https://osv.dev/vulnerability/GHSA-7qmx-3fpx-r45m (and https://osv.dev/vulnerability/RUSTSEC-2024-0436 as a depdendency).
- switch from wasi-common to wasmtime-wasi
- verify that wasmtime dep is at least 34.0.2
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | Jdforrester-WMF | T402957 [26Q2] Rust evaluator in production | |||
| Open | None | T404014 [Q2 Rust Integration] Ensure that Rust evaluator meets resource and performance requirements | |||
| Open | None | T404905 [Rust Q2] Avoid reading .wasm binaries in async tasks | |||
| Open | None | T403669 Rust evaluator messaging protocol should handle arbitrary buffer sizes | |||
| Open | None | T405315 Add wasmedge-related metadata to Rust evaluator | |||
| Open | None | T402956 Build the JS executor when compiling the Rust image rather than relying on the checked-in blob | |||
| Open | cmassaro | T409592 Re-enable Rust tests | |||
| In Progress | cmassaro | T388981 In our Rust POC of the function-evaluator, switch from wasi-common to wasmtime-wasi and upgrade wasmtime to 21.0.2+ (or replace) |
Event Timeline
Comment Actions
I believe the core issue is our use of wasi-common, which is outdated and unsupported. For independent reasons, we should switch our Rust dep to wasmtime-wasi, which will also allow us to bump our version of wasmtime to 34.0.2.