Release Wasmtime 46.0.3 (#14170)

* Release Wasmtime 46.0.3

[automatically-tag-and-release-this-commit]

* Add release notes

---------

Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
Co-authored-by: Alex Crichton <alex@alexcrichton.com>

Author: wasmtime-publish

Cargo.lock

@@ -204,7 +204,7 @@ exclude = [
 ]
 
 [workspace.package]
-version = "46.0.2"
+version = "46.0.3"
 authors = ["The Wasmtime Project Developers"]
 edition = "2024"
 # Wasmtime's current policy is that this number can be no larger than the
@@ -265,18 +265,18 @@ extra_unused_type_parameters = 'warn'
 # tooling but aren't intended to be widely depended on.
 #
 # All of these crates are supported though in the sense that
-wasmtime = { path = "crates/wasmtime", version = "46.0.2", default-features = false }
-wasmtime-cli-flags = { path = "crates/cli-flags", version = "=46.0.2" }
-wasmtime-environ = { path = "crates/environ", version = "=46.0.2" }
-wasmtime-wasi = { path = "crates/wasi", version = "46.0.2", default-features = false }
-wasmtime-wasi-io = { path = "crates/wasi-io", version = "46.0.2", default-features = false }
-wasmtime-wasi-http = { path = "crates/wasi-http", version = "46.0.2", default-features = false }
-wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "46.0.2" }
-wasmtime-wasi-config = { path = "crates/wasi-config", version = "46.0.2" }
-wasmtime-wasi-keyvalue = { path = "crates/wasi-keyvalue", version = "46.0.2" }
-wasmtime-wasi-threads = { path = "crates/wasi-threads", version = "46.0.2" }
-wasmtime-wasi-tls = { path = "crates/wasi-tls", version = "46.0.2" }
-wasmtime-wast = { path = "crates/wast", version = "=46.0.2" }
+wasmtime = { path = "crates/wasmtime", version = "46.0.3", default-features = false }
+wasmtime-cli-flags = { path = "crates/cli-flags", version = "=46.0.3" }
+wasmtime-environ = { path = "crates/environ", version = "=46.0.3" }
+wasmtime-wasi = { path = "crates/wasi", version = "46.0.3", default-features = false }
+wasmtime-wasi-io = { path = "crates/wasi-io", version = "46.0.3", default-features = false }
+wasmtime-wasi-http = { path = "crates/wasi-http", version = "46.0.3", default-features = false }
+wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "46.0.3" }
+wasmtime-wasi-config = { path = "crates/wasi-config", version = "46.0.3" }
+wasmtime-wasi-keyvalue = { path = "crates/wasi-keyvalue", version = "46.0.3" }
+wasmtime-wasi-threads = { path = "crates/wasi-threads", version = "46.0.3" }
+wasmtime-wasi-tls = { path = "crates/wasi-tls", version = "46.0.3" }
+wasmtime-wast = { path = "crates/wast", version = "=46.0.3" }
 
 # Internal Wasmtime-specific crates.
 #
@@ -285,55 +285,55 @@ wasmtime-wast = { path = "crates/wast", version = "=46.0.2" }
 # that these are internal unsupported crates for external use. These exist as
 # part of the project organization of other public crates in Wasmtime and are
 # otherwise not supported in terms of CVEs for example.
-wasmtime-core = { path = "crates/core", version = "=46.0.2", package = 'wasmtime-internal-core' }
-wasmtime-wmemcheck = { path = "crates/wmemcheck", version = "=46.0.2", package = 'wasmtime-internal-wmemcheck' }
-wasmtime-c-api-macros = { path = "crates/c-api-macros", version = "=46.0.2", package = 'wasmtime-internal-c-api-macros' }
-wasmtime-cache = { path = "crates/cache", version = "=46.0.2", package = 'wasmtime-internal-cache' }
-wasmtime-cranelift = { path = "crates/cranelift", version = "=46.0.2", package = 'wasmtime-internal-cranelift' }
-wasmtime-winch = { path = "crates/winch", version = "=46.0.2", package = 'wasmtime-internal-winch'  }
-wasmtime-explorer = { path = "crates/explorer", version = "=46.0.2", package = 'wasmtime-internal-explorer'  }
-wasmtime-fiber = { path = "crates/fiber", version = "=46.0.2", package = 'wasmtime-internal-fiber' }
-wasmtime-jit-debug = { path = "crates/jit-debug", version = "=46.0.2", package = 'wasmtime-internal-jit-debug' }
-wasmtime-component-util = { path = "crates/component-util", version = "=46.0.2", package = 'wasmtime-internal-component-util' }
-wasmtime-component-macro = { path = "crates/component-macro", version = "=46.0.2", package = 'wasmtime-internal-component-macro' }
-wasmtime-versioned-export-macros = { path = "crates/versioned-export-macros", version = "=46.0.2", package = 'wasmtime-internal-versioned-export-macros' }
-wasmtime-jit-icache-coherence = { path = "crates/jit-icache-coherence", version = "=46.0.2", package = 'wasmtime-internal-jit-icache-coherence' }
-wasmtime-wit-bindgen = { path = "crates/wit-bindgen", version = "=46.0.2", package = 'wasmtime-internal-wit-bindgen' }
-wasmtime-unwinder = { path = "crates/unwinder", version = "=46.0.2", package = 'wasmtime-internal-unwinder' }
-wasmtime-debugger = { path = "crates/debugger", version = "=46.0.2", package = "wasmtime-internal-debugger" }
-gdbstub-component-artifact = { path = "crates/gdbstub-component/artifact", version = "=46.0.2", package = "wasmtime-internal-gdbstub-component-artifact" }
-wasmtime-wizer = { path = "crates/wizer", version = "46.0.2" }
+wasmtime-core = { path = "crates/core", version = "=46.0.3", package = 'wasmtime-internal-core' }
+wasmtime-wmemcheck = { path = "crates/wmemcheck", version = "=46.0.3", package = 'wasmtime-internal-wmemcheck' }
+wasmtime-c-api-macros = { path = "crates/c-api-macros", version = "=46.0.3", package = 'wasmtime-internal-c-api-macros' }
+wasmtime-cache = { path = "crates/cache", version = "=46.0.3", package = 'wasmtime-internal-cache' }
+wasmtime-cranelift = { path = "crates/cranelift", version = "=46.0.3", package = 'wasmtime-internal-cranelift' }
+wasmtime-winch = { path = "crates/winch", version = "=46.0.3", package = 'wasmtime-internal-winch'  }
+wasmtime-explorer = { path = "crates/explorer", version = "=46.0.3", package = 'wasmtime-internal-explorer'  }
+wasmtime-fiber = { path = "crates/fiber", version = "=46.0.3", package = 'wasmtime-internal-fiber' }
+wasmtime-jit-debug = { path = "crates/jit-debug", version = "=46.0.3", package = 'wasmtime-internal-jit-debug' }
+wasmtime-component-util = { path = "crates/component-util", version = "=46.0.3", package = 'wasmtime-internal-component-util' }
+wasmtime-component-macro = { path = "crates/component-macro", version = "=46.0.3", package = 'wasmtime-internal-component-macro' }
+wasmtime-versioned-export-macros = { path = "crates/versioned-export-macros", version = "=46.0.3", package = 'wasmtime-internal-versioned-export-macros' }
+wasmtime-jit-icache-coherence = { path = "crates/jit-icache-coherence", version = "=46.0.3", package = 'wasmtime-internal-jit-icache-coherence' }
+wasmtime-wit-bindgen = { path = "crates/wit-bindgen", version = "=46.0.3", package = 'wasmtime-internal-wit-bindgen' }
+wasmtime-unwinder = { path = "crates/unwinder", version = "=46.0.3", package = 'wasmtime-internal-unwinder' }
+wasmtime-debugger = { path = "crates/debugger", version = "=46.0.3", package = "wasmtime-internal-debugger" }
+gdbstub-component-artifact = { path = "crates/gdbstub-component/artifact", version = "=46.0.3", package = "wasmtime-internal-gdbstub-component-artifact" }
+wasmtime-wizer = { path = "crates/wizer", version = "46.0.3" }
 
 # Miscellaneous crates without a `wasmtime-*` prefix in their name but still
 # used in the `wasmtime-*` family of crates depending on various features/etc.
-wiggle = { path = "crates/wiggle", version = "=46.0.2", default-features = false }
-wiggle-macro = { path = "crates/wiggle/macro", version = "=46.0.2" }
-wiggle-generate = { path = "crates/wiggle/generate", version = "=46.0.2" }
-wasi-common = { path = "crates/wasi-common", version = "=46.0.2", default-features = false }
-pulley-interpreter = { path = 'pulley', version = "=46.0.2" }
-pulley-macros = { path = 'pulley/macros', version = "=46.0.2" }
+wiggle = { path = "crates/wiggle", version = "=46.0.3", default-features = false }
+wiggle-macro = { path = "crates/wiggle/macro", version = "=46.0.3" }
+wiggle-generate = { path = "crates/wiggle/generate", version = "=46.0.3" }
+wasi-common = { path = "crates/wasi-common", version = "=46.0.3", default-features = false }
+pulley-interpreter = { path = 'pulley', version = "=46.0.3" }
+pulley-macros = { path = 'pulley/macros', version = "=46.0.3" }
 
 # Cranelift crates in this workspace
-cranelift-assembler-x64 = { path = "cranelift/assembler-x64", version = "0.133.2" }
-cranelift-codegen = { path = "cranelift/codegen", version = "0.133.2", default-features = false, features = ["unwind"] }
-cranelift-frontend = { path = "cranelift/frontend", version = "0.133.2" }
-cranelift-entity = { path = "cranelift/entity", version = "0.133.2" }
-cranelift-native = { path = "cranelift/native", version = "0.133.2" }
-cranelift-module = { path = "cranelift/module", version = "0.133.2" }
-cranelift-interpreter = { path = "cranelift/interpreter", version = "0.133.2" }
-cranelift-reader = { path = "cranelift/reader", version = "0.133.2" }
+cranelift-assembler-x64 = { path = "cranelift/assembler-x64", version = "0.133.3" }
+cranelift-codegen = { path = "cranelift/codegen", version = "0.133.3", default-features = false, features = ["unwind"] }
+cranelift-frontend = { path = "cranelift/frontend", version = "0.133.3" }
+cranelift-entity = { path = "cranelift/entity", version = "0.133.3" }
+cranelift-native = { path = "cranelift/native", version = "0.133.3" }
+cranelift-module = { path = "cranelift/module", version = "0.133.3" }
+cranelift-interpreter = { path = "cranelift/interpreter", version = "0.133.3" }
+cranelift-reader = { path = "cranelift/reader", version = "0.133.3" }
 cranelift-filetests = { path = "cranelift/filetests" }
-cranelift-object = { path = "cranelift/object", version = "0.133.2" }
-cranelift-jit = { path = "cranelift/jit", version = "0.133.2" }
+cranelift-object = { path = "cranelift/object", version = "0.133.3" }
+cranelift-jit = { path = "cranelift/jit", version = "0.133.3" }
 cranelift-fuzzgen = { path = "cranelift/fuzzgen" }
-cranelift-bforest = { path = "cranelift/bforest", version = "0.133.2" }
-cranelift-bitset = { path = "cranelift/bitset", version = "0.133.2" }
-cranelift-control = { path = "cranelift/control", version = "0.133.2", default-features = false }
-cranelift-srcgen = { path = "cranelift/srcgen", version = "0.133.2" }
-cranelift = { path = "cranelift/umbrella", version = "0.133.2" }
+cranelift-bforest = { path = "cranelift/bforest", version = "0.133.3" }
+cranelift-bitset = { path = "cranelift/bitset", version = "0.133.3" }
+cranelift-control = { path = "cranelift/control", version = "0.133.3", default-features = false }
+cranelift-srcgen = { path = "cranelift/srcgen", version = "0.133.3" }
+cranelift = { path = "cranelift/umbrella", version = "0.133.3" }
 
 # Winch crates in this workspace.
-winch-codegen = { path = "winch/codegen", version = "=46.0.2" }
+winch-codegen = { path = "winch/codegen", version = "=46.0.3" }
 
 # Internal crates not published to crates.io used in testing, builds, etc
 wasi-preview1-component-adapter = { path = "crates/wasi-preview1-component-adapter" }

Cargo.toml

@@ -1,3 +1,17 @@
+## 46.0.3
+
+Released 2026-08-20
+
+### Fixed
+
+* Guest controlled-size host heap allocation through WASIp3 streams.
+  [GHSA-x84v-gj2h-g759](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759)
+
+* Filesystem sandbox escape when paths or symlinks contain trailing slashes.
+  [GHSA-vqjp-4c8c-hfgg](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg)
+
+--------------------------------------------------------------------------------
+
 ## 46.0.2
 
 Released 2026-07-31.

RELEASES.md

@@ -1,7 +1,7 @@
 [package]
 name = "cranelift-assembler-x64"
 description = "A Cranelift-specific x64 assembler"
-version = "0.133.2"
+version = "0.133.3"
 license = "Apache-2.0 WITH LLVM-exception"
 edition.workspace = true
 rust-version.workspace = true
@@ -16,7 +16,7 @@ arbtest = { workspace = true }
 capstone = { workspace = true }
 
 [build-dependencies]
-cranelift-assembler-x64-meta = { path = "meta", version = "0.133.2" }
+cranelift-assembler-x64-meta = { path = "meta", version = "0.133.3" }
 
 [lints]
 workspace = true

cranelift/assembler-x64/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "cranelift-assembler-x64-meta"
 description = "Generate a Cranelift-specific assembler for x64 instructions"
-version = "0.133.2"
+version = "0.133.3"
 license = "Apache-2.0 WITH LLVM-exception"
 edition.workspace = true
 rust-version.workspace = true

cranelift/assembler-x64/meta/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-bforest"
-version = "0.133.2"
+version = "0.133.3"
 description = "A forest of B+-trees"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-bforest"

cranelift/bforest/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-bitset"
-version = "0.133.2"
+version = "0.133.3"
 description = "Various bitset stuff for use inside Cranelift"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-bitset"

cranelift/bitset/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen"
-version = "0.133.2"
+version = "0.133.3"
 description = "Low-level code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-codegen"
@@ -25,7 +25,7 @@ anyhow = { workspace = true, optional = true, features = ['std'] }
 bumpalo = { workspace = true }
 capstone = { workspace = true, optional = true }
 cranelift-assembler-x64 = { workspace = true }
-cranelift-codegen-shared = { path = "./shared", version = "0.133.2" }
+cranelift-codegen-shared = { path = "./shared", version = "0.133.3" }
 cranelift-entity = { workspace = true }
 cranelift-bforest = { workspace = true }
 cranelift-bitset = { workspace = true }
@@ -57,8 +57,8 @@ env_logger = { workspace = true }
 proptest = { workspace = true }
 
 [build-dependencies]
-cranelift-codegen-meta = { path = "meta", version = "0.133.2" }
-cranelift-isle = { path = "../isle/isle", version = "=0.133.2" }
+cranelift-codegen-meta = { path = "meta", version = "0.133.3" }
+cranelift-isle = { path = "../isle/isle", version = "=0.133.3" }
 
 [features]
 default = ["std", "unwind", "host-arch", "timing"]

cranelift/codegen/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "cranelift-codegen-meta"
 authors = ["The Cranelift Project Developers"]
-version = "0.133.2"
+version = "0.133.3"
 description = "Metaprogram for cranelift-codegen code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -17,8 +17,8 @@ rustdoc-args = ["--document-private-items"]
 
 [dependencies]
 cranelift-srcgen = { workspace = true }
-cranelift-assembler-x64-meta = { path = "../../assembler-x64/meta", version = "0.133.2" }
-cranelift-codegen-shared = { path = "../shared", version = "0.133.2" }
+cranelift-assembler-x64-meta = { path = "../../assembler-x64/meta", version = "0.133.3" }
+cranelift-codegen-shared = { path = "../shared", version = "0.133.3" }
 pulley-interpreter = { workspace = true, optional = true }
 heck = "0.5.0"
 

cranelift/codegen/meta/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen-shared"
-version = "0.133.2"
+version = "0.133.3"
 description = "For code shared between cranelift-codegen-meta and cranelift-codegen"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"