[dependabot]

Bumps wasmtime-wasi from 48.0.7 to 50.0.1.

Release notes

Sourced from wasmtime-wasi's releases.

v50.0.1

50.0.1

Released 2026-10-29.

Fixed

• wasi-sockets: UDP connect only required the address to be permitted for sending or receiving, allowing guests to send datagrams to addresses denied for UdpSend. GHSA-hmmr-87qq-258j

• Cross-engine type confusion with host-created struct-types-with-supertypes has been fixed. GHSA-qw58-7h65-crq2

• Panic with typed functions with i31 or nullref arguments has been fixed. GHSA-3982-jqvv-277m

• Unchecked memory usage in transferring borrowed resources between components has been fixed. GHSA-6fr9-xmw9-5352

• Fixed a possibility of content-length being invalid or not matching body length in wasi-http p2. GHSA-h4wp-g4x3-7398

v50.0.0

50.0.0

Released 2026-10-20.

Added

• Wasmtime now supports the WebAssembly compact imports proposal, disabled by default, via Config::wasm_compact_imports. #14335

• The Wasmtime CLI now has options to configure unsafe intrinsics and compile-time builtins. #14279

• The Wasmtime CLI and C API can now enable the component model's canonical names and accessors features. #14344 #14497

• A new Store::gc_heap_grow method can be used to manually grow the GC heap of a store.

... (truncated)

Changelog

Sourced from wasmtime-wasi's changelog.

50.0.1

Released 2026-10-29.

Fixed

• wasi-sockets: UDP connect only required the address to be permitted for sending or receiving, allowing guests to send datagrams to addresses denied for UdpSend. GHSA-hmmr-87qq-258j

• Cross-engine type confusion with host-created struct-types-with-supertypes has been fixed. GHSA-qw58-7h65-crq2

• Panic with typed functions with i31 or nullref arguments has been fixed. GHSA-3982-jqvv-277m

• Unchecked memory usage in transferring borrowed resources between components has been fixed. GHSA-6fr9-xmw9-5352

• Fixed a possibility of content-length being invalid or not matching body length in wasi-http p2. GHSA-h4wp-g4x3-7398

---

50.0.0

Released 2026-10-20.

Added

• Wasmtime now supports the WebAssembly compact imports proposal, disabled by default, via Config::wasm_compact_imports. #14335

• The Wasmtime CLI now has options to configure unsafe intrinsics and compile-time builtins. #14279

• The Wasmtime CLI and C API can now enable the component model's canonical names and accessors features. #14344 #14497

• A new Store::gc_heap_grow method can be used to manually grow the GC heap of a store. #14341

... (truncated)

Commits

• c307ec8 Release Wasmtime 50.0.1 (#15061)
• 3706f85 [50.0.0] omnibus patch PR for today's security release (#15068)
• ebe5e8d Release Wasmtime 50.0.0 (#14877)
• 5c9b044 Backport security fixes to 50.0.0 (#14821)
• 7172481 [release-50] update rustls to 0.23.46 (#14765)
• 4d23d62 [50.0.0] Combined set of backports (#14722)
• e733abb Add release notes (#14703)
• 5147dc2 [50.0.x] backport #14574 and #14624 (#14630)
• 4426c48 [50.0.0] Another crop of backports (#14604)
• 86fa356 [50.0.0] Backport some changes from main (#14546)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.