fix(deps): bump wasmtime 29→46 — close RUSTSEC-2026-0096 CVSS 9.0 (ARN-169)

[rita-aga]

Closes ARN-169 (Urgent, security) under epic ARN-165. Draft for review — do not merge.

What

Bump wasmtime 29.0.1 → 46.0.1 (and wasmtime-wasi) to close RUSTSEC-2026-0096 (CVSS 9.0 — aarch64 Cranelift miscompile → full WASM sandbox escape) plus the ~8 other wasmtime advisories.

Changes (crates/temper-wasm/src/engine/mod.rs, Cargo.toml, Cargo.lock)

API migration for the v46 wasmtime-wasi layout — a pure path rename, no behavior change:

• wasmtime_wasi::preview1 → wasmtime_wasi::p1
• wasmtime_wasi::pipe::MemoryOutputPipe::new(64 * 1024) → wasmtime_wasi::p2::pipe::MemoryOutputPipe::new(64 * 1024) — same 64 KB output bound.

The sandbox is not weakened: per-invocation store, fuel, epoch timeout, memory limiter, and WASI (no dirs/env/net) are all intact — verified by the sandbox-invariant tests.

Verification

Full pre-push workspace suite green against wasmtime 46 (this is the real check — the migration compiles and all tests pass). The 6 sandbox-invariant tests pass: fuel_exhaustion_returns_error, memory_growth_denied_by_limiter, timeout_enforced_by_epoch, wasm_trap_does_not_crash_host, timed_out_invocation_does_not_interrupt_unrelated_active_invocation, noop_module_completes.

Scope notes

• Kernel (temper repo) only — the temperpaw side of ARN-169 is separate.
• The other advisories listed in ARN-169 (postgres-protocol, quick-xml, quinn-proto, rustls-webpki) are not in this PR — filed to keep this scoped to the CVSS-9.0 wasmtime bump; follow-up.
• ADR-0159.

🤖 Generated with Claude Code

Greptile Summary

This PR bumps wasmtime and wasmtime-wasi from 29.0.1 to 46.0.1 to close RUSTSEC-2026-0096 (CVSS 9.0 — aarch64 Cranelift sandbox escape) and ~18 other advisories. The code change is a pure module-path migration required by the WASI reorganization that landed in wasmtime 34.

• Cargo.toml: Two-line version pin change; all sandbox-controlling wasmtime features (component-model, profiling) are unchanged.
• crates/temper-wasm/src/engine/mod.rs: Four targeted renames — preview1 → p1 (imports + two add_to_linker_sync call sites) and wasmtime_wasi::pipe::MemoryOutputPipe → wasmtime_wasi::p2::pipe::MemoryOutputPipe — with no behavioral change; fuel, epoch timeout, memory limiter, and WASI no-dirs/no-env/no-net sandbox posture are all intact.
• docs/adrs/0159-wasmtime-46-bump.md: New ADR documenting the migration table, rationale for taking latest (46) over minimum-viable (36), and rollback policy.

Confidence Score: 5/5

Safe to merge — the change is a pure API path rename required by wasmtime's WASI module reorganization, and every sandbox control is demonstrably intact.

The code diff is four targeted import/call-site renames with no logic changes. Fuel metering, epoch timeout, memory limiter, and the WASI no-dirs/no-env/no-net policy all remain exactly as they were in v29. The new wasmtime_wasi::p2::pipe::MemoryOutputPipe path is the correct location for that type in v46 and is fully compatible with WasiCtxBuilder::build_p1(). The ADR is thorough, the migration table matches the diff line-for-line, and the PR author reports the full sandbox-invariant test suite passing against wasmtime 46.

No files require special attention.

Important Files Changed

Filename	Overview
crates/temper-wasm/src/engine/mod.rs	Four pure path renames for the wasmtime-wasi WASI reorg (preview1→p1, pipe→p2::pipe); all sandbox controls (fuel, epoch, memory limiter, WASI policy) are unchanged and correct for v46.
Cargo.toml	Two-line version bump (wasmtime/wasmtime-wasi 29→46); feature flags and all other workspace dependencies are unchanged.
Cargo.lock	Expected lockfile churn from the major wasmtime/cranelift version jump; also picks up crossbeam-epoch 0.9.20 and other minor dependency refreshes consistent with the PR's stated scope.
docs/adrs/0159-wasmtime-46-bump.md	Well-written ADR covering the migration table, rationale for jumping to v46 over minimum-viable v36, DST compliance note, and rollback policy.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Caller
    participant WasmEngine
    participant Store
    participant MemoryOutputPipe as p2::pipe::MemoryOutputPipe
    participant WasiCtxBuilder
    participant p1 as p1::add_to_linker_sync
    participant Guest as WASM Guest

