[dependabot]

Updates the requirements on wasmtime-cli to permit the latest version.

Release notes

Sourced from wasmtime-cli's releases.

v48.0.8

48.0.8

Fixed 2026-10-29.

Fixed

• wasi-sockets: UDP connect only required the address to be permitted for sending or receiving, allowing guests to send datagrams to addresses denied for UdpSend. GHSA-hmmr-87qq-258j

• Cross-engine type confusion with host-created struct-types-with-supertypes has been fixed. GHSA-qw58-7h65-crq2

• Panic with typed functions with i31 or nullref arguments has been fixed. GHSA-3982-jqvv-277m

• Unchecked memory usage in transferring borrowed resources between components has been fixed. GHSA-6fr9-xmw9-5352

• Fixed a possibility of content-length being invalid or not matching body length in wasi-http p2. GHSA-h4wp-g4x3-7398

• Compiling a module with more than ~32k data segments with copy-on-write memory initialization disabled no longer panics with MemFlagsSetOverflow. #15050

Changelog

Sourced from wasmtime-cli's changelog.

48.0.8

Fixed 2026-10-29.

Fixed

• wasi-sockets: UDP connect only required the address to be permitted for sending or receiving, allowing guests to send datagrams to addresses denied for UdpSend. GHSA-hmmr-87qq-258j

• Cross-engine type confusion with host-created struct-types-with-supertypes has been fixed. GHSA-qw58-7h65-crq2

• Panic with typed functions with i31 or nullref arguments has been fixed. GHSA-3982-jqvv-277m

• Unchecked memory usage in transferring borrowed resources between components has been fixed. GHSA-6fr9-xmw9-5352

• Fixed a possibility of content-length being invalid or not matching body length in wasi-http p2. GHSA-h4wp-g4x3-7398

• Compiling a module with more than ~32k data segments with copy-on-write memory initialization disabled no longer panics with MemFlagsSetOverflow. #15050

---

48.0.7

Released 2026-10-19.

Fixed

• wasi-http: Guests can add conflicting content lengths to messages GHSA-r8xh-cgf7-392j
• wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hook GHSA-jxcf-8qw5-5c33
• wasi-http p3: Guests can set incorrect content-length for spliced response bodies GHSA-9prg-84vf-g5fc
• Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction GHSA-mghf-wjfp-p5xm
• Update rustls to 0.23.46 #14768
• Panic lowering a host-created component model stream into a guest that expects a different payload type. GHSA-9pvw-hwfg-92h5

... (truncated)

Commits

• 7b6c29e Release Wasmtime 48.0.8 (#15071)
• c5a7eff [48.0.0] omnibus patch PR for today's security release (#15066)
• 5840a8d Add release notes for #15050 (#15055)
• 8be1a51 [48.0.x] Use one alias region per runtime-data array (#15050)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)