zellij/0.41.2-r1: cve remediation

[octo-sts]

zellij/0.41.2-r1: fix GHSA-c2f5-jxjv-2hh8

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/zellij.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error:

error: failed to select a version for the requirement `wasmtime = "^21.0.2"`
candidate versions found which didn't match: 24.0.2
location searched: crates.io index
required by package `zellij-server v0.41.2`

• Error Category: Dependency/Version

• Failure Point: rust/cargobump step when attempting to update the wasmtime dependency

• Root Cause Analysis: The cargobump tool is trying to update wasmtime to a newer version, but zellij-server specifically requires wasmtime 21.0.2, while only version 24.0.2 is available in the crates.io index.

• Suggested Fix:
Add wasmtime to the exclusion list in cargobump-deps.yaml:

exclude:
  - wasmtime

• Explanation:
The failure occurs because wasmtime 21.0.2 is a hard requirement for zellij-server 0.41.2, but cargobump is trying to update it to 24.0.2. By excluding wasmtime from the automatic updates, we preserve the required version compatibility while allowing other dependencies to update safely.

• Additional Notes:

• This is a common issue when a package has strict version requirements for critical dependencies
• Wasmtime has significant breaking changes between major versions
• The exclusion approach is safer than forcing an upgrade that could break functionality

• References:

• Zellij Dependencies: https://github.com/zellij-org/zellij/blob/main/Cargo.toml
• Wasmtime Changelog: https://github.com/bytecodealliance/wasmtime/blob/main/RELEASES.md
• Cargobump Documentation: https://github.com/wolfi-dev/tools/tree/main/cargobump

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error:

error: failed to select a version for the requirement `wasmtime = "^21.0.2"`
candidate versions found which didn't match: 25.0.0
location searched: crates.io index
required by package `zellij-server v0.41.2`

• Error Category: Dependency Version Conflict

• Failure Point: rust/cargobump step during dependency update

• Root Cause Analysis: The package requires wasmtime v21.0.2, but this version is no longer available in crates.io. The only available version is 25.0.0, which is incompatible with the current package version.

• Suggested Fix:

1. Add a version override in the cargobump-deps.yaml file:

dependencies:
  - name: wasmtime
    version: "25.0.0"

2. Or pin the specific version in the pipeline:

  - uses: rust/cargobump
    with:
      packages:
        - [email protected]

• Explanation: The wasmtime dependency has undergone a major version update from 21.x to 25.x. Since this is a breaking change, we need to explicitly specify the version compatibility. The fix will allow the build system to use the newer version of wasmtime.

• Additional Notes:

• This may require additional code changes due to breaking API changes between wasmtime 21 and 25
• Consider opening an upstream issue to update the wasmtime dependency
• Test thoroughly as this is a major version jump

• References:

• https://github.com/bytecodealliance/wasmtime/releases
• https://crates.io/crates/wasmtime/versions
• https://github.com/zellij-org/zellij/blob/main/Cargo.toml

[mamccorm]

Unfortunately we cannot remediate this one. Advisory filed:

• pending-upstream-fix advisory for GHSA-c2f5-jxjv-2hh8 advisories#9359