chore(deps): bump wasmtime 43 -> 47 to fix RUSTSEC-2026-0222 - #137
Conversation
The scheduled supply-chain audit failed on RUSTSEC-2026-0222 ("Stores can
mix up type indices between engines", GHSA-hgjw-h833-99q9) affecting
wasmtime 43.0.2. The 43.x line received no backport; the advisory's fixed
ranges are >=24.0.12 <25, >=36.0.13 <37, >=46.0.2 <47 and >=47.0.3, so the
only forward move is the 47 line.
wasmtime 47 requires rustc 1.94, so the workspace MSRV moves 1.91 -> 1.94
along with the msrv CI job, the README badge and the contributor docs.
No source changes were needed: the API surface we use (Config, Engine,
Module, Linker, Store, Caller, Memory, TypedFunc, ResourceLimiter,
OptLevel) is unchanged across 43 -> 47.
Verified locally: cargo deny check advisories passes, cargo check
--workspace --all-targets is clean, both CI clippy invocations are clean,
and cargo test -p barbacane-wasm passes (195 tests + 1 doctest).
|
Warning Review limit reached
Next review available in: 46 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe project MSRV increased from Rust 1.91 to 1.94. Workspace dependencies upgraded ChangesRust Toolchain Upgrade
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Cargo.toml`:
- Around line 24-26: Update the Dockerfile builder image from Rust 1.93 to Rust
1.94 or newer, and revise its adjacent toolchain comment to match the selected
version while preserving the existing build configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 278641a4-e91f-4c04-82a3-f65b8ed5da31
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock,!**/*.lock,!**/Cargo.lock
📒 Files selected for processing (5)
.github/workflows/ci.ymlCONTRIBUTING.mdCargo.tomlREADME.mddocs/contributing/development.md
The Dockerfiles pinned rust:1.93-slim-bookworm, one minor below the workspace MSRV that wasmtime 47 raised to 1.94, so every image build would have failed on the rust-version gate. Docker builds do not run on pull requests, so CI did not catch it. Covers Dockerfile, Dockerfile.control and both builder stages of Dockerfile.standalone, plus the copy-pasteable snippets in ADR-0019 and the FIPS guide.
|
Good catch, fixed in 148e146. All three Dockerfiles pinned Bumped to
Also updated the copy-pasteable snippets that carried the same pin, since they'd otherwise hand readers a broken build:
The adjacent comments referencing the old "wasmtime 43 / cranelift 0.130 floor" rationale were updated to the wasmtime 47 floor at the same time. Swept the tree for any other Rust version pin below 1.94; none remain. |
1 participant
Why
The scheduled supply-chain audit (run 31364240272) failed on RUSTSEC-2026-0222, "Stores can mix up type indices between engines" (GHSA-hgjw-h833-99q9), affecting
wasmtime43.0.2.The 43.x line received no backport. The advisory's fixed ranges are
>=24.0.12 <25,>=36.0.13 <37,>=46.0.2 <47and>=47.0.3, so the only forward move is the 47 line. Pinned to 47.0.3 in the lockfile.What changed
wasmtimeandwasmtime-wasi43 -> 47 in the workspace dependencies,Cargo.lockupdatedmsrvCI job, the README badge,CONTRIBUTING.mdanddocs/contributing/development.mdNo source changes were needed: the API surface we use (
Config,Engine,Module,Linker,Store,Caller,Memory,TypedFunc,ResourceLimiter,OptLevel) is unchanged across 43 -> 47.Verification
Run locally before pushing:
cargo deny check advisories-> advisories okcargo check --workspace --all-targets-> cleancargo clippy --workspace --lib --bins -- -D warnings-> cleancargo clippy --workspace --all-targets -- -D warnings -A clippy::unwrap_used -A clippy::expect_used -A clippy::panic-> cleancargo test -p barbacane-wasm-> 195 passed, 0 failed, plus 1 doctestOut of scope
Two remaining cargo-deny warnings, neither of which fails the audit:
spin 0.9.8is yanked, pulled in viamulter<-axum 0.8.8. No upgrade path until axum bumps multer.winnow0.7.15 / 1.0.1 (toml 0.8on our side vstoml 0.9inside wasmtime).bans.multiple-versionsis set towarn.Note for reviewers
The MSRV bump is the real cost here: building Barbacane now requires Rust 1.94.
Summary by CodeRabbit
Chores
Documentation