`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability
instances. The dangerous ones were not exotic: the S2 executor was pinned to
wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379
(9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole
job is to execute untrusted guest code, so a sandbox-escape class defect there
is not a dependency hygiene matter — it is the confinement claim itself.
wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight
advisories names as patched (50.0.0 exists but no advisory lists it as fixed,
so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the
constant is attested into the mechanism commitment under SPEC §7.9, so leaving
it stale would attest confinement to a runtime that did not run. The crate's
own `wasmtime_version_matches_the_lockfile` test enforces that pairing.
The rest are semver-compatible bumps carrying no API change: rustls 0.23.46,
rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto
0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch
0.9.20, rtrb 0.3.5.
Not fixed here, and deliberately so rather than silently: zip (>=9.0.0),
hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all
semver-major moves, three of them transitive, so each needs its dependent
assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all.
Co-Authored-By: Claude Opus 5 <[email protected]>
db65d20be0