Repository navigation
chore(deps): update wasmtime requirement from 47.0 to 48.0 in /examples/wasmtime-loader - #265
Merged
temper-pulseengine[bot] merged 1 commit intoAug 25, 2026
Conversation
Updates the requirements on [wasmtime](https://github.com/bytecodealliance/wasmtime) to permit the latest version. - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/main/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v47.0.0...v48.0.0) --- updated-dependencies: - dependency-name: wasmtime dependency-version: 48.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
temper-pulseengine
Bot
deleted the
dependabot/cargo/examples/wasmtime-loader/wasmtime-48.0
branch
August 25, 2026 00:44
avrabe
added a commit
that referenced
this pull request
Oct 1, 2026
…ts own PR
The `cargo` job's "Build Examples" and "Test Wasmtime Example" steps build
examples/wasmtime-loader, but rust.yml's path filters covered only src/**,
Cargo.{toml,lock}, BUILD.bazel, MODULE.bazel and the workflow file — NOT
examples/**. So the job that builds the examples was never triggered by
changes to the examples.
That is how main went red: dependabot's wasmtime bumps (#265, #281) touched
only examples/wasmtime-loader/Cargo.toml, so this workflow did not run and
they merged with zero validation. The MSRV breakage then surfaced on the next
unrelated src/** push, making main look broken by innocent commits and
blocking the release.
Adds examples/** (and rust-toolchain.toml, since every job's compiler comes
from it and a channel change can break any of them) to both the push and
pull_request filters. Net effect: an example-only regression now fails on its
own PR instead of poisoning main.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
avrabe
added a commit
that referenced
this pull request
Oct 1, 2026
…ger CI on examples/** (#285) * fix(ci): pin wasmtime example to the MSRV of the repo toolchain main's `cargo` job has been red on both OSes since at least 2026-09-22, blocking the entire release process (AGENTS.md requires CI to pass completely before a release). Root cause: dependabot's wasmtime bumps (#265, #281) moved examples/wasmtime-loader to wasmtime 49.0.1, whose MSRV is rustc 1.96.0, while rust-toolchain.toml pins channel 1.94.0. The "Build Examples" step therefore failed with "requires rustc 1.96.0". MSRV by wasmtime line (crates.io): 49.x -> 1.96.0, 48.x -> 1.95.0, 47.x -> 1.94.0. So 47.0 is the newest line that builds on the pinned toolchain. Pin to "47.0" and declare `rust-version = "1.94"` on the crate so cargo's MSRV-aware resolver selects compatible transitive versions (observed: it downgrades cranelift-* 0.136.1 -> 0.134.4) and an incompatible bump fails fast as a resolver error naming the requirement, instead of an opaque rustc error mid-build. Scoped deliberately to the example: examples/wasmtime-loader is in the workspace `exclude` list, so this touches no shipping crate. Bumping rust-toolchain.toml to 1.96 instead would re-qualify every formal-verification gate (Kani, Verus, Rocq, the witness MC/DC harness) and both Bazel targets immediately before a release, to fix an example — that belongs in its own PR with its own full-CI qualification, after v0.12.0. Note: examples/wasmtime-loader/.gitignore ignores Cargo.lock and the lockfile is untracked, so CI resolves fresh on every run; the fix has to live in Cargo.toml, not a `cargo update --precise` pin. Verified locally on the pinned 1.94.0 toolchain: - `cargo build --release` succeeds (was: MSRV failure) - `cargo run --release -- --help` succeeds (the next CI step) - forcing wasmtime = "49.0" again reproduces a clear resolver MSRV error Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH * fix(ci): trigger CI on examples/** so example breakage is caught on its own PR The `cargo` job's "Build Examples" and "Test Wasmtime Example" steps build examples/wasmtime-loader, but rust.yml's path filters covered only src/**, Cargo.{toml,lock}, BUILD.bazel, MODULE.bazel and the workflow file — NOT examples/**. So the job that builds the examples was never triggered by changes to the examples. That is how main went red: dependabot's wasmtime bumps (#265, #281) touched only examples/wasmtime-loader/Cargo.toml, so this workflow did not run and they merged with zero validation. The MSRV breakage then surfaced on the next unrelated src/** push, making main look broken by innocent commits and blocking the release. Adds examples/** (and rust-toolchain.toml, since every job's compiler comes from it and a channel change can break any of them) to both the push and pull_request filters. Net effect: an example-only regression now fails on its own PR instead of poisoning main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Oct 1, 2026
