Skip to content

chore(deps): update rust crate wasmtime to v36 [security] #348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update rust crate wasmtime to v36 [security] #348

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 13, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
wasmtime dev-dependencies major 27.0.0 → 36.0.0

GitHub Vulnerability Alerts

CVE-2025-64345

Impact

Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host.

Wasmtime has a wasmtime::Memory type which represents linear memories in a WebAssembly module. Wasmtime also has wasmtime::SharedMemory, however, which represents shared linear memories introduced in the WebAssembly threads proposal. The API of SharedMemory does not provide accessors which return &[u8] in Rust, for example, as that's not a sound type signature when other threads could be modifying memory. The wasmtime::Memory type, however, does provide this API as it's intended to be used with non-shared memories where static knowledge is available that no concurrent or parallel reads or writes are happening. This means that it's not sound to represent a shared linear memory with wasmtime::Memory and it must instead be represented with wasmtime::SharedMemory.

There were two different, erroneous, methods of creating a wasmtime::Memory which represents a shared memory however:

  1. The wasmtime::Memory::new constructor takes a MemoryType which could be shared. This function did not properly reject shared memory types and require usage of SharedMemory::new instead.
  2. Capturing a core dump with WebAssembly would expose all linear memories a wasmtime::Memory. This means that a core dump would perform an unsynchronized read of shared linear memory, possibly leading to data races.

This is a bug in Wasmtime's safe Rust API. It should not be possible to cause unsoundness with Wasmtime's embedding API if unsafe is not used. Embeddings which do not use the wasm threads proposal nor created shared memories nor actually share shared memories across threads are unaffected. Only if shared memories are created across threads might an embedding be affected.

Patches

Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via Memory::new and shared memories are now excluded from core dumps.

Workarounds

Embeddings affected by this issue should use SharedMemory::new instead of Memory::new to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default. It's recommended to upgrade to a patched version of Wasmtime, however.

Release Notes

bytecodealliance/wasmtime (wasmtime)

v36.0.3

Compare Source

36.0.3

Released 2025-11-11.

Fixed

v36.0.2

Compare Source

36.0.2

Released 2025-08-26.

Fixed
  • Wasmtime will no longer panic in the pooling allocator when in near-OOM
    conditions related to resetting the linear memory of a slot.
    #​11510

v36.0.1

Compare Source

36.0.1

Released 2025-08-21.

Added
  • Accessors for internal WASI-related contexts are added to
    wasmtime_wasi::WasiCtx to account for refactorings that happened in this
    release.
    #​11473
Changed
  • Release artifacts for the C API are now smaller than the previous release to
    assist with redistribution as-is.
    #​11483

v36.0.0

Compare Source

36.0.0

Released 2025-08-20.

Added
Changed

  • Users who implemented WasiHttpView::is_forbidden_header from
    wasmtime-wasi-http now need to include DEFAULT_FORBIDDEN_HEADERS, e.g.
    DEFAULT_FORBIDDEN_HEADERS.contains(name) || name.as_str() == "custom-forbidden-header"
    #​11292

  • Cranelift's incremental cache has received some optimizations.
    #​11186

  • Wasmtime's internal implementations of WebAssembly primitives has been
    refactored to be modeled with safer internal primitives.
    #​11211
    #​11212
    #​11216
    #​11229
    #​11215
    #​11254
    #​11255
    #​11319
    #​11320

  • Detection of native hardware features has been refactored on s390x.
    #​11220

  • Further progress has been made towards an implementation of the WebAssembly
    exceptions proposal, although it is not yet complete.
    #​11230
    #​11321

  • Cranelift's assembler for x64 now supports EVEX encoding.
    #​11153
    #​11270
    #​11303

  • The default implementation of send_request in the wasmtime-wasi-http crate
    is now behind an on-by-default feature gate.
    #​11323

  • Configuration of the bindgen! macro has been redesigned to more consistently
    configure per-function options such as whether or not it's async.
    #​11328

  • Initial support fo mutatis has been added to Wasmtime's fuzzers.
    #​11290

  • The debug-builtins crate feature of wasmtime no compiles on no_std
    targets.
    #​11304

Fixed

  • Deserializing external modules no long unnecessarily requires the allocation
    to be aligned.
    #​11306

  • A CMake linker error and warning when using the C API on macOS has been fixed.
    #​11293
    #​11315

  • The C API declaration of wasmtime_component_linker_instance_add_func has
    been fixed.
    #​11327

  • The calculation of reachable DWARF has been fixed.
    #​11338

v35.0.0

Compare Source

35.0.0

Released 2025-07-22.

