Update vulnerable modules

[SupernaviX]

This PR just updates dependencies which were on vulnerable versions.

The only notable change is that it updates from wasmtime 0.34 to 0.36. That's still a quite old release line, but the wasmtime maintainers backport vulnerability fixes to it. There were a lot of vulnerabilities in 0.34, some of which looked pretty exploitable on a system like balius which runs arbitrary wasm code.

There were also a few modules which specified a vulnerable patch version, I loosened those so that cargo update just includes fixes for them in the future.

The tests for this repo don't really work, but I ran it in my own project and it was working just fine there.

Summary by CodeRabbit

• Chores
  • Updated runtime and async-related dependencies to newer compatible versions.
  • Adjusted component binding settings to use a consolidated async/tracing configuration.
  • No user-facing features or public APIs were changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4696f93c-e261-419f-8aca-10d8bf14c033

📥 Commits

Reviewing files that changed from the base of the PR and between 528ca26 and fba749e.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• balius-runtime/Cargo.toml
• balius-runtime/src/lib.rs
• balius/Cargo.toml
• baliusd/Cargo.toml

---

📝 Walkthrough

Walkthrough

Updates the wasmtime dependency to version 36 in balius-runtime, with corresponding bindgen! macro configuration change to use unified default: async | tracing settings. Also relaxes tokio (1.41.0 → 1) and tracing-subscriber (0.3.18 → 0.3) version constraints in balius and baliusd Cargo.toml files.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Wasmtime upgrade and bindgen config balius-runtime/Cargo.toml, balius-runtime/src/lib.rs	wasmtime dependency bumped from 34.0.2 to 36, and the bindgen! macro's wit config for imports/exports switched to a unified default: async | tracing setting.
Tokio and tracing-subscriber relaxation balius/Cargo.toml, baliusd/Cargo.toml	tokio requirement loosened from 1.41.0 to 1, and tracing-subscriber loosened from 0.3.18 to 0.3, in both crates.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Hop, hop, version bump anew,
Wasmtime grows, tokio loosens too,
Bindgen macros now align,
Async and tracing, all in one line,
A rabbit's Cargo.toml, fresh and true! 🐇📦

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the PR’s main theme of updating vulnerable dependencies, including wasmtime, tokio, and tracing-subscriber.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sg/update-vulns

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}