Clear wasmtime and rkyv cargo-audit violations

[leynos]

Summary

This branch clears the two make audit violations that surfaced in the
weekly scheduled dependency audit (and block CI on
#322):

• RUSTSEC-2026-0222 (wasmtime 45.0.3, stores can mix up type indices
  between engines, CVSS 3.8): upgrade wasmtime and wasmtime-wasi to
  47.0.3, the current fixed head. No fixed 45.x release exists, and both
  fixed lines (46.0.2 and 47.0.3) require Rust 1.94, so rust-version
  rises from 1.93 to 1.94 in the root manifest and crates/ambient-fs,
  with the developers' guide updated to match. The workspace compiles
  against wasmtime 47 with no source changes.
• RUSTSEC-2026-0235 (rkyv 0.7.46, out-of-bounds reads): rkyv is an
  optional dependency of rust_decimal that no enabled feature activates —
  it is locked but never compiled (cargo tree -i rkyv prints nothing),
  and no rust_decimal release drops it. Added to the Makefile's
  centralized ignore list with the removal condition documented, following
  the existing convention.

This PR is the base of a small stack: #322 (Ubicloud runner cost
reduction) now targets this branch and should merge after it.

Review walkthrough

• Start with Cargo.toml
  for the wasmtime pin and the MSRV bump.
• Then the Makefile
  ignore-list entry and its justification comment.
• docs/developers-guide.md
  and crates/ambient-fs/Cargo.toml
  carry the matching MSRV references.
• The two lockfiles (Cargo.lock,
  fuzz/Cargo.lock)
  change only wasmtime and its cap-std-family dependencies.

Validation

• make audit: all 17 manifests pass, including root and fuzz/.
• make check-fmt: clean.
• make lint (clippy, all three feature configurations plus the GitHub
  tool): clean. The whitaker stage reports 102 findings locally, but an
  identical 102 occur on a clean main worktree — local lint-version
  drift, not introduced here; CI pins whitaker-installer 0.2.6.
• cargo nextest run --workspace --features test-helpers: 4,193 passed
  with the database-backed trees and one snapshot test excluded. The
  Postgres trees fail locally with ident authentication (no local
  database), and html_to_markdown::convert_test_pages_to_markdown fails
  identically on a clean main worktree; neither is related to this
  change.

Notes

• The audit initially appeared to break the Telegram channel tests with a
  WIT version mismatch; that traced to a stale, gitignored local
  channels-src/telegram/telegram.wasm built against WIT 0.3.0, absent in
  CI. Rebuilding it locally resolved the failures — no repository change
  was needed.
• Raising the MSRV to 1.94 is unavoidable for this advisory: both fixed
  wasmtime lines declare rust-version = "1.94.0".

Summary by Sourcery

Raise the minimum supported Rust version and update sandboxing dependencies to resolve security advisories and clean the dependency audit.

Enhancements:

• Upgrade wasmtime and wasmtime-wasi dependencies to 47.0.3 for the WASM sandbox.
• Increase the workspace and ambient-fs crate MSRV from Rust 1.93 to 1.94 to align with updated dependencies.

Build:

• Extend the centralized cargo-audit ignore list to cover the rkyv 0.7.46 advisory that only affects an unused optional dependency.

Documentation:

• Update the developers guide to reference Rust 1.94 as the required toolchain version.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1ff64cd8-5d34-42aa-926e-39a6b1f2887f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the workspace to use wasmtime 47.0.3 and raises MSRV to Rust 1.94 to satisfy a security advisory, while explicitly ignoring an unused rkyv advisory in the centralized cargo-audit configuration; lockfiles are refreshed accordingly.

Flow diagram for make audit with new rkyv advisory ignore

flowchart TD
  dev[Developer runs make audit]
  make_audit[make audit]
  cargo_audit[cargo-audit]
  audit_flags[AUDIT_FLAGS includes RUSTSEC-2026-0235]
  rkyv_advisory[RUSTSEC-2026-0235 on rkyv 0.7.46]
  unused_dep[rkyv optional in rust_decimal and not compiled]
  result[Audit passes without blocking CI]

  dev --> make_audit
  make_audit --> audit_flags
  audit_flags --> cargo_audit
  cargo_audit --> rkyv_advisory
  rkyv_advisory --> unused_dep
  cargo_audit --> result

Loading

File-Level Changes

Change	Details	Files
Raise minimum supported Rust version (MSRV) to 1.94 across manifests and docs to match wasmtime requirements.	Bump root crate rust-version from 1.93 to 1.94. Align crates/ambient-fs crate rust-version with the new MSRV. Update developer documentation to instruct using Rust 1.94 and reference the new rust-version in the root manifest.	Cargo.toml crates/ambient-fs/Cargo.toml docs/developers-guide.md
Upgrade wasmtime and wasmtime-wasi to 47.0.3 and refresh dependency locks.	Change wasmtime dependency from 45.0.3 to 47.0.3 with existing feature set preserved. Change wasmtime-wasi dependency from 45.0.3 to 47.0.3. Regenerate Cargo.lock to pick up the new wasmtime and cap-std-family dependency versions. Regenerate fuzz/Cargo.lock to match fuzz workspace dependencies with the wasmtime upgrade.	Cargo.toml Cargo.lock fuzz/Cargo.lock
Add a cargo-audit ignore for the unused rkyv advisory with justification.	Document the rationale for ignoring RUSTSEC-2026-0235 (rkyv 0.7.46) in the Makefile audit section, including that rkyv is never compiled under current features. Extend AUDIT_FLAGS to include --ignore RUSTSEC-2026-0235 alongside existing ignores.	Makefile

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codescene-access]

No quality gates enabled for this code.