Added

  • A new InputFile type has been added for specifying stdin as a file in WASI.
    #​10968

  • Conditional branches to unconditional traps are now translated to conditional
    traps during legalization.
    #​10988

  • The TE HTTP header can now be specified by guests.
    #​11002

  • Winch on AArch64 should now pass all WebAssembly MVP tests. Note that it is
    still not yet Tier 1 at this time, however.
    #​10829
    #​11013
    #​11031
    #​11051

  • The x64 backend now has lowering rules for {add,sub,or,and} mem, imm
    #​11043

  • Initial support for WASIp2 in the C API has started to land.
    #​11055
    #​11172

  • Initial support for GC support in the component model has started to land
    (note that it is not finished yet).
    #​10967
    #​11020

  • The wasmtime-wasi-nn crate now has a feature to use a custom ONNX runtime.
    #​11060

  • Cranelift now optimizes division-by-constant operations to no longer use
    division.
    #​11129

  • A native-tls backend has been added for the wasi-tls implementation.
    #​11064

Changed

  • Many more instructions for the x64 backend in Cranelift were migrated to the
    new assembler.
    #​10927
    #​10928
    #​10918
    #​10946
    #​10954
    #​10958
    #​10971
    #​10942
    #​10975
    #​11017
    #​10898
    #​10836
    ... (and more)

  • Wasmtime internally uses Pin for VM data structures to make the internal
    implementations more sound to use. This has no effect on the public API of
    Wasmtime.
    #​10934
    #​10937
    #​10943
    #​10959
    #​11042

  • Fused adapters between components now transfer the enum component model type
    more efficiently.
    #​10939

  • Filenames of --emit-clif now match the symbol names found in *.cwasm
    artifacts and include the function name as well.
    #​10947
    #​11040

  • Wasmtime-internal crates are now all named wasmtime-internal-* to even
    further discourage their use.
    #​10963

  • Codegen of conditional traps with float compares has been improved.
    #​10966

  • More patterns are now optimized in ISLE mid-end rules.
    #​10978
    #​10979
    #​11173

  • Winch's support for constants/scratch registers has been improved internally.
    #​10986
    #​10998

  • The C API artifacts on Windows are now produced with Clang instead of
    cl.exe.
    #​10890

  • WebAssembly operand types are now taken into account during translation to
    optimize codegen better in the face of subtyping.
    #​11030

  • The behavior of blocking-write-and-flush has been updated during flushing
    when closed is found.
    #​11018

  • WASI WITs have been updated to 0.2.6.
    #​11049

  • OpenVINO has been updated to v2025.1.
    #​11054

  • The size of the wasmtime.addrmap section in *.cwasm artifacts has been
    shrunk slightly.
    #​11126

  • Authorities in wasmtime-wasi-http can now contain the : character.
    #​11145

  • Wasmtime now requires Rust 1.86 to compile.
    #​11142

  • Wasmtime's DRC collector has been optimized and has a new more efficient means
    of managing the set of over-approximated roots on the stack.
    #​11144
    #​11148
    #​11167
    #​11168
    #​11169
    #​11175

  • The ComponentType trait in Wasmtime now requires the Send and Sync
    bounds for all implementors.
    #​11160

  • The V128 type is now usable on platforms other than aarch64 and x86_64.
    #​11165

  • Wasmtime's policy on unsafe code and guidelines has been added.
    #​11177

  • The std crate will no longer implicitly be used on cfg(unix) and
    cfg(windows) targets when the std Cargo feature is disabled. This means
    that these platforms now require std to be enabled to use the
    platform-specific implementation of linear memory, for example.
    #​11152

Fixed

  • A panic when optimizing icmp with vectors has been fixed.
    #​10948

  • A panic when lowering scalar_to_vector with i16x8 types has been fixed.
    #​10949

  • The vector state register is now considered clobbered by calls on riscv64 to
    ensure it's updated across calls.
    #​11048

  • An instance of gdb crashing on DWARF emitted by Wasmtime has been fixed.
    #​11077

  • Fix a panic in the host caused by preview1 guests using fd_renumber.
    CVE-2025-53901.

