chore(deps): bump wasmtime-wasi from 18.0.4 to 24.0.9 - #91
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump wasmtime-wasi from 18.0.4 to 24.0.9#91dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [wasmtime-wasi](https://github.com/bytecodealliance/wasmtime) from 18.0.4 to 24.0.9. - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v24.0.9/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v18.0.4...v24.0.9) --- updated-dependencies: - dependency-name: wasmtime-wasi dependency-version: 24.0.9 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This was referenced Aug 6, 2026
bdelanghe
added a commit
that referenced
this pull request
Aug 6, 2026
…hem (#111) Closes #108. Discharges #89, #91 and #109. Remainder tracked in #112. The deps lane had never scanned this repo. .gitignore listed the TRACKED Cargo.lock — inert for git, which exempts tracked files, but osv-scanner applies the pattern literally and skipped the only lockfile, so --allow-no-lockfiles turned "scanned nothing" into a pass. Removed from .gitignore and from both generator sites so gen-config cannot put it back. before: 0 Extract calls, "No package sources found", GREEN after: 1 Extract call, 446 packages scanned, RED on 11 real findings Cleared 42 advisories on the way. #91/#109 are discharged by DELETION, not by bump: nothing imports wasmtime — crates/xtask is the only member that declares it and only ever shells out to a wasmtime binary — so dropping two .workspace lines removes 90 packages. Bumping would not have terminated anywhere useful (24.0.7 still carries 7 advisories; 47.0.3 is the first clean release and needs Rust 1.94 against a 1.88 pin). A prediction in the original PR body was wrong and the scan is what caught it: clearing the known 35 did not leave the lane green, because only 5 of 446 packages had been queried. A third commit then cleared the 7 reachable by cargo update alone. Deliberately no osv-scanner.toml. The 7 unmaintained-crate findings are the documented case for [[IgnoredVulns]], but that is an accepted-risk judgement for a maintainer, not a rider on a scanner fix; the other 4 are fixable and suppressing those would recreate exactly what this ends. All in #112. Supersedes #110, which fixed the same issue 18 minutes earlier and was duplicated because #108 was never claimed before work started. Two findings from it carried here: the @Checksum header is a hardcoded literal copied verbatim rather than computed (recomputing gives c08f83bd; no offset yields e902a214), and `gen-config --overwrite` would DROP the Trunk, hooksmith events, .direnv and .config sections, which exist in the file but in neither generator — so regenerating is not a safe way to apply this fix. cargo check --workspace --locked --all-targets passes.
Collaborator
|
Superseded by #111, merged as The proposed 24.0.9 would also not have been clean — it still carries RUSTSEC-2026-0182 and RUSTSEC-2026-0188. Removal clears all 5. Context: these were invisible because the deps lane had never scanned Generated by Claude Code |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps wasmtime-wasi from 18.0.4 to 24.0.9.
Release notes
Sourced from wasmtime-wasi's releases.
... (truncated)
Changelog
Sourced from wasmtime-wasi's changelog.
... (truncated)
Commits
97ebe81Release Wasmtime 24.0.9 (#13434)638b337release-24.0.0: Fix wasmtime-wasi path_open(TRUNCATE) bypass of FilePerms::WR...f179d80Release Wasmtime 24.0.8 (#13238)588c319[24.0] Backport Cranelift: x64: fix incorrect load-sinking incopysignoper...a15daffRelease Wasmtime 24.0.7 (#12998)89e08c4[24.0.x] Combined backports for a 24.0.7 release (#13002)f18f06eRelease Wasmtime 24.0.6 (#12653)dfbb2be[24.0.x] Backport fixes for security advisories (#12647)0c655c2Migrate this workspace to using trusted publishing (#12257) (#12281)ef7b9b7Release Wasmtime 24.0.5 (#12026)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.