chore(release): prepare v0.17.0

[chaliy]

What changed

Prepares Bashkit v0.17.0 across Rust, CLI, Python, native Node, browser WASM, and C ABI release artifacts. 56 commits since v0.16.0.

Release content:

• Bashkit runs as a plain wasm component with no JS engine and no WASI (Hyperlight guest), and builds cleanly for WASI targets under CI coverage.
• The rustls crypto backend is selectable: ring (default) or aws-lc-rs. http_client no longer implies a backend.
• The always-on dependency graph is 21 crates smaller and the browser wasm bundle 911 KB lighter; timezone data moved behind a default-on tzdata feature.
• Untrusted input costs bounded work at every parse point touched this cycle: script analysis, zip buffers, pipeline stderr, realfs appends, snapshot chunks, C ABI script intake, CLI host stdin.
• Sandbox escapes closed at the host boundary: host bridge shell injection, HostMounts path normalization, backend symlink reads, YAML aliases, arithmetic command substitutions.
• Every cargo lockfile in the tree is audited, clearing 16 wasmtime advisories plus the fuzz lockfile gap.

The changelog documents three breaking changes with migration guidance (rustls backend selection, tzdata, non-ASCII domain names rejected instead of UTS 46 normalized). All three only affect builds with --no-default-features or hosts that fed internationalized domain names to the HTTP allowlist.

This PR also fixes the CLI packaging proxy in just release-check. The proxy resolves the core crate from crates.io, so it may only request features the published core exposes; ring and tzdata are new this cycle, so the proxy failed to resolve. scripts/cli_publish_proxy.py now reads the published feature set from the registry and drops the missing ones in the disposable copy only, with unit tests under scripts/tests/. The workspace copy also uses tar instead of rsync, which is absent from the release sandbox.

Why

There are 56 verified commits since v0.16.0, including new public features and intentional feature-flag breaking changes, so this is a minor release. All registries currently report v0.16.0.

Before / After

Registries before this release:

crates.io bashkit -> 0.16.0
crates.io bashkit-cli -> 0.16.0
PyPI bashkit -> 0.16.0
npm @everruns/bashkit (latest) -> 0.16.0
npm @everruns/bashkit-wasm (latest) -> 0.16.0

Prepared and smoke-tested at 0.17.0:

$ cargo run -q -p bashkit-cli -- --version
bashkit 0.17.0
$ python -c "import bashkit, importlib.metadata as m; print(m.version('bashkit'), bashkit.Bash().execute_sync('echo hello').stdout)"
0.17.0 hello

Publish-readiness report:

• just pre-pr passed: fmt, clippy, Rust test suite, script unit tests, capability parity, OKF bundle, doc links, cargo vet.
• cargo publish --dry-run -p bashkit packaged and verified v0.17.0.
• Disposable registry-backed bashkit-cli package dry-run succeeded (7 files, 232.0 KiB) with the fixed proxy.
• Nightly and Fuzz workflows green on their most recent runs on main.
• Native Node release binding built; full ava suite green (569 tests).
• Browser WASM release build plus headless Node integration suite green (63 tests).
• Python cp39-abi3 release wheel built, installed into a clean virtualenv, and executed.
• just apidocs regenerated the Python and TypeScript API references: no drift.
• Version sync verified across workspace Cargo.toml, bashkit-cli path-dep pin, both package.json files, crates/bashkit/src/lib.rs docs, README, docs snippets, and all lockfiles.

Risk

• Medium
• Multi-registry minor release with intentional feature-flag changes documented in the changelog.
• Publishing remains CI-managed; post-merge monitoring will verify the GitHub Release, crates.io, PyPI, both npm packages, Homebrew, and the C ABI archives before the release is declared shipped.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	6d75354	Commit Preview URL Branch Preview URL	Aug 22 2026, 05:11 AM