Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump wat from 1.211.1 to 1.219.1 #417

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump wat from 1.211.1 to 1.219.1 #417

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 14, 2024

Bumps wat from 1.211.1 to 1.219.1.

Release notes

Sourced from wat's releases.

v1.219.1

What's Changed

Full Changelog: bytecodealliance/wasm-tools@v1.219.0...v1.219.1

v1.219.0

What's Changed

Full Changelog: bytecodealliance/wasm-tools@v1.218.0...v1.219.0

v1.218.0

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump wat from 1.211.1 to 1.219.1
252732c 
Bumps [wat](https://github.com/bytecodealliance/wasm-tools) from 1.211.1 to 1.219.1.
- [Release notes](https://github.com/bytecodealliance/wasm-tools/releases)
- [Commits](bytecodealliance/wasm-tools@v1.211.1...v1.219.1)

---
updated-dependencies:
- dependency-name: wat
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file. rust Pull requests that update Rust code labels Oct 14, 2024
@dependabot dependabot bot mentioned this pull request Oct 14, 2024
Closed
@dryrunsecurity DryRunSecurity
Copy link

DryRun Security Summary

The provided code changes include updates to several dependencies, most notably the wat, wasm-encoder, and wasmparser dependencies, which are critical for handling WebAssembly (Wasm) functionality in the application.

Expand for full summary

Summary:

The provided code changes include updates to several dependencies in the Cargo.toml and Cargo.lock files. The most notable changes are the updates to the wat, wasm-encoder, and wasmparser dependencies, which are critical for handling WebAssembly (Wasm) functionality in the application.

From an application security perspective, these dependency updates are generally not concerning, as the Rust community maintains a high standard of security for its core libraries and dependencies. The wat crate update is a minor version change, which typically includes bug fixes and improvements, but does not introduce major breaking changes. The updates to the wasm-encoder and wasmparser dependencies are more significant, as they are directly related to Wasm parsing and encoding, which is a crucial component of the application's security.

Overall, the changes appear to be routine dependency updates, but it's important to review the release notes and change logs for the updated dependencies to ensure there are no known security vulnerabilities or breaking changes that could affect the application. Additionally, monitoring the security posture of the Wasm-related dependencies is recommended, as Wasm is a relatively new technology with evolving security considerations.

Files Changed:

  1. Cargo.toml: This file has been updated to include a version change for the wat dependency, from 1.211.1 to 1.219.1. This is a minor version update that typically includes bug fixes and improvements.

  2. Cargo.lock: This file has been updated to include several dependency changes:

    • The itertools dependency has been updated from version 0.10.5 to 0.12.1.
    • The windows-targets dependency has been updated from version 0.48.5 to 0.52.5.
    • The wasm-encoder dependency has been added in version 0.219.1.
    • The wasmparser dependency has been updated from version 0.211.1 to 0.219.1.
    • The wast dependency has been updated from version 211.0.1 to 219.0.1.
    • The wat dependency has been updated from version 1.211.1 to 1.219.1.

The updates to the wasm-encoder and wasmparser dependencies are particularly important, as they are directly related to Wasm parsing and encoding, which is a critical component of the application's security.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file. rust Pull requests that update Rust code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants