[SnowCheetos]

Why

wasmtime 48.0.5 carries eleven RUSTSEC advisories (2026-0353 through -0364, all but -0360) in its component-model, concurrency, store and handle-table code. The Advisories workflow (cargo audit --deny warnings) refuses it on any branch cut from alpha. That is the only red check on #27 (Advisories job); its build, target, entry and Miri jobs are green. 48.0.6 fixes all eleven.

What

• crates/wasi/Cargo.toml: kore-wasi's requirements on wasmtime (the target dependency and the host dev-dependency) and on wasmtime-wasi-io move to 48.0.6. A caret requirement on 48.0.5 would still let a consumer resolve the vulnerable release through this crate; 48.0.6 rules it out.
• Cargo.lock moves the whole family and nothing else, 29 packages:
  • wasmtime, wasmtime-environ, wasmtime-internal-*, wasmtime-wasi-io;
  • pulley-*;
  • cranelift-* 0.135.6.
• native/Cargo.lock holds no Wasmtime and is unchanged.

Verification

Local runs of the steps CI runs, all exit 0 (zig 0.16.0 for kore-ffi's build script):

• cargo audit --deny warnings on Cargo.lock and native/Cargo.lock, and lockfile currency (--locked resolves both).
• make fmt test check docs owners bindings-check and tools/check-local.py native.
• Per-target cargo check and tools/check-entry.py on x86_64, aarch64 and riscv64gc.
• make miri.

What this unblocks

Once this lands on alpha, #27 goes green on Advisories when it picks up alpha (merge or rebase); nothing in that PR needs to change.

kore side

kore vendors Wasmtime as a no_std patch and was still building 48.0.5. MicroPerceptron/kore#1299 carries that patch forward to 48.0.6 and fixes why kore's own make audit never reported these advisories: crates patched to a path were invisible to it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmEMGSFqb56Tcsvuk9PQPx

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

[SnowCheetos]

copilot-pull-request-reviewer failed before reviewing anything. The Copilot service answered HTTP 402: You have exceeded your monthly quota (job log). That is the organization's Copilot review quota, not this diff, so nothing in the PR can fix it. A re-run would hit the same quota until it resets, so I haven't re-run it.

The check this PR exists for, Advisories (cargo audit --deny warnings), passed on this head, and so did Lockfile currency. The host, target and Miri jobs are still running.

---

Generated by Claude Code