[LKSNDRTMLKV]

The scheduled Advisories run on main failed on 2026-10-30, the first run after 2026-10-29's green one: cargo audit finds four vulnerabilities in wasmtime and wasmtime-wasi, all published on 2026-10-29 against a dependency tree that had not changed (failed run).

Advisory	Crate	Title
RUSTSEC-2026-0424	wasmtime	Unchecked memory usage in transferring borrowed resources between components
RUSTSEC-2026-0423	wasmtime	Cross-engine type confusion with host-created struct-types-with-supertypes
RUSTSEC-2026-0422	wasmtime	Typed functions with i31 or nullref arguments may panic due to insufficient type-check
RUSTSEC-2026-0420	wasmtime-wasi	wasip3 UDP send can deliver a datagram to an address only allowed for receiving

All four are fixed in 49.0.5 (the 49.x line is patched from >=49.0.5, <50.0.0), so this is a lockfile-only change: the root Cargo.toml already asks for "49". cargo update -p wasmtime -p wasmtime-wasi moves 32 packages, all of them the crates the release pins to (wasmtime*, wasmtime-internal-*, pulley-*, wiggle*, cranelift-*). No other package changes.

I did not work out, advisory by advisory, whether a plugin can reach each of them. The plugin host is the sandbox they concern, so the bump does not wait on that.

Checked

• cargo audit --deny yanked --deny unmaintained (the workflow's own flags) exits 0 on this commit.
• bash scripts/check-audit-register.sh: 5 entries, all current.
• cargo check --locked -p dpp-plugin-host: clean.

Not run locally: just check and the plugin-host test suites. CI covers them on this PR.

Left alone

The same audit reports one allowed warning, tokio 1.53.1, RUSTSEC-2026-0386 (AsyncFd::new and related constructors violate I/O safety). It is an unsound notice, not a vulnerability, and --deny unmaintained does not turn it into a failure, so the run goes green without touching it.