diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0caf0d865..b50cfb09c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -51,7 +51,7 @@ updates: - dependency-name: "monty" - dependency-name: "monty-types" - # wasmtime is pinned exactly (=48.0.5): the `cpython` feature embeds a + # wasmtime is pinned exactly (=48.0.6): the `cpython` feature embeds a # module precompiled by build.rs, and a precompiled module loads only # into the same wasmtime version. 49.x also needs a newer rustc than # rust-toolchain.toml pins. Bump deliberately together with the @@ -124,7 +124,7 @@ updates: - "*" ignore: # The fuzz lockfile resolves the root workspace, so a bump here rewrites - # the root `wasmtime = "=48.0.5"` pin — and `ignore` is per-entry, so the + # the root `wasmtime = "=48.0.6"` pin — and `ignore` is per-entry, so the # "/" entry's wasmtime block above does not cover this one. That gap # opened #2708, where every rust job failed at resolution with # "wasmtime@49.0.2 requires rustc 1.96.0" against the pinned 1.95.0. diff --git a/Cargo.lock b/Cargo.lock index b8fc76fc7..d16072f9e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -978,7 +978,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1107,27 +1107,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -1135,9 +1135,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -1146,9 +1146,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -1177,9 +1177,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -1190,24 +1190,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -1217,9 +1217,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -1230,15 +1230,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -1247,9 +1247,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc" @@ -1722,7 +1722,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4147,9 +4147,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -4159,9 +4159,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -4800,14 +4800,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -4858,7 +4858,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5600,10 +5600,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6441,9 +6441,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -6480,9 +6480,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -6511,9 +6511,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -6526,15 +6526,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -6543,9 +6543,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -6569,9 +6569,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -6583,9 +6583,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -6593,9 +6593,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -6604,9 +6604,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -6616,9 +6616,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -6627,9 +6627,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags 2.13.2", @@ -6690,7 +6690,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 90ed78ac3..2aad79c80 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,7 +22,7 @@ categories = ["command-line-utilities", "parser-implementations"] # into the identical wasmtime version. Runtime build: no Cranelift, Pulley # interpreter only; Cranelift is added as a build-dependency by the artifact # crate. 48.x is the newest line supporting the pinned rustc 1.95. -wasmtime = { version = "=48.0.5", default-features = false, features = ["runtime", "std", "pulley", "async"] } +wasmtime = { version = "=48.0.6", default-features = false, features = ["runtime", "std", "pulley", "async"] } # Async runtime # Base features are WASM-compatible; crates needing more (rt-multi-thread, fs, net, process) # add them in their own Cargo.toml or via [target.'cfg(...)'.dependencies]. diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock index fa882856c..67cc08807 100644 --- a/crates/bashkit/fuzz/Cargo.lock +++ b/crates/bashkit/fuzz/Cargo.lock @@ -396,27 +396,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -424,9 +424,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -435,9 +435,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -466,9 +466,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -479,24 +479,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -506,9 +506,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -519,15 +519,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -536,9 +536,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc" @@ -1422,9 +1422,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -1434,9 +1434,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -1569,9 +1569,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -2067,9 +2067,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -2106,9 +2106,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -2137,9 +2137,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -2152,15 +2152,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -2169,9 +2169,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -2195,9 +2195,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -2209,9 +2209,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -2219,9 +2219,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -2230,9 +2230,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -2242,9 +2242,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -2253,9 +2253,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags 2.13.1", diff --git a/examples/hyperlight/host/Cargo.lock b/examples/hyperlight/host/Cargo.lock index 8ce469f69..aa95fc8a5 100644 --- a/examples/hyperlight/host/Cargo.lock +++ b/examples/hyperlight/host/Cargo.lock @@ -117,27 +117,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -145,9 +145,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -156,9 +156,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -187,9 +187,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -200,24 +200,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -227,9 +227,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -240,15 +240,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -257,9 +257,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc32fast" @@ -602,9 +602,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -614,9 +614,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -892,9 +892,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -933,9 +933,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -964,9 +964,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -979,15 +979,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -996,9 +996,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -1022,9 +1022,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -1036,9 +1036,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -1046,9 +1046,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -1057,9 +1057,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -1069,9 +1069,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -1080,9 +1080,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags", diff --git a/knowledge/log.md b/knowledge/log.md index 2976c9a91..208d31524 100644 --- a/knowledge/log.md +++ b/knowledge/log.md @@ -1,5 +1,9 @@ # Bashkit Knowledge Update Log +## 2026-10-15 + +* **Security / Operations**: Nightly run 263 went red on the Advisory Audit with 15 vulnerabilities in the root and fuzz lockfiles and 11 in `examples/hyperlight/host` — none from a tree that changed. Two upstream batches landed on 2026-10-14: eleven `wasmtime` advisories against the pinned 48.0.5 (RUSTSEC-2026-0353 through -0359 and -0361 through -0364: host panics reachable from guest code, an unaligned-host-data bug, and an unmetered component-model handle table) and four `rustls` advisories against 0.23.45 (RUSTSEC-2026-0346 through -0349: `Debug` impls exposing TLS secrets, buffered application data sent to the outer server after ECH rejection, pre-authentication Brotli certificate decompression allocating up to 1 GiB, and an unauthenticated `ServerHello` downgrading later connections to classical key exchange). The wasmtime pin moves `=48.0.5` -> `=48.0.6`, which is the fix release on the 48 line and keeps MSRV at 1.95.0, matching `rust-toolchain.toml`; 49.0.3 also carries the fixes but needs rustc 1.96, so the reason the pin exists is unchanged and the dependabot `ignore` entries stay. `rustls` is a caret dependency and moves 0.23.45 -> 0.23.46. All three cargo lockfiles are updated together, since the fuzz lockfile resolves the root workspace and `examples/hyperlight/host` carries its own. No guest rebuild is needed for the wasmtime bump: `build.rs` recompiles the `.cwasm`, per [cpython-wasm](runtimes/cpython-wasm.md). The general point: an exact pin held for an MSRV reason still has to move on the patch line when that line is the advisory fix — the pin is not a reason to stay vulnerable. + ## 2026-10-13 * **Parallel execution / Security**: Streaming producers now atomically share background-job admission, lease owned fork state and future layouts before allocation, borrow stage ASTs, and check construction work/cancellation/deadlines (TM-DOS-124). Group slots and storage release with pipeline owners. Tiny admission/ownership units and ordinary two-stage Bash-parity fixtures cover the contract. diff --git a/knowledge/runtimes/cpython-wasm.md b/knowledge/runtimes/cpython-wasm.md index f0feb3173..7ad040b95 100644 --- a/knowledge/runtimes/cpython-wasm.md +++ b/knowledge/runtimes/cpython-wasm.md @@ -307,7 +307,7 @@ snapshots, smoke-tests with the reference runtime and rewrites `artifacts/` three together. Changing `engine_config()` or the wasmtime version requires no guest rebuild; `build.rs` recompiles the `.cwasm`. -wasmtime is pinned (`=48.0.5`): a `.cwasm` loads only into the version and +wasmtime is pinned (`=48.0.6`): a `.cwasm` loads only into the version and compile-affecting configuration that produced it. 49.x needs rustc 1.96. ## Known gaps diff --git a/scripts/tests/test_dependabot_coverage.py b/scripts/tests/test_dependabot_coverage.py index 00d72d054..3d4b52fbd 100644 --- a/scripts/tests/test_dependabot_coverage.py +++ b/scripts/tests/test_dependabot_coverage.py @@ -112,14 +112,14 @@ def test_the_two_random_fs_fixtures_are_both_covered(self): self.assertIn(fixture, covered) def test_no_cargo_entry_can_propose_a_wasmtime_bump(self): - # wasmtime is held at =48.0.5 for two independent reasons: the + # wasmtime is held at =48.0.6 for two independent reasons: the # `cpython` feature loads a module precompiled by build.rs, which only # loads into the identical wasmtime version, and 48.x is the newest # line whose MSRV the pinned rustc satisfies. 