From cfdc433beb2b184be9c7fa8e7f64a290624d9d35 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Thu, 15 Oct 2026 09:18:21 +0000 Subject: [PATCH] fix(deps): clear the 2026-10-14 wasmtime and rustls advisories Nightly run 263 went red on the Advisory Audit with 15 vulnerabilities in the root and fuzz lockfiles and 11 in examples/hyperlight/host. Nothing in the tree changed; two upstream batches landed on 2026-10-14. wasmtime 48.0.5 collected eleven advisories (RUSTSEC-2026-0353..-0359 and -0361..-0364): host panics reachable from guest code, exception tags that can leave host data structures unaligned, and a component-model handle table capped only per instance and charged to no limit. 48.0.6 is the fix release on the 48 line and keeps MSRV at 1.95.0, matching rust-toolchain.toml. 49.0.3 carries the same fixes but needs rustc 1.96, so the reason the exact pin exists is unchanged and the dependabot ignore entries stay as they are. rustls 0.23.45 collected four (RUSTSEC-2026-0346..-0349): Debug impls on client session values exposing TLS secrets, buffered application data sent to the outer server after ECH rejection, Brotli certificate decompression allocating up to 1 GiB before authentication, and an unauthenticated ServerHello downgrading later connections to classical key exchange. It is a caret dependency and moves to 0.23.46. All three cargo lockfiles move together: the fuzz lockfile resolves the root workspace and examples/hyperlight/host carries its own. The wasmtime bump needs no guest rebuild - build.rs recompiles the .cwasm. cargo-vet covers wasmtime 48.0.6 through the existing bytecodealliance trusted-publisher wildcard. rustls 0.23.46 needed a hand delta audit; it is recorded in supply-chain/audits.toml after reading the diff. Every change in it narrows: the key-exchange hint moves out of handle_server_hello into ExpectFinished so it is recorded only after cert_verified and sig_verified, start_traffic moves after the ECH-rejection check, the writer and flush paths return the stored fatal error instead of buffering plaintext, and brotli/zlib decompression now check consumed input and produced output against the caller's slices. No unsafe added or changed, no new ambient capability, no new dependencies. Before: ./scripts/audit-lockfiles.sh exits 1, "error: 15 vulnerabilities found!" on the root and fuzz lockfiles and "11 vulnerabilities found!" on examples/hyperlight/host. After: the same script exits 0, with only the pre-existing allowed atomic-polyfill unmaintained warning. Claude-Session: https://claude.ai/code/session_014HHDRjwpPVfNtawkM9Ht8p --- .github/dependabot.yml | 4 +- Cargo.lock | 126 +++++++++++----------- Cargo.toml | 2 +- crates/bashkit/fuzz/Cargo.lock | 112 +++++++++---------- examples/hyperlight/host/Cargo.lock | 108 +++++++++---------- knowledge/log.md | 4 + knowledge/runtimes/cpython-wasm.md | 2 +- scripts/tests/test_dependabot_coverage.py | 6 +- supply-chain/audits.toml | 6 ++ supply-chain/imports.lock | 108 +++++++++---------- 10 files changed, 244 insertions(+), 234 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0caf0d865..b50cfb09c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -51,7 +51,7 @@ updates: - dependency-name: "monty" - dependency-name: "monty-types" - # wasmtime is pinned exactly (=48.0.5): the `cpython` feature embeds a + # wasmtime is pinned exactly (=48.0.6): the `cpython` feature embeds a # module precompiled by build.rs, and a precompiled module loads only # into the same wasmtime version. 49.x also needs a newer rustc than # rust-toolchain.toml pins. Bump deliberately together with the @@ -124,7 +124,7 @@ updates: - "*" ignore: # The fuzz lockfile resolves the root workspace, so a bump here rewrites - # the root `wasmtime = "=48.0.5"` pin — and `ignore` is per-entry, so the + # the root `wasmtime = "=48.0.6"` pin — and `ignore` is per-entry, so the # "/" entry's wasmtime block above does not cover this one. That gap # opened #2708, where every rust job failed at resolution with # "wasmtime@49.0.2 requires rustc 1.96.0" against the pinned 1.95.0. diff --git a/Cargo.lock b/Cargo.lock index b8fc76fc7..d16072f9e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -978,7 +978,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -1107,27 +1107,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -1135,9 +1135,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -1146,9 +1146,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -1177,9 +1177,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -1190,24 +1190,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -1217,9 +1217,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -1230,15 +1230,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -1247,9 +1247,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc" @@ -1722,7 +1722,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4147,9 +4147,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -4159,9 +4159,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -4800,14 +4800,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -4858,7 +4858,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5600,10 +5600,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6441,9 +6441,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -6480,9 +6480,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -6511,9 +6511,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -6526,15 +6526,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -6543,9 +6543,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -6569,9 +6569,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -6583,9 +6583,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -6593,9 +6593,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -6604,9 +6604,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -6616,9 +6616,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -6627,9 +6627,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags 2.13.2", @@ -6690,7 +6690,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 90ed78ac3..2aad79c80 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,7 +22,7 @@ categories = ["command-line-utilities", "parser-implementations"] # into the identical wasmtime version. Runtime build: no Cranelift, Pulley # interpreter only; Cranelift is added as a build-dependency by the artifact # crate. 48.x is the newest line supporting the pinned rustc 1.95. -wasmtime = { version = "=48.0.5", default-features = false, features = ["runtime", "std", "pulley", "async"] } +wasmtime = { version = "=48.0.6", default-features = false, features = ["runtime", "std", "pulley", "async"] } # Async runtime # Base features are WASM-compatible; crates needing more (rt-multi-thread, fs, net, process) # add them in their own Cargo.toml or via [target.'cfg(...)'.dependencies]. diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock index fa882856c..67cc08807 100644 --- a/crates/bashkit/fuzz/Cargo.lock +++ b/crates/bashkit/fuzz/Cargo.lock @@ -396,27 +396,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -424,9 +424,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -435,9 +435,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -466,9 +466,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -479,24 +479,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -506,9 +506,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -519,15 +519,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -536,9 +536,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc" @@ -1422,9 +1422,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -1434,9 +1434,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -1569,9 +1569,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -2067,9 +2067,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -2106,9 +2106,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -2137,9 +2137,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -2152,15 +2152,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -2169,9 +2169,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -2195,9 +2195,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -2209,9 +2209,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -2219,9 +2219,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -2230,9 +2230,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -2242,9 +2242,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -2253,9 +2253,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags 2.13.1", diff --git a/examples/hyperlight/host/Cargo.lock b/examples/hyperlight/host/Cargo.lock index 8ce469f69..aa95fc8a5 