Implements ADR 0006 (the spec). Resolves snifs#50.
- Fork wasmex →
hyperpolymath/wasmex, branch snif-wasmtime-patched: bump wasmtime/wasmtime-wasi/wasmtime-wasi-http to ≥42.0.2 (pin 43.x) in native/wasmex/Cargo.toml; set default-features = false, features = ["cranelift"]; drop the WASI deps; fix wasmtime 41→43 API breakage in wasmex's Rust.
- demo/mix.exs:
{:wasmex, github: "hyperpolymath/wasmex", branch: "snif-wasmtime-patched", force_build: true}.
- CI gate: advisory scan of the built
Cargo.lock fails if wasmtime is in any advisory's vulnerable range.
- Run demo + metamorphic/pool suites against the new host.
- Then bump CITATION.cff / Zenodo (version + date) — only once the fix is verified (no overclaim).
These are the two CRITICAL alerts from the dep-security round (aarch64 Winch + Cranelift sandbox escapes).
Implements ADR 0006 (the spec). Resolves snifs#50.
hyperpolymath/wasmex, branchsnif-wasmtime-patched: bumpwasmtime/wasmtime-wasi/wasmtime-wasi-httpto ≥42.0.2 (pin 43.x) innative/wasmex/Cargo.toml; setdefault-features = false, features = ["cranelift"]; drop the WASI deps; fix wasmtime 41→43 API breakage in wasmex's Rust.{:wasmex, github: "hyperpolymath/wasmex", branch: "snif-wasmtime-patched", force_build: true}.Cargo.lockfails if wasmtime is in any advisory's vulnerable range.These are the two CRITICAL alerts from the dep-security round (aarch64 Winch + Cranelift sandbox escapes).