no bashkit source changes.
• The exemption removals are the part worth a second look. They are not
  loosened checks: cargo vet still passes with them gone, because the
  refreshed upstream audits cover those crates for real. If an import later
  disappears, cargo vet fails closed in CI rather than silently accepting.
• The oxc_* ignore means dependabot stops proposing oxc bumps entirely. That
  is intended, and the knowledge entry records when to drop it.

Checklist

• Tests added or updated — test_dependabot_coverage.py covers the config
  shape; the bumps are lockfile-only with no new code surface to test
• Backward compatibility considered — no API change; oxc stays on the
  version the vendored parser is written against

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	5ef9f35	Commit Preview URL Branch Preview URL	Oct 20 2026, 10:17 AM