From 1ab7fd83e1ab56a91512d83bd254e2ce26f3096a Mon Sep 17 00:00:00 2001 From: EnRaiha <15997552+EnRaiha@users.noreply.github.com> Date: Thu, 1 Oct 2026 23:55:29 +0800 Subject: [PATCH 1/2] deps: raise wasmtime to 49.0.1 for two fuel-metering advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cargo deny check advisories` fails on `main` with two RustSec advisories against `wasmtime` 48.0.1, both patched in the ranges `>= 48.0.3, < 49.0.0` and `>= 49.0.1`: - RUSTSEC-2026-0315 — `call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification. - RUSTSEC-2026-0316 — dynamic record lifting can allocate beyond the hostcall fuel limit. The advisory is not incidental to this codebase. The WASM UDF runtime meters every user-submitted module with `config.consume_fuel(true)` (`nodedb/src/control/planner/wasm/runtime.rs:33`) and sets a per-invocation budget with `store.set_fuel(fuel)` (`pool.rs:111`). Fuel is the bound that stops a submitted UDF from running away; an amplification bug lets a module exceed it. The modules import nothing (`Instance::new(&mut store, module, &[])`), so the impact is runaway CPU rather than reaching outside the sandbox, but the bound is one this runtime sets and relies on. Raise the workspace dependency to 49 and the lockfile to 49.0.1. `deny.toml` is untouched: the advisories have a fixed release, so they are cleared rather than ignored. 48.0.3 would also satisfy the patched range and is the smaller move, but 49.0.1 is the current release and was verified against the six `wasmtime` Api items this crate uses. --- Cargo.lock | 133 ++++++++++++++++++++++++++++------------------------- Cargo.toml | 2 +- 2 files changed, 72 insertions(+), 63 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0cdae75ef..63fdf1aab 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -182,7 +182,7 @@ version = "0.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6" dependencies = [ - "object", + "object 0.39.1", ] [[package]] @@ -1447,27 +1447,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9903e767cc0a95a59950de099a6b1d61e1476f774be1cdfa06d7ccdc9bfae56f" +checksum = "c8a495ae3e4d638712a0c0378719e526e448d04d7ebbbe1745712e12c5feb4c3" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e777252ea3ec9daffa71408fbfe0793ab0a7b7bc3b2cf0f417dd0fa33964b8ef" +checksum = "4eb2e299e844a27d799f43988e4415a37696fdb738cb463312ef5d06cae15b2a" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7828208a36e6627481cea61bd24c6234e31411d5c58b48e80ca094a1d593b944" +checksum = "f4710c34489bc844e45c1c0005d3e44d3d2b29cee77187507ba8d0bb400c621f" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -1475,9 +1475,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a58c8447cc59ef98c49096679f81392ad0acec2224cea2bef52011f5169f9d02" +checksum = "76b63a4b0cfea80610150fffda11b1a9c3dc5a835403d9f381bf7d1a2874b4d7" dependencies = [ "serde", "serde_derive", @@ -1486,9 +1486,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce520e899df1de583e7b564eafd66760fbc147d72894d2278ddac57a1489fcc0" +checksum = "e1af881f3b3392433e6f4f9b172b8d99270c538db4effea62b28bc48f02f0833" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -1517,9 +1517,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d8ab23e63d78ea6bbda18ae1ed9c958bc1cb88d90fb5e95f5ba62e9c019474b" +checksum = "24ce99c30dc7a692294613241119eea0de3c3cb4cf10ac2570ed72adf9a8c2eb" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -1530,24 +1530,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24319a996b1ef40ebf8af69b39c868c790b35a42cfe38edacfd8c9deb75ea712" +checksum = "34c2a529b638d95c347c2337403dacec86197ad6503cedc63caf53466ae5c4de" [[package]] name = "cranelift-control" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf9856d68cc2cefb83229cb2c55b620dd38427555c2fe87d73f8a4421616f628" +checksum = "570eb4e02cca190896beb3c8a0a67583dca8b6965517a9f3e04cc89e17c9a986" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e0ec225d6b79c5d61358cb5ea081a1384ec541dbf8c1a8c618d187875af326ad" +checksum = "e73c65538d460b1062cb9a97428ee6bb4b616f5cb17be3b3ac0a3e4f1f789166" dependencies = [ "cranelift-bitset", "serde", @@ -1557,9 +1557,9 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d3a96a09bd9bd3cf6df2de2ea15d7418f493e946a8eaa1acfe39297a67ed3f3" +checksum = "5ed70ab5849184973c42b57366f57611dc81c3e355d5b612c68a2900bea92242" dependencies = [ "cranelift-codegen", "hashbrown 0.17.1", @@ -1570,15 +1570,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bd28f593c36afbdc9aa17305c0bb66c39ce0530e1caffcf389fbec053950083e" +checksum = "379f10a451c9b1bf4f59e4ce38061c53ca2454783041a3c1fafa6deef3c37108" [[package]] name = "cranelift-native" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2987ca47affc261aa31ac643fb80dd7f8274cebf878003ba9f50cd6ff2c1055f" +checksum = "4f496865b1a14bc85bcc9fb51a9539ca93b1d1f44fb92bd6a091fba02d6ab4a7" dependencies = [ "cranelift-codegen", "libc", @@ -1587,9 +1587,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.135.1" +version = "0.136.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b7431dd8c9def94aca43b27915dee0d42103d9b13922cfb044febcd975547d68" +checksum = "89643801d9192df80c294f174d5fe0416395e7edb0bb3024784ba10fc933e76f" [[package]] name = "crash-context" @@ -4958,6 +4958,15 @@ name = "object" version = "0.39.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b" +dependencies = [ + "memchr", +] + +[[package]] +name = "object" +version = "0.40.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd229a0361b9d0d4396176e02d65897f487eebeab7caa6d443855ee152ca0b9c" dependencies = [ "crc32fast", "hashbrown 0.17.1", @@ -5610,9 +5619,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f755d75e0809a4738a3e4880eeeb852fadbe1de5a437505b84f09c381657012a" +checksum = "0091857bc410bd7117eb6ac042ced7714c69f994a8b9c2ae30add2f73e3a25ac" dependencies = [ "cranelift-bitset", "log", @@ -5622,9 +5631,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7e69fa1c4a555946f82e7894a7df88b0e9ee03b4266829b4811467c616ce51d" +checksum = "8798ebc6bf0ef227e204fa3fad05b04970599a85f456fd28365450fd679b2600" dependencies = [ "proc-macro2", "quote", @@ -7023,7 +7032,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", "windows-sys 0.61.2", @@ -7853,9 +7862,9 @@ dependencies = [ [[package]] name = "wasm-encoder" -version = "0.254.0" +version = "0.258.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393" +checksum = "e974fe6821a8cf64575d51ea2194e2c8f77e7b66e9afe7419ce8a97f9ee0d251" dependencies = [ "leb128fmt", "wasmparser", @@ -7876,9 +7885,9 @@ dependencies = [ [[package]] name = "wasmparser" -version = "0.254.0" +version = "0.258.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27" +checksum = "d9a61719f93a87b16d325921e251800c4833f8fab50fa21c7de73aed50086313" dependencies = [ "bitflags 2.13.1", "hashbrown 0.17.1", @@ -7889,9 +7898,9 @@ dependencies = [ [[package]] name = "wasmprinter" -version = "0.254.0" +version = "0.258.