Wasmtime GitHub notifications bot (Jan 08 2026 at 15:45): Wasmtime GitHub notifications bot (Jan 08 2026 at 15:45):alexcrichton opened PR #12285 from alexcrichton:fix-vet to bytecodealliance:main:
This updates the
cargo vetused in CI to include support for trusted publishing. This is necessary now that the latest version of Wasmtime (40.0.1) is published with trusted publishing. I'm not entirely sure why this is necessary, but it's going to be inevitable in the future anyway as we transition to trusted publishing.The
cargo vettool is now installed from git and new wildcard audits for all wasmtime, wasm-tools, and wit-bindgen crates are added for the appropriate trusted-publisher. Maintainers will need to install cargo-vet from git as well, but unfortunately after the publish of 40.0.1 yesterday I don't think we have an option as otherwise CI is broken.<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
Wasmtime GitHub notifications bot (Jan 08 2026 at 15:45):alexcrichton requested cfallin for a review on PR #12285.
Wasmtime GitHub notifications bot (Jan 08 2026 at 15:45):alexcrichton requested wasmtime-default-reviewers for a review on PR #12285.
Wasmtime GitHub notifications bot (Jan 08 2026 at 15:46):alexcrichton edited PR #12285:
This updates the
cargo vetused in CI to include support for trusted publishing. This is necessary now that the latest version of Wasmtime (40.0.1) is published with trusted publishing. I'm not entirely sure why this is necessary, but it's going to be inevitable in the future anyway as we transition to trusted publishing.The
cargo vettool is now installed from git and new wildcard audits for all wasmtime, wasm-tools, and wit-bindgen crates are added for the appropriate trusted-publisher. Maintainers will need to install cargo-vet from git as well, but unfortunately after the publish of 40.0.1 yesterday I don't think we have an option as otherwise CI is broken.Closes #12283
<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
Wasmtime GitHub notifications bot (Jan 08 2026 at 18:52):fitzgen submitted PR review:
Thanks!
Wasmtime GitHub notifications bot (Jan 08 2026 at 19:18):fitzgen merged PR #12285.
Last updated: Jan 09 2026 at 13:15 UTC