chore: add exception for wasmtime 45 vulnerability

[gilcu3]

Closes #4031

[claude]

Pull request overview

Adds RUSTSEC-2026-0222 (wasmtime 45.0.0 — "Stores can mix up type indices between engines") to the [advisories] ignore list in deny.toml so cargo deny --all-features check stops failing Extra CI checks on unrelated PRs. The 45.x line has no patched release and both dependency paths (near-sdk 5.28.0 -> near-vm-runner 0.36.0, nearcore 2.13.2 -> near-vm-runner 2.13.2) pin wasmtime = "45.0.0", so an ignore is the only way to unblock CI until upstream moves to >= 46.0.2. I confirmed against Cargo.lock that wasmtime 45.0.0 is reached only through those two near-vm-runner copies (Cargo.lock:7972, Cargo.lock:8022), so the reachability statement in the comment is accurate for the current lockfile.

Changes:

• deny.toml: one new advisory ignore entry plus a three-line rationale comment.

Reviewed changes

Per-file summary

File	Description
deny.toml	Adds RUSTSEC-2026-0222 to [advisories] ignore with a comment explaining that wasmtime 45.x has no patched release and that the advisory is only reachable via near-vm-runner.

Findings

Blocking (must fix before merge):

• deny.toml:32 — No tracking issue for removing the exception. The PR body says Closes #4031, so after merge nothing tracks the cleanup, and the acceptance criteria of Add cargo-deny exception for RUSTSEC-2026-0222 (wasmtime 45.0.0) #4031 explicitly asks for a TODO(#NNNN) reference matching the sibling entries. This also diverges from the neighbouring # TODO(#3732): entry at deny.toml:29 and from docs/engineering-standards.md:306-324 ("long-form rationale that belongs in an issue" — prefer a short TODO(#issue) over a paragraph of context). Suggested fix: open a follow-up issue for dropping the ignore once near-sdk/nearcore depend on wasmtime >= 46.0.2, move the severity/reachability analysis there, and collapse the comment to:

  # TODO(#NNNN): remove once near-sdk and nearcore depend on wasmtime >= 46.0.2 (no patched 45.x release)
  "RUSTSEC-2026-0222", # wasmtime stores can mix up type indices between engines

Non-blocking (nits, follow-ups, suggestions):

• deny.toml:34 — "Only reachable through near-vm-runner, which never shares a Store across Engines" is a claim about third-party code that cannot be checked from this repo and will go stale silently if near-vm-runner changes or a second wasmtime dependent enters the tree. Keeping that risk assessment in the tracking issue (next to a link to the advisory) makes it re-verifiable; the deny.toml comment only needs the removal condition.

⚠️ Issues found

[gilcu3]

@claude review

updated the issue, adding another issue for this seems an overkill

[claude]

Pull request overview

Adds RUSTSEC-2026-0222 (wasmtime 45.0.0 — “Stores can mix up type indices between engines”) to the advisories ignore list in deny.toml, unblocking Extra CI checks (cargo deny --all-features check) on unrelated PRs. Re-review following the update to #4031 that struck the follow-up-issue requirement.

Changes:

• deny.toml: one new advisory ignore entry plus a three-line rationale comment stating the removal condition.

Reviewed changes

Per-file summary

File	Description
deny.toml	Adds RUSTSEC-2026-0222 to the advisories ignore list, with a comment noting wasmtime 45.x has no patched release and that the advisory is only reachable via near-vm-runner.

Findings

Blocking: none.

Re-verified against the current lockfile:

• wasmtime 45.0.0 is the only wasmtime version in the tree, and its only two reverse dependencies are near-vm-runner 0.36.0 (Cargo.lock:7932, via near-sdk) and near-vm-runner 2.13.2 (Cargo.lock:7977, via the pinned nearcore tag) — see Cargo.lock:7972 and Cargo.lock:8022. The reachability half of the comment is accurate, and a lockfile-only fix is impossible: both dependants use a caret wasmtime = 45.0.0 requirement, so cargo cannot reach the patched >= 46.0.2.
• No sortedness or TODO-format lint applies to this entry: scripts/check-todo-format.sh:5-7 only scans *.rs/*.py/*.sh/*.yml/*.yaml/*.md, so .toml is out of scope.

On my earlier blocking comment asking for a TODO(#NNNN) reference: withdrawn. Beyond #4031 being updated, the repo tooling argues for the current form — .github/scripts/check-todo-closed-issues.sh:52 fails CI when a PR that closes issue #Y leaves a TODO(#Y) behind, so TODO(#4031) here would have been a red check. Without a separate follow-up issue (reasonably judged overkill), a plain “Remove once ...” comment carrying the removal condition is the right shape, and it matches the six unreferenced entries at deny.toml:23-28.

I could not run cargo deny in this environment (advisory-DB fetch unavailable), so the claim that the ignore actually clears the failure rests on the Extra CI checks run for this PR.

✅ Approved