Release Wasmtime 0.34.2 (#3984)

* Bump Wasmtime to 0.34.2

[automatically-tag-and-release-this-commit]

* Add release notes for 0.34.2

* Disable stack overflow tests on Windows

This test is disabled on Windows because we determined it is too risky to back
port #3861 to the 0.34.x
release branch.

* Switch back to windows-2019 on CI (#3854)

Looks like windows-2022 is failing, let's perhaps pin for now?

Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>
Co-authored-by: Alex Crichton <alex@alexcrichton.com>

.github/workflows/main.yml

@@ -215,8 +215,8 @@ jobs:
         include:
           - os: ubuntu-latest
           - os: macos-latest
-          - os: windows-latest
-          - os: windows-latest
+          - os: windows-2019
+          - os: windows-2019
             target: x86_64-pc-windows-gnu
           - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-cli"
-version = "0.34.1"
+version = "0.34.2"
 authors = ["The Wasmtime Project Developers"]
 description = "Command-line interface for Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -21,14 +21,14 @@ path = "src/bin/wasmtime.rs"
 doc = false
 
 [dependencies]
-wasmtime = { path = "crates/wasmtime", version = "0.34.1", default-features = false, features = ['cache', 'cranelift'] }
-wasmtime-cache = { path = "crates/cache", version = "=0.34.1" }
-wasmtime-cranelift = { path = "crates/cranelift", version = "=0.34.1" }
-wasmtime-environ = { path = "crates/environ", version = "=0.34.1" }
-wasmtime-wast = { path = "crates/wast", version = "=0.34.1" }
-wasmtime-wasi = { path = "crates/wasi", version = "0.34.1" }
-wasmtime-wasi-crypto = { path = "crates/wasi-crypto", version = "0.34.1", optional = true }
-wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "0.34.1", optional = true }
+wasmtime = { path = "crates/wasmtime", version = "0.34.2", default-features = false, features = ['cache', 'cranelift'] }
+wasmtime-cache = { path = "crates/cache", version = "=0.34.2" }
+wasmtime-cranelift = { path = "crates/cranelift", version = "=0.34.2" }
+wasmtime-environ = { path = "crates/environ", version = "=0.34.2" }
+wasmtime-wast = { path = "crates/wast", version = "=0.34.2" }
+wasmtime-wasi = { path = "crates/wasi", version = "0.34.2" }
+wasmtime-wasi-crypto = { path = "crates/wasi-crypto", version = "0.34.2", optional = true }
+wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "0.34.2", optional = true }
 structopt = { version = "0.3.5", features = ["color", "suggestions"] }
 anyhow = "1.0.19"
 target-lexicon = { version = "0.12.0", default-features = false }
@@ -46,7 +46,7 @@ rustix = "0.33.0"
 
 [dev-dependencies]
 # depend again on wasmtime to activate its default features for tests
-wasmtime = { path = "crates/wasmtime", version = "0.34.1" }
+wasmtime = { path = "crates/wasmtime", version = "0.34.2" }
 env_logger = "0.8.1"
 filecheck = "0.5.0"
 more-asserts = "0.2.1"

RELEASES.md

@@ -2,6 +2,17 @@
 
 --------------------------------------------------------------------------------
 
+## 0.34.2
+
+Released 2022-03-31.
+
+### Security Fixes
+
+* [CVE-2022-24791](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2):
+  Fixed a use after free with `externref`s and epoch interruption.
+
+--------------------------------------------------------------------------------
+
 ## 0.34.1
 
 Released 2022-02-16.
@@ -12,6 +23,8 @@ Released 2022-02-16.
   Fixed an invalid drop of a partially-initialized instance in the pooling instance
   allocator.
 
+--------------------------------------------------------------------------------
+
 ## 0.34.0
 
 Released 2022-02-07.