From 6a035a52d9dc67eb51e6418df718f4fc8a16f60f Mon Sep 17 00:00:00 2001 From: fylorn <249551762+fylorn@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:22:32 +0800 Subject: [PATCH] Bump wasmtime to 49.0.3 and rustls to 0.23.46 (RustSec advisories) The scheduled Audit on main fails on RUSTSEC-2026-0353 to -0364 (wasmtime 49.0.2) and RUSTSEC-2026-0346 to -0349 (rustls 0.23.45). tw-plugin pins Wasmtime exactly in both [dependencies] and [build-dependencies]: the sandbox is precompiled in build.rs and only loads in the same release, so both pins move to 49.0.3 together. Cranelift and the wasmtime-internal crates follow; wasmparser and wasm-encoder stay at 0.258.3. rustls moves with cargo update -p rustls. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 114 ++++++++++++++++++------------------ crates/tw-plugin/Cargo.toml | 4 +- 2 files changed, 59 insertions(+), 59 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 716669a2..f871a3b8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -702,27 +702,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "658e8623bea025d142fb11c299b8c6572ffe9fd663b52887c4dc124735cc130b" +checksum = "f6d504c8c7ba3f3accaf8e98b7096beb98e1a271404357744c7e9e730c6865ff" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a4b12b8c55c31c3d8598c2de9a657c3b978f905f6886c43e02216e0b15fe45a3" +checksum = "c065757905596bc06e82969ebd7b92d691b7fd710a7e9e8181ae0c30dab588d0" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "894b984f82c5a36f05fdd4973fbf4d37d69cd5cdf8c16e8ffe3af4a9cdfe193c" +checksum = "5ca7162cd4d4fc5f9f2f88d1459d939882203d93a8c5a19ef2c405b2e82ef13f" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -730,9 +730,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3a1e4c34abe94193ada09f821f474be87ac8a1fbbacd87058571ef04c1bf4009" +checksum = "0ec2ba2d4f3d959ec4023a10266c3dcfb28381d1938d507a9a5e1abb78bbcc88" dependencies = [ "serde", "serde_derive", @@ -741,9 +741,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63826cef0bf70e61d56cc930aa4ee423638f66dc3cfc10d683e73138a6d177b8" +checksum = "51a64cb821d5fed56bdd6053acd36fa928cd82b70bf6b19b8b14b8b27d047b9a" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -772,9 +772,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26de7849112293681a19f7525c689e1d73dc6eb2687355170fb7458c4da8d353" +checksum = "142be1e267a7497ba3c2b5a829eaf5387b92b9bcdba6e0a6020f1ffccae7f2b8" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -785,24 +785,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df315a8b1cfd6e620971e3d4249bd2c4528167717e8f48a6317a87c55891bcb8" +checksum = "0e41f75410da6cce8601330137d73718f679db81cb790a33de3871b5c90a0de3" [[package]] name = "cranelift-control" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2c3fff7610fb17f228f16598e1a044db79a12806ece7496ff2c69cf1a27a79a5" +checksum = "0c2616c6d01c14921ac9289ef65eb7702d9c760dfdc4537a8ee5bf38ea2832c6" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6158b1ac381792ad11e670abbcd15db8b1737e84bfa8a7f2bd7eb41388a92530" +checksum = "a03e8b44c4877cf2fb21e5788d514af6fd291a066ed9ae37adf114a25fecb4aa" dependencies = [ "cranelift-bitset", "serde", @@ -812,9 +812,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "099361a0919067086dcde624a281ce719834cebf8544d6c24646f5e924107234" +checksum = "366ff7cb014bd08752210eba55a650969f8db9b52670d69d2ea0b23e1e9e3edf" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -825,15 +825,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a2f30ea3fd5a11f7d3473976d3b62b5b3f2b62fa943c85e0331d88bf505082c" +checksum = "9ea6526ebf9064fff8ce3b1e26afad7027f9e6bb0e45d2b9200e4cbab8343345" [[package]] name = "cranelift-native" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "397508a8d817dc74019603ac5a4c4e40b4df627e5aed4f2f8088345d4c01d401" +checksum = "b44d323f3e5108a8a5bc61f3acd227285ece066e19afe9aece211d66b34a64ea" dependencies = [ "cranelift-codegen", "libc", @@ -842,9 +842,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.136.2" +version = "0.136.