    Caller->>WasmEngine: invoke_with_blobs(hash, context, limits)
    WasmEngine->>WasmEngine: spawn OS thread (stack 16 MB)
    WasmEngine->>MemoryOutputPipe: "MemoryOutputPipe::new(64 * 1024)"
    WasmEngine->>WasiCtxBuilder: new().stderr(pipe).build_p1()
    WasiCtxBuilder-->>WasmEngine: WasiP1Ctx
    WasmEngine->>Store: "new(engine, HostState{wasi_ctx, limiter, ...})"
    WasmEngine->>Store: set_fuel(max_fuel)
    WasmEngine->>Store: "limiter(MemoryLimiter{max_memory})"
    WasmEngine->>Store: set_epoch_deadline(ticks)
    alt pre-linked WASI module
        WasmEngine->>p1: add_to_linker_sync (compile_and_cache)
        WasmEngine->>Store: instance_pre_wasi.instantiate()
    else fallback re-link
        WasmEngine->>p1: add_to_linker_sync (invoke_blocking)
        WasmEngine->>Store: linker.instantiate()
    end
    WasmEngine->>Guest: run_fn.call(ctx_ptr, ctx_len)
    Guest-->>WasmEngine: result_ptr (or trap)
    WasmEngine->>MemoryOutputPipe: pipe.contents() [on empty result]
    WasmEngine-->>Caller: WasmInvocationResult

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Caller
    participant WasmEngine
    participant Store
    participant MemoryOutputPipe as p2::pipe::MemoryOutputPipe
    participant WasiCtxBuilder
    participant p1 as p1::add_to_linker_sync
    participant Guest as WASM Guest

    Caller->>WasmEngine: invoke_with_blobs(hash, context, limits)
    WasmEngine->>WasmEngine: spawn OS thread (stack 16 MB)
    WasmEngine->>MemoryOutputPipe: "MemoryOutputPipe::new(64 * 1024)"
    WasmEngine->>WasiCtxBuilder: new().stderr(pipe).build_p1()
    WasiCtxBuilder-->>WasmEngine: WasiP1Ctx
    WasmEngine->>Store: "new(engine, HostState{wasi_ctx, limiter, ...})"
    WasmEngine->>Store: set_fuel(max_fuel)
    WasmEngine->>Store: "limiter(MemoryLimiter{max_memory})"
    WasmEngine->>Store: set_epoch_deadline(ticks)
    alt pre-linked WASI module
        WasmEngine->>p1: add_to_linker_sync (compile_and_cache)
        WasmEngine->>Store: instance_pre_wasi.instantiate()
    else fallback re-link
        WasmEngine->>p1: add_to_linker_sync (invoke_blocking)
        WasmEngine->>Store: linker.instantiate()
    end
    WasmEngine->>Guest: run_fn.call(ctx_ptr, ctx_len)
    Guest-->>WasmEngine: result_ptr (or trap)
    WasmEngine->>MemoryOutputPipe: pipe.contents() [on empty result]
    WasmEngine-->>Caller: WasmInvocationResult

Loading

_{Reviews (2): Last reviewed commit: "fix(deps): bump wasmtime 29→46 to close ..." | Re-trigger Greptile}

[rita-aga]

@greptile review

[rita-aga]

ARN-165 principle audit — request changes / scope incomplete

The dependency upgrade is worthwhile, but it does not meet ARN-169's “clear advisories in both repos” acceptance criteria.

Audit evidence

• Temper current main (a28fdb2e): 37 vulnerabilities, 5 unmaintained advisories, 5 unsound advisories.
• This branch reduces Temper to 9 vulnerabilities, but still reports protobuf, both quick-xml DoS advisories, RSA, four rustls-webpki advisories, and tokio-tar.
• TemperPaw current main still reports 29 vulnerabilities, 5 unmaintained, and 3 unsound advisories. This PR does not change that repository.

Required before closure

1. Rebase this behind branch onto current main and rerun the complete workspace, sandbox, and cargo audit gates.
2. Complete or explicitly split the remaining kernel advisories with owners and non-punted acceptance dates.
3. Land the compatible TemperPaw dependency update and produce clean/accepted audit reports for both lockfiles.
4. Exercise actual WASM compile/invoke/resource-limit behavior after the Wasmtime jump, not only ordinary unit tests.

This upgrade also does not address the independent raw-host/stream-capability sandbox findings in ARN-207/208. Please narrow the title if those deliverables are intentionally moved to separate PRs.