Split out of #2351, which ignored RUSTSEC-2026-0222 to unblock the v0.62.0 release.
State
wasmtime = "43" (workspace Cargo.toml:273) now carries nine ignored advisories:
- RUSTSEC-2026-0085 / 0086 / 0088 / 0089 / 0091 / 0092 / 0094 / 0096 — cranelift internals
- RUSTSEC-2026-0114 — table allocation panic (5.9 medium)
- RUSTSEC-2026-0222 — cross-engine type-index confusion (3.8 low, published 2026-07-31)
There is also a second, independent pin: crates/aprender-test/Cargo.toml:42 has wasmtime = "38".
Why it is currently safe
Verified for #2351, not assumed:
cargo tree -p aprender -> 0 wasmtime paths
cargo tree -p aprender --no-default-features -> 0 wasmtime paths
wasmtime is optional, behind aprender-test-lib's runtime feature, which nothing in the workspace enables. It appears to cargo-audit only because Cargo.lock records optional deps.
Why it should still be fixed
An ignore list this long on one crate is a standing liability, and the safety argument is conditional on nobody enabling runtime. The moment a test starts using the WASM logic-testing path, all nine become live and the justification in .cargo/audit.toml silently becomes false. Nothing currently detects that transition.
Work
- Bump
wasmtime 43 → >=46.0.2,<47 or >=47.0.3. Four majors; expect API churn in aprender-test-lib's runtime module.
- Reconcile the separate
wasmtime = "38" pin in aprender-test.
- Drop all nine ignores from
.cargo/audit.toml and deny.toml and confirm cargo audit -n and cargo deny check advisories stay at exit 0.
- Consider a guard: fail CI if any crate enables
aprender-test-lib/runtime while these ignores are present. That converts the conditional safety argument into an enforced one — otherwise this is a comment asserting a property nothing checks.
Item 4 is arguably the highest-value part: the ignores are fine today precisely because of a fact no gate verifies.
Split out of #2351, which ignored RUSTSEC-2026-0222 to unblock the v0.62.0 release.
State
wasmtime = "43"(workspaceCargo.toml:273) now carries nine ignored advisories:There is also a second, independent pin:
crates/aprender-test/Cargo.toml:42haswasmtime = "38".Why it is currently safe
Verified for #2351, not assumed:
wasmtime is optional, behind
aprender-test-lib'sruntimefeature, which nothing in the workspace enables. It appears to cargo-audit only becauseCargo.lockrecords optional deps.Why it should still be fixed
An ignore list this long on one crate is a standing liability, and the safety argument is conditional on nobody enabling
runtime. The moment a test starts using the WASM logic-testing path, all nine become live and the justification in.cargo/audit.tomlsilently becomes false. Nothing currently detects that transition.Work
wasmtime43 →>=46.0.2,<47or>=47.0.3. Four majors; expect API churn inaprender-test-lib's runtime module.wasmtime = "38"pin inaprender-test..cargo/audit.tomlanddeny.tomland confirmcargo audit -nandcargo deny check advisoriesstay at exit 0.aprender-test-lib/runtimewhile these ignores are present. That converts the conditional safety argument into an enforced one — otherwise this is a comment asserting a property nothing checks.Item 4 is arguably the highest-value part: the ignores are fine today precisely because of a fact no gate verifies.