fix(deps): update rust dependencies to v44 (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
wasi-preview1-component-adapter-provider	dependencies	major	41 → 44
wasmtime	workspace.dependencies	major	42 → 44
wasmtime-wasi	workspace.dependencies	major	42 → 44
wasmtime-wizer	dependencies	major	42 → 44

---

Release Notes

bytecodealliance/wasmtime (wasi-preview1-component-adapter-provider)

v44.0.1

Compare Source

44.0.1

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space.
  GHSA-p8xm-42r7-89xg

v44.0.0

Compare Source

44.0.0

Released 2026-04-20.

Added

• The wasmtime CLI now supports a -g flag which runs a built-in wasm program
  to host a gdbstub-compatible server (can be connected to with LLDB) to debug
  guest programs.
  #​12756
  #​12771
  #​12856
  #​12859

• Wasmtime now has experimental support for the map<K, V> type in the
  component model.
  #​12216

• Wasmtime's C API now supports wasm tag types.
  #​12763
  #​12803

• Wasmtime's C API now supports exceptions.
  #​12861

• Wasmtime's C API has more support for the GC proposal.
  #​12914
  #​12915
  #​12916
  #​12917

• An initial implementation of the wasi:tls proposal for the 0.3.0-draft
  version has been added.
  #​12834

Changed

• The demangle Cargo feature of the wasmtime crate is now compatible with
  no_std targets.
  #​12740

• The wasmtime-wasi-tls-* crates are now merged into one crate with feature
  flags for each backend.
  #​12780

• Wasmtime now requires Rust 1.92.0 or later to build.
  #​12828

• The cranelift-codegen crate now compiles for no_std targets.
  #​12812

• The csdb instruction, a defense-in-depth measure for spectre, is no longer
  emitted by default on aarch64 to match what peer runtimes are doing. In some
  situations this is known to provide up to a 6x performance boost on macOS as
  well.
  #​12932

Fixed

• Wasmtime's native DWARF has been improved on aarch64 to support recovering
  values more frequently.
  #​12779

• A significant number of minor issues have been fixed throughout this release.
  In addition to the security advisories found by LLMs there have also
  been a large number of other issues identified as well. Many minor fixes are
  present in this release for various situations for issues found in this
  manner.

v43.0.2

Compare Source

43.0.2

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space.
  GHSA-p8xm-42r7-89xg

v43.0.1

Compare Source

43.0.1

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Use-after-free bug after cloning wasmtime::Linker.
  GHSA-hfr4-7c6c-48w2

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

v43.0.0

Compare Source

43.0.0

Released 2026-03-20.

Added

• Wasmtime now supports the WASIp3 snapshot 0.3.0-rc-2026-03-15.
  #​12557

• The number of frames captured in backtrace collection can now be configured.
  #​12542

• Wasmtime now supports fine-grained operator cost configuration for when fuel
  is enabled.
  #​12541

• Configuring the gc_support option is now possible through the C API.
  #​12630

• Configuring the concurrency_support option is now possible through the C
  API.
  #​12703

• Debugging-related APIs have been added to access all modules and instances on
  a store.
  #​12637

• All store entities now expose a "unique ID" for debugging purposes.
  #​12645

• Cranelift's x64 backend now supports the cls instruction for all integer
  types.
  #​12644

Changed

• Internal refactoring and support necessary for handling OOM gracefully
  throughout the runtime is proceeding apace. New APIs such as
  FuncType::try_new are available in addition to many internal changes.
  #​12530
  #​12537
  (... and many more ...)

• Wasmtime's representation of stack frames in the debugging API no longer
  borrows the store itself and is instead represented as a handle.
  #​12566

• Wasmtime now unconditionally sets SO_REUSEADDR for guest-bound sockets.
  #​12597

• Cranelift now supports more VRegs which means effectively that larger
  functions will be compilable by default rather than returning a "function too
  large" error.
  #​12611

• WASIp3 implementations now limit returned memory by default for randomness and
  HTTP headers.
  #​12745
  #​12761

Fixed

• Running wasmtime wizer over components with modules that contain an
  _initialize function no longer removes the function to preserve the validity
  of the component.
  #​12540

• Borrow state for host async tasks is now handled more correctly throughout
  Wasmtime, especially in the face of cancellation.
  #​12550

• Bindings generation now accounts for the fact that future and stream are
  not cloneable types.
  #​12155

• The impementation of UDP in WASIp2 has had some wakeup-related bugs fixed.
  #​12629

• Cancellation of host subtasks for component-model-async has been improved and
  works more reliably.
  #​12640

• Subtask management for component-model-async now no longer reparents which
  fixes a number spec-related divergences.
  #​12570

• Converting a wasmtime::Error into anyhow::Error and using downcast has
  been fixed.
  #​12689

• Async stream/future read/write cancellation has had some corner cases fixed.
  #​12704

• Cranelift's timing infrastructure is now more robust in the face of buggy
  system clocks.
  #​12709

• The currently running guest task has been corrected in a number of cases
  related to component-model-async and cooperative threading.
  #​12718
  #​12735
  #​12736
  #​12737

• An issue of lost wakeups with the WASIp3 stdin implementation has been fixed.
  #​12745

v42.0.2

Compare Source

42.0.2

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

v42.0.1

Compare Source

42.0.1

Released 2026-02-25.

Fixed

• Fix some minor bindgen! issues with anyhow: true
  #​12658

v42.0.0

Compare Source

42.0.0

Released 2026-02-20.

Added

• Cranelift now supports bitwise operations on floats on aarch64.
  #​12326

• Cranelift now supports NaN canonicalization of f16 and f128.
  #​12337

• Wasmtime has gained minimal support to implement fixed-length lists in the
  component model being communicated between composed components.
  #​10619

• Wasmtime's Error and Result types are now built-in to the wasmtime crate
  and are no longer defined by the anyhow crate. Wasmtime exports a
  mostly-compatible anyhow-like API at wasmtime::error which is used
  instead. Wasmtime's own Error handles OOM internally and is foundational
  part of Wasmtime's work-in-progress support to gracefully handle OOM.
  #​12309

• Wasmtime now exports an extension trait to convert anyhow::Result<T> into
  wasmtime::Result<T>.
  #​12255

• Wasmtime supports a new bindgen! option to generate bindings specifically
  with anyhow::Result instead of wasmtime::Result.
  #​12331

• The Nvidia-Cuda execution provider is now supported for the wasi-nn onnx
  backend.
  #​12044

• Non-exported and private entities can now be accessed through the debugger
  API.
  #​12367

• A new Store::try_new API has been added which handles OOM.
  #​12415

• Initial configuration knobs for record-and-replay support have been added.
  #​12375

• Cranelift's s390x backend now has support for instructions added in z17.
  #​12319

• Wasmtime's implementation of fibers can now be compiled on riscv32imac
  platforms.
  #​12506

• Wasmtime's implementation of WASI now correctly limits resource consumption on
  behalf of the guest, such as host-allocated memory, by default. This means
  that some behaviors previously allowed by Wasmtime are now disallowed by
  default if they rely on transferring a large amount of data from the guest to
  the host. Additionally calls to wasi:random/random.get-random-bytes, for
  example, now have limits in place by default to avoid allocating too much
  memory on the host. For more information on this see the related security
  advisory with further details on knobs added and what behaviors are now
  restricted by default.
  GHSA-852m-cvvp-9p4w

Changed

• Reentrance rules for WebAssembly components have changed in accordance with
  upstream specification changes. Embeddings are not expected to be affected,
  but please reach out if you find problems.
  #​12349

• Wasmtime's Config::async_support option is now removed and no longer
  necessary. Embeddings can likely just remove turning this on and everything
  should keep working like normal.
  #​12371

• Wasmtime now supports Config::concurrency_support as a knob to enable or
  disable *_concurrent APIs at runtime when the component-model-async crate
  feature is enabled.
  #​12416

• The post_return-style functions in Wasmtime's API are now noops and will be
  removed in the future.
  #​12498

• Translation of global.get of a defined, immutable global is now turned into
  a CLIF constant.
  #​12234

• The wasmtime-wasi-nn crate's dependency on ort has been updated.
  #​12162

• Error bounds requiring using hyper::Error in wasmtime-wasi-http have been
  relaxed to taking E: Into<ErrorCode> instead.
  #​12227

• The cranelift-assembler-x64, and cranelift-isle crates now supports
  no_std targets. The cranelift-codegen crate now mostly supports no_std,
  but not entirely.
  #​12222
  #​12235
  #​12236

• Android release binaries are now compiled with a larger page size configured.
  #​12246

• Implicit binds are now allowed for WASIp3 sockets.
  #​12225

• Wasmtime's implementation of component-model-async now correctly checks for
  whether tasks are allowed to block in all guest-to-guest situations.
  #​12282

• The wasmtime-wasi-tls crate now has an OpenSSL backend.
  #​12228

• Wasmtime's OutOfMemory error now keeps track of the attempted allocation
  size that failed.
  #​12351

• Wasmtime's *_unchecked functions now work with MaybeUninit<ValRaw> instead
  of ValRaw directly.
  #​12366

• Wasmtime now requires Rust 1.91.0 to compile.
  #​12392

• Wasmtime's management of component-model-async tasks is now consistently done
  in all boundaries between guest/host tasks.
  #​12379

Fixed

• The HeapType::matches implementation for NoExn has been fixed.
  #​12350

• Enum discriminant validation for composed components has been fixed.
  #​12356

• Shifts in some situations on aarch64 with Winch have been fixed.
  #​12501

• Debug value locations around cold blocks have been improved.
  #​12484

• Panics when adding too many headers to a wasi:http/types.fields has been
  resolved
  GHSA-243v-98vx-264h

v41.0.4

Compare Source

41.0.4

Released 2026-02-24.

Changed

• Wasmtime's implementation of WASI now has the ability to limit resource
  consumption on behalf of the guest, such as host-allocated memory. This means
  that some behaviors previously allowed by Wasmtime can now disallowed, such as
  transferring excessive data from the guest to the host. Additionally calls to
  wasi:random/random.get-random-bytes, for example, can have limits in place
  to avoid allocating too much memory on the host. To preserve
  backwards-compatible behavior these limits are NOT set by default. Embedders
  must opt-in to configuring these knobs as appropriate for their embeddings.
  For more information on this see the related security advisory with further
  details on knobs added and what behaviors can be restricted.
  GHSA-852m-cvvp-9p4w

Fixed

• Panics when adding too many headers to a wasi:http/types.fields has been
  resolved
  GHSA-243v-98vx-264h

• Panic when dropping a [Typed]Func::call_async future.
  GHSA-xjhv-v822-pf94

v41.0.3

Compare Source

41.0.3

Released 2026-02-04.

Fixed

• Fix an incorrect mid-end optimization rule that could cause a compiler panic
  due to mismatched types.
  #​12504

v41.0.2

Compare Source

41.0.2

Released 2026-02-03.

Fixed

• Reduce the dependencies of the wasmtime-internal-jit-icache-coherence crate.
  #​12446

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.