Stream: git-wasmtime

Topic: wasmtime / PR #14996 cache: depend on zstd 0.14.3

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif opened PR #14996 from SebTardif:cache-zstd-0.14.3 to bytecodealliance:main:

There is no prior discussion for this bump.

wasmtime-internal-cache is the only crate here with a direct zstd dependency. The requirement is 0.13.0, which Cargo treats as ^0.13.0. This repo's lockfile currently resolves that to zstd 0.13.0 and zstd-safe 7.0.0. A downstream that does not reuse this lockfile resolves zstd 0.13.3 and zstd-safe 7.2.4.

Those resolved versions land in three RustSec advisories, all fixed in the same zstd-rs pull (gyscos/zstd-rs#384):

• RUSTSEC-2026-0391 applies to zstd 0.13.2 through 0.14.2. Encoder::with_context and Decoder::with_context keep data from an abandoned stream and prepend it to the next one. The patched release is zstd 0.14.3. zstd 0.13.0, the version in this lockfile, is below that range. zstd 0.13.3 is not.
• RUSTSEC-2026-0398 applies to zstd-safe 7.2.2 through 8.1. Seekable::decompress can set a Vec length past its capacity when the offset is beyond the end of the data. The patched release is zstd-safe 8.2.0. zstd-safe 7.0.0 is below that range. zstd-safe 7.2.4 is not.
• RUSTSEC-2026-0403 applies to zstd-safe 4.0.0 through 8.1. When streaming decompression of a legacy frame fails, DCtx::decompress_stream can expose uninitialized memory. The patched release is zstd-safe 8.2.0. The advisory states that zstd::decode_all is not affected. zstd-safe 7.0.0 is inside this range.

The cache crate does not call with_context, Seekable::decompress, or the streaming writer. It calls zstd::encode_all, zstd::decode_all, and zstd::DEFAULT_COMPRESSION_LEVEL. In zstd 0.14.3 those functions have the same signatures (encode_all(source, level), decode_all(source), and DEFAULT_COMPRESSION_LEVEL re-exported from zstd_safe::CLEVEL_DEFAULT). default-features = false stays, so legacy, arrays, and zdict_builder stay off. The accepted levels in the cache config remain 0..=21, which still sit inside compression_level_range().

0.14.0 is not a sufficient floor. RUSTSEC-2026-0391 includes every zstd release below 0.14.3. zstd 0.14.3 declares rust-version 1.64, under this workspace's 1.97.

The lockfile moves the cache edge to zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2+zstd.1.5.7. zip 0.6.6 (via tch and torch-sys) still depends on zstd 0.11.2 and zstd-safe 5.0.2. Cargo unified the single zstd-sys to 2.1.2, so that older pair now builds against libzstd 1.5.7. I compiled zstd 0.11.2 against zstd-sys 2.1.2 and a short encode_all / decode_all roundtrip passed. zstd 0.11.2 is outside RUSTSEC-2026-0391, and zstd-safe 5.0.2 is outside RUSTSEC-2026-0398. zstd-safe 5.0.2 remains inside the RUSTSEC-2026-0403 version range. This patch does not try to replace zip 0.6.6.

Cache files on disk stay ordinary zstd frames. The calls that read and write them are the same.

cargo test -p wasmtime-internal-cache --locked passed: 24 unit tests, cache_write_default_config, and the doc tests. cargo fmt -p wasmtime-internal-cache --check passed. I did not run cargo fmt --all here; one path in this Windows tree exceeds MAX_PATH.

I did not edit supply-chain/. The contributor guide asks us not to run cargo vet or add vet entries: cargo vet for contributors. Maintainer entries are needed for zstd 0.14.3 (the existing audit stops at 0.13.0), zstd-safe 8.2.0 (the existing audit stops at 7.0.0), and zstd-sys 2.1.2+zstd.1.5.7 (the current exemption is 2.0.9+zstd.1.5.5).

Development process: https://docs.wasmtime.dev/contributing-development-process.html

Bytecode Alliance AI tool policy: https://github.com/bytecodealliance/governance/blob/main/AI_TOOL_POLICY.md

Code of conduct: https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif removed the review request for wasmtime-core-reviewers from PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif requested wasmtime-core-reviewers for a review on PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif requested cfallin for a review on PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif removed the review request for wasmtime-default-reviewers from PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif requested wasmtime-default-reviewers for a review on PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:00):

SebTardif requested fitzgen for a review on PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:09):

pchickey commented on PR #14996:

This PR doesn't appear to comply with our policy on tool-generated content, and requires additional justification for why it is valuable enough to the project for us to review it. Please see our developer policy on AI-generated contributions: https://github.com/bytecodealliance/governance/blob/main/AI_TOOL_POLICY.md

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:09):

:cross_mark: pchickey closed without merge PR #14996.

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:14):

SebTardif commented on PR #14996:

Hum, is this closed by an AI called @pchickey ?

I will make sure whatever I write here is not spell checked ;-)

zstd version used has a lot of issues and try to not get that shitty version when I use wasmtime.

If this is the description of a PR, is this better?

WTF, AI hatter make my work slower

Wasmtime GitHub notifications bot (Oct 26 2026 at 17:45):

tschneidereit commented on PR #14996:

@SebTardif you're asking maintainers to read through a page full of irrelevant details your LLM spit out for a tiny change, and then insult a maintainer for pointing out the violation of our policies. That's entirely unacceptable and, as Pat points out, a very clear violation of our AI tool use policy. That your LLM even chose to include a link to said policy is I guess some sort of bizarre irony.

In any case, I want to emphasize that Pat closing this issue is entirely correct, and that we expect contributors to be more mindful about the work they create on the maintainers' side.

Wasmtime GitHub notifications bot (Oct 26 2026 at 20:32):

SebTardif deleted a comment on PR #14996:

Hum, is this closed by an AI called @pchickey ?

I will make sure whatever I write here is not spell checked ;-)

zstd version used has a lot of issues and try to not get that shitty version when I use wasmtime.

If this is the description of a PR, is this better?

WTF, AI hatter make my work slower

Last updated: Oct 31 2026 at 23:03 UTC