Bump the nonbreaking group with 8 updates by dependabot[bot] · Pull Request #1320 · bytecodealliance/javy

dependabot · 2026-10-20T20:35:08Z

Bumps the nonbreaking group with 8 updates:

Package	From	To
wasmtime-wasi	`49.0.2`	`49.0.3`
wasmtime-wizer	`49.0.2`	`49.0.3`
tokio	`1.53.1`	`1.53.3`
uuid	`1.26.1`	`1.28.0`
serde_json	`1.0.151`	`1.0.154`
insta	`1.48.0`	`1.49.0`
syn	`3.0.6`	`3.0.9`
wat	`1.259.0`	`1.262.0`

Updates wasmtime-wasi from 49.0.2 to 49.0.3

Release notes

Sourced from wasmtime-wasi's releases.

v49.0.3

49.0.3

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

Panic viewing component model stream or future as the wrong type. GHSA-63h4-6cx9-pjfj

Component-model handle tables are capped only per instance and charged to no limit. GHSA-q554-3cjc-rx7p

Exception tags can cause host data structures to be unaligned. GHSA-p79w-pv2r-29qp

Filesystem sandbox escape when renaming symlinks with trailing slashes. GHSA-m9f7-9w4p-gv38

Overlapping string transcode in a fused adapter can panic. GHSA-54p9-vhhq-8f7q

Guests can send absolute-form HTTP requests to different hosts. GHSA-5qpp-g3j2-8frx

... (truncated)

Changelog

Sourced from wasmtime-wasi's changelog.

49.0.3

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

Panic viewing component model stream or future as the wrong type. GHSA-63h4-6cx9-pjfj

Component-model handle tables are capped only per instance and charged to no limit. GHSA-q554-3cjc-rx7p

Exception tags can cause host data structures to be unaligned. GHSA-p79w-pv2r-29qp

Filesystem sandbox escape when renaming symlinks with trailing slashes. GHSA-m9f7-9w4p-gv38

Overlapping string transcode in a fused adapter can panic. GHSA-54p9-vhhq-8f7q

Guests can send absolute-form HTTP requests to different hosts. GHSA-5qpp-g3j2-8frx

wasi-http: Request with long url before query parameter crashes host.

... (truncated)

Commits

f96eaba Release Wasmtime 49.0.3 (#14725)
61959b2 [49.0.x] Combined backports for today's security release (#14721)
8ffaab7 Update logic for finding the run for a release (#14494) (#14499)
4efb695 Fix a flaky test failure (#14489) (#14492)
See full diff in compare view

Updates wasmtime-wizer from 49.0.2 to 49.0.3

Release notes

Sourced from wasmtime-wizer's releases.

v49.0.3

49.0.3

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

Panic viewing component model stream or future as the wrong type. GHSA-63h4-6cx9-pjfj

Component-model handle tables are capped only per instance and charged to no limit. GHSA-q554-3cjc-rx7p

Exception tags can cause host data structures to be unaligned. GHSA-p79w-pv2r-29qp

Filesystem sandbox escape when renaming symlinks with trailing slashes. GHSA-m9f7-9w4p-gv38

Overlapping string transcode in a fused adapter can panic. GHSA-54p9-vhhq-8f7q

Guests can send absolute-form HTTP requests to different hosts. GHSA-5qpp-g3j2-8frx

... (truncated)

Changelog

Sourced from wasmtime-wizer's changelog.

49.0.3

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

Panic viewing component model stream or future as the wrong type. GHSA-63h4-6cx9-pjfj

Component-model handle tables are capped only per instance and charged to no limit. GHSA-q554-3cjc-rx7p

Exception tags can cause host data structures to be unaligned. GHSA-p79w-pv2r-29qp

Filesystem sandbox escape when renaming symlinks with trailing slashes. GHSA-m9f7-9w4p-gv38

Overlapping string transcode in a fused adapter can panic. GHSA-54p9-vhhq-8f7q

Guests can send absolute-form HTTP requests to different hosts. GHSA-5qpp-g3j2-8frx

wasi-http: Request with long url before query parameter crashes host.

