Skip to content

chore(deps): bump wasmtime from 18.0.4 to 24.0.7 - #109

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/wasmtime-24.0.7
Closed

chore(deps): bump wasmtime from 18.0.4 to 24.0.7#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/wasmtime-24.0.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown

Bumps wasmtime from 18.0.4 to 24.0.7.

Release notes

Sourced from wasmtime's releases.

v24.0.7

24.0.7

Released 2026-04-09.

Fixed

v24.0.6

24.0.6

Released 2026-02-24.

Changed

  • Wasmtime's implementation of WASI now has the ability to limit resource consumption on behalf of the guest, such as host-allocated memory. This means that some behaviors previously allowed by Wasmtime can now disallowed, such as transferring excessive data from the guest to the host. Additionally calls to wasi:random/random.get-random-bytes, for example, can have limits in place to avoid allocating too much memory on the host. To preserve backwards-compatible behavior these limits are NOT set by default. Embedders must opt-in to configuring these knobs as appropriate for their embeddings. For more information on this see the related security advisory with further details on knobs added and what behaviors can be restricted. GHSA-852m-cvvp-9p4w

Fixed

  • Panics when adding too many headers to a wasi:http/types.fields has been resolved GHSA-243v-98vx-264h

v24.0.5

24.0.5

... (truncated)

Changelog

Sourced from wasmtime's changelog.

24.0.7

Released 2026-04-09.

Fixed

24.0.6

Released 2026-02-24.

Changed

  • Wasmtime's implementation of WASI now has the ability to limit resource consumption on behalf of the guest, such as host-allocated memory. This means that some behaviors previously allowed by Wasmtime can now disallowed, such as transferring excessive data from the guest to the host. Additionally calls to wasi:random/random.get-random-bytes, for example, can have limits in place to avoid allocating too much memory on the host. To preserve backwards-compatible behavior these limits are NOT set by default. Embedders must opt-in to configuring these knobs as appropriate for their embeddings. For more information on this see the related security advisory with further details on knobs added and what behaviors can be restricted. GHSA-852m-cvvp-9p4w

Fixed

  • Panics when adding too many headers to a wasi:http/types.fields has been resolved GHSA-243v-98vx-264h

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump wasmtime from 18.0.4 to 24.0.7
d78ca1b 
Bumps [wasmtime](https://github.com/bytecodealliance/wasmtime) from 18.0.4 to 24.0.7.
- [Release notes](https://github.com/bytecodealliance/wasmtime/releases)
- [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v24.0.7/RELEASES.md)
- [Commits](bytecodealliance/wasmtime@v18.0.4...v24.0.7)

---
updated-dependencies:
- dependency-name: wasmtime
  dependency-version: 24.0.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 6, 2026
@dependabot
dependabot Bot requested a review from bdelanghe as a code owner August 6, 2026 11:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 6, 2026
This was referenced Aug 6, 2026
Closed
Merged
bdelanghe added a commit that referenced this pull request Aug 6, 2026
@bdelanghe
fix(deps): clear 42 advisories, and unblind the scanner that missed t…
46028b3 
…hem (#111)

Closes #108. Discharges #89, #91 and #109. Remainder tracked in #112.

The deps lane had never scanned this repo. .gitignore listed the TRACKED
Cargo.lock — inert for git, which exempts tracked files, but osv-scanner
applies the pattern literally and skipped the only lockfile, so
--allow-no-lockfiles turned "scanned nothing" into a pass. Removed from
.gitignore and from both generator sites so gen-config cannot put it back.

  before:  0 Extract calls, "No package sources found", GREEN
  after:   1 Extract call, 446 packages scanned, RED on 11 real findings

Cleared 42 advisories on the way. #91/#109 are discharged by DELETION, not
by bump: nothing imports wasmtime — crates/xtask is the only member that
declares it and only ever shells out to a wasmtime binary — so dropping two
.workspace lines removes 90 packages. Bumping would not have terminated
anywhere useful (24.0.7 still carries 7 advisories; 47.0.3 is the first
clean release and needs Rust 1.94 against a 1.88 pin).

A prediction in the original PR body was wrong and the scan is what caught
it: clearing the known 35 did not leave the lane green, because only 5 of
446 packages had been queried. A third commit then cleared the 7 reachable
by cargo update alone.

Deliberately no osv-scanner.toml. The 7 unmaintained-crate findings are the
documented case for [[IgnoredVulns]], but that is an accepted-risk judgement
for a maintainer, not a rider on a scanner fix; the other 4 are fixable and
suppressing those would recreate exactly what this ends. All in #112.

Supersedes #110, which fixed the same issue 18 minutes earlier and was
duplicated because #108 was never claimed before work started. Two findings
from it carried here: the @Checksum header is a hardcoded literal copied
verbatim rather than computed (recomputing gives c08f83bd; no offset yields
e902a214), and `gen-config --overwrite` would DROP the Trunk, hooksmith
events, .direnv and .config sections, which exist in the file but in neither
generator — so regenerating is not a safe way to apply this fix.

cargo check --workspace --locked --all-targets passes.
@bdelanghe Claude

bdelanghe commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #111, merged as 46028b3 — but by removing wasmtime, not by bumping it, so it is worth saying why this PR was not the right fix rather than just closing it.

Nothing in the workspace imports wasmtime. crates/xtask is the only member that declares it, and its only references are Command::new("wasmtime") — shelling out to a binary — plus one string in a README template. The other use wasmtime:: sites live in crates/apps (not a workspace member) and crates/hooksmith-app (a member declaring no wasmtime dependency), so neither compiles. Dropping the dependency removed 90 packages from the lockfile.

The bump would also not have finished the job:

18.0.4  (current)         28 advisories
24.0.7  (this PR)          7 advisories  — still not clean
47.0.3  (first clean)     requires Rust 1.94; rust-toolchain.toml pins 1.88.0

So merging this would have left 7 advisories behind, and reaching a clean version would have forced a repo-wide toolchain bump — for a dependency nothing calls.

Context: these advisories were invisible because the deps lane had never scanned Cargo.lock at all (#108, fixed in the same PR).

Generated by Claude Code

@bdelanghe bdelanghe mentioned this pull request Aug 6, 2026
Closed
@bdelanghe bdelanghe closed this Aug 6, 2026
@bounded-systems-front-desk bounded-systems-front-desk Bot moved this from Todo to Done in Front Desk Aug 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/cargo/wasmtime-24.0.7 branch August 6, 2026 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bdelanghe bdelanghe Awaiting requested review from bdelanghe bdelanghe is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

Front Desk
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bdelanghe