Update wasmi to 0.20.0 in wasmtime-fuzzing (bytecodealliance#5256)

* update wasmi to 0.20 in wasmtime-fuzzing

* add cargo-vet entries for wasmi_core 0.5.0 and wasmi 0.20.0

crates/fuzzing/Cargo.toml

@@ -25,7 +25,7 @@ wasm-encoder = { workspace = true }
 wasm-smith = { workspace = true }
 wasm-mutate = { workspace = true }
 wasm-spec-interpreter = { path = "./wasm-spec-interpreter", optional = true }
-wasmi = "0.19.0"
+wasmi = "0.20.0"
 
 # We rely on precompiled v8 binaries, but rusty-v8 doesn't have a precompiled
 # binary for MinGW which is built on our CI. It does have one for Windows-msvc,

supply-chain/audits.toml

@@ -481,6 +481,27 @@ unexpected usage of the filesystem or things like that and otherwise is mostly
 plumbing for all the integer operations in core wasm.
 """
 
+[[audits.wasmi_core]]
+who = "Robin Freyler <[email protected]>"
+criteria = "safe-to-run"
+version = "0.5.0"
+notes = "See notes for version 0.4.0"
+
+[[audits.wasmi]]
+who = "Robin Freyler <[email protected]>"
+criteria = "safe-to-run"
+version = "0.20.0"
+notes = """
+I am the author of this crate. It contains unsafe Rust code.
+However, the crate does not read or write data from any parts of the filesystem,
+it does not install software upon compilation e.g. via build scripts,
+it does not connect to network endpoints and does not misuse system resources.
+
+If any of the above happens it is either by the user explicitly telling the
+crate to do so (it is an interpreter) or due to a bug or other unintended
+behavior.
+"""
+
 [[audits.wasmparser]]
 who = "Alex Crichton <[email protected]>"
 criteria = "safe-to-deploy"