... (truncated)

Commits

f96eaba Release Wasmtime 49.0.3 (#14725)
61959b2 [49.0.x] Combined backports for today's security release (#14721)
8ffaab7 Update logic for finding the run for a release (#14494) (#14499)
4efb695 Fix a flaky test failure (#14489) (#14492)
See full diff in compare view

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

io: wake and drop DuplexStream wakers outside the lock (#8618)

macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)

runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)

sync: wake waiters outside the lock when closing a semaphore (#8529)

test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits

a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
482eadd runtime: record time wake when unparking tasks on current thread (#8595)
55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
0448618 sync: make tracing_sync tests synchronous (#8427)
2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
Additional commits viewable in compare view

Updates uuid from 1.26.1 to 1.28.0

Release notes

Sourced from uuid's releases.

v1.28.0

What's Changed

Add optional serde format adapters by @RanaPriyansh in uuid-rs/uuid#916

Prepare for 1.28.0 release by @KodrAus in uuid-rs/uuid#918

New Contributors

@RanaPriyansh made their first contribution in uuid-rs/uuid#916

Full Changelog: uuid-rs/uuid@v1.27.0...v1.28.0

v1.27.0

What's Changed

Accept case-insensitive urn:uuid: prefixes when parsing by @jaideeppyne in uuid-rs/uuid#912

Fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos by @KodrAus in uuid-rs/uuid#915

Prepare for 1.27.0 release by @KodrAus in uuid-rs/uuid#917

New Contributors

@jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

Commits

276c236 Merge pull request #918 from uuid-rs/cargo/v1.28.0
4b3b9f5 prepare for 1.28.0 release
cbf9c81 Merge pull request #916 from RanaPriyansh/fix/optional-serde-adapters-840
784a022 Inline expected tokens in optional compact serde test
a5678c3 Simplify optional serde adapter tests to option tokens
638a518 Refactor optional serde adapter tests and share byte wrapper
b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
ffd8ec5 prepare for 1.27.0 release
654fa5b Add optional serde format adapters
4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

Support preserve_order in no_std builds (#1333, thanks @razmser)

v1.0.153

Report invalid UTF-8 at the first bad byte (#1345, thanks @00200200)

v1.0.152

Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @yuxi-liu-wired)

Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @yuxi-liu-wired)

Commits

20572a6 Release 1.0.154
a91bfaf Fix RandomState links in map documentation
3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
4b2d726 Release 1.0.153
83335ee Touch up PR 1345
4b4810a Resolve range_plus_one pedantic clippy lint
8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
c9f1e3b Release 1.0.152
854fc70 Touch up PR 1347
Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@dislogical)

Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@aljohri)

Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@teddytennant)

Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@Tiwalun)

Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@hiro-nikaitou)

Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939

Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"
Download cargo-insta 1.49.0

File Platform Checksum

cargo-insta-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum

cargo-insta-x86_64-apple-darwin.tar.xz Intel macOS checksum

cargo-insta-x86_64-pc-windows-msvc.zip x64 Windows checksum

cargo-insta-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum

cargo-insta-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

cargo-insta-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

This was written by Codex on behalf of @max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@dislogical)

Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@aljohri)

Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@teddytennant)

Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@Tiwalun)

Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@hiro-nikaitou)

Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939

Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

5df39ce Release 1.49.0 (#944)
1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
08b67d9 Remove trailing semicolons from macro bodies (#940)
06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
70be034 Serialize unit enum variants used as JSON map keys (#934)
54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
See full diff in compare view

Updates syn from 3.0.6 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

Add Punctuated::retain (#2088)

3.0.8

Fix parsing of <- and -> tokens in expressions (#2086, #2087)

3.0.7

Fix parsing absolute path expr in labeled break (#2085, thanks @A4-Tacks)

Commits

7c44a55 Release 3.0.9
13234ab Merge pull request #2088 from dtolnay/retain
b617dc9 Add Punctuated::retain
f18a083 Release 3.0.8
e1eab98 Merge pull request #2087 from dtolnay/rightarrow
5345ee5 Allow end of expr before ->
5631c74 Merge pull request #2086 from dtolnay/leftarrow
c5b3cf0 Fix left arrow being split into less-than and negative-sign
ec4c2da Release 3.0.7
f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
Additional commits viewable in compare view

Updates wat from 1.259.0 to 1.262.0

Release notes

Sourced from wat's releases.

v1.262.0

What's Changed

Fix an overflow during fuzzing by @alexcrichton in bytecodealliance/wasm-tools#2749

Add a FIXME for #2731 by @alexcrichton in bytecodealliance/wasm-tools#2732

Remove component names subsumed by external-id by @alexcrichton in bytecodealliance/wasm-tools#2735

Implement cm64 handling for thread.new-indirect by @alexcrichton in bytecodealliance/wasm-tools#2733

Limit types in rec groups in components by @alexcrichton in bytecodealliance/wasm-tools#2726

Improve handling of exact functions in components by @alexcrichton in bytecodealliance/wasm-tools#2729

Fix some edge case behavior of btree collections by @alexcrichton in bytecodealliance/wasm-tools#2751

Fix subtyping of globals in components by @alexcrichton in bytecodealliance/wasm-tools#2750

Fix type checks in components w.r.t. kebab-names by @alexcrichton in bytecodealliance/wasm-tools#2752

Increase the maximum number of tables by @alexcrichton in bytecodealliance/wasm-tools#2756

Fix some minor issues with components and named imports by @alexcrichton in bytecodealliance/wasm-tools#2753

Fix a panic validating components & resources by @alexcrichton in bytecodealliance/wasm-tools#2754

Fix a panic when processing an invalid component by @alexcrichton in bytecodealliance/wasm-tools#2757

Fix an exponential algorithm validating components by @alexcrichton in bytecodealliance/wasm-tools#2755

Fix some minor issues with incremental-parse fuzzer by @alexcrichton in bytecodealliance/wasm-tools#2759

Disallow borrow types in task.return immediates by @alexcrichton in bytecodealliance/wasm-tools#2761

Scope the debug-only arity-tracking a bit more by @alexcrichton in bytecodealliance/wasm-tools#2758

OperatorValidator: reduce debug state used to check arity by @keithw in bytecodealliance/wasm-tools#2762

Revert "feat(wit-parser): Add support for a custom WIT package deps path (#2677)" by @celarye in bytecodealliance/wasm-tools#2764

wasmparser: share the function subtyping check by @Lstarsky0 in bytecodealliance/wasm-tools#2765

Make component target semver compatible by @chenyan2002 in bytecodealliance/wasm-tools#2763

Keep track of more type depth in wit-smith by @alexcrichton in bytecodealliance/wasm-tools#2769

Remove explicit_resources maps by @alexcrichton in bytecodealliance/wasm-tools#2760

Rename versionsuffix to version-suffix in the text format by @alexcrichton in bytecodealliance/wasm-tools#2770

Release wasm-tools 1.262.0 by @github-actions[bot] in bytecodealliance/wasm-tools#2771

Full Changelog: bytecodealliance/wasm-tools@v1.261.0...v1.262.0

v1.261.0

What's Changed

Switch to ignoring semver-minor updates by @alexcrichton in bytecodealliance/wasm-tools#2710

Bump actions/setup-node from 4 to 7 by @dependabot[bot] in bytecodealliance/wasm-tools#2712

Ignore semver-patch updates in dependabot by @alexcrichton in bytecodealliance/wasm-tools#2716

wit-parser: reject duplicate record fields, flags and cases by @youdie006 in bytecodealliance/wasm-tools#2698

wasm-wave: Upgrade logos to 0.16.1 by @lann in bytecodealliance/wasm-tools#2718

wit-parser: reject flags with more than 32 members by @youdie006 in bytecodealliance/wasm-tools#2719

Fix some issues validating custom sections by @alexcrichton in bytecodealliance/wasm-tools#2720

Fix incremental parsing of component start section by @alexcrichton in bytecodealliance/wasm-tools#2722

Fix read_var_s33 and handling in component defined types by @alexcrichton in bytecodealliance/wasm-tools#2723

Reject truncated nested modules and components by @alexcrichton in bytecodealliance/wasm-tools#2724

Fix validation of the key types of map by @alexcrichton in bytecodealliance/wasm-tools#2725

Tighten some feature gates in wasmparser by @alexcrichton in bytecodealliance/wasm-tools#2721

Fix disallowing borrows in streams/futures/values by @alexcrichton in bytecodealliance/wasm-tools#2727

Fix some custom-descriptors validation of dead code by @alexcrichton in bytecodealliance/wasm-tools#2734

Limit total components/modules in validation by @alexcrichton in bytecodealliance/wasm-tools#2730

Fix validation of tags in components by @alexcrichton in bytecodealliance/wasm-tools#2741

Release wasm-tools 1.261.0 by @github-actions[bot] in bytecodealliance/wasm-tools#2738

... (truncated)

Commits

e22db44 Release wasm-tools 1.262.0 (#2771)
943c264 Rename versionsuffix to version-suffix in the text format (#2770)
e578749 Remove explicit_resources maps (#2760)
085e7fe Keep track of more type depth in wit-smith (#2769)
e3623d9 Make component target semver compatible (#2763)
3505209 Revert "feat(wit-parser): Add support for a custom WIT package deps path (#...
1c27a83 wasmparser: share the function subtyping check (#2765)
96376d3 OperatorValidator: reduce state used to check arity in debug builds (#2762)
80c84bc Scope the debug-only arity-tracking a bit more (#2758)
b37603a Disallow borrow types in task.return immediates (#2761)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the nonbreaking group with 8 updates: | Package | From | To | | --- | --- | --- | | [wasmtime-wasi](https://github.com/bytecodealliance/wasmtime) | `49.0.2` | `49.0.3` | | [wasmtime-wizer](https://github.com/bytecodealliance/wasmtime) | `49.0.2` | `49.0.3` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.26.1` | `1.28.0` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [insta](https://github.com/mitsuhiko/insta) | `1.48.0` | `1.49.0` | | [syn](https://github.com/dtolnay/syn) | `3.0.6` | `3.0.9` | | [wat](https://github.com/bytecodealliance/wasm-tools) | `1.259.0` | `1.262.0` | Updates `wasmtime-wasi` from 49.0.2 to 49.0.3 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v49.0.3/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v49.0.2...v49.0.3) Updates `wasmtime-wizer` from 49.0.2 to 49.0.3 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v49.0.3/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v49.0.2...v49.0.3) Updates `tokio` from 1.53.1 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.3) Updates `uuid` from 1.26.1 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.26.1...v1.28.0) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `insta` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/mitsuhiko/insta/releases) - [Changelog](https://github.com/mitsuhiko/insta/blob/master/CHANGELOG.md) - [Commits](mitsuhiko/insta@1.48.0...1.49.0) Updates `syn` from 3.0.6 to 3.0.9 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@3.0.6...3.0.9) Updates `wat` from 1.259.0 to 1.262.0 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](bytecodealliance/wasm-tools@v1.259.0...v1.262.0) --- updated-dependencies: - dependency-name: wasmtime-wasi dependency-version: 49.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nonbreaking - dependency-name: wasmtime-wizer dependency-version: 49.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nonbreaking - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nonbreaking - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nonbreaking - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nonbreaking - dependency-name: insta dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nonbreaking - dependency-name: syn dependency-version: 3.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nonbreaking - dependency-name: wat dependency-version: 1.262.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nonbreaking ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Oct 20, 2026

Navigation Menu

Repository navigation

Bump the nonbreaking group with 8 updates - #1320

Bump the nonbreaking group with 8 updates#1320
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/nonbreaking-9a39fe2f74

dependabot Bot commented on behalf of github Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Conversation

dependabot Bot commented on behalf of github Oct 20, 2026

v49.0.3

49.0.3

Fixed

49.0.3

Fixed

v49.0.3

49.0.3

Fixed

49.0.3

Fixed

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

Changed

Fixed

Fixed (unstable)

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

v1.28.0

What's Changed

New Contributors

v1.27.0

What's Changed

New Contributors

v1.0.154

v1.0.153

v1.0.152

1.49.0

Release Notes

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

Download cargo-insta 1.49.0

1.49.0

3.0.9

3.0.8

3.0.7

v1.262.0

What's Changed

v1.261.0

What's Changed

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants