db65d20be0
`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 <[email protected]>
55 lines
1.8 KiB
TOML
55 lines
1.8 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/sandbox-schema",
|
|
"crates/sandbox-capability",
|
|
"crates/sandbox-meter",
|
|
"crates/sandbox-attest",
|
|
"crates/sandbox-runtime",
|
|
"crates/sandbox-tee",
|
|
"crates/sandbox-exec-wasm",
|
|
"crates/sandbox-exec-microvm",
|
|
"crates/sandbox-exec-os",
|
|
"crates/sandbox-conformance",
|
|
"crates/sandbox-proof",
|
|
"crates/sandbox-proof-wasm",
|
|
"crates/sandbox-mcp",
|
|
"crates/sandbox-build",
|
|
"crates/sandbox-cli",
|
|
"crates/sandbox-jcp",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/transaction-science/open-standards"
|
|
rust-version = "1.97"
|
|
|
|
[workspace.dependencies]
|
|
sandbox-schema = { path = "crates/sandbox-schema" }
|
|
sandbox-capability = { path = "crates/sandbox-capability" }
|
|
sandbox-meter = { path = "crates/sandbox-meter" }
|
|
sandbox-attest = { path = "crates/sandbox-attest" }
|
|
sandbox-runtime = { path = "crates/sandbox-runtime" }
|
|
sandbox-tee = { path = "crates/sandbox-tee" }
|
|
sandbox-exec-wasm = { path = "crates/sandbox-exec-wasm" }
|
|
sandbox-exec-microvm = { path = "crates/sandbox-exec-microvm" }
|
|
sandbox-exec-os = { path = "crates/sandbox-exec-os" }
|
|
sandbox-conformance = { path = "crates/sandbox-conformance" }
|
|
sandbox-proof = { path = "crates/sandbox-proof" }
|
|
sandbox-build = { path = "crates/sandbox-build" }
|
|
|
|
wasmtime = "49"
|
|
p384 = { version = "0.13", default-features = false, features = ["ecdsa", "sha384"] }
|
|
p256 = { version = "0.13", default-features = false, features = ["ecdsa"] }
|
|
sha2 = { version = "0.10", default-features = false }
|
|
ureq = { version = "2", features = ["json"] }
|
|
blake3 = "1"
|
|
ed25519-dalek = { version = "2", features = ["rand_core"] }
|
|
ciborium = "0.2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
base64 = "0.22"
|
|
hex = "0.4"
|
|
thiserror = "2"
|