Bump wasmtime from 39.0.2 to 43.0.2

[dependabot]

Bumps wasmtime from 39.0.2 to 43.0.2.

Release notes

Sourced from wasmtime's releases.

v43.0.2

43.0.2

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space. GHSA-p8xm-42r7-89xg

v43.0.1

43.0.1

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift. GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access. GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings. GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill. GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator on x86-64. GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend. GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings. GHSA-jxhv-7h78-9775

• Panic when lifting flags component value. GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding. GHSA-hx6p-xpx3-jvvv

• Use-after-free bug after cloning wasmtime::Linker. GHSA-hfr4-7c6c-48w2

• Data leakage between pooling allocator instances.

... (truncated)

Changelog

Sourced from wasmtime's changelog.

43.0.2

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space. GHSA-p8xm-42r7-89xg

---

43.0.1

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift. GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access. GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings. GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill. GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator on x86-64. GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend. GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings. GHSA-jxhv-7h78-9775

• Panic when lifting flags component value. GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding. GHSA-hx6p-xpx3-jvvv

• Use-after-free bug after cloning wasmtime::Linker. GHSA-hfr4-7c6c-48w2

• Data leakage between pooling allocator instances.

... (truncated)

Commits

• f8557c1 Release Wasmtime 43.0.2 (#13240)
• efe2dc0 Fix panicking overflow when calculating table sizes (#13243)
• cd4b6ed Release Wasmtime 43.0.1 (#13001)
• 96dde3a [43.0.x] Combined backports for a 43.0.1 release (#13005)
• be23469 Release Wasmtime 43.0.0 (#12806)
• d225583 cm-async: Fix cancelling a completed host task (#12797) (#12801)
• b0dc282 [43.0.0] A few more backports (#12795)
• 51ec9db WASIP3 update to latest rc (#12781) (#12786)
• e7e3996 [43.0.0] Add release notes (#12770)
• 4b24669 [43.0.0] Backport fixes, refactorings, and updates to wasip3 limits (#12769)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dgohman-fastly]

The Wasmtime packages require additional changes. See #642.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.