  • Fix a panic in the preview1 adapter caused by guests using fd_renumber.
    #​11277

v34.0.2

Compare Source

34.0.2

Released 2025-07-18.

Fixed

  • Fix a panic in the host caused by preview1 guests using fd_renumber.
    CVE-2025-53901.

  • Fix a panic in the preview1 adapter caused by guests using fd_renumber.
    #​11277

34.0.1

Released 2025-06-24.

Fixed
  • Fix a panic with host-defined tables/globals and concrete reference
    types.
    #​11103

v34.0.1

Compare Source

34.0.1

Released 2025-06-24.

Fixed
  • Fix a panic with host-defined tables/globals and concrete reference
    types.
    #​11103

v34.0.0

Compare Source

34.0.0

Released 2025-06-20.

Added

  • Support for SIMD in the Pulley interpreter can now be disabled at compile-time
    to shrink the size of the final binary.
    #​10727

  • The C API now has wasmtime_trap_new_code to create a wasm_trap_t from
    its code.
    #​10765

  • Winch's support for x86_64 is now classified with tier 1 support in Wasmtime.
    #​10755

  • Winch's support for aarch64 now implements stack checks to pass many more spec
    tests.
    #​10763

  • Cranelift's s390x backend now has full support for the f128 type.
    #​10774

  • Wasmtime's C API for the component model has initial support for calling
    functions.
    #​10697
    #​10841
    #​10858
    #​10864
    #​10877

  • The wasmtime wast command now has a --generate-dwarf flag to show
    filename/line number information for backtraces.
    #​10780

Changed

  • The shape of bindgen!-generated add_to_linker functions has changed with
    the removal of GetHost and replacement of a HasData trait. For more
    information see the associated PR.
    #​10770

  • Wasmtime's Store<T> now requires that T: 'static. This is done in
    preparation for merging WASIp3 work to the main repository with some more
    information on the associated PR.
    #​10760

  • The wasmtime::component::Instance::instance_pre method is now public.
    #​10761

  • Wasmtime and Cranelift's minimnum supported version of Rust (MSRV) is now
    1.85.0.
    #​10785

  • Cranelift's debugtrap on aarch64 now generates brk #&#8203;0xf000 for debuggers
    to recognize it.
    #​10813

  • The wasi-http implementation no longer generates a trap if the handle to
    receive the response on the host is dropped early.
    #​10833

  • The wasmtime serve command will now send some boilerplate descriptive HTML
    on a 500 server error instead of nothing.
    #​10851

  • A significant amount of work has gone into the new assembler for the x64
    backend. Too many PRs to list here but progress continues apace at defining
    all machine instructions in a standalone crate.

  • Cranelift will now reject unimplemented big-endian loads/stores on backends
    that do not implement this functionality.
    #​10863

  • The wasmtime explore generated HTML handles large modules better now.
    #​10892

  • Wasmtime's internal representation of wasmtime::Func has changed and a
    previous optimization of Func::call has been lost. If affected it'd
    recommended to use Func::call_unchecked instead or to open an issue.
    #​10897

v33.0.2

Compare Source

33.0.2

Released 2025-07-18.

Fixed

  • Fix a panic in the host caused by preview1 guests using fd_renumber.
    CVE-2025-53901.

  • Fix a panic in the preview1 adapter caused by guests using fd_renumber.
    #​11277

33.0.1

Released 2025-06-24.

Fixed
  • Fix a panic with host-defined tables/globals and concrete reference
    types.
    #​11103

v33.0.1

Compare Source

33.0.1

Released 2025-06-24.

Fixed
  • Fix a panic with host-defined tables/globals and concrete reference
    types.
    #​11103

v33.0.0

Compare Source

33.0.0

Released 2025-05-20.

