Thanks for the PR! One thing to note is that we try to be careful about dependencies in Wasmtime, notably we're auditing new dependencies being added. As you've seen this means that dependency updates need to be audited. Additionally we're avoiding adding new exemptions to the audit list, so all updates need to be audited.

While it's ok to update everything here all-at-once, there's a fair amount to audit, so if you'd prefer to split things up into separate PRs I think that would work well too.

Subscribe to Label Action

cc @kubkon

Is it ok for you if ahash is left out as an exception for now ? I reviewed all others updates.

Thanks for working on this.

I apologize for a bit of a runaround on what to do about the cargo vet entries here. We're still experimenting ourselves how best to handle this. We decided a little bit ago that for dependency updates like this what we'll do is that one of the "trusted reviewers" will merge new vet entries into main which the PR can then rebase on top of. To that end I've created #5778 which creates vet entries for the dependencies being pulled in here, so when that merges could you rebase on that to merge?

We independently talked a bit ago about what to do about dependencies transitively used by the standard library and we decided that we would consider updating exemptions based on that but didn't want to record a full audit purely based on the usage in the standard library as well. (mostly just as a heads up, doesn't affect this PR too much with #5778 having all the necessary vet entries)