zellij/0.41.2-r1: cve remediation

zellij.yaml

@@ -1,7 +1,7 @@
 package:
   name: zellij
   version: 0.41.2
-  epoch: 1
+  epoch: 2
   description: A terminal workspace with batteries included
   copyright:
     - license: MIT
@@ -27,6 +27,18 @@ pipeline:
 
   - uses: rust/cargobump
 
+  # Remediates: GHSA-c2f5-jxjv-2hh8. This is two-parts:
+  #   1. Updates in 'zellij-server/Cargo.toml' (this patch)
+  #   2. Upgrades dependency at top level of project using 'cargo update'.
+  # cargo/bump is not able to handle either of these scenarios currently.
+  # Can be removed if the following contribution is accepted: https://github.com/zellij-org/zellij/pull/3902.
+  - uses: patch
+    with:
+      patches: bump-wasmtime.patch
+
+  - runs: |
+      cargo update -p [email protected] --precise 24.0.2
+
   - runs: |
       # use system openssl
       export OPENSSL_NO_VENDOR=1

zellij/bump-wasmtime.patch

@@ -0,0 +1,31 @@
+diff --git a/zellij-server/Cargo.toml b/zellij-server/Cargo.toml
+index 7e5653b5..ad102c31 100644
+--- a/zellij-server/Cargo.toml
++++ b/zellij-server/Cargo.toml
+@@ -19,7 +19,7 @@ daemonize = "0.5"
+ serde_json = "1.0"
+ unicode-width = "0.1.8"
+ url = "2.2.2"
+-wasmtime-wasi = "21.0.2" # Keep in sync with wasmtime
++wasmtime-wasi = "24.0.2" # Keep in sync with wasmtime
+ cassowary = "0.3.0"
+ zellij-utils = { path = "../zellij-utils/", version = "0.41.2" }
+ log = "0.4.17"
+@@ -34,7 +34,7 @@ uuid = { version = "1.4.1", features = ["serde", "v4"] }
+ semver = "0.11.0"
+
+ [dependencies.wasmtime]
+-version = "21.0.2" # Keep in sync with wasmtime-wasi
++version = "24.0.2" # Keep in sync with wasmtime-wasi
+ default-features = false
+ features = [
+   'async',
+@@ -53,7 +53,7 @@ features = [
+ [dev-dependencies]
+ insta = "1.6.0"
+ tempfile = "3.2.0"
+-wasmtime = { version = "21.0.2", features = ["winch"] } # Keep in sync with the other wasmtime dep
++wasmtime = { version = "24.0.2", features = ["winch"] } # Keep in sync with the other wasmtime dep
+
+ [features]
+ singlepass = ["wasmtime/winch"]