Skip to content

chore(audit): allow RUSTSEC-2026-0114 (wasmtime panic) — unblocks 2026-05-01 CI#1242

Merged
noahgift merged 1 commit into
mainfrom
chore/audit-rustsec-2026-0114
May 1, 2026
Merged

chore(audit): allow RUSTSEC-2026-0114 (wasmtime panic) — unblocks 2026-05-01 CI#1242
noahgift merged 1 commit into
mainfrom
chore/audit-rustsec-2026-0114

Conversation

@noahgift

@noahgift noahgift commented May 1, 2026

Copy link
Copy Markdown
Contributor

Summary

New RustSec advisory RUSTSEC-2026-0114 (published 2026-04-30) flags wasmtime 43.0.1 for a table allocation panic. Severity 5.9 (medium). Surfaced as ci / security: FAILURE on every PR opened on 2026-05-01 — blocks the entire current PR queue including the M32d discharge stack (#1222 #1226 #1228 #1232 #1238).

Triage

Same handling as the existing wasmtime advisory cluster (RUSTSEC-2026-0085/0086/0088/0089/0091/0092/0094/0096):

  • test-only dep (aprender-test-lib), not production
  • availability bug (panic), not RCE / memory safety
  • upgrade path: >=43.0.2 / >=44.0.1 — same path as the other 8 wasmtime advisories

Adding to ignore list with the same justification keeps consistency with the existing cluster.

Files

  • .cargo/audit.toml — adds RUSTSEC-2026-0114 after the existing wasmtime cluster
  • deny.toml — adds matching entry per "Mirrors deny.toml ignore list for consistency" comment

Test plan

  • cargo deny check advisories 2>&1 | grep -c RUSTSEC produces same count
  • FALSIFY-AUDIT-001 invariant maintained (audit.toml IDs == --ignore flags passed)

Refs

🤖 Generated with Claude Code

New advisory published 2026-04-30 against wasmtime 43.0.1 — table
allocation panic when exceeding the host's address space. Severity 5.9
(medium). Surfaced as a CI failure on every PR opened on 2026-05-01
(blocked all in-flight work).

Same handling as the existing wasmtime advisory cluster
(RUSTSEC-2026-0085/0086/0088/0089/0091/0092/0094/0096):

  - test-only dep (aprender-test-lib), not production
  - availability bug (panic), not RCE / memory safety
  - upgrade path: >=43.0.2 / >=44.0.1 — same path as the other 8

Both .cargo/audit.toml and deny.toml updated to keep them in sync per
"Mirrors deny.toml ignore list for consistency" comment in audit.toml.

This unblocks the entire 2026-05-01 PR queue including the M32d
discharge stack (#1222 #1226 #1228 #1232 #1238).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@noahgift noahgift enabled auto-merge (squash) May 1, 2026 14:41
@noahgift noahgift merged commit 625f6c0 into main May 1, 2026
11 checks passed
@noahgift noahgift deleted the chore/audit-rustsec-2026-0114 branch May 1, 2026 18:08
noahgift added a commit that referenced this pull request May 2, 2026
…d discharge audit-trail bump (#1078)

Source-of-truth bytes pushed by the companion repo. M22 paired-mirror
guard via pin.lock (sha256 byte-identity, will be refreshed in companion
PR).

Net change: bumps top-level contract YAML from v1.22.0 to v1.23.0 with
one new status_history entry (M35) recording M32d's functional discharge
on aprender main as commit 5235aae (#1228 squash).

What M35 records
================

  M32d numerical-parity bundle landed across multiple aprender PRs:
    #1222 (Step 2)        forward_qwen3_moe_traced diagnostic surface
    #1226 (Step 2.5)      `apr trace --payload` qwen3_moe dispatch
                          (squashed into #1222)
    #1242                 RUSTSEC-2026-0114 audit unblocker
    #1401 (Step 2 JSON)   `apr trace --json --payload` JSON output
                          (FAST PATH Step 2 exit-criterion shape)
    #1228 (THE BUNDLE)    Step 5 + 5b + 6 + 7 + regression test +
                          evidence — squashed into one commit on main:
                          - per-head Q/K RMSNorm in
                            forward_qwen3_moe (rank-3 prior, 15%)
                          - rope_theta 10K → 1M for qwen3_moe (rank-4
                            prior, 10%)
                          - chat template: qwen3_moe → ChatML
                            (no `<think>` injection)
                          - sync forward_qwen3_moe_traced with Step 5
                          - F-QW3-MOE-STEP5-001 regression test
                          - evidence/m32d-discharge-2026-05-01/

Live evidence on lambda-vector RTX 4090 against the 17.3 GB
Qwen3-Coder-30B-A3B-Instruct-Q4_K_M.gguf:

  $ apr run --prompt "What is 2+2?" --max-tokens 8
  Output: 2 + 2 = 4

  $ apr run --prompt "Capital of France:" --max-tokens 30
  Output: The capital of France is Paris.

  $ apr run --prompt "Translate to Spanish: Hello world" --max-tokens 30
  Output: ¡Hola mundo!

  $ apr run --prompt "Solve x^2 - 5x + 6 = 0:" --max-tokens 30
  Output: I need to solve the quadratic equation x² - 5x + 6 = 0.
          I can solve this by factoring.

Output transition timeline:
  pre-fix         "%%%%%%%%"
  + Step 5        "Human: What is 2+"
  + Step 5b       "Human: What is 2+2?"
  + Step 6        "2 + 2 = 4"

M34 FAST PATH actual cost: 5 PRs / ~6 hours wall — **lucky-case bound**
of the 4-6 PRs / 2-3 days estimate.

What M35 does NOT discharge
============================

  - Cosine vs HF FP16 measurement (operator-confirm — ~60 GB download).
    The formal flip of `qwen3-moe-forward-v1` v1.3.0 DRAFT → v1.4.0
    ACTIVE_RUNTIME waits on that measurement.
  - GPU MoE path (no forward_qwen3_moe_gpu; CUDA/wgpu kernels TBD).
  - Other Qwen3-MoE variants.

Refs aprender commit 5235aae (#1228)
Refs companion M34 (v1.21.0 → v1.22.0 plan)
Refs PMAT-CCPA-PARITY-001
Refs M22 paired-mirror invariant

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant