Many versions of wasm-tools mixed

[cpetig]

The dependencies in Cargo.toml should refer to the same release version of the libraries, cutting down on duplicated internal dependencies (see cargo tree):

wasmparser = "0.252"
wasm-encoder = "0.248"
wit-parser = "0.244"
wit-component = "0.244"
wat = "1.219"
wast = "252.0"

This should all refer to the same version (within different schemas), the current release is 252

[avrabe]

Thanks @cpetig — good catch. Dependabot had bumped wasmparser→0.252 but left the rest of the family behind. PR #466 aligns the workspace Cargo.toml to release 252: wasm-encoder 0.248→0.252, wit-parser 0.244→0.252, wit-component 0.244→0.252, wat 1.219→1.252 (wasmparser 0.252 and wast 252.0 were already current). Collapses the 0.247/0.248 duplicate copies into 0.252.

Frozen-safe: these are synth-frontend-only (Component Model parsing) + the wat/wast test parsers — the codegen path is untouched, and the frozen byte gates are bit-identical (wat 1.252 parses the fixtures to the same bytes).

One honest caveat: a single 0.244 wasm-tools copy will still show in cargo tree — but it's not from our manifest. It's pulled transitively by wit-bindgen's own pinned wit-component 0.244, deep in the z3-sys build chain (wasip2 → getrandom → … → z3-sys → synth-verify). That one only collapses when wit-bindgen updates upstream; nothing we pin here moves it.

— issue-hunt automation (avrabe), on behalf of the maintainers.

[avrabe]

Correction to my earlier note + PR #466 description: I overstated the dedup. PR #466 aligned the direct wasm-tools deps in our Cargo.toml to release 252 (correct, and frozen-safe), but it did not collapse the tree to a single version — I was wrong to say it removed the 0.247 copies. Accurate cargo tree state after the merge:

version	copies	pulled by
0.252	5	our aligned direct deps ✓
0.247	1	scry-sai-core (dev-dep) — pins ~0.247
0.244	5	wit-bindgen, transitively via the z3-sys build chain

So only the 0.248 tier collapsed into 0.252. The 0.247 (scry) and 0.244 (wit-bindgen) copies remain and aren't movable from our manifest — they need those intermediate crates to advance upstream. The 0.247 is the one we could plausibly chase by getting scry-sai-core onto 0.252.

Net: the manifest is now internally consistent (your original ask), but full single-version dedup across the tree is not achieved. Apologies for the inaccurate first description.

[avrabe]

Filed the chaseable residual upstream: pulseengine/scry#62 — asks scry-sai-core to move wasmparser 0.247 → 0.252 so the duplicate collapses on the scry side. (The 0.244/wit-bindgen copy remains genuinely upstream-of-upstream.)