…it (#286) * fix(ci): pin wasmtime example to the MSRV of the repo toolchain main's `cargo` job has been red on both OSes since at least 2026-09-22, blocking the entire release process (AGENTS.md requires CI to pass completely before a release). Root cause: dependabot's wasmtime bumps (#265, #281) moved examples/wasmtime-loader to wasmtime 49.0.1, whose MSRV is rustc 1.96.0, while rust-toolchain.toml pins channel 1.94.0. The "Build Examples" step therefore failed with "requires rustc 1.96.0". MSRV by wasmtime line (crates.io): 49.x -> 1.96.0, 48.x -> 1.95.0, 47.x -> 1.94.0. So 47.0 is the newest line that builds on the pinned toolchain. Pin to "47.0" and declare `rust-version = "1.94"` on the crate so cargo's MSRV-aware resolver selects compatible transitive versions (observed: it downgrades cranelift-* 0.136.1 -> 0.134.4) and an incompatible bump fails fast as a resolver error naming the requirement, instead of an opaque rustc error mid-build. Scoped deliberately to the example: examples/wasmtime-loader is in the workspace `exclude` list, so this touches no shipping crate. Bumping rust-toolchain.toml to 1.96 instead would re-qualify every formal-verification gate (Kani, Verus, Rocq, the witness MC/DC harness) and both Bazel targets immediately before a release, to fix an example — that belongs in its own PR with its own full-CI qualification, after v0.12.0. Note: examples/wasmtime-loader/.gitignore ignores Cargo.lock and the lockfile is untracked, so CI resolves fresh on every run; the fix has to live in Cargo.toml, not a `cargo update --precise` pin. Verified locally on the pinned 1.94.0 toolchain: - `cargo build --release` succeeds (was: MSRV failure) - `cargo run --release -- --help` succeeds (the next CI step) - forcing wasmtime = "49.0" again reproduces a clear resolver MSRV error Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH * fix(release): repoint Mythos tier-5 paths after the v0.11.0 crate split The MANDATORY pre-release Mythos delta pass greps tier-5 paths that the v0.11.0 crate split moved out of src/lib, so those patterns now match nothing and the gate guarding the crown jewels silently scopes to zero files and reports clean. This is the vacuous-oracle shape REQ-30/#258 exists to kill, sitting on the release gate itself. Stale -> current: src/lib/src/wasm_module/ -> src/verify-core/src/wasm_module/ src/lib/src/signature/keys.rs -> src/verify-core/src/signature/keys.rs src/lib/src/signature/sig_sections.rs -> src/verify-core/src/signature/sig_sections.rs src/lib/src/secure_file.rs -> src/verify-core/src/secure_file.rs src/lib/src/dsse.rs -> src/dsse/src/lib.rs (src/lib/src/airgapped/{bundle,tuf}.rs, platform/ and provisioning/ca.rs were already correct.) Fixed in both places that carry the list — AGENTS.md's delta-pass command and scripts/mythos/rank.md's tier-5 rubric — plus rank.md's `Scope:` line, which only covered src/lib, src/cli and src/component and so excluded the three crates the split created. Evidence the gate was vacuous, measured on the real v0.11.0..main delta: OLD paths -> 0 files NEW paths -> 1 file (src/verify-core/src/signature/keys.rs, tier 5) So the v0.12.0 delta pass would have skipped a changed crown-jewel file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on wasmtime to permit the latest version.
Release notes
Sourced from wasmtime's releases.
... (truncated)
Changelog
Sourced from wasmtime's changelog.
... (truncated)
Commits
f1412a5Release Wasmtime 48.0.0 (#14169)f821ba6[48.0.0] Backports for security fixes (#14175)a12fff3Add release notes (#14159)a90217aAlias analysis: do not eliminate loads with different byte orders (#14162) (#...c267eed[48.0.0] Some more backports (#14138)fc78952[48.0.0] Backport some changes frommain(#14106)45af25fwinch(x64): Prefer operands in the value stack for atomic operations (#14074)a71048c[wasi-nn] disable AMX instructions in OneDNN (#14073)ff1cab3Print fixed-length lists with WAVE (#14068)0843940riscv64: Implement f16 conversion instructions (#14071)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)