Added

  • Cranelift now has initial support for try_call and try_call_indirect
    instructions, to be used in the future for the WebAssembly exception-handling
    proposal. Wasmtime does not yet implement this proposal yet.
    #​10510
    #​10557
    #​10593

  • Cranelift can now optimize some simple possibly-side-effectful instructions,
    such as division.
    #​10524

  • Wasmtime now supports --invoke for components using the WAVE format.
    #​10054

  • Initial support for the Component Model has landed in Wasmtime's C API. Note
    that the API is not yet feature-complete, however.
    #​10566
    #​10598
    #​10651
    #​10675

  • Wasmtime's C++ API is now available from this repository and the
    bytecodealliance/wasmtime-cpp repository has been archived. Additionally the
    monolithic wasmtime.hh header file has been split into separate header
    files.
    #​10582
    #​10600

  • Wasmtime's cookbook-style documentation has been expanded.
    #​10630

  • Wasmtime's now supports custom yield behavior when using epoch interrupts.
    #​10671

Changed

  • Wasmtime's bindgen now type-checks export functions in the constructor of
    the generated {Worldname}Pre or {Worldname} structs, rather than at the
    call of the export function.
    #​10610

  • Wasmtime's component::Component and component::Instance now have consistient
    get_export and get_export_index methods, which return (ComponentItem, ComponentExportIndex) and ComponentExportIndex, respectively.
    #​10597

  • On failure, wasmtime serve gives an internal server error response, rather
    than closing the connection.
    #​10645

  • Cranelift's single-pass allocator has been disabled due to being unable to
    support internal refactorings in preparation for the WebAssembly exceptions
    proposal. Re-enabling this allocator is tracked at
    regalloc2#217 for
    those interested.
    #​10554

  • Wasmtime's {Array,Extern,Struct}Ref functions will now automatically trigger
    a GC.
    #​10560

  • Wasmtime's GC heaps now use the same translation techniques as linear memories
    meaning they have far fewer bounds-checks than before.
    #​10503

  • Wasmtime's implementation of WASIp2 has moved to wasmtime_wasi::p2 from the
    root of the crate.
    #​10073

  • Wasmtime will no longer emit calls to Cranelift-defined "libcalls" and instead
    everything goes through Wasmtime's libcall mechanism instead, paving the way
    for a future change for more efficient stack limit checking in wasm. This can
    also improve deserialize-from-disk times and improve page cache usage for
    modules that use libcalls as relocations are no longer necessary.
    #​10657

  • Configuration of caching can now be done through an API instead of exclusively
    through a configuration file. Additionally cache-related APIs in Config have
    changed.
    #​10665

  • Resources in the Component Model are now stored in a single table per-instance
    instead of per-type tables. Guests will see a different pattern of index
    allocation but this is not expected to cause any issues at runtime.
    #​10701

Fixed

  • Some math intrinsics have been fixed when compiled by Rust 1.87+.
    #​10534

  • Component model libcalls correctly handle platform-specific argument extension
    in ABIs.
    #​10540

  • An off-by-one issue with DWARF debuginfo has been fixed.
    #​10570

  • The Config::target method is no longer gated by a #[cfg] for an enabled
    compiler, it can be used when only the runtime feature is available.
    #​10618

  • An issue with "simulated" DWARF has been fixed.
    #​10681

  • C/C++ headers are now tested that they can be included in isolation, and a
    number of issues have been fixed.
    #​10694

v32.0.1

Compare Source

32.0.1

Released 2025-06-24.

Fixed
  • Fix a panic with host-defined tables/globals and concrete reference
    types.
    #​11103

v32.0.0

Compare Source

32.0.0

Released 2025-04-21.

Added

  • {Module,Component}::deserialize_raw can now be used to deserialize an
    in-memory module while relying on external management of the memory.
    #​10321

  • An initial implementation of wasi-tls has been added.
    #​10249

  • The wasmtime CLI now supports hexadecimal integer CLI arguments.
    #​10360

  • Cranelift now supports a log2_min_function_alignment flag.
    #​10391

  • A new wasmtime objdump subcommand has been added to help explore and debug
    *.cwasm files.
    #​10405

  • Support for the pooling allocator has been added to the C API.
    #​10484

  • Support for the guest profiler with the component model has been added.
    #​10507

Changed

  • Cranelift MemFlags now has a can_move flag which restricts whether a load
    or store can be moved.
    #​10340

  • The .text size of Pulley *.cwasm files should be smaller with less
    padding.
    #​10285

  • The wasmtime serve subcommand now implements a graceful shutdown on ctrl-c.
    #​10394

  • Stack maps used for GC are now stored in a serialized binary format that is
    faster to deserialize.
    #​10404

  • The aegraph implementation in Cranelift has been simplified to remove the
    union-find and canonical eclass IDs.
    #​10471

  • The store_list and load_list helpers have been specialized in components
    for f32 and f64.
    #​9892

  • Cranelift now removes block params on critical-edge blocks.
    #​10485

  • The Linker::define_unknown_imports_as_default_values API now supports
    defining defaults for more kinds of items.
    #​10500

  • Wasmtime now requires Rust 1.84.0 to compile.
    #​10520

Fixed

  • Winch compilation of extadd instructions has been fixed.
    #​10337

  • Fix an issue with DRC collector's barriers.
    #​10371

  • Loads on (ref null none) that can trap are now performed.
    #​10372

  • Fix reference count management in AnyRef::from_raw.
    #​10374

  • An issue with multi-value returns in Winch has been fixed.
    #​10370

  • A panic at compile-time from an overflowing shift has been fixed when
    targeting aarch64.
    #​10382

  • The wasmtime serve command no longer panics when handle returns before
    calling set.
    #​10387

  • Winch compilation of replace_lane instructions with floats has been fixed.
    #​10393

  • An invalid integer-shift optimization on vector types has been removed.
    #​10413

  • The DWARF loclist to exprloc optimization has been fixed.
    #​10400

  • Objects in the DRC collector are now transitively dec-ref's when collected.
    #​10401

  • A bug with GC rec gropus and registration in an Engine has been fixed.
    #​10435

  • A bug related to GC arrays of GC refs misreported their count of GC edges has
    been fixed.
    #​10453

  • A bug related to appropriately adding stack maps for all GC variables has been
    fixed.
    #​10456
    #​10468

  • A bug with array.fill has been fixed.
    #​10470

  • GC structs are no longer reordered to optimize their size to fix subtyping.
    #​10463

  • Panics related to exceptions and components being mixed has been fixed.
    #​10473

  • Winch stack parameter alignment has been fixed.
    #​10513

  • Rendering inline function frames in a trap backtrace has been fixed.
    #​10523

v31.0.0

Compare Source

31.0.0

Released 2025-03-20.

Added
Changed

  • Pulley's implementation of loads/stores to linear memory has changed to
    better support optimizations and reduction of interpreter opcodes in the
    final binary.
    #​10154

  • Cranelift's verifier now ensures that integers used as address types have the
    correct width.
    #​10209

  • Wasmtime and Cranelift's minimum supported version of Rust is now 1.83.0.
    #​10264

  • Wasmtime now mentions the filename when the input cannot be opened on the CLI.
    #​10292

  • All types are now generated in component::bindgen!, even if they're not
    reachable.
    #​10311

  • Tables allocated with the system allocator now use alloc_zeroed (aka
    calloc) for allocation.
    #​10313

Fixed

  • GC: the is-null-or-i31ref checks have been fixed.
    #​10221

  • GC: an incorrect assertion and canonicalized types for runtime usage has been
    fixed.
    #​10223

  • GC: subtype checks for imported globals during instantiation have been fixed.
    #​10304

  • GC: exposing references to wasm in the gc_alloc_raw libcall has been fixed.
    #​10322

  • Winch's fuel checks correctly sync fuel before the check now.
    #​10231

  • Winch's treatment of stores and other trapping ops has been fixed on AArch64.
    #​10201

  • Winch's handling of the shadow stack pointer has been fixed on AArch64.
    #​10263

  • Winch's handling of address calculations has been fixed on AArch64.
    #​10297

  • Winch's handling of multivalue return of constants has ben fixed.
    #​10315

v30.0.2

Compare Source

30.0.2

Released 2025-02-25.

Fixed
  • MinGW C API builds are now built with a newer version of GCC which seems to
    fix an issue caused by #​9929.
    #​10290
Changed
  • The cranelift-codegen crate now no longer depends on arbitrary, a
    now-unnecessary dependency.
    #​10217

v30.0.1

Compare Source

30.0.1

Released 2025-02-21.

Fixed
  • Fixes an issue building the cranelift-assembler-x64 crate on Windows
    when the Rust toolchain is on a different drive than the project using
    wasmtime. For more details, see the Zulip discussion. #​10270

v30.0.0

Compare Source

30.0.0

Released 2025-02-20.