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4944ef05513e1c1a85a945cf8f29d95ddea8bcbb19e0bfd4e71063450967420" +checksum = "fc173168f291ff3b95b5d0769d6a05b1eaef5e6d74c2600affab8396b4e7b420" [[package]] name = "crc32fast" @@ -2021,9 +2021,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b66b7448cb92d709f2924de98b5ba5b5ce4ea08e6d6b9c3b403fcd88d122ca2" +checksum = "def59f28ccaf2cb4f8dfaac83197fd7d56a4470a70e4f2589454c731370101c5" dependencies = [ "cranelift-bitset", "log", @@ -2033,9 +2033,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "185b9b4cd91f85110f48f8c0314757dfb2bb48c40f5d91055ea666cbbcbf317b" +checksum = "3a1834d3b3ef994f266a0c9ed29a8214f2c2faaa9b1c44babfa57566bb05af83" dependencies = [ "proc-macro2", "quote", @@ -2356,9 +2356,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -2786,7 +2786,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", @@ -3722,9 +3722,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1801b9c9f91e16e352ed77656824e7c4556a7538dbfc1a50b37243f0e12ea045" +checksum = "4fbdd39f5c66f63ba6b5b31391b324b7ade7237d29c866cdb561330118ef436e" dependencies = [ "addr2line", "async-trait", @@ -3761,9 +3761,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f397969b8daf208e45120036be74956e99364ce916d5b5d67f9e9f0fe40e5477" +checksum = "e915c27826de4f7b4411b61fd6db32ca448657a5136b8c8e8874a15e90cecbf4" dependencies = [ "anyhow", "cpp_demangle", @@ -3792,15 +3792,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fe14bd5ea6444a09f6baa3865559c93c91158930e7fe6d127429a9372f6165" +checksum = "e754a3ff5690c34eb4713bd7c65f60dd607ead4e39042cbf52ac8011de14455b" [[package]] name = "wasmtime-internal-core" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2053fd1d90080e502ca4ea39d86c3528587a40220b9572a874c8b742c219a00c" +checksum = "ba00c5db77adb0749ee059068e5a417bfac3d8969f5a3479d9bd1ca8c1ba248d" dependencies = [ "hashbrown 0.17.1", "libm", @@ -3809,9 +3809,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15e96d6c55401e68e40e3f74078ec96f92fe9b8a7e90e885fb87265e69eea559" +checksum = "97ceeb4325712a253f463e50a69b5a547fbbecd52e45612360c543eaa25a03ff" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -3835,9 +3835,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b913875bab1b78fada489e55d5e0a10b53286fb4bb09f5657212f549c9af36c" +checksum = "3eb3f21bc32b5382ea95f83ce9a5f2f62b68f1b25a37d0802a41a65236eae5ae" dependencies = [ "cc", "libc", @@ -3849,9 +3849,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0356a1a09dee1239904e09e962456d9f6edfa5da61c5e3e1b0e4669710f48fba" +checksum = "e786f9925126e0d2e466c5308e572e8b6226f4047596228a3d63d99528a78949" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -3859,9 +3859,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dead9a2d7b5d835698a2e1a32006e7d0b5711f4697b24bab1564bb2488e3d7a" +checksum = "92cb1dd5da78f5b21d65e91063bdd8c2eb343c1f077a1dcbc29003d4a794abb0" dependencies = [ "libc", "wasmtime-internal-core", @@ -3870,9 +3870,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69ffac8fc893de2958b263d9d7274cf4c531ba9ff582558348d4e28d97b8a0f2" +checksum = "d0243d244f6dd07ccd114e6bb099e8dd1197b47de5c054576adc9483f80f65d8" dependencies = [ "cranelift-codegen", "log", @@ -3882,9 +3882,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a20f0dcb6c6a006363d3f85b5c633675730487b0dc23726b2d40495872407fb" +checksum = "20fa5616cd875ec78f5b92020fa47ced7c8bb923079185c8475751098b8c4a69" dependencies = [ "proc-macro2", "quote", @@ -3893,9 +3893,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-winch" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3a9b10dbc3f7acb1c81079805e8f7e089ccd67757e1011eff0c1b618b2c702f4" +checksum = "e9af52e40494b4ccc9e28e79d74999814c6b62a413a8b4d01971dc01c32ccb65" dependencies = [ "cranelift-codegen", "gimli", @@ -3948,9 +3948,9 @@ dependencies = [ [[package]] name = "winch-codegen" -version = "49.0.2" +version = "49.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cc189bbe1a3e5be7c358dd7b8a34ab273600d591bd15429cb3d14f5c351bf9f" +checksum = "96b51835167dc181074f20e833e7dbe89915b579c28f6788bd6263da3a28d44c" dependencies = [ "cranelift-assembler-x64", "cranelift-codegen", diff --git a/crates/tw-plugin/Cargo.toml b/crates/tw-plugin/Cargo.toml index c9f15a22..3ec02ed0 100644 --- a/crates/tw-plugin/Cargo.toml +++ b/crates/tw-plugin/Cargo.toml @@ -18,7 +18,7 @@ description = "Runs one script plugin's hooks inside a WebAssembly sandbox (Quic # **只有运行时**：没有 Cranelift，没有池分配器。沙箱的机器码在 build.rs 里预编译 # 好、嵌进二进制。版本钉死，并且和下面构建依赖里的是同一个：预编译产物只肯在 # 同一版本的 Wasmtime 里加载 -wasmtime = { version = "=49.0.2", default-features = false, features = ["runtime", "std"] } +wasmtime = { version = "=49.0.3", default-features = false, features = ["runtime", "std"] } serde = { workspace = true } serde_json = { workspace = true } sha2 = { workspace = true } @@ -32,7 +32,7 @@ libc = { workspace = true } [build-dependencies] # 构建时的编译器：Cranelift 把快照编成目标平台的机器码；all-arch 让交叉编译 # （比如在 x64 上编 aarch64 的 Windows）也能编 -wasmtime = { version = "=49.0.2", default-features = false, features = ["runtime", "std", "cranelift", "all-arch", "parallel-compilation"] } +wasmtime = { version = "=49.0.3", default-features = false, features = ["runtime", "std", "cranelift", "all-arch", "parallel-compilation"] } # 改写快照的数据段。和 Wasmtime 49 自己用的是同一版 wasmparser = "0.258" wasm-encoder = "0.258"