100644 --- a/examples/hyperlight/host/Cargo.lock +++ b/examples/hyperlight/host/Cargo.lock @@ -117,27 +117,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3bfbb8f30b72ef5cedf2dbd85ee2f167a33c888d492a40e999250187138663c9" +checksum = "9195e7cefae4f6c586ef4abace39e08a4cfbbde0839479f7075f0739db5ec108" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5715fdd9d897798ba2bb834df5d6c1129319d51e82ddcf81812c23231e9b852b" +checksum = "f47195db7c0d11bb54fc4a03f94136344059121baad9e59dcf537cf007ed45f9" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a266da98b248dd98dfc8a46d45d57810db04a55b81a6d8c7a9c6cf0bd2db7c3" +checksum = "23e38972e913f89b465f99d3a1add645d507ad8d2cb32b05161769330b72648c" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -145,9 +145,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c67c1887ed2194ef3ecc283a9add4fe8a79d249a293063046f2adedc31ae7200" +checksum = "d3352069928676bf94f502e352f4d879ba16dcd2fc413fddb9617d72eaf42127" dependencies = [ "serde", "serde_derive", @@ -156,9 +156,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90103abeafa22cc578c577999bdf1b51c32b8a59e15a09789841b4e9a854588d" +checksum = "7332e689fc423e86b03617b071889a0e67089ed529b0cba1e22e2d630e120987" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -187,9 +187,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73eaff808bc302e2899e42d822c0e64df23f38facb98ecdf695d1817d2063a3" +checksum = "6dc7d4ec2d00466628fa9cb8197b7850771a2db0c16a902065c8513706a7ac18" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -200,24 +200,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de19c4fc55ac3cdeb8e153f35ef9f51db197da91a64c9811d0ddd21ed1b9d18d" +checksum = "b08c970e27b123ff6764a525aa50dfd4a6e350022e8c27027d10b3dde5cc49fc" [[package]] name = "cranelift-control" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bbd919579d74a7212e6e849dc24ff015cb823e70051d01559eea828efaf773f" +checksum = "985a7c32c3a72fd8f44a8ead3211352c364ce509bf8b0b177184d7574f4e9397" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af201af93fa8a576ac4b04b901ac3f252545d7b703053c922526fce28f65a7be" +checksum = "ce7ae3678365a2fced842f320dd90760816d57e62dc41e65804c7a86ce16dff2" dependencies = [ "cranelift-bitset", "serde", @@ -227,9 +227,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69395ceee43706b93bf869b3a6631ab8d9dcb2bf19f9af4d1d2db0cb9e18af18" +checksum = "21e84fb8be0b38d9d1c52831050957586e9b1140565f47dcbcf9a08d2d124940" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -240,15 +240,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e8d98a81f71e2ddc61849ca1454ff424fbf42a3ee5529365be8c0859ddf5b9a" +checksum = "8f295be6751bdae90f2ecdda3ecc5ef60192ac204ec2345ec1b924b9a6554ed4" [[package]] name = "cranelift-native" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "273c79e0265b754f67ff76c42d6db4856dabf9101e3bb1b23c83255e2438dd02" +checksum = "b00de3571d1817908e3a6d0e04349400a360d336be8ad07ca0f7cb0beeb3c353" dependencies = [ "cranelift-codegen", "libc", @@ -257,9 +257,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.5" +version = "0.135.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b73d7e686f3518831f88ffe88be02c6c92be09930fc5ab90a3dfd9a4de3815e" +checksum = "ce1932d832b1d6c0fcb852d4b1fd1fe9930fc2e0cfa7d125a90ee3f86978310d" [[package]] name = "crc32fast" @@ -602,9 +602,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dfc9a7073f2530aab972ac0a7ce43624ff59de8ad06b76a4ef4021f7ddd1035a" +checksum = "8da9e35352d5ed6636a3b18e2099f96cf00e9dcc707f7d9d599a64ec5fabcef7" dependencies = [ "cranelift-bitset", "log", @@ -614,9 +614,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "864f92c9538de48325a4f8709ec83e56471446798d48a29073ca094c5447b549" +checksum = "cf76d5588cc67bac2ba972c751d4f1b4545eebf2dea8117410dc7f450bae6c97" dependencies = [ "proc-macro2", "quote", @@ -892,9 +892,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b94eda6b1c1d8ade526a67e4ce50cc6234d1c7af68e5d7bf13f40bc07e70daba" +checksum = "3a26206e1b2f1403d4d17c8fa7e736b693d7e9b1a7b9a5bf860e1c580472704d" dependencies = [ "addr2line", "async-trait", @@ -933,9 +933,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84ca4865ece3a37abb34c2df96c741ff4aed308d35744d84095cff79848752d4" +checksum = "ca61f6e56877ffa9633e0d1ee3ee01c4b5dd08d8e1609417a245b496163526af" dependencies = [ "anyhow", "cpp_demangle", @@ -964,9 +964,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ae080b05e5e0356a2167c478c264e26f3fe5dbaaf1b285f8f5501301b99facb" +checksum = "d217ee3ec268aaa301fdf63af2b560c1a00ea774c5789fc8537364c2726be4ab" dependencies = [ "anyhow", "proc-macro2", @@ -979,15 +979,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8f014d9ad6f6acbc449e9d7c4e7b7757b4b6b1a84a3662f66ea6da2ebed788c" +checksum = "3d4bb47a14f6458a45125d6fedaac3ad95769f946755ae282763fc0343c8ccdc" [[package]] name = "wasmtime-internal-core" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc0a0310fc4a3f545427c7880362657f72f838ffcfe4d3b8c864021df3b3488" +checksum = "84493645ddd62c4615bbe0bd1a6bf9740e69c11b70404f2db8726ee793442b88" dependencies = [ "hashbrown 0.17.1", "libm", @@ -996,9 +996,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb6c8d2b6f8ed3a784fcd127a1936589db8051febbd228230660175e41b5751d" +checksum = "de4b3fb57ab495f3a08032859e1b940fa63e63cb755804fb032a06bf530aeb33" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -1022,9 +1022,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92b558b5892ca405508103641fa3a3ec2e986b1cc679a083ed47e6bcb08ecf31" +checksum = "984950b72b8660737ec8deb590c95e4103877c23c83bd0ad23b9990a789fcfe2" dependencies = [ "cc", "libc", @@ -1036,9 +1036,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0669ce70a8a8c92eb8ad148c1d7b9b771aab37787e9462efd75b2e2b4575406" +checksum = "679f24b3251a3c6235bc0170efa0d503ac570678308d60bd2e7f325d16f51536" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -1046,9 +1046,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aa66405e95fc7b82adb195c14fa8b38f45046c3ad99a273b06262b8eb755e76" +checksum = "a2627fc8f496dcb22fad20cb97e8b77b494c225d84522642d23ec425bf17713b" dependencies = [ "libc", "wasmtime-internal-core", @@ -1057,9 +1057,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70555458e519d6fb8790e042b4274132ab58171ae0f2a6917c3dc29ded0184d0" +checksum = "64752c0f1351970e20ed8fd7704220d7871b8824bdeb252258738b58264ef191" dependencies = [ "cranelift-codegen", "log", @@ -1069,9 +1069,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fca407e3e2809c0e6568be132065095a16f184c30c6bee4157dfdc497aee10a1" +checksum = "ff1b5eb4b2838bbbeaadd02c61e307a1fdbd47efca9d96684c04de5721157dca" dependencies = [ "proc-macro2", "quote", @@ -1080,9 +1080,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-wit-bindgen" -version = "48.0.5" +version = "48.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2aacdb42fb0b393353e402a1534e0b492a6b0fddf6528bfaec65c5f56b990c43" +checksum = "bf92ecab96882cd1a5d9ee41c457053bccf8f1c57cfe617d38549b929ab82e91" dependencies = [ "anyhow", "bitflags", diff --git a/knowledge/log.md b/knowledge/log.md index 2976c9a91..208d31524 100644 --- a/knowledge/log.md +++ b/knowledge/log.md @@ -1,5 +1,9 @@ # Bashkit Knowledge Update Log +## 2026-10-15 + +* **Security / Operations**: Nightly run 263 went red on the Advisory Audit with 15 vulnerabilities in the root and fuzz lockfiles and 11 in `examples/hyperlight/host` — none from a tree that changed. Two upstream batches landed on 2026-10-14: eleven `wasmtime` advisories against the pinned 48.0.5 (RUSTSEC-2026-0353 through -0359 and -0361 through -0364: host panics reachable from guest code, an unaligned-host-data bug, and an unmetered component-model handle table) and four `rustls` advisories against 0.23.45 (RUSTSEC-2026-0346 through -0349: `Debug` impls exposing TLS secrets, buffered application data sent to the outer server after ECH rejection, pre-authentication Brotli certificate decompression allocating up to 1 GiB, and an unauthenticated `ServerHello` downgrading later connections to classical key exchange). The wasmtime pin moves `=48.0.5` -> `=48.0.6`, which is the fix release on the 48 line and keeps MSRV at 1.95.0, matching `rust-toolchain.toml`; 49.0.3 also carries the fixes but needs rustc 1.96, so the reason the pin exists is unchanged and the dependabot `ignore` entries stay. `rustls` is a caret dependency and moves 0.23.45 -> 0.23.46. All three cargo lockfiles are updated together, since the fuzz lockfile resolves the root workspace and `examples/hyperlight/host` carries its own. No guest rebuild is needed for the wasmtime bump: `build.rs` recompiles the `.cwasm`, per [cpython-wasm](runtimes/cpython-wasm.md). The general point: an exact pin held for an MSRV reason still has to move on the patch line when that line is the advisory fix — the pin is not a reason to stay vulnerable. + ## 2026-10-13 * **Parallel execution / Security**: Streaming producers now atomically share background-job admission, lease owned fork state and future layouts before allocation, borrow stage ASTs, and check construction work/cancellation/deadlines (TM-DOS-124). Group slots and storage release with pipeline owners. Tiny admission/ownership units and ordinary two-stage Bash-parity fixtures cover the contract. diff --git a/knowledge/runtimes/cpython-wasm.md b/knowledge/runtimes/cpython-wasm.md index f0feb3173..7ad040b95 100644 --- a/knowledge/runtimes/cpython-wasm.md +++ b/knowledge/runtimes/cpython-wasm.md @@ -307,7 +307,7 @@ snapshots, smoke-tests with the reference runtime and rewrites `artifacts/` three together. Changing `engine_config()` or the wasmtime version requires no guest rebuild; `build.rs` recompiles the `.cwasm`. -wasmtime is pinned (`=48.0.5`): a `.cwasm` loads only into the version and +wasmtime is pinned (`=48.0.6`): a `.cwasm` loads only into the version and compile-affecting configuration that produced it. 49.x needs rustc 1.96. ## Known gaps diff --git a/scripts/tests/test_dependabot_coverage.py b/scripts/tests/test_dependabot_coverage.py index 00d72d054..3d4b52fbd 100644 --- a/scripts/tests/test_dependabot_coverage.py +++ b/scripts/tests/test_dependabot_coverage.py @@ -112,14 +112,14 @@ def test_the_two_random_fs_fixtures_are_both_covered(self): self.assertIn(fixture, covered) def test_no_cargo_entry_can_propose_a_wasmtime_bump(self): - # wasmtime is held at =48.0.5 for two independent reasons: the + # wasmtime is held at =48.0.6 for two independent reasons: the # `cpython` feature loads a module precompiled by build.rs, which only # loads into the identical wasmtime version, and 48.x is the newest # line whose MSRV the pinned rustc satisfies. 49.x needs 1.96. # # The "/" entry carried that ignore; the fuzz and example entries did # not, and the ignore is per-entry. The fuzz lockfile resolves the root - # workspace, so dependabot edited the root `=48.0.5` pin straight + # workspace, so dependabot edited the root `=48.0.6` pin straight # through the gap and opened #2708, where every rust job died at # resolution with "wasmtime@49.0.2 requires rustc 1.96.0". The # hyperlight host pins its own wasmtime "48" and is built by required @@ -148,7 +148,7 @@ def test_no_cargo_entry_can_propose_a_wasmtime_bump(self): 'wasmtime', ignored, f'cargo entry {scope} can propose a wasmtime bump; ' - 'it is pinned to =48.0.5 by MSRV and by precompiled-module ' + 'it is pinned to =48.0.6 by MSRV and by precompiled-module ' 'compatibility, so every cargo entry must ignore it', ) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index ba9ea357a..982261e61 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -520,6 +520,12 @@ criteria = "safe-to-deploy" delta = "0.63.3 -> 0.64.1" notes = "Reviewed complete published package diff: no new dependencies, no build scripts, no new host filesystem, network or process access, and no new unsafe blocks anywhere in src. The substantive change is a server-side authentication fix: a publickey request's signature must now use the algorithm the request announced (RFC 4252 section 7, RFC 8332 section 3). Before, a client could announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server accepted it; the delta adds the comparison and a regression test asserting both the rejection and that a matching signature is still accepted. One dependency is removed, not added: the legacy-ed25519-pkcs8-parser feature and its yasna ASN.1 dependency are gone, so the PKCS8 path no longer falls back to a second parser on error. This tree uses russh as a client with default features, so it never enabled that feature and is not exposed to the server-side bug; both changes are a reduction in attack surface for it. Partial-success auth now carries proceed_with_methods as an Option, removing password from the offered set when none is given, and resets partial_success per request. The remainder is mechanical: let-chain rewrites in keys/known_hosts.rs and