Added
Changed

  • wasmtime-wasi split the WasiView trait into IoView and WasiView, and
    wasmtime-wasi-http re-uses IoView in WasiHttpView. Details on porting
    for embedders in PR.
    #​10016

  • wasmtime-wasi renamed some exported types and traits. Embedders which use
    Pollable, InputStream, OutputStream, Subscribe, HostInputStream,
    HostOutputStream, PollableFuture, or ClosureFuture from that crate
    will need to rename those imports to their new names, describe in PR.
    #​10036

  • Components using a 64-bit linear memory should never have worked before, but
    they're now rejected earlier in the validation process.
    #​9952

  • Module validation is now deterministic in the face of multiple errors.
    #​9947

  • Wasmtime's minimum supported version of Rust is now 1.82.0.
    #​9956

  • Cranelift will now deduplicate trap[n]z instructions.
    #​10004

  • The --emit-clif option to wasmtime compile now emits post-optimization
    CLIF.
    #​10011

  • The signals-based-traps Cargo feature has been removed in favor of
    auto-detection of available features based on the #[cfg] directives
    available for the target platform.
    #​9941

  • The async_stack_zeroing configuration knob now covers all stack allocations,
    not just those from the pooling allocator.
    #​10027

  • Wasmtime should work-by-default on more platforms, even those where Cranelift
    has no support for the architecture. This is done by ensuring some
    architecture and platform-specific bits are removed on unknown platforms (and
    Pulley is used instead).
    #​10107

  • Wasmtime now compiles on platforms missing 64-bit atomics.
    #​10134

Fixed

  • Fixed a missing case for Ref::matches_ty should return true.
    #​9985

  • A bug with using the single_pass register allocation algorithm on x64/s390x
    has been fixed by refactoring how branches are represented.
    #​10086
    #​10087

  • A bug with argument extensions on riscv64 has been fixed.
    #​10069

  • The PartialEq implementation for RegisteredType has been fixed.
    #​10091

  • The output of component::bindgen! now works with #![no_std] crates.
    #​10105

  • Fix wasmtime wast when combined with --fuel.
    #​10121

  • The wat feature of the C API is now plumbed correctly in a few more
    locations.
    #​10124

  • Spurious wake-ups in blocking_* methods of InputStream and OutputStream
    have been fixed.
    #​10113

v29.0.1

Compare Source

29.0.1

Released 2025-01-21.

Fixed
  • Fix a missing increment in WASIp1-to-WASIp2 adapter which affected WASI
    configurations that have multiple preopened directories.
    #​10064

v29.0.0

Compare Source

29.0.0

Released 2025-01-20.

Added

  • Winch now supports epoch-based interruption.
    #​9737

  • Pulley, Wasmtime's WebAssembly interpreter, has seen quite a lot of progress
    and support fleshed out. It's still not 100% complete but should be about
    ready to start kicking the tires.
    #​9744

  • The Wasmtime CLI now supports a -Wextended-const flag to control whether the
    extended-const wasm proposal is enabled or not.
    #​9768

  • Work continues to progress on the AArch64 Winch backend, bringing it closer to
    completion.
    #​9762
    #​9767
    #​9751
    #​9784
    #​9781
    #​9792
    #​9787
    #​9798
    #​9850

  • Wasmtime now supports a "custom code publisher" which can be useful when
    Wasmtime doesn't have built-in support for a particular environment.
    #​9778

  • Configuration options have been added for wasmtime-wasi-http outgoing
    bodies.
    [#​9800](https://redirect.github.com/bytecodealliance/wasmtime/pull/9

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Nov 13, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: language/Cargo.lock
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path language/crates/code-generator/Cargo.toml --package wasmtime@27.0.0 --precise 36.0.3
    Updating crates.io index
error: failed to select a version for the requirement `wasmtime = "^27.0.0"`
candidate versions found which didn't match: 36.0.3
location searched: crates.io index
required by package `wasmtime-wasi v27.0.0`
    ... which satisfies dependency `wasmtime-wasi = "^27.0.0"` of package `code-generator v0.1.0 (/tmp/renovate/repos/github/shuiro-dev/shuiro/language/crates/code-generator)`

@renovate renovate bot force-pushed the renovate/crate-wasmtime-vulnerability branch from 81cf091 to 6cf2cbd Compare December 21, 2025 16:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant