fix(deps): update rust crate wasmtime-wasi-io to v41

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
wasmtime-wasi-io	dependencies	major	36 → 41

---

Release Notes

bytecodealliance/wasmtime (wasmtime-wasi-io)

v41.0.3

Compare Source

41.0.3

Released 2026-02-04.

Fixed

• Fix an incorrect mid-end optimization rule that could cause a compiler panic
  due to mismatched types.
  #​12504

v41.0.2

Compare Source

41.0.2

Released 2026-02-03.

Fixed

• Reduce the dependencies of the wasmtime-internal-jit-icache-coherence crate.
  #​12446

v41.0.1

Compare Source

41.0.1

Released 2026-01-26.

Fixed

• Fixed a bug in lowering of f64.copysign on x86-64 whereby when combined
  with an f64.load, the resulting machine code could read 16 bytes rather
  than 8 bytes. This could result in a segfault when Wasmtime is configured
  without signals-based traps.

v41.0.0

Compare Source

41.0.0

Released 2026-01-20.

Added

• Support for {Future,Stream}Any in the component model has improved.
  #​12142

• Wasmtime has initial support for breakpoints and single-stepping with the
  debug feature for guest programs.
  #​12133

• Wasmtime has begun adding a new Error type which is similar to
  anyhow::Error but supports gracefully handling OOM. Wasmtime still uses
  anyhow::Error but this will change in the future to wasmtime::Error which
  will be a distinct type.
  #​12163

• An initial top-level crate for async-debugging guest programs has been added.
  #​12183

Changed

• Cranelift now optimizes redundant select + icmp instructions.
  #​12135

• Synchronous component model functions can no longer block before returning.
  This implements a change in the upstream specification to the upcoming async
  support in the component model which places stricter restrictions on
  non-async functions and their ability to perform blocking operations.
  #​12043

• Frame iteration in debug mode now visits all activations which enables
  seeing all frames from recursive wasm calls.
  #​12176

• Wasmtime now requires Rust 1.90.0 or later.
  #​12167

• Intra-component stream/future reads/writes are now allowed for simple data
  types.
  #​12181

• The POLL callback code has been removed from the canonical ABI for async
  functions and the waitable-set.poll function no longer yields.
  #​12182

• Guest-to-guest adapters injected by Wasmtime now have improved trapping error
  messages.
  #​12215

Fixed

• #[derive(Lift)] for enums with exactly 256 cases has been fixed.
  #​12140

• With component-model-async support recursively calling a guest from a host
  function has now been fixed.
  #​12152

v40.0.3

Compare Source

40.0.3

Released 2026-01-26.

Fixed

• Fixed a bug in lowering of f64.copysign on x86-64 whereby when combined
  with an f64.load, the resulting machine code could read 16 bytes rather
  than 8 bytes. This could result in a segfault when Wasmtime is configured
  without signals-based traps.

v40.0.2

Compare Source

40.0.2

Released 2026-01-14.

Fixed

• A possible stack overflow in the x64 backend with cmp emission has been
  fixed.
  #​12333

• Some ISLE optimization rules which created erroneous IR for vector inputs have
  been fixed.
  #​12179
  #​12335

• The x64 lowering of shld has been fixed for some edge caxes.
  #​12321

v40.0.1

Compare Source

40.0.1

Released 2026-01-07.

Changed

• This release is a test of Wasmtime's CI-based crate publishing infrastructure.
  Wasmtime is switching to crates.io-based trusted publishing for this release
  and is testing that everything works.
  #​12257

v40.0.0

Compare Source

40.0.0

Released 2025-12-20.

Added

• WASIp3 support for wasi:http now implements Response::from_http to convert
  from standard Rust types to WASI types.
  #​12063

• Cranelift now supports a "patchable" ABI which has a maximum number of
  arguments and clobbers no registers. This is paired as well with a new
  patchable_call instruction which supports being turned into NOPs at runtime.
  #​12061
  #​12101

Changed

• Support for the WebAssembly threads proposal is now classified as tier 2 by
  default. Additionally creation of SharedMemory is disabled by deafult behind
  a new config knob/CLI flag.
  #​12036

• A variety of peephole-style optimizations have been added to Cranelift's
  optimization passes.
  #​11994
  #​11995
  #​11996
  #​11997
  #​11998
  #​11999
  #​12000
  #​12006
  #​12008

• Component host functions have been slightly optimized to remove an Arc clone
  and reduce contention.
  #​11987

• Support for component-model-async has been updated to account for the
  changes specified in WebAssembly/component-model#578.
  This means that historical binaries using WASIp3, for example, are no longer
  valid. Recompilation of historical components will be required and
  source-level changes may also be required in some circumstances.
  #​12031
  #​12043

• The UnsyncBoxBody type is now used everywhere in wasmtime-wasi-http instead
  of just in the wasip3 support.
  #​12060

• Initial groundwork for gracefully handling OOM (e.g. returning an error
  instead of aborting) has been added.
  #​12070
  #​12089

• Wasmtime will create a private copy of code memory when guest debugging is
  enabled to assist with modifying code when adding/removing breakpoints.
  #​12051

• The ResourceTable type will no longer use Tombstone when compiled in debug
  mode.
  #​12114

• Intra-component future/stream reads/writes will now trap instead of
  accidentally being allowed.
  #​12117

• Cranelift optimization rules have been tweaked after it was discovered that
  they could pessimize code containing long chains of computations.
  #​12116

Fixed

• Compilation of i8x16.popcnt has been fixed in Winch for some potential
  inputs.
  #​12010

• A panic in Instance::prepare_call for some component-model-async situations
  has been fixed.
  #​12054

• An off-by-one error for lifting/lowering enums/variants with 255 cases has
  been fixed.
  #​12066

• Restarting the read of a host future after cancellation has been fixed.
  #​12093

• Compilation for OpenBSD on x86_64 has been fixed.
  #​12097

• Components containing a module type which exoprts a tag are now supported.
  #​12125

v39.0.2

Compare Source

39.0.2

Released 2026-01-14.

Fixed

• A possible stack overflow in the x64 backend with cmp emission has been
  fixed.
  #​12333

v39.0.1

Compare Source

39.0.1

Released 2025-11-24.

Fixed

• Compiling the debug feature without the gc feature enabled has been fixed.
  #​12074

v39.0.0

Compare Source

39.0.0

Released 2025-11-20.

Added

• Initial work has begun to support WebAssembly-level debugging natively in
  Wasmtime. This is intended to complement today's preexisting DWARF-level
  debugging, but this work will be portable and operate at the WebAssembly level
  of abstraction rather than the machine-level. Note that this work is not yet
  complete at this time but is expected to get filled out over the coming
  releases.
  #​11768
  #​11769
  #​11873
  #​11892
  #​11895

• The pooling allocator now exposes more metrics about unused slots.
  #​11789

• The Wizer and component-init projects have been merged into Wasmtime under
  a new wasmtime wizer CLI subcommand and wasmtime-wizer crate. This is
  mostly a drop-in replacement for both with a minor caveat that the
  initialization function is now called wizer-initialize instead of
  wizer.initialize to be compatible with components.
  #​11805
  #​11851
  #​11853
  #​11855
  #​11857
  #​11863
  #​11866
  #​11867
  #​11877
  #​11876
  #​11878
  #​11891
  #​11897
  #​11898

• The Config::wasm_feature method is now public.
  #​11812

• Enabling the wasm exceptions proposal is now exposed in the C API.
  #​11861

• The wasmtime crate now has a custom-sync-primitives Cargo feature which
  enables using custom synchronization primitives defined by the embedder. This
  is useful in no_std targets where the default panic-on-contention primitives
  are not appropriate.
  #​11836

• Wasmtime now supports unsafe intrinsics to be used for compile-time builtins.
  This can be used to provide give low-level access to host APIs/memory to a
  guest program in a controlled fashion.
  #​11825
  #​11918

• The signals_based_traps configuration option is now exposed in the C API.
  #​11879

• A new EqRef::from_i31 function has been added.
  #​11884

• The wasmtime serve subcommand will, by default, now reuse instances when
  used with WASIp3 components. This increases throughput and additionally
  showcases the concurrent features of WASIp3. This can be opted-out-of on the
  CLI as well.
  #​11807

• The C++ API for components has been filled out and implemented.
  #​11880
  #​11889
  #​11988

• A new ResourceDynamic type, similar to Resource<T>, has been added to
  support host resources that have a dynamic tag at runtime rather than a
  statically known tag at compile time. This is then used to implement resources
  in the C/C++ API as well.
  #​11885
  #​11920

• The C/C++ API of Wasmtime now supports the custom-page-sizes wasm proposal.
  #​11890

• Initial support has been added for the cooperative multithreading component
  model proposal in Wasmtime, built on async primitives.
  #​11751

• The epoch_deadline_callback Rust API has been bound in C++.
  #​11945

• A new Request::into_http helper has been added to the WASIp3 implementation
  of wasi:http.
  #​11843

• A define_unknown_imports_as_traps function has been added to the C API.
  #​11962

• A callback-based implementation of stdout and stderr has been added to the
  C API for WASI configuration.
  #​11965

Changed

• Running async functions in the component model now operates at the
  Store-level of abstraction rather than an Instance.
  #​11796

• The wasmtime serve subcommand no longer mistakenly spawns an epoch thread
  per-request and instead uses a single epoch thread.
  #​11817

• The component-model-async Cargo feature is now on-by-default. Note that it
  is still gated at runtime by default. Also note that Wasmtime 39 does not include
  #​12031 which means
  that components using async produced with the latest wasm-tools will not run
  in Wasmtime 39. To run async components it's recommended to pin to a
  historical version of wasm-tools and guest toolchains for now.
  #​11822

• Bindings generated by wiggle no longer use async_trait.
  #​11839

• Wasmtime's documentation now has an example of a plugin system using Wasmtime.
  #​11848

• Profiling with perfmap or jitdump now uses O_APPEND to be more amenable to
  other engines in the same process also using perfmap/jitdump.
  #​11865

• The wasmtime-wasi-http crate now uses UnsyncBoxBody to clarify that Sync
  is not required.
  #​11941

• A . character is now used instead of / int he bindgen! macro to separate
  interface members.
  #​11947

• The func_new function for component linkers now provides the type to the
  callee so it knows the type that the component that imported it is using.
  #​11944

• The component::Func type now has a type accessor and the old params/result
  accessors were deleted.
  #​11943

• Wasmtime now requires Rust 1.89.0 or later to compile.
  #​11959

Fixed

• Some panics handling shapes of components with resources in various locations
  has been fixed.
  #​11798

• Bitwise float operations in Cranelift have been fixed on aarch64.
  #​11811

• An off-by-one in the bounds check of wasm atomic operations has been fixed.
  #​11977

• Bounds-check elision now happens again with 4 GiB guard pages.
  #​11973

v38.0.4

Compare Source

38.0.4

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v38.0.3

Compare Source

38.0.3

Released 2025-10-24.

Fixed

• Fix possible host crash with host-to-wasm component intrinsics
  CVE-2025-62711

v38.0.2: : Release Wasmtime 38.0.2 (#​11903)

Compare Source

38.0.2

Released 2025-10-21.

Changed

• This repository is attempting to start out using GitHub's "Immutable Releases"
  feature with this release, and this'll be the first release, assuming all goes
  well, that has this enabled.
  #​11901

Fixed

• Fix compatibility with the Go runtime on Windows for exceptions.
  #​11892

v38.0.1

38.0.1

Released 2025-10-20.

Fixed

• Fixed some automation that went wrong with the 38.0.0 release.

v37.0.3

Compare Source

37.0.3

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v37.0.2

Compare Source

37.0.2

Released 2025-10-07.

Fixed

• Fix a memory leak in the C API when using anyref or externref.
  CVE-2025-61670.

v37.0.1

Compare Source

37.0.1

Released 2025-09-23.

Fixed

• Cranelift's cranelift-jit crate now properly applies relocations to ADRP
  instructions on aarch64; a zero-extension on the offset was fixed to properly
  sign-extend instead.
  #​11734

v37.0.0

Compare Source

37.0.0

Released 2025-09-20.

Added

• Wasmtime now fully implements the WebAssembly exception-handling proposal.
  Support is still disabled by default but is ready for testing. The proposal
  will be enabled by default in a future release of Wasmtime.
  #​11326

• An initial implementation of WASIp3 is available for the 0.3.0-rc-2025-08-15
  tag made for the WASIp3 release. Note that this is not production ready yet
  but is an excellent time to start kicking the tires in preparation for an
  upcoming officialy WASIp3 0.3.0 release. Users of the CLI can opt-in with
  -Sp3 -Wcomponent-model-async.
  #​11406
  #​11423
  #​11443

• Wasmtime has initial support for the Linux PAGEMAP_SCAN ioctl which can
  greatly improve instantiation throughput in scenarios with a high number of
  instantiations and short instance lifetime. This support is disabled by
  default but will likely be enabled by default in a future release.
  #​11372
  #​11433

• GC support can now be configured in Config and not only through crate
  features through Config::gc_support.
  #​11463

• Wasmtime now supports reading metrics of the pooling allocator at runtime.
  #​11490

• The ManuallyRooted type is now replaced with OwnedRooted which is intended
  to make management of GC object lifetimes on the host easier.
  #​11514

• Wasmtime's documentation of the C++ embedding API and examples has been
  expanded.
  #​11569

• Wasmtime's support for the stack-switching WebAssembly proposal continues to
  progress on x86_64 Linux.
  #​11003

Changed

• The preview0 and preview1 modules and features in the wasmtime-wasi
  crate are now called p0 and p1.
  #​11380

• Release artifacts for the C API are now unconditionally built with unwind
  tables.
  #​11383

• Wasmtime now requires Rust 1.87.0 or later to build.
  #​11396

• The component-model-async gated AbortHandle is now named JoinHandle.
  #​11414

• Wasmtime's internal implementation details are now async in many more
  locations to help ensure the implementation is more sound.
  #​11411
  #​11416
  #​11442
  #​11444
  #​11457
  #​11460
  #​11461
  #​11468
  #​11470
  #​11481
  #​11496

• Component-model-async primitives such as streams, tasks, etc, now use the same
  table as resources in a component. This means that guest-visible allocated
  indices are updated slightly.
  #​11374

• Wasmtime's precompiled binaries available from CI now include the
  component-model-async feature.
  #​11429

• C API release artifacts are now built with LTO so they have a smaller size.
  #​11483

• Code can no longer be loaded on x86_64-unknown-none by default without
  opting-in to a contract that either the host is compiled with SSE2 support or
  wasm is compiled with enough features that libcalls aren't used.
  #​11553

• Host support for component model async futures/streams has been updated to a
  new API.
  #​11515

Fixed

• GC of dead DWARF has been improved.
  #​11402

• Wasm-gc branching instructions now correctly check for fuel.
  #​11426

• The array.new_default instruction now checks for fuel/epochs in its inner
  loop.
  #​11428

• The "min" C API artifacts now have correct headers.
  #​11479

• GC OOM during const eval no longer panics.
  #​11557

• Wasmtime now properly respects a disabled std feature even on targets which
  have std available.
  #​11568

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.