chore(deps): move monty to crates.io 0.0.19

[chaliy]

What changed

Monty published 0.0.19 to crates.io, so the embedded Python interpreter stops being a git dependency.

• python works from a registry install. cargo add bashkit --features python and cargo install bashkit-cli (where python is a default feature) now ship the Python builtin. Previously the publish pipeline deleted the monty dep, the python feature, and the python examples from every workspace manifest before cargo publish, so no released crate could run Python.
• Publish workflow lost its manifest surgery — two sed-based "strip git-only dependencies" steps and both --allow-dirty flags are gone.
• PythonLimits::max_allocations is removed. Monty dropped max_allocations from its resource limits (Remove max_allocations from resource limits pydantic/monty#611). The knob moves off the shared RuntimeLimits onto TypeScriptLimits, the only runtime that still enforces one — leaving it on PythonLimits would hand callers a security knob that silently does nothing. Python allocation bombs are contained by max_memory / max_duration.
• Collected print output is now bounded. PrintWriter::CollectString gained a byte cap upstream (Cap CollectString/CollectStreams so print loops can't OOM the host pydantic/monty#558) because a print loop grows the host buffer without touching the VM heap. Bashkit wires it to max_memory, so one number bounds both heap and captured output.
• Supply chain: deny.toml drops the monty/ruff git allowances; cargo-vet's stale [policy.monty] audit-as-crates-io = false is replaced with exemptions for monty/monty-macros/monty-types at 0.0.19.

The [patch.crates-io] pin on jiter stays: monty 0.0.19 still requires jiter ^0.15.0, and published 0.15.0 is pyo3-0.28-only (0.16.0 moved to pyo3 0.29 but is outside monty's range). Removing the patch reproduces the links = "python" resolver conflict, so pyo3 0.29 in bashkit-python still depends on it.

Why

Monty being git-only was the single reason the python feature could not ship to crates.io, and the reason the release pipeline carried a fragile manifest-rewriting step (its sed for python = ["dep:monty"] had already drifted out of date against the real python = ["dep:monty", "dep:monty-types"] line, so it silently no longer matched).

Before / After

Registry consumers, cargo publish -p bashkit --dry-run:

# Before — python stripped at publish time, examples deleted from the manifest
sed -i '/^monty = .*/d' crates/bashkit/Cargo.toml
sed -i '/^python = \["dep:monty"\]/d' crates/bashkit/Cargo.toml
cargo publish -p bashkit --allow-dirty

# After
cargo publish -p bashkit
    Packaging bashkit v0.14.3
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 38.62s
   Uploading bashkit v0.14.3
warning: aborting upload due to dry run

Print flood against a 256 KB budget — previously the host buffer grew unbounded while max_memory stayed satisfied, now it is capped:

$ python3 -c "for i in range(10000000): print('x' * 100)"    # max_memory = 256 KB
exit=1, stdout <= 256 KB      (was: unbounded host-side growth)

Behavior is otherwise unchanged — CLI smoke test:

$ bashkit -c 'python3 -c "print(2 ** 10)"'
1024

Risk

• Medium. Breaking API change for embedders: PythonLimits::max_allocations and RuntimeLimits::max_allocations are gone; TypeScript callers read limits.max_allocations instead of limits.common.max_allocations. The monty bump itself is a pre-1.0 interpreter upgrade (beta.6 → 0.0.19) that also brings upstream user-defined classes, closure capture, and iterator changes.
• What can break: downstream code setting the removed knob stops compiling (deliberate — it had become a no-op); anything relying on Python capturing more than max_memory of print output now errors instead.
• Dependabot now treats monty* as standalone PRs, since 0.0.x bumps keep breaking the embedding API.

Checklist

• Tests added or updated — new print_output_capped_by_memory_limit / print_output_under_cap_succeeds; the allocation-cap tests were retuned to measured memory thresholds (one 10k list fits in 256 KB, three do not) rather than left as no-op assertions
• Backward compatibility considered — internal/pre-1.0 API, removal preferred over a silently dead knob

Verified: cargo fmt --check, cargo clippy --all-targets -- -D warnings (plus a python,typescript,jq,http_client,sqlite,git,scripted_tool,bot-auth slice), cargo test --features http_client, failpoint suite, integration suite with python,typescript (1327 passed), doctests, cargo vet --locked, both python examples, and the CLI smoke test above.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	9054a5c	Commit Preview URL Branch Preview URL	Jul 25 2026, 04:44 AM