Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

sandbox-rs: wasmtime 49.0.4 -> 49.0.5 (RUSTSEC-2026-0422, -0423, -0424) #547

Merged
dcharlot merged 1 commit from sec/wasmtime-49.0.5 into main 2026-10-30 08:50:06 -04:00
Conversation 0 Commits 1 Files changed 2 +61 -61
dcharlot commented 2026-10-30 08:37:43 -04:00
Owner
Copy link

Three advisories against wasmtime 49.0.4 were published on 2026-10-29. repository checks now fails on every commit until they are fixed: main's run for #538's merge (afd1c246) reports all three as "not in the allow list". Each is patched in 49.0.5:

  • RUSTSEC-2026-0422 (GHSA-3982-jqvv-277m): typed functions with i31 or nullref arguments may panic, because a type check is insufficient.
  • RUSTSEC-2026-0423 (GHSA-qw58-7h65-crq2): cross-engine type confusion with host-created struct types that have supertypes.
  • RUSTSEC-2026-0424 (GHSA-6fr9-xmw9-5352): unchecked memory use when borrowed resources pass between components.

The change

  • sandbox/sandbox-rs/Cargo.lock: cargo update -p wasmtime --precise 49.0.5. It moves only the wasmtime family (49.0.4 → 49.0.5) and its cranelift crates (0.136.4 → 0.136.5). zstd is unchanged, so the allow list's version-pinned zstd entries still match.
  • sandbox-exec-wasm: WASMTIME_VERSION is now "49.0.5". The enforcement commitment names it, and wasmtime_version_matches_the_lockfile holds it to the lockfile.

No other lockfile pins wasmtime.

Checked before pushing

  • python3 -I scripts/check-advisories.py: exit 0 across 59 lockfiles (M3 Ultra, cargo-audit 0.22.0).
  • scripts/check-advisories-selftest.sh: passes.
  • cargo test --locked --workspace in sandbox/sandbox-rs on Linux: every test result ok, including wasmtime_version_matches_the_lockfile.
  • Public-name check: clean.

🤖 Generated with Claude Code

Three advisories against wasmtime 49.0.4 were published on 2026-10-29. `repository checks` now fails on every commit until they are fixed: main's run for #538's merge (`afd1c246`) reports all three as "not in the allow list". Each is patched in 49.0.5: - **RUSTSEC-2026-0422** (GHSA-3982-jqvv-277m): typed functions with `i31` or `nullref` arguments may panic, because a type check is insufficient. - **RUSTSEC-2026-0423** (GHSA-qw58-7h65-crq2): cross-engine type confusion with host-created struct types that have supertypes. - **RUSTSEC-2026-0424** (GHSA-6fr9-xmw9-5352): unchecked memory use when borrowed resources pass between components. ## The change - `sandbox/sandbox-rs/Cargo.lock`: `cargo update -p wasmtime --precise 49.0.5`. It moves only the wasmtime family (49.0.4 → 49.0.5) and its cranelift crates (0.136.4 → 0.136.5). zstd is unchanged, so the allow list's version-pinned zstd entries still match. - `sandbox-exec-wasm`: `WASMTIME_VERSION` is now `"49.0.5"`. The enforcement commitment names it, and `wasmtime_version_matches_the_lockfile` holds it to the lockfile. No other lockfile pins wasmtime. ## Checked before pushing - `python3 -I scripts/check-advisories.py`: exit 0 across 59 lockfiles (M3 Ultra, cargo-audit 0.22.0). - `scripts/check-advisories-selftest.sh`: passes. - `cargo test --locked --workspace` in `sandbox/sandbox-rs` on Linux: every test result ok, including `wasmtime_version_matches_the_lockfile`. - Public-name check: clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sandbox-rs: wasmtime 49.0.4 -> 49.0.5 (RUSTSEC-2026-0422, -0423, -0424)
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 8s
Details
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 29s
Details
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m4s
Details
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 1m6s
Details
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 1m9s
Details
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 1m31s
Details
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, -p sandbox-tee --features amd-kds,intel-pcs, sandbox-rs, linux) (pull_request) Successful in 2m13s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m34s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 7m7s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m57s
Details
6e2004f70e 
Three advisories against wasmtime 49.0.4, published 2026-10-29, each patched in
49.0.5:

- RUSTSEC-2026-0422: typed functions with i31 or nullref arguments may panic,
  from an insufficient type check.
- RUSTSEC-2026-0423: cross-engine type confusion with host-created struct types
  that have supertypes.
- RUSTSEC-2026-0424: unchecked memory use when borrowed resources pass between
  components.

The update moves only the wasmtime family (49.0.4 -> 49.0.5) and its cranelift
crates (0.136.4 -> 0.136.5). WASMTIME_VERSION, which the enforcement commitment
names, follows the lockfile, as wasmtime_version_matches_the_lockfile requires.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!547
No description provided.