49.x needs 1.96. # # The "/" entry carried that ignore; the fuzz and example entries did # not, and the ignore is per-entry. The fuzz lockfile resolves the root - # workspace, so dependabot edited the root `=48.0.5` pin straight + # workspace, so dependabot edited the root `=48.0.6` pin straight # through the gap and opened #2708, where every rust job died at # resolution with "wasmtime@49.0.2 requires rustc 1.96.0". The # hyperlight host pins its own wasmtime "48" and is built by required @@ -148,7 +148,7 @@ def test_no_cargo_entry_can_propose_a_wasmtime_bump(self): 'wasmtime', ignored, f'cargo entry {scope} can propose a wasmtime bump; ' - 'it is pinned to =48.0.5 by MSRV and by precompiled-module ' + 'it is pinned to =48.0.6 by MSRV and by precompiled-module ' 'compatibility, so every cargo entry must ignore it', ) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index ba9ea357a..982261e61 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -520,6 +520,12 @@ criteria = "safe-to-deploy" delta = "0.63.3 -> 0.64.1" notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host filesystem, network or process access, and no new unsafe blocks anywhere in src. The substantive change is a server-side authentication fix: a publickey request's signature must now use the algorithm the request announced (RFC 4252 section 7, RFC 8332 section 3). Before, a client could announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server accepted it; the delta adds the comparison and a regression test asserting both the rejection and that a matching signature is still accepted. One dependency is removed, not added: the legacy-ed25519-pkcs8-parser feature and its yasna ASN.1 dependency are gone, so the PKCS8 path no longer falls back to a second parser on error. This tree uses russh as a client with default features, so it never enabled that feature and is not exposed to the server-side bug; both changes are a reduction in attack surface for it. Partial-success auth now carries proceed_with_methods as an Option, removing password from the offered set when none is given, and resets partial_success per request. The remainder is mechanical: let-chain rewrites in keys/known_hosts.rs and kex/dh/mod.rs with identical semantics, saturating arithmetic for the cipher byte counter, and new integration tests. Source safety review, not a cryptographic audit." +[[audits.rustls]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.23.45 -> 0.23.46" +notes = "Reviewed the 2026-10-14 advisory delta (RUSTSEC-2026-0346 through -0349); every change narrows. The TLS 1.3 key-exchange hint moves out of handle_server_hello into ExpectFinished, so it is recorded only after cert_verified and sig_verified, not from an unauthenticated ServerHello. start_traffic now runs after the ECH-rejection check, and the std writer/flush paths return the connection's stored fatal error instead of buffering plaintext, so application data cannot reach the outer server after ECH rejection. Brotli certificate decompression switches to BrotliDecompressStream over a caller-supplied output slice with BrotliState::new_strict, rejecting large windows and trailing input instead of letting brotli::BrotliDecompress allocate; zlib switches to Inflate so total_in/total_out are checked against both slice lengths. Secret-bearing Debug derives on Tls13ClientSessionValue, ClientSessionCommon and ServerSessionValue become hand impls that destructure and skip the secret/master_secret fields, with finish_non_exhaustive and tests asserting the key bytes are absent. Supporting changes: LimitedCache evicts on an explicit max rather than VecDeque::capacity (eviction only, no bound raised), pre_encrypt_action uses >= so the hard limit is checked first, protected change_cipher_spec is rejected per RFC 9846 section 5, ECH hello-retry acceptance is recorded and enforced as final per RFC 9849, and the aws-lc-rs HPKE sealer/opener move from NonceSequence to LessSafeKey with an explicit compute_nonce plus increment_seq_num. No unsafe blocks added or changed, no new filesystem, network, process or environment access, no new dependencies, build.rs unchanged. Source safety review of the delta, not a cryptographic proof or a full crate review." + [[audits.rustls-webpki]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index f3cbdcbfb..8dbbe1595 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -23,78 +23,78 @@ user-login = "jrmuizel" user-name = "Jeff Muizelaar" [[publisher.cranelift-assembler-x64]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-assembler-x64-meta]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-bforest]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-bitset]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen-meta]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen-shared]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-control]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-entity]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-frontend]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-isle]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-native]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-srcgen]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.pulley-interpreter]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.pulley-macros]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.regalloc2]] @@ -209,63 +209,63 @@ when = "2026-10-02" trusted-publisher = "github:bytecodealliance/wasm-tools" [[publisher.wasmtime]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-environ]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-component-macro]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-component-util]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-core]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-cranelift]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-fiber]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-jit-debug]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-jit-icache-coherence]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-unwinder]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-versioned-export-macros]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-wit-bindgen]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.winnow]]