Skip to content

chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates - #2708

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/crates/bashkit/fuzz/fuzz-dependencies-af6de4cd66
Closed

chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates#2708
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/crates/bashkit/fuzz/fuzz-dependencies-af6de4cd66

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates: wasmtime and zeroize.

Updates wasmtime from 48.0.5 to 49.0.2

Release notes

Sourced from wasmtime's releases.

v49.0.2

49.0.2

Released 2026-10-02.

Fixed

  • WASI preview 0 implementation of poll_oneoff circumvents fuel consumption. GHSA-j366-h8gg-77pm

  • Excessive allocated memory on the host when guests don't have stdio. GHSA-gqmc-89g8-p25r

  • fd_readdir copies uninitialized struct padding into guest memory. GHSA-96f6-r43r-8c24

  • Guest can panic host through filesystem timestamp before the epoch on wasip3. GHSA-mr2v-56j5-cmfc

  • Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. GHSA-32h6-97mm-8q3c

  • Mis-typed WebAssembly tag imports can lead to GC heap corruption. GHSA-cfhf-m2cr-62wj

  • Wasmtime wasi:http implementation panics with a zero timeout supplied. GHSA-w4qr-p94g-mjhv

  • Rooting for GC values live across try_call may be missing, causing GC heap corruption. GHSA-hw8m-q44c-ggrf

v49.0.1

49.0.1

Released 2026-09-24.

Fixed

  • Do not drop fuel-spend accrued by callees of call_ref and callees that return via exception throws. GHSA-m63x-6p34-q65x

  • Fix fuel spend for dynamic record lifting. GHSA-jqpg-j7w6-42pr

  • Fix host memory exhaustion on outgoing HTTP body write. GHSA-c9gc-w9vx-w86p

  • wasmtime-wasi: Fix panic on out-of-range datetimes in WASI filesystem set-times, set-times-at.

... (truncated)

Changelog

Sourced from wasmtime's changelog.

49.0.2

Released 2026-10-02.

Fixed

  • WASI preview 0 implementation of poll_oneoff circumvents fuel consumption. GHSA-j366-h8gg-77pm

  • Excessive allocated memory on the host when guests don't have stdio. GHSA-gqmc-89g8-p25r

  • fd_readdir copies uninitialized struct padding into guest memory. GHSA-96f6-r43r-8c24

  • Guest can panic host through filesystem timestamp before the epoch on wasip3. GHSA-mr2v-56j5-cmfc

  • Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. GHSA-32h6-97mm-8q3c

  • Mis-typed WebAssembly tag imports can lead to GC heap corruption. GHSA-cfhf-m2cr-62wj

  • Wasmtime wasi:http implementation panics with a zero timeout supplied. GHSA-w4qr-p94g-mjhv

  • Rooting for GC values live across try_call may be missing, causing GC heap corruption. GHSA-hw8m-q44c-ggrf

49.0.1

Released 2026-09-24.

Fixed

... (truncated)

Commits

Updates zeroize from 1.9.0 to 1.9.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the fuzz-dependencies group
a97ef98 
Bumps the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates: [wasmtime](https://github.com/bytecodealliance/wasmtime) and [zeroize](https://github.com/RustCrypto/utils).


Updates `wasmtime` from 48.0.5 to 49.0.2
- [Release notes](https://github.com/bytecodealliance/wasmtime/releases)
- [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v49.0.2/RELEASES.md)
- [Commits](bytecodealliance/wasmtime@v48.0.5...v49.0.2)

Updates `zeroize` from 1.9.0 to 1.9.1
- [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1)

---
updated-dependencies:
- dependency-name: wasmtime
  dependency-version: 49.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: fuzz-dependencies
- dependency-name: zeroize
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: fuzz-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 13, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 13, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 bashkit a97ef98 Commit Preview URL

Branch Preview URL		 Oct 13 2026, 04:18 AM

chaliy added a commit that referenced this pull request Oct 13, 2026
@chaliy
fix(ci): stop dependabot bumping the pinned wasmtime from other entries
4506599 
The "/" cargo entry ignores wasmtime, because the pin is load-bearing
twice over: the `cpython` feature loads a module precompiled by build.rs,
which only loads into the identical wasmtime version, and 48.x is the
newest line whose MSRV the pinned rustc 1.95.0 satisfies.

`ignore` is per-entry, and neither the fuzz entry nor the example
workspaces entry carried it. The fuzz lockfile resolves the root
workspace, so dependabot rewrote the root `=48.0.5` pin straight through
that gap and opened #2708, where every rust job died at resolution:

    wasmtime@49.0.2 requires rustc 1.96.0
    Either upgrade rustc or select compatible dependency versions

`examples/hyperlight/host` had the same exposure from the other entry: it
pins its own wasmtime "48" and is built by required CI on the same pinned
toolchain. Left alone, both reopen weekly, the same way the monty ignores
were added after #2296 and #2297 came back.

Add the ignore to both entries, and a test that fails whenever any cargo
entry can propose a wasmtime bump — which entry reaches which manifest is
not worth re-deriving each time one is added, and this is the manual step
the file already exists to catch.
@chaliy chaliy mentioned this pull request Oct 13, 2026
Merged
2 tasks done
@chaliy Claude

chaliy commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

This one can't merge, and the fix belongs in config rather than here.

The group update rewrote the root wasmtime = "=48.0.5" pin to =49.0.2, which the pinned toolchain cannot build:

wasmtime@49.0.2 requires rustc 1.96.0
Either upgrade rustc or select compatible dependency versions

rust-toolchain.toml pins 1.95.0, so Test, Lint, Examples, Audit, Check and Generate Rust Coverage all failed at resolution before compiling anything.

The pin is deliberate twice over — the cpython feature loads a module precompiled by build.rs, which only loads into the identical wasmtime version, and 48.x is the newest line the pinned rustc satisfies. The / cargo entry in .github/dependabot.yml already ignores wasmtime for exactly that reason, but ignore is per-entry and this PR comes from the /crates/bashkit/fuzz entry, which had no ignore list. The fuzz lockfile resolves the root workspace, so the bump reached the root manifest through that gap.

#2715 adds the missing ignore to the fuzz entry (and to the example-workspaces entry, where examples/hyperlight/host had the same exposure), plus a test that fails if any cargo entry can propose a wasmtime bump. Once that lands this PR should stop being recreated.

The non-wasmtime half of the group is only the fuzz lockfile moving in lockstep with it, so there's nothing here worth salvaging separately. wasmtime 49 becomes available when the toolchain moves to 1.96+, which is a deliberate bump that also has to update the dtolnay/rust-toolchain@<version> refs across the workflows.

Generated by Claude Code

chaliy added a commit that referenced this pull request Oct 13, 2026
@chaliy
fix(ci): unbreak main and nightly, and close the dependabot wasmtime …
801e478 
…gap (#2715)

Three CI failures, two causes, none of them from a tree that changed.

The GNU dd oracle wrote to dd's stdin and unwrapped; with count=0 dd exits
without reading, so the write raced the child's exit and EPIPEd under load.
That had already reddened main on 0f23a91 and fa78d9b. EPIPE is now accepted
as the case under test; every assertion still runs.

Nightly's cargo-geiger was installed unpinned and built from source against the
toolchain pinned at 1.95.0. 0.14.0 shipped 2026-10-12 with its MSRV raised to
1.97, so run 259 went red the next morning and skipped the unsafe-code audit.
Pinned to 0.13.0.

Dependabot's wasmtime ignore existed only on the "/" cargo entry, but ignore is
per-entry: the fuzz lockfile resolves the root workspace, so the bump rewrote
the root =48.0.5 pin and opened #2708, red at resolution with
"wasmtime@49.0.2 requires rustc 1.96.0". examples/hyperlight/host had the same
exposure from the example-workspaces entry. Both now carry the ignore, plus a
test that fails if any cargo entry can propose a wasmtime bump.

Also corrects the threat-model tooling table, which listed cargo-geiger as
running on every PR; it has only ever run nightly.
</commit_message>
</invoke>
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 13, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/crates/bashkit/fuzz/fuzz-dependencies-af6de4cd66 branch October 13, 2026 10:06
@chaliy Claude

chaliy commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

Closing: this can never merge as it stands, and the config that produced it is fixed.

The root wasmtime = "=48.0.5" pin it rewrote needs rustc 1.96; rust-toolchain.toml pins 1.95.0. #2715 added the missing wasmtime ignore to the /crates/bashkit/fuzz entry (and to the example-workspaces entry, where examples/hyperlight/host had the same exposure), plus a test that fails if any cargo entry can propose a wasmtime bump. So this group update should not be recreated in this shape.

The non-wasmtime half was only the fuzz lockfile moving in lockstep, so nothing here is worth salvaging separately. wasmtime 49 becomes available when the toolchain moves to 1.96+, which is a deliberate bump that also updates the dtolnay/rust-toolchain@<version> refs across the workflows.

Generated by Claude Code

@chaliy chaliy mentioned this pull request Oct 15, 2026
Merged
2 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chaliy