From 88715bfedc381f70e0f180b6fbf66faf2e1fbcae Mon Sep 17 00:00:00 2001 From: cfal Date: Tue, 21 Jul 2026 10:31:24 +0000 Subject: [PATCH] workflows: upgrade Wasmtime to v47 wasmtime-go v28 embeds an unsupported runtime that predates the guest-controlled WASI resource limits added for CVE-2026-27204. Move directly to v47 because the v36 Go binding does not publish the patched LTS releases. --- go.mod | 2 +- go.sum | 4 ++-- pkg/workflows/wasm/host/execution.go | 2 +- pkg/workflows/wasm/host/module.go | 2 +- pkg/workflows/wasm/host/module_test.go | 2 +- pkg/workflows/wasm/host/unwind_unix.go | 2 +- pkg/workflows/wasm/host/unwind_windows.go | 2 +- pkg/workflows/wasm/host/wasip1.go | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index c145da9584..40479c3317 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/XSAM/otelsql v0.37.0 github.com/andybalholm/brotli v1.1.1 github.com/atombender/go-jsonschema v0.16.1-0.20240916205339-a74cd4e2851c - github.com/bytecodealliance/wasmtime-go/v28 v28.0.0 + github.com/bytecodealliance/wasmtime-go/v47 v47.0.0 github.com/cloudevents/sdk-go/binding/format/protobuf/v2 v2.16.1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc github.com/dominikbraun/graph v0.23.0 diff --git a/go.sum b/go.sum index 028587f22b..e4b11c5902 100644 --- a/go.sum +++ b/go.sum @@ -27,8 +27,8 @@ github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY= github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE= github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk= github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= -github.com/bytecodealliance/wasmtime-go/v28 v28.0.0 h1:aBU8cexP2rPZ0Qz488kvn2NXvWZHL2aG1/+n7Iv+xGc= -github.com/bytecodealliance/wasmtime-go/v28 v28.0.0/go.mod h1:4OCU0xAW9ycwtX4nMF4zxwgJBJ5/0eMfJiHB0wAmkV4= +github.com/bytecodealliance/wasmtime-go/v47 v47.0.0 h1:PAe4o7Mq1VjSx81Dc+V4w1XvxLouFTB384N4ZT4o+7k= +github.com/bytecodealliance/wasmtime-go/v47 v47.0.0/go.mod h1:icJLhTDV7EyKlZpeuBuJl4yoTMqhjUvNv1mewMJUvr4= github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= diff --git a/pkg/workflows/wasm/host/execution.go b/pkg/workflows/wasm/host/execution.go index 6cd16bc4e2..53caaf3774 100644 --- a/pkg/workflows/wasm/host/execution.go +++ b/pkg/workflows/wasm/host/execution.go @@ -9,7 +9,7 @@ import ( "sync" "time" - "github.com/bytecodealliance/wasmtime-go/v28" + "github.com/bytecodealliance/wasmtime-go/v47" "google.golang.org/protobuf/proto" caperrors "github.com/smartcontractkit/chainlink-common/pkg/capabilities/errors" diff --git a/pkg/workflows/wasm/host/module.go b/pkg/workflows/wasm/host/module.go index 704857bf5f..0cd4798a42 100644 --- a/pkg/workflows/wasm/host/module.go +++ b/pkg/workflows/wasm/host/module.go @@ -18,7 +18,7 @@ import ( "time" "github.com/andybalholm/brotli" - "github.com/bytecodealliance/wasmtime-go/v28" + "github.com/bytecodealliance/wasmtime-go/v47" "google.golang.org/protobuf/proto" "github.com/smartcontractkit/chainlink-common/pkg/workflows/host" diff --git a/pkg/workflows/wasm/host/module_test.go b/pkg/workflows/wasm/host/module_test.go index 7435ec83a9..052a1c7cb2 100644 --- a/pkg/workflows/wasm/host/module_test.go +++ b/pkg/workflows/wasm/host/module_test.go @@ -8,7 +8,7 @@ import ( "sync" "testing" - "github.com/bytecodealliance/wasmtime-go/v28" + "github.com/bytecodealliance/wasmtime-go/v47" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" diff --git a/pkg/workflows/wasm/host/unwind_unix.go b/pkg/workflows/wasm/host/unwind_unix.go index b05aff84b8..6540fbe7cb 100644 --- a/pkg/workflows/wasm/host/unwind_unix.go +++ b/pkg/workflows/wasm/host/unwind_unix.go @@ -2,7 +2,7 @@ package host -import "github.com/bytecodealliance/wasmtime-go/v28" +import "github.com/bytecodealliance/wasmtime-go/v47" // Load testing shows that leaving native unwind info enabled causes a very large slowdown when loading multiple modules. func SetUnwinding(cfg *wasmtime.Config) { diff --git a/pkg/workflows/wasm/host/unwind_windows.go b/pkg/workflows/wasm/host/unwind_windows.go index b70d3a4003..77192a12ee 100644 --- a/pkg/workflows/wasm/host/unwind_windows.go +++ b/pkg/workflows/wasm/host/unwind_windows.go @@ -2,7 +2,7 @@ package host -import "github.com/bytecodealliance/wasmtime-go/v28" +import "github.com/bytecodealliance/wasmtime-go/v47" func SetUnwinding(cfg *wasmtime.Config) { // Unwinding cannot be disabled on Windows. diff --git a/pkg/workflows/wasm/host/wasip1.go b/pkg/workflows/wasm/host/wasip1.go index 9b22751560..eb9e3e5954 100644 --- a/pkg/workflows/wasm/host/wasip1.go +++ b/pkg/workflows/wasm/host/wasip1.go @@ -8,7 +8,7 @@ import ( "math/rand" "time" - "github.com/bytecodealliance/wasmtime-go/v28" + "github.com/bytecodealliance/wasmtime-go/v47" "github.com/jonboulle/clockwork" )