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "64e3ba11e024f504698f87b629b2b66c22a1231758de7607754963f7d198be39" +checksum = "3a65e30fb2cd3cc5cb7761a6064787b2abf017e6566d8d0dedf2bb7f55ad5383" dependencies = [ "anyhow", "termcolor", @@ -7900,9 +7909,9 @@ dependencies = [ [[package]] name = "wasmtime" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1bd39f78fe9bc82cee4025ec9d52118269e9a1498016cc60119b14f2e1d86a8d" +checksum = "942ddd2fc5800ec01d4b11c28ad62ab00517dcd416aff728f7d73fddf75872c1" dependencies = [ "addr2line", "async-trait", @@ -7914,7 +7923,7 @@ dependencies = [ "log", "mach2", "memfd", - "object", + "object 0.40.0", "once_cell", "postcard", "pulley-interpreter", @@ -7937,9 +7946,9 @@ dependencies = [ [[package]] name = "wasmtime-environ" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "00c1070d95484d048994ec109cd42c4932ac07e6ee3cc1886fb90c7a18ec29da" +checksum = "98f2ca21b23a51c1b1944297e9671a628c368e92aa6250e4c38f48e2dc251f0c" dependencies = [ "anyhow", "cpp_demangle", @@ -7950,7 +7959,7 @@ dependencies = [ "hashbrown 0.17.1", "indexmap", "log", - "object", + "object 0.40.0", "postcard", "rustc-demangle", "semver", @@ -7968,15 +7977,15 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2c0fe8292115fda08875f29064ae9f7f0b2c1ffbb323146eae538ae34b8a613f" +checksum = "294c7f12f062ceb148cd26c77170ff739552db76d1f203f6127f249684988a70" [[package]] name = "wasmtime-internal-core" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "821385794cf44baf2967fd2515368429ed2bff9b9b256f62d09a0f1301474fd8" +checksum = "64b67114739063bb72bb8ed2b4994b8b22809d354432db68553ad529850f9536" dependencies = [ "hashbrown 0.17.1", "libm", @@ -7985,9 +7994,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cranelift" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0238b4a52773457ad1b8a1a26be90486e0ca0108cf46b9be16cc1d8d8cabdfa1" +checksum = "b7d19868a30cc20df6f6648c9a4b3f700fcd1ddd0a63af9a98cb75f2b58dc874" dependencies = [ "cranelift-codegen", "cranelift-control", @@ -7997,7 +8006,7 @@ dependencies = [ "gimli", "itertools 0.14.0", "log", - "object", + "object 0.40.0", "pulley-interpreter", "smallvec", "target-lexicon", @@ -8011,9 +8020,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "596f1d85e06cbf9c9add9c78ea135171c5753264ffe94a83dcc082a1ff49fc9b" +checksum = "4f1999aee268c3f625666b12ba0ded55a6ac2c800b60b426af7d164d63411908" dependencies = [ "cc", "libc", @@ -8025,9 +8034,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "365faed74827bb0116785bab5872372df1baaec9ec0003c83bc99ccdc595f689" +checksum = "33ca2499301c6f11cc9eb42c2beafc8efae396ae4cb91077e3ac080dc5d765e4" dependencies = [ "cc", "wasmtime-internal-versioned-export-macros", @@ -8035,9 +8044,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3cce25afd9e7ac4957292a5c6a219951dd0f140b8417e7378a97f50b67c3b96f" +checksum = "7162d829c56265e183d23b17d67afc5c6876433daaed54c137388a8078a1bb6b" dependencies = [ "libc", "wasmtime-internal-core", @@ -8046,21 +8055,21 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1fdea09d51e39c774984ca68a7d7486767e5b2935f5e686fa654aabcfc3c42d" +checksum = "4e167cf144f3cee40838f7663e3a589f93bba65151efa084a2d58b2bd47469f1" dependencies = [ "cranelift-codegen", "log", - "object", + "object 0.40.0", "wasmtime-environ", ] [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "48.0.1" +version = "49.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97e48a5f514c38c2f74249724cb3501e45548d3311ca9e3881694859fd6ba116" +checksum = "8d09e038ad69c741dae29da4606ccfc0df66f156e62cb7f0664c8d7d1272a36d" dependencies = [ "proc-macro2", "quote", diff --git a/Cargo.toml b/Cargo.toml index 2d4068067..fdf0fb8a2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -135,7 +135,7 @@ reqwest = { version = "0.13", default-features = false, features = [ sha2 = { version = "0.10", features = ["oid"] } # WASM runtime -wasmtime = { version = "48", default-features = false, features = [ +wasmtime = { version = "49", default-features = false, features = [ "cranelift", "runtime", ] } From afa6a6ed8457931c95ef7e19ee67239fb2431a06 Mon Sep 17 