kasferdowsi opened issue #11499:
Feature
Many of the
cargo vetaudits, including those forwasmtimeitself and other Bytecode Alliance crates, have been expired since 2025-07-30, e.g.:[[wildcard-audits.wasmtime]] who = "Bobby Holley <bobbyholley@gmail.com>" criteria = "safe-to-deploy" user-id = 73222 # wasmtime-publish start = "2021-10-29" end = "2025-07-30" notes = "The Bytecode Alliance is the author of this crate."Benefit
Users of
wasmtimecan import the audits when updating to new versions.Implementation
It's probably as simple as updating the audits for crates from Bytecode Alliance that are already trusted. But I'm not super familiar with
wasmtime'scargo vetpolicies.Alternatives
Users can trust or vet all the necessary crates manually.
alexcrichton closed issue #11499:
Feature
Many of the
cargo vetaudits, including those forwasmtimeitself and other Bytecode Alliance crates, have been expired since 2025-07-30, e.g.:[[wildcard-audits.wasmtime]] who = "Bobby Holley <bobbyholley@gmail.com>" criteria = "safe-to-deploy" user-id = 73222 # wasmtime-publish start = "2021-10-29" end = "2025-07-30" notes = "The Bytecode Alliance is the author of this crate."Benefit
Users of
wasmtimecan import the audits when updating to new versions.Implementation
It's probably as simple as updating the audits for crates from Bytecode Alliance that are already trusted. But I'm not super familiar with
wasmtime'scargo vetpolicies.Alternatives
Users can trust or vet all the necessary crates manually.
alexcrichton commented on issue #11499:
Thanks for the report! This is happening in #11498 as our own CI started breaking from it, so I think it'll be covered once that merges (should be soon)
kasferdowsi commented on issue #11499:
Awesome, thanks @alexcrichton!
Last updated: Dec 06 2025 at 06:05 UTC