kex/dh/mod.rs with identical semantics, saturating arithmetic for the cipher byte counter, and new integration tests. Source safety review, not a cryptographic audit." +[[audits.rustls]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.23.45 -> 0.23.46" +notes = "Reviewed the 2026-10-14 advisory delta (RUSTSEC-2026-0346 through -0349); every change narrows. The TLS 1.3 key-exchange hint moves out of handle_server_hello into ExpectFinished, so it is recorded only after cert_verified and sig_verified, not from an unauthenticated ServerHello. start_traffic now runs after the ECH-rejection check, and the std writer/flush paths return the connection's stored fatal error instead of buffering plaintext, so application data cannot reach the outer server after ECH rejection. Brotli certificate decompression switches to BrotliDecompressStream over a caller-supplied output slice with BrotliState::new_strict, rejecting large windows and trailing input instead of letting brotli::BrotliDecompress allocate; zlib switches to Inflate so total_in/total_out are checked against both slice lengths. Secret-bearing Debug derives on Tls13ClientSessionValue, ClientSessionCommon and ServerSessionValue become hand impls that destructure and skip the secret/master_secret fields, with finish_non_exhaustive and tests asserting the key bytes are absent. Supporting changes: LimitedCache evicts on an explicit max rather than VecDeque::capacity (eviction only, no bound raised), pre_encrypt_action uses >= so the hard limit is checked first, protected change_cipher_spec is rejected per RFC 9846 section 5, ECH hello-retry acceptance is recorded and enforced as final per RFC 9849, and the aws-lc-rs HPKE sealer/opener move from NonceSequence to LessSafeKey with an explicit compute_nonce plus increment_seq_num. No unsafe blocks added or changed, no new filesystem, network, process or environment access, no new dependencies, build.rs unchanged. Source safety review of the delta, not a cryptographic proof or a full crate review." + [[audits.rustls-webpki]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index f3cbdcbfb..8dbbe1595 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -23,78 +23,78 @@ user-login = "jrmuizel" user-name = "Jeff Muizelaar" [[publisher.cranelift-assembler-x64]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-assembler-x64-meta]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-bforest]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-bitset]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen-meta]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-codegen-shared]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-control]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-entity]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-frontend]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-isle]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-native]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.cranelift-srcgen]] -version = "0.135.5" -when = "2026-10-02" +version = "0.135.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.pulley-interpreter]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.pulley-macros]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.regalloc2]] @@ -209,63 +209,63 @@ when = "2026-10-02" trusted-publisher = "github:bytecodealliance/wasm-tools" [[publisher.wasmtime]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-environ]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-component-macro]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-component-util]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-core]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-cranelift]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-fiber]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-jit-debug]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-jit-icache-coherence]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-unwinder]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-versioned-export-macros]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.wasmtime-internal-wit-bindgen]] -version = "48.0.5" -when = "2026-10-02" +version = "48.0.6" +when = "2026-10-14" trusted-publisher = "github:bytecodealliance/wasmtime" [[publisher.winnow]]