00:00:00 2001 From: Farhan Syah Date: Fri, 2 Oct 2026 01:26:38 +0800 Subject: [PATCH 2/2] chore: resolve Rust 1.99 Clippy warnings - Server counters use `try_update` with existing orderings and overflow handling. - Sorted-index bounds pass the framing closure without an unnecessary borrow. - Cargo.toml declares Rust 1.96, required by Wasmtime 49 and sufficient for `try_update`. --- Cargo.toml | 2 +- nodedb/src/control/server/admission/registry.rs | 2 +- nodedb/src/control/server/listener.rs | 2 +- nodedb/src/control/server/pgwire/connection_identity.rs | 2 +- nodedb/src/control/server/sync/listener.rs | 2 +- nodedb/src/engine/kv/sorted_index/key.rs | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index fdf0fb8a2..36807d76a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -30,7 +30,7 @@ resolver = "2" [workspace.package] version = "0.5.0" edition = "2024" -rust-version = "1.94" +rust-version = "1.96" license = "BUSL-1.1" readme = "README.md" repository = "https://github.com/NodeDB-Lab/nodedb" diff --git a/nodedb/src/control/server/admission/registry.rs b/nodedb/src/control/server/admission/registry.rs index 7cf365d11..3e6257888 100644 --- a/nodedb/src/control/server/admission/registry.rs +++ b/nodedb/src/control/server/admission/registry.rs @@ -139,7 +139,7 @@ impl LimitEntry { let owed = u32::try_from(owed).unwrap_or(u32::MAX); let _ = self .pending_shrink - .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| { + .try_update(Ordering::AcqRel, Ordering::Acquire, |current| { Some(current.saturating_add(owed)) }); } diff --git a/nodedb/src/control/server/listener.rs b/nodedb/src/control/server/listener.rs index 5bc131d9b..4fac50a9c 100644 --- a/nodedb/src/control/server/listener.rs +++ b/nodedb/src/control/server/listener.rs @@ -142,7 +142,7 @@ impl Listener { }; let Some(raw_connection_id) = next_connection_id - .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| { + .try_update(Ordering::Relaxed, Ordering::Relaxed, |current| { current.checked_add(1) }) .ok() diff --git a/nodedb/src/control/server/pgwire/connection_identity.rs b/nodedb/src/control/server/pgwire/connection_identity.rs index 515de855e..2fb20cdaf 100644 --- a/nodedb/src/control/server/pgwire/connection_identity.rs +++ b/nodedb/src/control/server/pgwire/connection_identity.rs @@ -38,7 +38,7 @@ impl ConnectionIdAllocator { pub(crate) fn allocate(&self) -> Result { let id = self .next - .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| { + .try_update(Ordering::Relaxed, Ordering::Relaxed, |current| { current.checked_add(1) }) .map_err(|_| ConnectionAllocationError::Exhausted)?; diff --git a/nodedb/src/control/server/sync/listener.rs b/nodedb/src/control/server/sync/listener.rs index bbae3e044..42905c746 100644 --- a/nodedb/src/control/server/sync/listener.rs +++ b/nodedb/src/control/server/sync/listener.rs @@ -124,7 +124,7 @@ impl SyncSessionGuard { fn open(state: Arc) -> Option { let sequence = state .connections_accepted - .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| { + .try_update(Ordering::Relaxed, Ordering::Relaxed, |current| { current.checked_add(1) }) .ok()? diff --git a/nodedb/src/engine/kv/sorted_index/key.rs b/nodedb/src/engine/kv/sorted_index/key.rs index ecf1adac3..27103dd69 100644 --- a/nodedb/src/engine/kv/sorted_index/key.rs +++ b/nodedb/src/engine/kv/sorted_index/key.rs @@ -126,7 +126,7 @@ impl SortKeyEncoder { }; let (lower_source, upper_source) = if descending { (max, min) } else { (min, max) }; - let lower = lower_source.map(&framed); + let lower = lower_source.map(framed); let upper = upper_source.map(|value| { let mut bound = framed(value); bound.extend_from_slice(&[0xFF; 4]);